Base Orbit enrollment end user auth on server policy

[juan-fdz-hawa]

EnrollOrbit now determines end user authentication requirements from server policy rather than the client-supplied X-Fleet-Capabilities header, which is treated as an informational hint.

Adds the mdm.allow_orbit_end_user_auth_bypass setting (enabled by default) controlling whether hosts that do not complete end user authentication may enroll into a team that requires it; set it to false to strictly enforce end user auth. The setting also governs installers built with fleetctl package --bypass-end-user-auth.

Checklist for submitter

If some of the following don't apply, delete the relevant line.

• Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
  See Changes files for more information.

Testing

• Added/updated automated tests
• QA'd all new/changed functionality manually

Summary by CodeRabbit

Summary by CodeRabbit

• New Features

  • Added a server-controlled setting to govern whether end-user authentication is enforced for Orbit enrollments when it hasn’t been completed (enabled by default).

• Bug Fixes

  • Orbit end-user authentication requirements are now determined by server policy instead of client-advertised capabilities.
  • Enhanced warnings when enrollment is blocked due to end-user authentication requirements.

• Tests

  • Expanded Orbit enrollment end-user authentication coverage, including bypass-flag and capability-header scenarios.

[juan-fdz-hawa]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 904eaf93-f7eb-4134-bb7d-7c9f1ace1ea3

📥 Commits

Reviewing files that changed from the base of the PR and between 166102b and 1512ce5.

⛔ Files ignored due to path filters (1)

• docs/Configuration/fleet-server-configuration.md is excluded by !**/*.md

📒 Files selected for processing (1)

• changes/16798-orbit-enroll-end-user-auth

---

Walkthrough

Orbit enrollment end-user authentication gating now derives from server-side policy rather than client-advertised capabilities. The new mdm.allow_orbit_end_user_auth_bypass setting defaults to enabled and controls unauthenticated enrollment when end-user authentication is incomplete. Enrollment logs additional host and team context when authentication is required. Integration and unit tests cover capability-header variants, bypass settings, and EUA-token precedence.

Possibly related PRs

• fleetdm/fleet#49683: Addresses Orbit end-user authentication bypass behavior alongside server-side enrollment enforcement.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly states the main change: Orbit enrollment now uses server policy for end-user auth.
Description check	✅ Passed	The description covers the required change, changes-file, automated tests, and manual QA, with only the optional related issue line omitted.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 16798-end-user-auth-bypass-in-orbitenroll-via-spoofed-x-fleet-capabilities

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@server/service/orbit.go`:
- Around line 288-294: Update the warning log in the unauthenticated enrollment
path to dereference secret.TeamID before passing it as the "team_id" attribute.
Handle a nil TeamID safely while ensuring non-nil values log the actual numeric
team ID rather than the pointer address.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 921eacdf-4c53-489c-be2c-1b0f52b20121

📥 Commits

Reviewing files that changed from the base of the PR and between d5d1b11 and dab070a8c8dcdf269d3dfe10fce898ae40f1ed3d.

⛔ Files ignored due to path filters (1)

• docs/Configuration/fleet-server-configuration.md is excluded by !**/*.md

📒 Files selected for processing (5)

• changes/16798-orbit-enroll-end-user-auth
• server/config/config.go
• server/service/integration_enterprise_test.go
• server/service/orbit.go
• server/service/orbit_test.go

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.08%. Comparing base (f5ca4b5) to head (1512ce5).

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #49675   +/-   ##
=======================================
  Coverage   68.08%   68.08%           
=======================================
  Files        3936     3936           
  Lines      250647   250661   +14     
  Branches    13275    13275           
=======================================
+ Hits       170642   170664   +22     
+ Misses      64693    64685    -8     
  Partials    15312    15312           

Flag	Coverage Δ
backend	69.42% <100.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

Note

The previously reviewed commits are no longer reachable (likely due to a force-push or rebase), so CodeRabbit is performing a full review instead of an incremental one. This review may take a little longer.

[coderabbitai]

🧹 Nitpick comments (1)

server/service/orbit.go (1)

278-281: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Consider a lower log level for the expected bypass path.

This branch fires on every enrollment where the (default-enabled) bypass allows a non-EUA-advertising client onto a team requiring EUA — likely the common case for many fleets. Logging this at Warn on every such enrollment may drown out genuine issues (e.g., the "blocking enrollment" warning below). Consider InfoContext or DebugContext instead, consistent with the "allowing re-enrollment" log at line 305 which uses InfoContext for a similarly benign case.

✏️ Proposed log-level tweak

-					svc.logger.WarnContext(ctx, "allowing enrollment without end-user authentication: end-user auth bypass is enabled and the client does not support end-user auth",
-						"host_uuid", hostInfo.HardwareUUID)
+					svc.logger.InfoContext(ctx, "allowing enrollment without end-user authentication: end-user auth bypass is enabled and the client does not support end-user auth",
+						"host_uuid", hostInfo.HardwareUUID)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@server/service/orbit.go` around lines 278 - 281, Lower the log level for the
expected enrollment bypass branch in the `AllowOrbitEndUserAuthBypass &&
!clientSupportsEUA` case from `WarnContext` to `InfoContext` (or the established
equivalent benign-path level), while preserving the message and `host_uuid`
context.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@server/service/orbit.go`:
- Around line 278-281: Lower the log level for the expected enrollment bypass
branch in the `AllowOrbitEndUserAuthBypass && !clientSupportsEUA` case from
`WarnContext` to `InfoContext` (or the established equivalent benign-path
level), while preserving the message and `host_uuid` context.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: b540eece-b2ed-4daa-bbfb-c1c7728d2de7

📥 Commits

Reviewing files that changed from the base of the PR and between 0504e59 and 166102b.

⛔ Files ignored due to path filters (1)

• docs/Configuration/fleet-server-configuration.md is excluded by !**/*.md

📒 Files selected for processing (5)

• changes/16798-orbit-enroll-end-user-auth
• server/config/config.go
• server/service/integration_enterprise_test.go
• server/service/orbit.go
• server/service/orbit_test.go