Single-sign on (SSO) in front of Fleet Desktop > My Device

[noahtalerman]

@noahtalerman: Let's plan on addressing this at the same time:

• Fleet Desktop should not trigger My Device auth during Setup Experience enrollment #43593

We don't want SSO to pop up during macOS setup experience.

---

Goal

User story
As a Fleet user,
I want to require that my end users are signed-in via SSO (IdP) before they can access Fleet Desktop on their macOS, Windows, Linux, or iOS/iPadOS host
so that I can enforce an extra layer of authentication.

Changes

Product

• UI changes: Figma
• CLI (fleetctl) usage changes: No changes
• YAML changes: PR
• REST API changes: PR
  • If new setting is enabled, API endpoints for Fleet desktop require authentication via SSO, with the exception of Get Fleet Desktop information
• Fleet's agent (fleetd) changes: No changes
• Fleet server configuration changes: No changes
• Exposed, public API endpoint changes: No changes
• fleetdm.com changes: No changes
• GitOps mode UI changes: New radio button field is disabled in GitOps mode.
• GitOps generation changes: Include new fleet_desktop > sso_enabled key in generated GitOps YAML.
• Activity changes: PR
• Permissions changes: No changes
• Changes to paid features or tiers: No changes
• My device and fleetdm.com/better changes: No changes
• Usage statistics: PR
• Other reference documentation changes: No changes
• First draft of test plan added
• Once shipped, requester has been notified
• Once shipped, dogfooding issue has been filed

Engineering

• Test plan is finalized
• Contributor API changes: TODO
• Feature guide changes: TODO
• Database schema migrations: TODO
• Load testing: TODO
• Pre-QA load test: TODO
• Load testing/osquery-perf improvements: TODO
• This is a premium only feature: Yes / No

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

Risk assessment

• Requires testing in a hosted environment: TODO
• Requires load testing: TODO
• Risk level: Low / High TODO
• Risk description: TODO

Test plan

Make sure to go through the list and consider all events that might be related to this story, so we catch edge cases earlier.

Core flow

• TODO

Edge cases

• TODO

Supplemental testing

Testing notes

Confirmation

1. Engineer: Added comment to user story confirming successful completion of test plan (include any special setup, test data, or configuration used during development/testing if applicable).
2. QA: Added comment to user story confirming successful completion of test plan.
3. QA: Determined whether this story needs Playwright automation.
   • Needs automation: Yes / No
   • If yes, filed a follow-up issue in the :help-qa project with status "Needs automation":

[lukeheath]

@rachaelshaw @lucasmrod I think we need to target 4.88.0 for this re: https://github.com/fleetdm/confidential/issues/16324

cc @noahtalerman