From e5cd5dbead75a198185b25bfdc5bd3d5b08f94e7 Mon Sep 17 00:00:00 2001 From: Scott Gress Date: Fri, 12 Dec 2025 06:07:32 -0800 Subject: [PATCH] Turn off end-user auth capability for macos (#37151) **Related issue:** Resolves #37134, resolves #37127 # Details This PR turns off Orbit's end-user authentication features for macOS (leaving them in place for Windows and Linux). macOS has its own end-user auth flows (either through ADE or through the /enroll endpoint), and the one put in place for Windows/Linux was interfering with those. It would be good to get this properly sorted out so that all devices are gated at the same point (currently manually-enrolled macOS devices enroll to Fleet prior to end-user auth, rather than after) but we need to unblock enrollment for macs in the meantime! # Checklist for submitter - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [ ] QA'd all new/changed functionality manually - [X] mac - [x] linux - [x] windows ## fleetd/orbit/Fleet Desktop - [X] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [X] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux and Windows - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) --------- Co-authored-by: Lucas Manuel Rodriguez --- .../changes/37134-fix-issue-with-end-user-auth-on-macos | 1 + server/fleet/capabilities.go | 9 +++++++-- server/service/orbit.go | 3 ++- 3 files changed, 10 insertions(+), 3 deletions(-) create mode 100644 orbit/changes/37134-fix-issue-with-end-user-auth-on-macos diff --git a/orbit/changes/37134-fix-issue-with-end-user-auth-on-macos b/orbit/changes/37134-fix-issue-with-end-user-auth-on-macos new file mode 100644 index 0000000000..97921ef044 --- /dev/null +++ b/orbit/changes/37134-fix-issue-with-end-user-auth-on-macos @@ -0,0 +1 @@ +- Fixed an issue where macOS devices would fail to enroll when end-user authentication was configured. diff --git a/server/fleet/capabilities.go b/server/fleet/capabilities.go index 2d345d2595..fe495632ed 100644 --- a/server/fleet/capabilities.go +++ b/server/fleet/capabilities.go @@ -2,6 +2,7 @@ package fleet import ( "os" + "runtime" "strings" "sync" ) @@ -121,11 +122,15 @@ func GetServerDeviceCapabilities() CapabilityMap { } func GetOrbitClientCapabilities() CapabilityMap { - return CapabilityMap{ + capabilities := CapabilityMap{ CapabilityEscrowBuddy: {}, CapabilitySetupExperience: {}, - CapabilityEndUserAuth: {}, } + // On non-macOS systems, include end user auth capability. + if runtime.GOOS != "darwin" { + capabilities[CapabilityEndUserAuth] = struct{}{} + } + return capabilities } // CapabilitiesHeader is the header name used to communicate the capabilities. diff --git a/server/service/orbit.go b/server/service/orbit.go index e86ee3faa9..d7531d32ce 100644 --- a/server/service/orbit.go +++ b/server/service/orbit.go @@ -203,7 +203,8 @@ func (svc *Service) EnrollOrbit(ctx context.Context, hostInfo fleet.OrbitHostInf if !ok { level.Error(svc.logger).Log("msg", "!!! ERR_ALLOWING_UNAUTHENTICATED: host is not authenticated, but fleet could not determine whether orbit supports end-user authentication. proceeding with enrollment. !!! ", "host_uuid", hostInfo.HardwareUUID) } else if !mp.Has(fleet.CapabilityEndUserAuth) { - level.Error(svc.logger).Log("msg", "!!! ERR_ALLOWING_UNAUTHENTICATED: host is not authenticated, but connected with an orbit version that does not support end user authentication. proceeding with enrollment. !!! ", "host_uuid", hostInfo.HardwareUUID) + // Quieting this error until https://github.com/fleetdm/fleet/issues/37134 has a proper fix. + level.Debug(svc.logger).Log("msg", "!!! ERR_ALLOWING_UNAUTHENTICATED: host is not authenticated, but connected with an orbit version that does not support end user authentication. proceeding with enrollment. !!! ", "host_uuid", hostInfo.HardwareUUID) } else { // Otherwise report the unauthenticated host and let Orbit handle it (e.g. by prompting the user to authenticate). return "", fleet.NewOrbitIDPAuthRequiredError()