Correct the 'patched' SQL predicates across many
ee/maintained-apps/outputs/*.json files by moving the version_compare
condition into the subquery's WHERE clause and removing the extra
parentheses. This normalizes the NOT EXISTS checks so installed-version
detection works as intended for both macOS and Windows app outputs.
Fixes#42874
Empty, whitespace-only, and missing `FLEET_JIT_USER_ROLE_*` SAML
attribute values are now treated as `null` (ignored) instead of
returning an error, matching the literal `"null"` workaround.
Resolves#45220
Here's one example why this is a good idea.
On `main`, the fleet production binary contains a private key used for
testing:
```
$ strings ./build/fleet | rg "BEGIN RSA TESTING"
proto3-----BEGIN RSA TESTING KEY-----
```
And it's gone when using this branch:
```
$ strings ./build/fleet | rg "BEGIN RSA TESTING"
<empty>
```
## Testing
- [X] QA'd all new/changed functionality manually.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Reorganized and centralized SCEP test helpers and servers for
certificate enrollment tests.
* Added embedded HTML fixtures to better emulate SCEP/NDES admin
responses (cache/full, permissions, password).
* Standardized UTF‑16 handling for test responses and improved test
server response handling.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45619?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
- `pkg/patch_policy/GenerateQueryForManifest` now wraps the
caller-supplied exists query in an inner set of parentheses before
appending the trailing `AND version_compare(...) < 0` clause. Without
the wrap, any `OR` in the exists body binds *after* the appended `AND`
(SQL precedence: `AND` > `OR`), producing an incorrect `patched` query.
The bug is currently only observable on `codex-cli` (uses `path = ... OR
path LIKE ...`) but would silently break any future FMA whose exists
query contains `OR`.
- All FMA outputs regenerated via `cmd/maintained-apps`. For AND-only
exists queries (the vast majority of existing FMAs), the new patched SQL
is semantically identical to the previous form — just with extra parens
around the WHERE body. `codex-cli/windows.json`'s OR clause is now
correctly grouped.
- `docker-desktop` is unchanged: its patched SQL is constructed inline
in the homebrew ingester at
[ingester.go:198-201](https://github.com/fleetdm/fleet/blob/claude/compassionate-merkle-afbd8a/ee/maintained-apps/ingesters/homebrew/ingester.go#L198-L201)
and bypasses the generator.
### Heads-up: upstream version drift bundled in
The regeneration also pulled in a handful of upstream version bumps that
landed since the last FMA run. These are real upstream changes, not
generator artifacts:
| App | Platform | Old → New |
|---|---|---|
| Figma | windows | 126.3.12 → 126.4.9 |
| GoLand | darwin | 2026.1.1 → 2026.1.2 |
| IntelliJ IDEA | darwin | 2026.1.1 → 2026.1.2 |
| RubyMine | darwin | 2026.1.1 → 2026.1.2 |
| Zed | darwin | 1.2.5 → 1.2.6 |
If you'd prefer these isolated from the paren-only change, let me know
and I'll split the PR.
### Code changes
- [pkg/patch_policy/patch_policy.go](pkg/patch_policy/patch_policy.go):
added `(` to `templateStart` and `)` to `templateEnd{Darwin,Windows}` so
`GenerateQueryForManifest` emits `... NOT EXISTS ((<before>) AND
version_compare(...) < 0);`.
-
[pkg/patch_policy/patch_policy_test.go](pkg/patch_policy/patch_policy_test.go):
updated existing expectations and added an OR-precedence case mirroring
codex-cli's exists query.
-
[ee/maintained-apps/ingesters/homebrew/ingester_test.go](ee/maintained-apps/ingesters/homebrew/ingester_test.go):
updated the generic `Patched` assertion (docker-desktop's hardcoded
expectation is unchanged — it bypasses the generator).
- 282 regenerated files under `ee/maintained-apps/outputs/**/*.json`.
## Test plan
- [x] `go test ./pkg/patch_policy/...` passes (incl. new OR case).
