UI: Conditional access - Microsoft Entra by jacobshandling · Pull Request #27982 · fleetdm/fleet

jacobshandling · 2025-04-08T15:50:19Z

Note - currently feature flagged. Build frontend with ALLOW_CONDITIONAL_ACCESS=true NODE_ENV=development yarn run webpack --progress --watch to enable this feature. Also, all of this functionality depends on the new config.license.managed_cloud being true, so you'll need to mock that data somehow. This branch has the appropriate fake data for testing

For #27043, #27864

Build front end for Fleet's integration with Microsoft Entra, allowing conditional prevention of single sign-on for hosts failing any policies on a team

Trigger the integration

Triggered, but configuration still not verified

Verified, short and long tenant ids:

Verified –> Deleted

Enable for policies of a team

Activities

Unavailable for self-hosted Fleet instances:

Premium only

Changes file added for user-visible changes in changes/
Added/updated automated tests
A detailed QA plan exists on the associated ticket (if it isn't there, work with the product group's QA engineer to add it)
Manual QA for all new/changed functionality

jacobshandling · 2025-04-09T19:12:13Z

@sgress454 setting as draft per updated decision to merge with feature flag, will mark ready for review when that's implemented

sgress454 · 2025-04-10T20:24:50Z

+export const createMockLocation = (
+  overrides?: Partial<IRouterLocation>
+): IRouterLocation => {
+  // Default values for the location object
+  const defaultLocation: IRouterLocation = {
+    pathname: "/",
+    host: "localhost:8080",
+    hostname: "localhost",
+    port: "8080",
+    protocol: "http:",
+  };
+
+  return {
+    ...defaultLocation,
+    ...overrides,
+  };
+};
+


Did you end up using this or IRouterLocation?

Did not, but figured it might be useful to leave there for the future

sgress454 · 2025-04-10T20:40:10Z

+            // These fields will never actually be changed here. See comment above
+            // IGlobalIntegrations definition.
+            zendesk: teamConfig?.integrations.zendesk || [],
+            jira: teamConfig?.integrations.jira || [],


why not ...teamConfig.integrations like you have above for globalConfig?

Not sure, will update

Oh, perhaps related to patch semantics? This way there will always be an [] in each of these
fields, whereas above they can be null

Yea...looks like if one of this is null but the other is set, this logic will wipe out the
null field even if it already exists on the db. Definitely room for improvement on that PATCH
endpoint but that seems to be why, same as above.

sgress454 · 2025-04-10T20:41:13Z

+          },
+        };
+        await teamsAPI.update(payload, teamIdForApi);
+        refetchGlobalConfig();


why refetching global config here, and team config above? seems backwards.

edit -- the one above looks like it's for no team, not all teams... so if we set this up for No Team then we add it to the global config?

Yep thanks for the catch, switching...

so if we set this up for No Team then we add it to the global config

That's right! Not the clearest system...

sgress454

A couple of questions but overall code looks really good, nice job on the different phases of the setup flow. Testing now 👍

sgress454 · 2025-04-10T21:20:29Z

+  if (
+    (!isManagedCloud && section?.includes("conditional-access")) ||
+    featureFlags.allowConditionalAccess !== "true"
+  ) {


Suggested change

if (

(!isManagedCloud && section?.includes("conditional-access")) ||

featureFlags.allowConditionalAccess !== "true"

) {

if (

section?.includes("conditional-access") &&

(!isManagedCloud || featureFlags.allowConditionalAccess !== "true")

) {

This is currently blocking the Integrations page completely if the feature flag is off -- you want it just for the conditional access section.

Err, nothing to see here...😅

sgress454 · 2025-04-10T21:37:16Z

+      );
+      setIsUpdating(false);
+      toggleDeleteConditionalAccessModal();
+      setPhase(Phase.Form);


Nit, we probably should be re-fetching the config here via the API, rather than trusting that this worked (like we do with GitOps mode). It's pretty low risk here since we should be able to trust our own backend when it says "this action was successful", but always better to be visualizing real data from the backend when we can.

Great call. The omission may have been to allow testing with the fake data before the backend
actually works, since if we refetch the backend when it's not actually doing anything it won't lead
to the right phase. Will include this in the "fake data" commit.

The goal here is for the page state to be driven by the state of the backend as much as possible. I realize that for certain parts of the process (like when the user is doing something on another site) we can't easily reach that goal. But for this case, I think we can by removing the setPhase(Phase.Form) here and moving it to the onSuccess of the config fetcher (contingent on the new config having microsoft_entra_connection_configured be false). Does that make sense?

