fleet

Files

T

NicoandClaude Sonnet 4.6 0a98ce5582 Enable JIT provisioning for Technician role (#41286 )

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #41242

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [x] Added/updated automated tests

- [x] QA'd all new/changed functionality manually

Configured SAML app in Okta following
https://fleetdm.com/docs/deploy/single-sign-on-sso#okta (needs update):

<img width="1069" height="790" alt="Screenshot 2026-03-10 at 9 10 05 AM"
src="https://github.com/user-attachments/assets/7a160599-524e-4118-922b-5f9b601129eb"
/>

Defined a Custom SAML Attribute Statement following
https://support.okta.com/help/s/article/How-to-define-and-configure-a-custom-SAML-attribute-statement?language=en_US.
This is to add `FLEET_JIT_USER_ROLE_GLOBAL` to the default User profile.

<img width="2536" height="1299" alt="Screenshot 2026-03-10 at 9 22
03 AM"
src="https://github.com/user-attachments/assets/68193815-4abd-4a3b-9e95-147b1b3105d3"
/>

Within the new Okta app > Sign On tab, added this expression:

<img width="765" height="444" alt="Screenshot 2026-03-10 at 9 35 41 AM"
src="https://github.com/user-attachments/assets/40073cfc-931c-492e-bd5f-e8e89434b107"
/>

Within Okta, added a new user in Directory > People and assigned it to
the new Okta app.

<img width="1050" height="515" alt="Screenshot 2026-03-10 at 9 36 14 AM"
src="https://github.com/user-attachments/assets/1b0a2847-208a-4251-8d9c-6bd0cba33d13"
/>

Logged in to fleet with the new user via SSO and verified its role is
Technician:

<img width="714" height="507" alt="Screenshot 2026-03-10 at 9 32 15 AM"
src="https://github.com/user-attachments/assets/cf44d99c-78bc-4d7c-9f46-5c25fc745778"
/>

<img width="1356" height="339" alt="Screenshot 2026-03-10 at 9 37 11 AM"
src="https://github.com/user-attachments/assets/baa028cb-6b3b-4c9b-b02e-ac2e16ec9262"
/>



For unreleased bug fixes in a release candidate, one of:

- [x] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-03-10 10:15:01 -03:00

config.php

…

README.md

…

users.php

Enable JIT provisioning for Technician role (#41286 )

2026-03-10 10:15:01 -03:00

README.md

The users.php file in this directory is mounted into the SimpleSAMLPHP Docker container to use for testing SSO with Fleet.

Edit that file to change the credentials or add new SSO users for local testing.