- [x] `go test ./ee/maintained-apps/...` passes.
- [x] `go vet ./pkg/patch_policy/... ./ee/maintained-apps/...` clean.
- [x] `cmd/maintained-apps` runs end-to-end with no errors against the
live Homebrew/winget APIs (with `NETWORK_TEST_GITHUB_TOKEN` set).
- [x] `git diff` audited: every diffed `patched` line on
`outputs/**/*.json` is a paren-only delta; non-`patched` deltas confined
to the 5 upstream version bumps listed above.
- [x] `docker-desktop/darwin.json` unchanged after regeneration.
- [ ] CI green.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added comprehensive support for managing Codex CLI (OpenAI's coding
agent) on Windows systems, including automated installation,
uninstallation, and verification that installed binaries match expected
versions
* Integrated Codex CLI icon component into the software interface for
improved visual identification and enhanced user experience when
managing this application
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/42397)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
- **Adding vpp users table**
- **Adding ManagedAppleID to HostMDM tables to pull when installing vpp
apps to a BYOD user enrolled device**
- **Adding user create vpp apis**
- **Updating install application to support user enrolled devices**
- **Handling already installed gracefully**
- **Adding provision user logic**
- **Adding logic to associate assets on install**
- **Add license managemnt logic**
- **Adding self service ui**
- **Adding setup experience support**
- **Adding setup experience flow**
- **Fix issue with fleet's docker image in k8s environments (#44373)**
- **Changing how the appleid is captured to use idp mdm users**
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Account-based User Enrollment (iOS/iPadOS) supports VPP and in‑house
.ipa installs, including self‑service installs.
* Enrollment now applies the selected Setup experience automatically for
user‑enrolled hosts.
* Installs and license associations are scoped to account user
associations (user‑scoped installs).
* **Bug Fixes**
* Improved error messaging for license/association failures (including
per‑user device cap cases).
* Mobile UI: self‑service now shows user‑enrolled iOS/iPadOS apps.
* “Already installed” install results are treated as acknowledged
successes.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45202)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Improve Camtasia uninstall handling by updating trash() to glob-expand
target paths (using compgen), iterate matches (preserving spaces), and
move each found file/symlink to the user's Trash with unique
timestamp+rand+index suffixes. If no matches are found the script now
reports the path doesn't exist. Also update darwin.json to point to the
new uninstall script ref (252f6f0e) and include the updated script
content in the refs section.
Register XCreds as a maintained app: add Homebrew cask (Casks/xcreds.rb)
and API/input JSON, add app metadata
(ee/maintained-apps/inputs/homebrew/xcreds.json), and include outputs
(apps.json and outputs/xcreds/darwin.json) with installer/uninstall
scripts and checks. Also add frontend icon component and asset
(XCreds.tsx, app-icon-xcreds-60x60@2x.png) and wire the icon into the
icons index mapping.
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Bumped installer metadata (version, download URLs, checksums, patch
checks) for multiple maintained apps to new releases.
* Adjusted Homebrew ingester logic to handle Camtasia year-prefixed
versions.
* **Bug Fixes**
* macOS uninstall cleanup updated for Camtasia to remove an additional
shared-filelist and preserve user files by moving them to Trash.
* Windows Docker install/uninstall improved: per-user silent install,
registry polling for completion, and more robust registry lookup/error
handling.
* **Tests**
* Added unit tests for Camtasia version transformation.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45503)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#43973
Fixes a few bugs regarding managed app configurations. Includes a few
cherry-picks for commits that were supposed to be merged, but got
overwritten by subsequent PRs that didn't get pushed properly while
working with the github stack.
Also includes some more integration test cases.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Improved error handling for VPP managed app configurations that
reference unresolvable Fleet variables.
* **Bug Fixes**
* Fixed cleanup of VPP app configuration data during team deletion.