Maybe move the isUpdating(false) to there too, just to avoid an edge case of "config load takes a moment and user can do weird things in the meantime"

Yes this makes sense

…hConfig

Support for this property was removed in #28245, which merged just before #27982. It's now causing linting errors. I confirmed that the Save button looks the same without it. <img width="793" alt="image" src="https://github.com/user-attachments/assets/f3357cd2-1c4f-4c91-8c2e-e56797fb86e9" />

jacobshandling added 26 commits March 27, 2025 16:49

foundational entities and types

5420c48

new route, scaffolding for Conditional Access page

f439324

redirect to settings for non cloud-managed

73fac82

wip

037f03a

Merge branch 'main' into 27043-MS-compliance-frontend

d318fcc

wip - form

b60de31

wip

8594133

add ui phase-based infrastructure

08aecb5

implement ui phases

d3cb992

wip

6712524

wip - enum

1a08a03

renders each state per values and form submissions correctly

a4b494d

add confirmation endpoint error state, comments, reorganize

d3596c8

Implement modal

18c5a6e

Shorten existing policy automation labels

b21c3ae

wip - conditional access modal / automation

afb027a

copy updates

92cf95a

Merge branch 'main' into 27043-MS-compliance-frontend

de4dcbd

style adjustments

83d97ba

Activities, clean up

c78bbcf

add fake activities API responses

1d1c125

use padding vars

4bbf516

cleanup

5f9f642

update PATCH configs

56db28c

update paths

1a7c7a9

Merge branch 'main' into 27043-MS-compliance-frontend-fake-data

7fead49

jacobshandling temporarily deployed to Docker Hub April 8, 2025 15:50 — with GitHub Actions Inactive

jacobshandling added 2 commits April 8, 2025 09:55

change file

6a17ffe

include new param in PATCH teams API

2352e46

jacobshandling force-pushed the 27043-MS-compliance-frontend branch from cdb7ce2 to 63f9239 Compare April 8, 2025 17:09

jacobshandling assigned sgress454 Apr 8, 2025

jacobshandling marked this pull request as ready for review April 8, 2025 22:54

jacobshandling requested a review from a team as a code owner April 8, 2025 22:54

jacobshandling marked this pull request as draft April 9, 2025 19:11

jacobshandling temporarily deployed to Docker Hub April 9, 2025 20:27 — with GitHub Actions Inactive

jacobshandling marked this pull request as ready for review April 9, 2025 20:29

add feature flag

ff8a55b

jacobshandling force-pushed the 27043-MS-compliance-frontend branch from e69ad02 to ff8a55b Compare April 9, 2025 20:38

jacobshandling temporarily deployed to Docker Hub April 9, 2025 20:38 — with GitHub Actions Inactive

facilitate long tenant ID truncation

019bcdb

jacobshandling temporarily deployed to Docker Hub April 9, 2025 22:22 — with GitHub Actions Inactive

sgress454 reviewed Apr 10, 2025

View reviewed changes

jacobshandling added 2 commits April 14, 2025 13:15

review updates 1

548697f

refetch config after deleting conditional access

89c1b13

jacobshandling temporarily deployed to Docker Hub April 14, 2025 20:29 — with GitHub Actions Inactive

jacobshandling requested a review from sgress454 April 14, 2025 20:29

jacobshandling added 2 commits April 15, 2025 12:39

depend state updates on successful config refetch

2b3d42d

maintain general use of context config while allowing useQuery refetc…

f81eb87

…hConfig

jacobshandling temporarily deployed to Docker Hub April 15, 2025 20:17 — with GitHub Actions Inactive

sgress454 approved these changes Apr 15, 2025

View reviewed changes

jacobshandling merged commit f585199 into main Apr 15, 2025
14 checks passed

jacobshandling deleted the 27043-MS-compliance-frontend branch April 15, 2025 20:55

sgress454 mentioned this pull request Apr 16, 2025

Remove button variant prop from Conditional Access page #28290

Merged

Conversation

jacobshandling commented Apr 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

For #27043, #27864

Build front end for Fleet's integration with Microsoft Entra, allowing conditional prevention of single sign-on for hosts failing any policies on a team

Trigger the integration

Triggered, but configuration still not verified

Verified, short and long tenant ids:

Verified –> Deleted

Enable for policies of a team

Activities

Unavailable for self-hosted Fleet instances:

Premium only

Uh oh!

jacobshandling commented Apr 9, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sgress454 Apr 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sgress454 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jacobshandling commented Apr 8, 2025 •

edited

Loading

sgress454 Apr 10, 2025 •

edited

Loading