Lucas Manuel RodriguezandEric
df36ce891a
**Related issue:** Resolves #47699 ## Testing - [x] QA'd all new/changed functionality manually ## What & why Entra conditional access is becoming available to self-hosted Fleet Premium instances, which don't have the shared `MS-API-KEY` that cloud-managed customers use. This makes the `microsoft-proxy/*` endpoints reachable without that key by dropping the `is-cloud-customer` policy gate (and the now-unused shared-secret config comments / policy file). A replacement auth mechanism for the proxy is tracked separately in #47702. > Split out of #49414 so the website change can ship independently. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Security / Access Control** * Updated Microsoft proxy access handling to bypass the prior cloud-customer check for matching requests. * **Configuration** * Removed unused cloud-customer compliance proxy shared-secret settings. * **Bug Fixes** * Improved compliance partner tenant creation by detecting existing tenants using the provided Entra tenant ID and corrected the success message text. * **Data Model** * Removed uniqueness enforcement for stored fleet instance URLs to prevent avoidable conflicts. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Eric <eashaw@sailsjs.com>
74 lines
2.4 KiB
JavaScript
Vendored
74 lines
2.4 KiB
JavaScript
Vendored
/**
|
|
* MicrosoftComplianceTenant.js
|
|
*
|
|
* @description :: A model definition represents a database table/collection.
|
|
* @docs :: https://sailsjs.com/docs/concepts/models-and-orm/models
|
|
*/
|
|
|
|
module.exports = {
|
|
|
|
attributes: {
|
|
|
|
// ╔═╗╦═╗╦╔╦╗╦╔╦╗╦╦ ╦╔═╗╔═╗
|
|
// ╠═╝╠╦╝║║║║║ ║ ║╚╗╔╝║╣ ╚═╗
|
|
// ╩ ╩╚═╩╩ ╩╩ ╩ ╩ ╚╝ ╚═╝╚═╝
|
|
|
|
fleetServerSecret: {
|
|
type: 'string',
|
|
description: 'The randomly generated API token generated by the Fleet website for the Fleet server used to authenticate requests coming from this compliance tenant.'
|
|
},
|
|
|
|
entraTenantId: {
|
|
type: 'string',
|
|
description: 'The Microsoft entra tenant ID for this compliance tenant',
|
|
unique: true,
|
|
required: true,
|
|
},
|
|
|
|
fleetInstanceUrl: {
|
|
type: 'string',
|
|
description: 'The url of the connected Fleet instance.',
|
|
required: true,
|
|
},
|
|
|
|
setupCompleted: {
|
|
type: 'boolean',
|
|
defaultsTo: false,
|
|
description: 'Whether or not the Fleet Compliance partner application has been provisioned on the tenant, created a policy, and assigned the created policy to all users.',
|
|
},
|
|
|
|
lastHeartbeatAt: {
|
|
type: 'string',
|
|
description: 'A JS timestamp (Epoch MS) representing the last time a heartbeat was sent for this compliance tenant'
|
|
},
|
|
|
|
adminConsented: {
|
|
type: 'boolean',
|
|
description: 'Whether or not an Intune admin consented to add Fleet as a compliance partner.',
|
|
extendedDescription: 'Used only during the initial setup.',
|
|
},
|
|
|
|
stateTokenForAdminConsent: {
|
|
type: 'string',
|
|
description: 'A token used to authenticate admin consent webhook requests.',
|
|
},
|
|
|
|
setupError: {
|
|
type: 'string',
|
|
description: 'The last error logged from a Microsoft API during the initial setup of the complaince tenant (If there were any)',
|
|
}
|
|
|
|
// ╔═╗╔╦╗╔╗ ╔═╗╔╦╗╔═╗
|
|
// ║╣ ║║║╠╩╗║╣ ║║╚═╗
|
|
// ╚═╝╩ ╩╚═╝╚═╝═╩╝╚═╝
|
|
|
|
|
|
// ╔═╗╔═╗╔═╗╔═╗╔═╗╦╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
|
|
// ╠═╣╚═╗╚═╗║ ║║ ║╠═╣ ║ ║║ ║║║║╚═╗
|
|
// ╩ ╩╚═╝╚═╝╚═╝╚═╝╩╩ ╩ ╩ ╩╚═╝╝╚╝╚═╝
|
|
|
|
},
|
|
|
|
};
|
|
|