* In-house app configurations now apply only to their specific installer
instead of sibling installers.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45452)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#45220 (one of several PRs to achieve removing "testing"
package as dependency in production binary)
## Testing
- [x] QA'd all new/changed functionality manually.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Switched many tests to use a dedicated MySQL test helper package and
consolidated test-only utilities for datastore setup, cleanup, ad‑hoc
SQL, certificate generation, and activity/aggregation helpers.
* Added expanded test utilities for replication, DB connections and test
data seeding to improve integration-test reliability.
* **Chores**
* No production behavior or user-facing APIs were changed.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45406)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated version tracking metadata for maintained applications to align
with the latest available releases across macOS and Windows platforms.
Includes updates for Balena Etcher, Box Drive, Brave Browser, Cursor,
Docker Desktop, Loom, Rancher Desktop, Spotify, Tailscale, Webex, and
Zed. Metadata now reflects current stable versions.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45447)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Enable strict shell flags and add a trap-based cleanup for DMG
mountpoints to ensure detach and removal on exit. Add explicit error
handling for hdiutil attach (fail fast with message) and reset
MOUNT_POINT after detach. Harden app quit/relaunch logic by using safer
variable assignments, providing fallbacks for osascript/stat, and
returning explicit status codes. Minor safety improvements (sudo cp, set
-euo pipefail) to make the installation script more reliable.
This pull request improves the handling and installation of Docker
Desktop in Fleet, with a focus on addressing issues caused by leftover
`.back` app bundles after in-app updates. It also introduces a custom
installation script for Docker Desktop to ensure correct app replacement
and relaunch behavior. The test coverage and configuration for Docker
Desktop have been updated accordingly.
**Docker Desktop patch policy and installation improvements:**
* Updated the patch policy query for Docker Desktop in `ingester.go` to
ignore any `.back` app bundles, preventing false "out of date" patch
status when stale bundles are present after self-updates.
* Added a custom install script (`docker_desktop_install.sh`) that
safely quits Docker Desktop, removes `.back` bundles, moves the new app
into place, relaunches the app if it was running, and sets up CLI
symlinks.
* Linked the new install script in the Docker Desktop Homebrew input
JSON (`docker-desktop.json`).
* Updated the Docker Desktop output JSON to use the improved patch query
and reference the new install script.
**Test enhancements:**
* Expanded test coverage in `ingester_test.go` to include Docker
Desktop, verifying the correct patch and exists queries for this special
case.
[[1]](diffhunk://#diff-82958e1ecc7af4c2032fcb933320788e6f5e663eb18ee6cc83df106f4df960e0L90-R90)
[[2]](diffhunk://#diff-82958e1ecc7af4c2032fcb933320788e6f5e663eb18ee6cc83df106f4df960e0R123)
[[3]](diffhunk://#diff-82958e1ecc7af4c2032fcb933320788e6f5e663eb18ee6cc83df106f4df960e0R153-R164)
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated version metadata and installer checksums for 12 maintained
applications including Camtasia, Cavalry, Docker Desktop, draw.io,
Google Chrome, Google Drive, Intune Company Portal, Microsoft Teams,
Ollama, Visual Studio Code, Warp, and WhatsApp.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45395)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Related to, but does not resolve, #45267
Adds a 12h cooldown period such that when npm is resolving dependencies
it will not resolve anything released less than 12 hours ago. This
doesn't apply globally within the fleet project because some portions
use yarn which #45267 will take care of however this does add it to our
CI jobs and the .npmrc files for projects that use npm
I was going to set this as NPM_CONFIG_MIN_RELEASE_AGE in a github EV but
that won't automatically set it on every runner so leaving it in here
for now
As far as QA local builds and CI are both green. Tested
NPM_CONFIG_MIN_RELEASE_AGE=0.5 and min-release-age=0.5(in npmrc) locally
using the npm package feed https://registry.npmjs.org/-/rss to verify
that recently updated packages either chose an older version OR the
update was blocked if I tried to choose a newer one
# Checklist for submitter
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Enhanced npm supply-chain security by implementing package
installation policies across build workflows and configuration files to
exclude packages released within the last 12 hours.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45268)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Refreshed version metadata and installer information for over 25
third-party applications, including Slack, Discord, Docker Desktop,
Claude, Firefox, Grammarly, Granola, MongoDB Compass, Signal, Telegram,
Teleport, Visual Studio Code, Notion, and others. Updates include new
installer URLs, updated security checksums, and modified version
comparison logic across macOS and Windows platforms.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45334)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44801
Fixed remaining issue setting end user authentication in the UI.
