Flag to bypass end-user authentication

[ddribeiro]

Goal

User story
As an IT admin,
I want to specify a flag to bypass end-user authentication when I create my fleetd installer
so that I can prevent end users from seeing the authentication prompt during enrollment (ie they already authenticated via Autopilot).

Demo video: https://www.youtube.com/watch?v=svCaA-820yc
Docs: https://github.com/fleetdm/fleet/pull/49713/changes

Changes

Product

• UI changes: No changes
• CLI (fleetctl) usage changes: No changes
• YAML changes: No changes
• REST API changes: No changes
• Fleet's agent (fleetd) changes: Add a new flag --bypass-end-user-auth to fleetctl package that, when set, configures the generated fleetd package to skip the end-user authentication prompt during enrollment.
• Fleet server configuration changes: No changes
• Exposed, public API endpoint changes: No changes
• fleetdm.com changes: No changes
• GitOps mode UI changes: No changes
• GitOps generation changes: No changes
• Activity changes: No changes
• Permissions changes: No changes
• Changes to paid features or tiers: No changes
• My device and fleetdm.com/better changes: No changes
• Usage statistics: No changes
• Other reference documentation changes: No changes
• First draft of test plan added
• Once shipped, requester has been notified
• Once shipped, dogfooding issue has been filed

Engineering

• Test plan is finalized
• Contributor API changes: No changes
• Feature guide changes: Yes
• Database schema migrations: No changes

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

Risk assessment

• Risk level: Low
• Any regressions to watch out for: Ensure standard end-user auth enrollment (without the flag) is unaffected by this change on both current and new fleetd.

Test plan

Make sure to go through [the list](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/ui/design-qa-considerations.md) and consider all events that might be related to this story, so we catch edge cases earlier.

ℹ️ This issue requires two rounds of testing:

• Phase 1 uses the current released fleetd, which does not yet support --bypass-end-user-auth. The goal is backwards-compatibility / regression testing only.
• Phase 2 uses the new fleetd version shipping in #49700 (fleetd-v1.60.0), which introduces the actual feature. The goal is functional verification of the new flag.

---

Phase 1 — Regression testing (current fleetd, feature not yet supported)

• Run fleetctl package --type=msi (no --bypass-end-user-auth flag) and generate a standard Windows installer
• Install the package on a Windows test host and verify that enrollment completes normally and the end-user authentication prompt appears as expected
• Attempt to run fleetctl package --bypass-end-user-auth --type=msi with the current fleetd version and verify that the CLI either rejects the unknown flag with a clear error or produces a package that still shows the auth prompt (i.e., the flag is not silently honored by an older binary)
• Confirm that a host enrolled without the flag is visible in Fleet and reports correctly

---

Phase 2 — Feature verification (new fleetd from #49700, fleetd-v1.60.0)

Core flow

• Run fleetctl package --bypass-end-user-auth --type=msi to generate a Windows installer using the new fleetd version
• Install the generated package on a clean Windows test host
• Verify that enrollment completes without the end-user authentication prompt appearing
• Confirm the enrolled host appears in Fleet and reports inventory correctly
• Run fleetctl package --type=msi (without the flag) using the new fleetd version and verify that the end-user authentication prompt still appears during enrollment (no regression)

Edge cases

• Attempt enrollment with --bypass-end-user-auth on a host that is already enrolled — verify no errors or unexpected behavior
• Verify that a package built with --bypass-end-user-auth cannot be reused to silently re-enroll a host that was unenrolled and re-imaged (auth should not be permanently bypassed for the device outside of this enrollment flow)
• Test enrollment via a Windows Autopilot-style flow (the primary target scenario) — verify no auth prompt and successful enrollment
• Verify that the flag has no effect on non-Windows package types (e.g., --type=pkg for macOS if tested) — flag should either error or be ignored cleanly
• Verify that omitting --bypass-end-user-auth on the new fleetd produces a functionally identical package to current fleetd (no unintentional behavior change)

Supplemental testing

Testing notes

Confirmation

1. Engineer: Added comment to user story confirming successful completion of test plan (include any special setup, test data, or configuration used during development/testing if applicable).
2. QA: Added comment to user story confirming successful completion of test plan.
3. QA: Determined whether this story needs Playwright automation.
   • Needs automation: Yes / No
   • If yes, filed a follow-up issue in the :help-qa project with status "Needs automation": TODO