From df36ce891a357004ae365eefed73b1af79bda3bb Mon Sep 17 00:00:00 2001 From: Lucas Manuel Rodriguez Date: Mon, 20 Jul 2026 17:38:28 -0300 Subject: [PATCH] Website: don't require an API key on Microsoft compliance proxy requests (#49434) **Related issue:** Resolves #47699 ## Testing - [x] QA'd all new/changed functionality manually ## What & why Entra conditional access is becoming available to self-hosted Fleet Premium instances, which don't have the shared `MS-API-KEY` that cloud-managed customers use. This makes the `microsoft-proxy/*` endpoints reachable without that key by dropping the `is-cloud-customer` policy gate (and the now-unused shared-secret config comments / policy file). A replacement auth mechanism for the proxy is tracked separately in #47702. > Split out of #49414 so the website change can ship independently. ## Summary by CodeRabbit * **Security / Access Control** * Updated Microsoft proxy access handling to bypass the prior cloud-customer check for matching requests. * **Configuration** * Removed unused cloud-customer compliance proxy shared-secret settings. * **Bug Fixes** * Improved compliance partner tenant creation by detecting existing tenants using the provided Entra tenant ID and corrected the success message text. * **Data Model** * Removed uniqueness enforcement for stored fleet instance URLs to prevent avoidable conflicts. --------- Co-authored-by: Eric --- .../create-compliance-partner-tenant.js | 6 ++--- .../api/models/MicrosoftComplianceTenant.js | 1 - website/api/policies/is-cloud-customer.js | 24 ------------------- website/config/custom.js | 2 -- website/config/policies.js | 2 +- 5 files changed, 4 insertions(+), 31 deletions(-) delete mode 100644 website/api/policies/is-cloud-customer.js diff --git a/website/api/controllers/microsoft-proxy/create-compliance-partner-tenant.js b/website/api/controllers/microsoft-proxy/create-compliance-partner-tenant.js index 42d11cec09..1ec058d873 100644 --- a/website/api/controllers/microsoft-proxy/create-compliance-partner-tenant.js +++ b/website/api/controllers/microsoft-proxy/create-compliance-partner-tenant.js @@ -16,7 +16,7 @@ module.exports = { exits: { - success: { description: 'Details about a new Microsoft complaince tsenant have been returned to a Fleet isntance' }, + success: { description: 'Details about a new Microsoft compliance tenant have been returned to a Fleet instance' }, connectionAlreadyExists: {description: 'A Microsoft compliance tenant already exists for the provided entra tenant id.', statusCode: 409}, missingOriginHeader: { description: 'No Origin header set', responseType: 'badRequest'}, }, @@ -29,8 +29,8 @@ module.exports = { throw 'missingOriginHeader'; } - // Look for an existing microsoftComplianceTenant record using the requesting Fleet instances URL. - let existingComplianceTenant = await MicrosoftComplianceTenant.findOne({fleetInstanceUrl: this.req.get('origin')}); + // Look for an existing microsoftComplianceTenant record using the provided entraTenantId. + let existingComplianceTenant = await MicrosoftComplianceTenant.findOne({entraTenantId}); if(existingComplianceTenant) { // If we found one with the provided tenant ID, and setup was not completed, delete the incomplete compliance tenant and create a new one. if(!existingComplianceTenant.setupCompleted) { diff --git a/website/api/models/MicrosoftComplianceTenant.js b/website/api/models/MicrosoftComplianceTenant.js index db6ea69753..872ea5d3c4 100644 --- a/website/api/models/MicrosoftComplianceTenant.js +++ b/website/api/models/MicrosoftComplianceTenant.js @@ -28,7 +28,6 @@ module.exports = { fleetInstanceUrl: { type: 'string', description: 'The url of the connected Fleet instance.', - unique: true, required: true, }, diff --git a/website/api/policies/is-cloud-customer.js b/website/api/policies/is-cloud-customer.js deleted file mode 100644 index 8888def5de..0000000000 --- a/website/api/policies/is-cloud-customer.js +++ /dev/null @@ -1,24 +0,0 @@ -/** - * is-cloud-customer - * - * A simple policy that allows requests to microsoft proxy endpoints from a cloud customer. - * - * For more about how to use policies, see: - * https://sailsjs.com/config/policies - * https://sailsjs.com/docs/concepts/policies - * https://sailsjs.com/docs/concepts/policies/access-control-and-permissions - */ -module.exports = async function (req, res, proceed) { - - // If an MS API KEY header was provided, check to see if it matches the entraSharedSecret. - if (req.get('MS-API-KEY')) { - if([sails.config.custom.cloudCustomerCompliancePartnerSharedSecret, sails.config.custom.alternateCompliancePartnerSharedSecret].includes(req.get('MS-API-KEY'))){ - return proceed(); - } - } - - //--• - // Otherwise, this request did not come from a cloud customer. - return res.unauthorized(); - -}; diff --git a/website/config/custom.js b/website/config/custom.js index cb5ab3abcb..dd339af160 100644 --- a/website/config/custom.js +++ b/website/config/custom.js @@ -515,8 +515,6 @@ module.exports.custom = { // Microsoft compliance proxy // compliancePartnerClientId: '…', // compliancePartnerClientSecret: '…', - // cloudCustomerCompliancePartnerSharedSecret: '…', - // alternateCompliancePartnerSharedSecret: '…', // Android proxy diff --git a/website/config/policies.js b/website/config/policies.js index b08291ebec..1b1d0e4ce0 100644 --- a/website/config/policies.js +++ b/website/config/policies.js @@ -13,7 +13,7 @@ module.exports.policies = { '*': 'is-logged-in', 'admin/*': 'is-super-admin', 'query-generator/*': 'has-query-generator-access', - 'microsoft-proxy/*': 'is-cloud-customer', + 'microsoft-proxy/*': true, // Bypass the `is-logged-in` policy for: 'entrance/*': true,