The root cause was that the frontend was always sending
`enable_managed_local_account : false` even when macOS MDM was disabled.
Fix:
<img width="756" height="363" alt="image"
src="https://github.com/user-attachments/assets/5f88797d-c5c3-4c03-9048-c8ee2981c374"
/>
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Automatic syncing of "Lock end user info" when toggling End User
Authentication now only runs when Apple MDM is enabled and configured
(with an exception when EUA is being disabled to preserve behavior).
* Save payloads omit Apple-only fields unless Apple MDM is configured.
* **UI**
* "Lock end user info" checkbox shows an Apple MDM–gated tooltip and is
disabled when Apple MDM is not configured.
* **Tests**
* Added coverage for Apple MDM–gated behaviors and saved-payload
variations.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45212)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#45220 (one of many small PRs)
## Testing
- [x] QA'd all new/changed functionality manually. (Ran basic smoke
testing.)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added a consolidated test utilities package to boot full test servers,
seed users, retrieve auth tokens, and provide common mocks for
integration/service tests.
* Updated integration and service tests to use the new helpers for more
consistent, reliable test setup and wiring.
* **Chores**
* Centralized and reorganized test configuration types and options, and
standardized test wiring for clearer, maintainable test setup.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45221)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Part of #38790. Stacked on top of #44932.
Closes#43969.
`fleetctl gitops` reads `configuration.path` for iOS / iPadOS VPP apps
and in-house `.ipa` apps, validates the file via
`fleet.ValidateAppleAppConfiguration`, and stores the bytes through the
service layer.
`fleetctl generate-gitops` emits `configuration.path` for apps that have
a stored configuration, writing the XML to
`lib/<team>/software/<app-slug>-config.xml`. Apps without configuration
omit the block entirely.
Round-trip integration tests
(`cmd/fleetctl/integrationtest/gitops/software_test.go`) cover apply +
generate for both VPP and in-house, plus a negative case for invalid
configuration content.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* Added managed app configuration support for enterprise software
deployments through GitOps
* Configurations now support platform-specific formats: XML for
iOS/iPadOS, JSON for Android
* Configuration validation ensures compatibility and prevents invalid
variable references
* **Tests**
* Added integration tests for configuration handling in software
deployment workflows
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/44933)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: jkatz01 <yehonatankatz@gmail.com>
Part of #38790. Stacked on top of #44931.
Closes#43965.
Wires managed configuration through the existing REST endpoints (`POST
/api/.../app_store_apps`, `PATCH
/api/.../software/titles/:id/app_store_app`, in-house `.ipa` upload /
update). Validation runs at the service layer for iOS / iPadOS; macOS
VPP installs silently drop the field. Wire format: a JSON-encoded string
of the XML plist on POST/PATCH and on GET single-title responses (not
base64).
Includes `server/service/integration_apple_vpp_config_test.go` with
end-to-end coverage: add / update with valid plist, allowed
`$FLEET_VAR_HOST_UUID`, omit-field-no-change, **`configuration: null` →
row deleted** (regression test for the clear-on-null fix in #43964),
malformed XML → 422, disallowed Fleet variable → 422, and macOS
silent-drop pre- / post-validation.
Also drops a stray `fmt.Println("auth")` in `SoftwareTitleByID`'s
authorization-failure branch.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for managed app configuration on iOS/iPadOS devices
through VPP and in-house installers.
* Configuration now validates plist format and detects disallowed Fleet
variables.
* **Bug Fixes**
* macOS apps now correctly ignore configuration settings as expected.
