FPSSO: Encrypt passwords "on the wire"#48048
Conversation
…into JM-47132-encrypt-passwords # Conflicts: # apps/fleet-desktop-macos/FleetPSSOExtension/AuthenticationViewController+PSSO.swift
JordanMontgomery
temporarily deployed
to
Docker Hub
GitHub Actions
Inactive
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## JM-46958-psso-device-reg-token #48048 +/- ##
================================================================
Coverage 67.09% 67.09%
================================================================
Files 3627 3627
Lines 230299 230408 +109
Branches 11787 11787
================================================================
+ Hits 154518 154598 +80
- Misses 61819 61832 +13
- Partials 13962 13978 +16
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
@coderabbitai review |
✅ Action performedReview finished.
|
There was a problem hiding this comment.
Warning
- Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.
Pull request overview
This PR adds “password encryption on the wire” for Apple Platform SSO (PSSO) by introducing a dedicated P-256 encryption key published via JWKS, updating the server to accept the encrypted embedded login assertion, and teaching the macOS extension to fetch and use the JWKS encryption key.
Changes:
- Add a new PSSO encryption key asset (in
mdm_config_assets) and publish it in the PSSO JWKS alongside the signing key. - Support encrypted password login assertions (JWE) via
grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer, decrypting the embedded assertion to recover username/password. - Update Fleet Desktop’s PSSO extension to fetch JWKS and set
loginRequestEncryptionPublicKeywhen an enc key is available.
Reviewed changes
Copilot reviewed 11 out of 12 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| server/service/apple_psso.go | Bootstraps and stores a new PSSO encryption private key asset. |
| server/service/apple_psso_test.go | Extends bootstrap tests to cover encryption key creation/preservation. |
| server/fleet/mdm.go | Adds the MDMAssetPSSOEncryptionKey asset name constant. |
| ee/server/service/apple_psso.go | Loads/caches encryption key, publishes it in JWKS, and accepts JWT-bearer password logins with embedded assertions. |
| ee/server/service/apple_psso_test.go | Adds a test verifying JWKS includes both signing and encryption keys. |
| ee/server/service/apple_psso_crypto.go | Adds assertion claim support plus JWE decryption + embedded assertion credential parsing helpers. |
| ee/server/service/apple_psso_crypto_test.go | Adds tests for inbound assertion decrypt round-trip and credential parsing, plus password resolution behavior. |
| apps/fleet-desktop-macos/README.md | Updates docs to note /jwks returns Fleet’s PSSO public keys (plural). |
| apps/fleet-desktop-macos/FleetPSSOExtension/AuthenticationViewController+Shared.swift | Makes login configuration async and sets loginRequestEncryptionPublicKey when JWKS provides an enc key. |
| apps/fleet-desktop-macos/FleetPSSOExtension/AuthenticationViewController+PSSO.swift | Adjusts registration flow to run async configuration before completing registration. |
| apps/fleet-desktop-macos/FleetPSSOExtension/AuthenticationViewController+Networking.swift | Adds JWKS fetch + minimal JWK parsing to import a P-256 public key as SecKey. |
| docs/Contributing/research/mdm/psso.md | Not reviewed (content excluded by policy). |
Files excluded by content exclusion policy (1)
- docs/Contributing/research/mdm/psso.md
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| encKey, encKID, err := svc.getPSSOEncryptionKey(ctx) | ||
| if err != nil { | ||
| return nil, ctxerr.Wrap(ctx, err, "load psso encryption key") | ||
| } |
| protected, err := base64.RawURLEncoding.DecodeString(protectedB64) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("psso inbound jwe: decode protected header: %w", err) | ||
| } |
| func loginRequestEncryptionKey(jwksURL: URL) async -> SecKey? { | ||
| guard let (data, resp) = try? await URLSession.shared.data(from: jwksURL), | ||
| let http = resp as? HTTPURLResponse, | ||
| (200...299).contains(http.statusCode), | ||
| let jwks = try? JSONDecoder().decode(JWKSet.self, from: data), | ||
| let jwk = jwks.keys.first(where: { $0.use == "enc" }) | ||
| else { return nil } | ||
| return jwk.ecPublicSecKey() | ||
| } |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (10)
WalkthroughThis PR adds end-to-end PSSO (Platform SSO) password encryption support. On the server side, a new Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Related issue: Resolves #
Checklist for submitter
If some of the following don't apply, delete the relevant line.
Changes file added for user-visible changes in
changes/,orbit/changes/oree/fleetd-chrome/changes.See Changes files for more information.
Input data is properly validated,
SELECT *is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.Timeouts are implemented and retries are limited to avoid infinite loops
If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes
Testing
Added/updated automated tests
Where appropriate, automated tests simulate multiple hosts and test for host isolation (updates to one hosts's records do not affect another)
QA'd all new/changed functionality manually
Summary by CodeRabbit
New Features
Tests
Chores