Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity

gate orbit enrollment to windows/linux only (#38207)

Browse Source 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #38205 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [ ] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
Tested with linux, windows and macos devices. Linux and Windows still
required end-user auth to happen before enrolling, macOS still did not
(but not longer showed the warning).
This commit is contained in:
Scott Gress
2026-01-14 08:41:50 -06:00
committed by GitHub
parent f60d081389
commit e13c87cede
2 changed files with 21 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
changes/38205-remove-incorrect-eua-warning-for-macos
+1
View File
@@ -0,0 +1 @@
- Removed a debug-level warning asserting that macOS devices were unauthenticated when enrolling to Fleet.
server/service/orbit.go
+20 -11
View File
@@ -196,17 +196,26 @@ func (svc *Service) EnrollOrbit(ctx context.Context, hostInfo fleet.OrbitHostInf
return "", fleet.OrbitError{Message: "failed to get IdP account: " + err.Error()}
}
if idpAccount == nil {
// If the Orbit client doesn't support end user auth, complain loudly and let the host enroll.
mp, ok := capabilities.FromContext(ctx)
//nolint:gocritic // ignore ifElseChain
if !ok {
level.Error(svc.logger).Log("msg", "!!! ERR_ALLOWING_UNAUTHENTICATED: host is not authenticated, but fleet could not determine whether orbit supports end-user authentication. proceeding with enrollment. !!! ", "host_uuid", hostInfo.HardwareUUID)
} else if !mp.Has(fleet.CapabilityEndUserAuth) {
// Quieting this error until https://github.com/fleetdm/fleet/issues/37134 has a proper fix.
level.Debug(svc.logger).Log("msg", "!!! ERR_ALLOWING_UNAUTHENTICATED: host is not authenticated, but connected with an orbit version that does not support end user authentication. proceeding with enrollment. !!! ", "host_uuid", hostInfo.HardwareUUID)
} else {
// Otherwise report the unauthenticated host and let Orbit handle it (e.g. by prompting the user to authenticate).
return "", fleet.NewOrbitIDPAuthRequiredError()
// Get the host platform.
h := fleet.Host{
Platform: hostInfo.Platform,
PlatformLike: hostInfo.PlatformLike,
}
platform := h.FleetPlatform()
// Orbit enrollment is only gated by end user auth for Linux and Windows hosts.
// For macOS hosts the MDM enrollment process handles end user auth.
if platform == "linux" || platform == "windows" {
// If the Orbit client doesn't support end user auth, complain loudly and let the host enroll.
mp, ok := capabilities.FromContext(ctx)
//nolint:gocritic // ignore ifElseChain
if !ok {
level.Error(svc.logger).Log("msg", "!!! ERR_ALLOWING_UNAUTHENTICATED: host is not authenticated, but fleet could not determine whether orbit supports end-user authentication. proceeding with enrollment. !!! ", "host_uuid", hostInfo.HardwareUUID)
} else if !mp.Has(fleet.CapabilityEndUserAuth) {
level.Warn(svc.logger).Log("msg", "!!! ERR_ALLOWING_UNAUTHENTICATED: host is not authenticated, but connected with an orbit version that does not support end user authentication. proceeding with enrollment. !!! ", "host_uuid", hostInfo.HardwareUUID)
} else {
// Otherwise report the unauthenticated host and let Orbit handle it (e.g. by prompting the user to authenticate).
return "", fleet.NewOrbitIDPAuthRequiredError()
}
}
}
}