* **Tests**
* Added comprehensive integration tests for Apple VPP and in-house
installer configuration workflows.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/44932)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: jkatz01 <yehonatankatz@gmail.com>
Co-authored-by: Jonathan Katz <44128041+jkatz01@users.noreply.github.com>
Closes#45024
## Summary
- Fixed the MDM SSO callback handler returning a `"missing profile:
missing profile"` error when an Android device enrolls via SSO (OTA
enrollment) on a Fleet instance that does **not** have Apple MDM
configured.
- Refactored all MDM SSO initiator magic strings (`"ota_enroll"`,
`"setup_experience"`, `"account_driven_enroll"`) into named constants
(`fleet.SSOInitiatorOTAEnroll`, etc.) to prevent typos and missed cases
— which is the class of bug that caused this issue.
## Code walkthrough
### The bug
The bug is in `ee/server/service/mdm.go` in
`mdmSSOHandleCallbackAuth()`.
**The flow:**
1. Android enrollment hits `/enroll?enroll_secret=xxx` → frontend calls
`InitiateMDMSSO` with initiator `"ota_enroll"`
(`server/service/frontend.go:248`)
2. User authenticates at the SAML IdP
3. The SSO callback arrives at `MDMSSOCallback` → calls
`mdmSSOHandleCallbackAuth`
4. After successful SAML auth, the function checks early-exit
conditions:
- Line 1133: account-driven enrollment (`originalURL ==
appleMDMAccountDrivenEnrollmentUrl`) → **no match** for OTA
- Line 1139: `Initiator != "setup_experience"` → **true** for
`"ota_enroll"` → enters the block
5. Line 1140: calls `getAutomaticEnrollmentProfile()` → returns `nil`
because **no Apple MDM is configured**
6. Line 1144–1146: `depProf == nil` → **returns `"missing profile"`
error**
Note that `MDMSSOCallback` (the caller) already has a guard at line 931
that correctly skips the Apple MDM verification for `/enroll?` paths:
```go
if !strings.HasPrefix(originalURL, "/enroll?") && ssoRequestData.Initiator != "setup_experience" {
if err := svc.VerifyMDMAppleConfigured(ctx); err != nil { ... }
}
```
But `mdmSSOHandleCallbackAuth` was missing the equivalent guard — it
unconditionally tried to fetch the Apple DEP profile for any
non-`setup_experience` initiator.
### The fix
Adds an early return for OTA enrollments (where `originalURL` starts
with `/enroll?`), matching the existing pattern for account-driven
enrollments right above it. OTA enrollments don't use the Apple DEP
profile token.
### The refactor
Replaced all raw initiator string literals across the backend with named
constants defined in `server/fleet/app.go`:
| Constant | Value | Used by |
|---|---|---|
| `fleet.SSOInitiatorOTAEnroll` | `"ota_enroll"` | `/enroll` page
(Android, BYOD iPhone/iPad) |
| `fleet.SSOInitiatorSetupExperience` | `"setup_experience"` | Orbit
agent (macOS Setup Assistant) |
| `fleet.SSOInitiatorAccountDrivenEnroll` | `"account_driven_enroll"` |
Apple account-driven MDM enrollment |
Constants are in `server/fleet/` (not `server/sso/`) so orbit can import
them without pulling in Redis dependencies.
