Windows and Linux hosts that had already orbit-enrolled were prompted
for end user authentication (an SSO browser tab) when fleetd re-enrolled
after a service restart, node key file loss, or osquery DB rebuild.
Hosts enrolled before EUA was enabled have no host_mdm_idp_accounts row,
so the service-layer EUA gate treated every re-enroll like a brand-new
device.
Before returning END_USER_AUTH_REQUIRED, EnrollOrbit now checks whether
a host matching the enrollment identifiers already exists and previously
held an orbit node key (HostPreviouslyOrbitEnrolled, reusing
matchHostDuringEnrollment's semantics). If so, the re-enroll proceeds
without prompting. Genuinely new devices, and hosts moved to a different
Fleet server, are still gated.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46300
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
**Bug Fixes**
* Fixed unnecessary end-user authentication prompts for Windows and
Linux hosts during fleetd re-enrollment after a service restart.
Previously enrolled devices can now re-enroll without being prompted for
SSO authentication, while new devices still require the appropriate
authentication.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Victor Lyuboslavsky
a2757a1d7c