Flag to bypass end user auth

[getvictor]

Related issue: Resolves #46644

Demo video: https://www.youtube.com/watch?v=svCaA-820yc
Docs: https://github.com/fleetdm/fleet/pull/49713/changes

Checklist for submitter

If some of the following don't apply, delete the relevant line.

• Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
  See Changes files for more information.

Testing

• Added/updated automated tests
• QA'd all new/changed functionality manually

fleetd/orbit/Fleet Desktop

• Verified compatibility with the latest released version of Fleet (see Must rule)
• If the change applies to only one platform, confirmed that runtime.GOOS is used as needed to isolate changes
• Verified that fleetd runs on macOS, Linux and Windows
  • Did not verify macOS.
• Verified auto-update works from the released version of component to the new version (see tools/tuf/test)

Summary by CodeRabbit

• New Features
  • Added --bypass-end-user-auth to fleetctl package and Orbit.
  • Generated Linux and Windows installers can skip the end-user authentication prompt during enrollment.
  • Added ORBIT_BYPASS_END_USER_AUTH for environment-based configuration.
  • End-user authentication remains enabled when a supported EUA token is provided.

[getvictor]

@coderabbitai full review

[getvictor]

/agentic_review

[coderabbitai]

✅ Action performed

Full review finished.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: abeeae31-c5ae-434d-89b1-a819d48a038c

📥 Commits

Reviewing files that changed from the base of the PR and between 0255bc8 and 56cc848.

📒 Files selected for processing (7)

• changes/46644-bypass-end-user-auth
• client/orbit_client.go
• client/orbit_client_test.go
• cmd/fleetctl/fleetctl/package.go
• orbit/changes/46644-bypass-end-user-auth
• orbit/cmd/orbit/orbit.go
• orbit/pkg/packaging/bypass_end_user_auth_test.go

🚧 Files skipped from review as they are similar to previous changes (3)

• changes/46644-bypass-end-user-auth
• orbit/pkg/packaging/bypass_end_user_auth_test.go
• client/orbit_client.go

---

Walkthrough

Adds --bypass-end-user-auth to fleetctl package and Orbit, propagating the setting to Linux and Windows installers. Orbit disables the bypass when an EUA token is available. NewOrbitClient removes the end-user authentication capability when bypassing is enabled, with updated call sites and tests covering capability and template output.

Possibly related issues

• #49700: Directly duplicates the end-user authentication bypass functionality implemented here.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately summarizes the main change: adding a bypass end-user auth flag.
Description check	✅ Passed	The description matches the template and includes the required issue link, checklist items, and testing notes.
Linked Issues check	✅ Passed	The changes add the flag, wire it into installer generation, and preserve default behavior when omitted.
Out of Scope Changes check	✅ Passed	The diff stays focused on the bypass-end-user-auth feature, with tests and supporting packaging updates only.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch victor/46644-bypass-end-user-auth

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Bypass ignores EUA token 🐞 Bug ≡ Correctness

Description

When bypassEndUserAuth=true, NewOrbitClient deletes CapabilityEndUserAuth; on the server, the
EnrollOrbit switch checks "!mp.Has(CapabilityEndUserAuth)" before the "platform==windows &&
euaToken!=\"\"" branch, so a provided EUA token will not be processed/associated. This can enroll
Windows hosts without the intended IdP mapping and triggers a misleading warning that the orbit
version does not support end-user authentication.

Code

client/orbit_client.go[R219-225]

orbitCapabilities := fleet.GetOrbitClientCapabilities()
+	if bypassEndUserAuth {
+		// Don't advertise the end-user auth capability so the Fleet server enrolls this host
+		// without prompting for end-user authentication (e.g. the user already authenticated
+		// via Autopilot/Intune). See https://github.com/fleetdm/fleet/issues/46644.
+		delete(orbitCapabilities, fleet.CapabilityEndUserAuth)
+	}

Evidence

The PR deletes CapabilityEndUserAuth when bypass is enabled, and server enrollment logic uses the
absence of that capability as an earlier switch case than Windows EUA-token handling; therefore,
even if Orbit sends an EUA token, the server will not process it once bypass removes the capability.
The Windows MSI template and Orbit runtime both support passing/setting an EUA token, making this a
realistic configuration.

