Zach Wasserman
322895c787
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #40630 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux and Windows (macOS only) - [ ] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md)) (should not affect updates)
38 lines
1.6 KiB
YAML
38 lines
1.6 KiB
YAML
name: app_sso_platform
|
|
platforms:
|
|
- darwin
|
|
description: Returns device and login information parsed from the "app-sso platform -s" command ("Platform SSO" extensions).
|
|
examples: |-
|
|
Check Platform SSO configuration by getting the device ID and and user principal name (UPN).
|
|
|
|
```
|
|
SELECT device_id, user_principal_name FROM app_sso_platform WHERE extension_identifier = 'com.microsoft.CompanyPortalMac.ssoextension' AND realm = 'KERBEROS.MICROSOFTONLINE.COM';
|
|
```
|
|
columns:
|
|
- name: extension_identifier
|
|
type: text
|
|
required: true
|
|
description: Extension identifier of the Platform SSO extension (e.g. "com.microsoft.CompanyPortalMac.ssoextension").
|
|
- name: realm
|
|
type: text
|
|
required: true
|
|
description: Realm of the user that logged via Platform SSO (e.g. "KERBEROS.MICROSOFTONLINE.COM").
|
|
- name: device_id
|
|
type: text
|
|
required: false
|
|
description: Device ID extracted from "Device Configuration" -> "deviceSigningCertificate" -> Subject -> CommonName.
|
|
- name: user_principal_name
|
|
type: text
|
|
required: false
|
|
description: User principal name of the user that logged in via Platform SSO.
|
|
- name: registration_completed
|
|
type: integer
|
|
required: false
|
|
description: Whether Platform SSO registration is completed (0 = false, 1 = true).
|
|
- name: login_type
|
|
type: text
|
|
required: false
|
|
description: Login type extracted from device configuration (e.g. "POLoginTypeUserSecureEnclaveKey (2)").
|
|
notes: This table is not a core osquery table. It is included as part of Fleet's agent ([fleetd](https://fleetdm.com/docs/get-started/anatomy#fleetd)).
|
|
evented: false
|