From e13c87cede0c7eddbdd39ea99cbee0f98a42dece Mon Sep 17 00:00:00 2001 From: Scott Gress Date: Wed, 14 Jan 2026 08:41:50 -0600 Subject: [PATCH] gate orbit enrollment to windows/linux only (#38207) **Related issue:** Resolves #38205 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [ ] Added/updated automated tests - [X] QA'd all new/changed functionality manually Tested with linux, windows and macos devices. Linux and Windows still required end-user auth to happen before enrolling, macOS still did not (but not longer showed the warning). --- ...205-remove-incorrect-eua-warning-for-macos | 1 + server/service/orbit.go | 31 ++++++++++++------- 2 files changed, 21 insertions(+), 11 deletions(-) create mode 100644 changes/38205-remove-incorrect-eua-warning-for-macos diff --git a/changes/38205-remove-incorrect-eua-warning-for-macos b/changes/38205-remove-incorrect-eua-warning-for-macos new file mode 100644 index 0000000000..87c58e3033 --- /dev/null +++ b/changes/38205-remove-incorrect-eua-warning-for-macos @@ -0,0 +1 @@ +- Removed a debug-level warning asserting that macOS devices were unauthenticated when enrolling to Fleet. diff --git a/server/service/orbit.go b/server/service/orbit.go index b56bbb88ca..c262af72c8 100644 --- a/server/service/orbit.go +++ b/server/service/orbit.go @@ -196,17 +196,26 @@ func (svc *Service) EnrollOrbit(ctx context.Context, hostInfo fleet.OrbitHostInf return "", fleet.OrbitError{Message: "failed to get IdP account: " + err.Error()} } if idpAccount == nil { - // If the Orbit client doesn't support end user auth, complain loudly and let the host enroll. - mp, ok := capabilities.FromContext(ctx) - //nolint:gocritic // ignore ifElseChain - if !ok { - level.Error(svc.logger).Log("msg", "!!! ERR_ALLOWING_UNAUTHENTICATED: host is not authenticated, but fleet could not determine whether orbit supports end-user authentication. proceeding with enrollment. !!! ", "host_uuid", hostInfo.HardwareUUID) - } else if !mp.Has(fleet.CapabilityEndUserAuth) { - // Quieting this error until https://github.com/fleetdm/fleet/issues/37134 has a proper fix. - level.Debug(svc.logger).Log("msg", "!!! ERR_ALLOWING_UNAUTHENTICATED: host is not authenticated, but connected with an orbit version that does not support end user authentication. proceeding with enrollment. !!! ", "host_uuid", hostInfo.HardwareUUID) - } else { - // Otherwise report the unauthenticated host and let Orbit handle it (e.g. by prompting the user to authenticate). - return "", fleet.NewOrbitIDPAuthRequiredError() + // Get the host platform. + h := fleet.Host{ + Platform: hostInfo.Platform, + PlatformLike: hostInfo.PlatformLike, + } + platform := h.FleetPlatform() + // Orbit enrollment is only gated by end user auth for Linux and Windows hosts. + // For macOS hosts the MDM enrollment process handles end user auth. + if platform == "linux" || platform == "windows" { + // If the Orbit client doesn't support end user auth, complain loudly and let the host enroll. + mp, ok := capabilities.FromContext(ctx) + //nolint:gocritic // ignore ifElseChain + if !ok { + level.Error(svc.logger).Log("msg", "!!! ERR_ALLOWING_UNAUTHENTICATED: host is not authenticated, but fleet could not determine whether orbit supports end-user authentication. proceeding with enrollment. !!! ", "host_uuid", hostInfo.HardwareUUID) + } else if !mp.Has(fleet.CapabilityEndUserAuth) { + level.Warn(svc.logger).Log("msg", "!!! ERR_ALLOWING_UNAUTHENTICATED: host is not authenticated, but connected with an orbit version that does not support end user authentication. proceeding with enrollment. !!! ", "host_uuid", hostInfo.HardwareUUID) + } else { + // Otherwise report the unauthenticated host and let Orbit handle it (e.g. by prompting the user to authenticate). + return "", fleet.NewOrbitIDPAuthRequiredError() + } } } }