**Files changed:**
- `ee/server/service/mdm.go` — 6 string replacements (switch cases +
comparisons)
- `server/service/frontend.go` — 1 replacement
- `orbit/cmd/orbit/orbit.go` — 1 replacement
- `server/service/testing_client.go` — 1 replacement
- `server/service/integration_mdm_test.go` — 1 replacement
## Local reproduction
### Setup
1. Started dev server: `build/fleet serve --dev --dev_license`
2. Infrastructure: MySQL, Redis, SimpleSAML IdP via `docker compose up`
3. Created admin user and enroll secret
4. Configured MDM SSO (`entity_id: mdm.test.com`, SimpleSAML IdP at
`localhost:9080`)
5. Set `enable_end_user_authentication: true` directly in DB (API blocks
this without Apple MDM — matches customer state)
6. **Did NOT configure Apple MDM** — only SSO + EUA, simulating
Android-only instance
### Steps
1. `GET https://localhost:8080/enroll?enroll_secret=test_enroll_secret`
→ 303 redirect to SimpleSAML IdP
2. Completed SAML login programmatically (user: `sso_user`, pass:
`user123#`)
3. `POST https://localhost:8080/api/v1/fleet/mdm/sso/callback` with the
SAMLResponse
### Before fix
```
=== CALLBACK RESULT ===
Status: HTTP/2 303
Location: /mdm/sso/callback?error=true
=== SERVER LOGS ===
ts=2026-05-08T16:53:49Z level=error component=http method=POST
uri=/api/v1/fleet/mdm/sso/callback took=12.148708ms
err="missing profile: missing profile"
```
### After fix
```
=== CALLBACK RESULT ===
Status: HTTP/2 303
Location: /enroll?enroll_secret=test_enroll_secret&enrollment_reference=7c67326c-...&initiator=ota_enroll&profile_token=
=== SERVER LOGS ===
ts=2026-05-08T17:27:54Z level=info component=http method=POST
uri=/api/v1/fleet/mdm/sso/callback took=15.973ms
```
No errors. Successful redirect back to the enrollment page with the
enrollment reference.
## Integration test
Added `TestOTAEnrollSSOWithoutAppleDEPProfile` which:
1. Configures SSO and creates a team with IdP enabled
2. **Deletes all Apple DEP enrollment profiles** to simulate an
Android-only instance
3. Runs the full OTA enrollment SSO flow (GET `/enroll` → SAML IdP login
→ callback)
4. Verifies the callback redirects to `/enroll?...` with
`enrollment_reference` and `initiator=ota_enroll` (not `?error=true`)
Confirmed the test **fails without the fix** (`err="missing profile:
missing profile"`) and **passes with the fix**.
Also added a `LoginOTAEnrollSSOUser` test helper that drives the
complete OTA SSO flow starting from `GET /enroll` through SAML IdP login
to the callback, using a single cookie jar.
## Test plan
- [ ] Verify Android SSO enrollment works on an instance with **only**
Android MDM configured (no Apple MDM)
- [ ] Verify Apple DEP enrollment with SSO still works (the DEP profile
path is unchanged)
- [ ] Verify Apple OTA enrollment with SSO still works (also uses
`/enroll?` path)
- [ ] Verify account-driven enrollment with SSO still works (has its own
early return)
- [ ] Verify setup experience SSO still works (uses `Initiator ==
"setup_experience"`)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Resolved a regression where OTA enrollment via SSO could return a
"missing profile" error on Android when Apple MDM is not configured; OTA
SSO now redirects correctly to the enrollment flow.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45046)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Magnus Jensen <magnus@fleetdm.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated ChatGPT Atlas macOS package metadata with new version and
installer information
* Updated Cloudflare WARP macOS package metadata with new version and
installation scripts
* Updated Discord Windows package metadata with new version and
installer information
* Updated OpenVPN Connect macOS installation script configuration
* Updated pgAdmin4 macOS package metadata with new version and installer
information
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45209)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Add OpenVPN Connect to maintained apps: create a Homebrew input manifest
and add an apps.json entry. Add a darwin output with version 3.8.1
(installer URL, sha256) plus install/uninstall script refs that handle
quitting/relaunching and cleanup. Add frontend icon component and
register it in the icon map, and include the app icon asset. Default
category set to Productivity.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44801
Note there is a related bug:
https://github.com/fleetdm/fleet/issues/45170
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* End user authentication can now be enabled for Windows-only and
Linux-only fleets without requiring macOS MDM configuration.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45162)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Cursor for macOS and Windows to version 3.3.30 with new
installer URLs and verification checksums.
* Updated Draw.io Desktop for macOS to version 30.0.0.
* Updated OrbStack for macOS to version 2.1.3.
* Refreshed package metadata and installation queries for all updated
applications.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45120)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Allen Houchins
