Scott GressandLucas Manuel Rodriguez
ffbbb9e866
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #43371 # Details * Ensures that if `enable_sso: true` is set in a global config, then all required sso keys (`entity_id`, `idp_name` and one of `metadata`/`metadata_url`) are provided * Ensures that if `end_user_authentication: true` is set on a fleet, then all required sso keys (`entity_id`, `idp_name` and one of `metadata`/`metadata_url`) are provided, _even if the fleet's config file is not provided in the gitops run_. * Ensures that if `end_user_authentication: true` is set in a fleet config in a gitops run, then all required sso keys (`entity_id`, `idp_name` and one of `metadata`/`metadata_url`) are provided, _even if the global config file is not provided in the gitops run_. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually ### Org SSO — gitops client validation (`fleetctl gitops`) - [x] `enable_sso: true` with **empty `metadata` and `metadata_url`** → fails (metadata-or-url) - [x] `enable_sso: true` with **empty `idp_name`** → fails (idp_name) - [x] `enable_sso: true` with **empty `entity_id`** → fails (entity_id) - [x] Multiple fields missing at once → **one error line per missing field** - [x] `enable_sso: true` + complete IdP (`metadata_url`) → succeeds - [x] `enable_sso: true` + complete IdP using inline `metadata` (no url) → succeeds - [x] `enable_sso: false` + empty IdP fields → succeeds - [x] `sso_settings` key **omitted entirely** → succeeds, and apply **clears** stored SSO - [x] The literal `generate-gitops` output (`metadata: # TODO: ...`) applied as-is → **rejected** ### MDM EUA — gitops group cross-file validation - [x] Team file enables EUA **+** global file **omits** the EUA IdP block → fails - [x] **#43371 core repro:** stored team EUA on, file NOT in run, global-only run blanks metadata → fails, names the team - [x] Same but the team's file **is** in the run with EUA `false` → succeeds - [x] EUA disabled everywhere + **empty** stored IdP → succeeds ### `--delete-other-fleets` - [x] Run with `--delete-other-fleets` degrading the IdP while a stored not-in-run team has EUA on → succeeds - [x] Confirm the omitted team is actually deleted on apply - [x] Known corner: `--delete-other-fleets` + omitted ABM/VPP team with EUA on + degraded IdP → fails at apply time ### Server-side backstop (REST API) - [x] `PATCH /config` (overwrite=false), `enable_sso:true`, metadata omitted, existing has metadata → **200**, metadata preserved - [x] `PATCH /config?overwrite=true`, `enable_sso:true` + empty metadata/url → **422** field `metadata` - [x] `?overwrite=true`, metadata_url set, empty `entity_id`/`idp_name` → **422** both `required` - [x] `?overwrite=true`, `enable_sso:false` → **200** (no IdP required when disabled); `sso_settings` omitted entirely → clears (covered by gitops POS-2) ### Server-side EUA (`euaStrict` keyed on incoming global flag only) - [x] `?overwrite=true` + incoming **global** EUA enabled + incomplete IdP → **422** `entity_id`/`idp_name` - [x] `?overwrite=true` + global EUA **off** + stored team EUA + payload degrades IdP → **succeeds** (via gitops #43371-OVERRIDE) - [x] `?overwrite=true` + global EUA off + payload **fully clears** IdP while a team has EUA → **422** `end_user_authentication` (IsEmpty guard) ### Regression / false-positive guards - [x] Multi-file gitops `--dry-run` configuring IdP AND enabling team EUA (empty stored IdP) → dry-run passes (EE dry-run skip) - [x] A previously-working gitops run with a complete SSO/EUA config → still applies cleanly ### End state verification - [x] After any **rejected** run, stored SSO/EUA config **unchanged** - [ ] After a valid complete-IdP run, SSO login + ADE/EUA enrollment works end-to-end (live device) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * GitOps now validates SSO and MDM end-user authentication (EUA) configs before applying changes, rejecting incomplete settings when SSO/EUA are enabled globally or for any team. Overwrite (GitOps) mode enforces stricter validation than standard updates; dry-run behavior adjusted to avoid spurious EUA rejections. * **Tests** * Added comprehensive tests covering SSO/EUA validation, overwrite vs patch semantics, cross-file EUA scenarios, and delete-other-fleets behavior. * **Refactor** * Reorganized validation and config-parsing helpers for reuse in GitOps checks. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
pkg directory
This top-level pkg directory contains packages that may be shared between all fleet backend components.