client/orbit_client.go[219-226]
server/service/orbit.go[251-286]
orbit/pkg/packaging/windows_templates.go[62-73]
orbit/cmd/orbit/orbit.go[1211-1215]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`--bypass-end-user-auth` is currently implemented by deleting `fleet.CapabilityEndUserAuth` from the client capabilities map.
On the server, the enrollment flow treats missing `CapabilityEndUserAuth` as "client doesn't support end-user auth" and executes that branch *before* the Windows EUA-token processing branch, so an `eua_token` sent by the client can be silently ignored (no IdP association), and the server emits misleading warning logs.
## Issue Context
- The Windows installer can pass an EUA token (`--eua-token=...`) and Orbit forwards it in the enroll request.
- The server only runs `processWindowsEUAToken(...)` in a switch case that is currently unreachable when the capability is removed.
## Fix Focus Areas
- client/orbit_client.go[219-225]
- server/service/orbit.go[251-272]
### Suggested direction
Prefer an explicit bypass signal (e.g., a dedicated request field/header/capability) that tells the server to skip returning `END_USER_AUTH_REQUIRED` while still allowing the server to process EUA tokens when present. Alternatively, adjust server-side branching/precedence so the Windows EUA-token path is evaluated before the "capability missing" path, or reject/clearly define precedence when both bypass and EUA token are provided.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[Copilot]

Warning

• Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Pull request overview

Adds support for a new --bypass-end-user-auth option to generated fleetd (Orbit) installers, intended to skip end-user authentication during enrollment by omitting the end_user_auth capability when creating the Orbit client.

Changes:

• Added --bypass-end-user-auth to fleetctl package and plumbed it into packaging options/templates for Linux (env file), macOS (launchd plist), and Windows (MSI service args).
• Added an Orbit runtime flag/env var (ORBIT_BYPASS_END_USER_AUTH) and forwarded it into fleetclient.NewOrbitClient.
• Updated NewOrbitClient to optionally remove fleet.CapabilityEndUserAuth, with new unit tests for both packaging templates and Orbit client capabilities behavior.

Reviewed changes

Copilot reviewed 10 out of 11 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
orbit/pkg/packaging/windows_templates.go	Appends --bypass-end-user-auth to Orbit service arguments when enabled.
orbit/pkg/packaging/packaging.go	Adds BypassEndUserAuth to packaging Options.
orbit/pkg/packaging/macos_templates.go	Emits ORBIT_BYPASS_END_USER_AUTH=true in launchd env when enabled.
orbit/pkg/packaging/linux_shared.go	Emits ORBIT_BYPASS_END_USER_AUTH=true in the Linux env file when enabled.
orbit/pkg/packaging/bypass_end_user_auth_test.go	Tests that the bypass option is present/absent across platform templates.
orbit/cmd/orbit/orbit.go	Adds runtime flag/env var and passes it into NewOrbitClient (and checker client).
cmd/osquery-perf/agent.go	Updates NewOrbitClient call site for the new parameter.
cmd/fleetctl/fleetctl/package.go	Adds --bypass-end-user-auth to fleetctl package.
client/orbit_client.go	Deletes CapabilityEndUserAuth from advertised capabilities when bypass enabled.
client/orbit_client_test.go	Adds unit tests verifying capability omission when bypass is enabled.

Files excluded by content exclusion policy (1)

• changes/46644-bypass-end-user-auth

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

❌ Patch coverage is 33.33333% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 67.89%. Comparing base (d81902f) to head (56cc848).
⚠️ Report is 9 commits behind head on main.

Files with missing lines	Patch %	Lines
orbit/cmd/orbit/orbit.go	0.00%	9 Missing ⚠️
cmd/osquery-perf/agent.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #49683   +/-   ##
=======================================
  Coverage   67.89%   67.89%           
=======================================
  Files        3890     3890           
  Lines      248437   248451   +14     
  Branches    13022    13022           
=======================================
+ Hits       168679   168691   +12     
- Misses      64543    64549    +6     
+ Partials    15215    15211    -4     

Flag	Coverage Δ
backend	69.27% <33.33%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Warning

• Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Pull request overview

Copilot reviewed 9 out of 10 changed files in this pull request and generated 1 comment.

Files excluded by content exclusion policy (1)

• changes/46644-bypass-end-user-auth

[Copilot]

Warning

• Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Pull request overview

Copilot reviewed 9 out of 10 changed files in this pull request and generated 1 comment.

Files excluded by content exclusion policy (1)

• changes/46644-bypass-end-user-auth

[Copilot]

Warning

• Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated 1 comment.

Files excluded by content exclusion policy (1)

• changes/46644-bypass-end-user-auth

[Copilot]

Warning

• Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated no new comments.

Files excluded by content exclusion policy (1)

• changes/46644-bypass-end-user-auth