Orbit passes EUA token during enrollment by ksykulev · Pull Request #43369 · fleetdm/fleet

ksykulev · 2026-04-09T20:20:03Z

Related issue: Resolves #41379

Checklist for submitter

If some of the following don't apply, delete the relevant line.

Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
See Changes files for more information.

Testing

Added/updated automated tests
Where appropriate, automated tests simulate multiple hosts and test for host isolation (updates to one hosts's records do not affect another)
QA'd all new/changed functionality manually

fleetd/orbit/Fleet Desktop

Verified compatibility with the latest released version of Fleet (see Must rule)
If the change applies to only one platform, confirmed that runtime.GOOS is used as needed to isolate changes
Verified that fleetd runs on macOS, Linux and Windows
Verified auto-update works from the released version of component to the new version (see tools/tuf/test)

claude

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

Copilot

Pull request overview

Adds support for passing a Windows MDM end-user authentication (EUA) token from the Fleet MSI installer into Orbit, and sending it along with the /api/fleet/orbit/enroll request so Fleet can link the IdP account during enrollment.

Changes:

Enable a new EUA_TOKEN MSI property (gated by Orbit version) and pass it to the Orbit Windows service as --eua-token.
Add a hidden --eua-token CLI flag to Orbit and plumb it into the Orbit enroll request payload (eua_token).
Add unit tests covering both the MSI template output and the enroll request JSON behavior.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
orbit/pkg/packaging/windows.go	Enables the new MSI property based on Orbit version gating.
orbit/pkg/packaging/windows_templates.go	Adds `EUA_TOKEN` property and wires it into the Windows service arguments.
orbit/pkg/packaging/windows_eua_test.go	New tests validating the WiX template includes/omits EUA pieces appropriately.
orbit/pkg/packaging/packaging.go	Extends packaging `Options` with `EnableEUATokenProperty`.
orbit/cmd/orbit/orbit.go	Adds hidden `--eua-token` flag and sets it on the Orbit client before enrollment-triggering calls.
client/orbit_client.go	Stores EUA token on the client and includes it in `EnrollOrbitRequest`.
client/orbit_client_eua_test.go	Verifies `eua_token` is present when set and omitted when empty.
changes/41379-orbit-eua	Adds a changelog entry for the new behavior.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

orbit/pkg/packaging/windows_eua_test.go

codecov · 2026-04-09T20:51:18Z

Codecov Report

❌ Patch coverage is 0% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 66.84%. Comparing base (16e696e) to head (6e1a51e).

Files with missing lines	Patch %	Lines
orbit/cmd/orbit/orbit.go	0.00%	8 Missing ⚠️
orbit/pkg/packaging/windows.go	0.00%	2 Missing ⚠️

Additional details and impacted files

@@                    Coverage Diff                     @@
##           41381-eua-ms-installer   #43369      +/-   ##
==========================================================
- Coverage                   66.88%   66.84%   -0.04%     
==========================================================
  Files                        2594     2588       -6     
  Lines                      207936   207536     -400     
  Branches                     9207     9207              
==========================================================
- Hits                       139080   138732     -348     
+ Misses                      56200    56184      -16     
+ Partials                    12656    12620      -36

Flag	Coverage Δ
backend	`68.63% <0.00%> (-0.05%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copilot

Pull request overview

Copilot reviewed 7 out of 8 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

client/orbit_client_eua_test.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

getvictor

Looks good. Just some minor comments.

getvictor · 2026-04-11T00:22:56Z

client/orbit_client_eua_test.go

+		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			body, err := io.ReadAll(r.Body)
+			assert.NoError(t, err)
+			assert.NoError(t, json.Unmarshal(body, &receivedBody))
+
+			resp := fleet.EnrollOrbitResponse{OrbitNodeKey: testNodeKey}
+			w.Header().Set("Content-Type", "application/json")
+			err = json.NewEncoder(w).Encode(resp)
+			assert.NoError(t, err)
+		}))
+		defer srv.Close()


Nit. This setup is the same in both subtests. Can this be table-driven?

getvictor · 2026-04-11T00:23:14Z

client/orbit_client_eua_test.go

+func TestSetEUAToken(t *testing.T) {
+	oc := &OrbitClient{}
+	require.Empty(t, oc.euaToken)
+
+	oc.SetEUAToken("some-token")
+	require.Equal(t, "some-token", oc.euaToken)
+
+	oc.SetEUAToken("")
+	require.Empty(t, oc.euaToken)
+}


Nit. This is already covered by the test above.

getvictor · 2026-04-11T00:27:06Z

changes/41379-orbit-eua

@@ -0,0 +1 @@
+* Orbit passes EUA token during enrollment request


This should be in orbit/changes/ directory

getvictor · 2026-04-11T00:29:03Z

orbit/pkg/packaging/windows_eua_test.go

+	t.Run("EUA_TOKEN flag appears in ServiceInstall Arguments", func(t *testing.T) {
+		opt := baseOpt
+		opt.EnableEUATokenProperty = true
+
+		var buf bytes.Buffer
+		err := windowsWixTemplate.Execute(&buf, opt)
+		require.NoError(t, err)
+
+		// Find the ServiceInstall Arguments line and verify eua-token is in it.
+		for line := range strings.SplitSeq(buf.String(), "\n") {
+			if strings.Contains(line, "Arguments=") && strings.Contains(line, "--fleet-url") {
+				assert.Contains(t, line, `--eua-token="[EUA_TOKEN]"`,
+					"eua-token flag should be in ServiceInstall Arguments")
+				return
+			}
+		}


Nit. This could be merged with test 1.

ksykulev requested a review from a team as a code owner April 9, 2026 20:20

claude bot reviewed Apr 9, 2026

View reviewed changes

ksykulev requested review from Copilot and removed request for a team April 9, 2026 20:21

ksykulev had a problem deploying to Docker Hub April 9, 2026 20:21 — with GitHub Actions Error

Copilot started reviewing on behalf of ksykulev April 9, 2026 20:24 View session

ksykulev force-pushed the 41379-eua-orbit branch from f1fd907 to 29776ec Compare April 9, 2026 20:28

ksykulev temporarily deployed to Docker Hub April 9, 2026 20:28 — with GitHub Actions Inactive

Copilot AI reviewed Apr 9, 2026

View reviewed changes

orbit/pkg/packaging/windows_eua_test.go Outdated Show resolved Hide resolved

ksykulev temporarily deployed to Docker Hub April 10, 2026 15:27 — with GitHub Actions Inactive

ksykulev force-pushed the 41379-eua-orbit branch from b249a9c to 049f089 Compare April 10, 2026 16:07

ksykulev temporarily deployed to Docker Hub April 10, 2026 16:07 — with GitHub Actions Inactive

ksykulev assigned getvictor Apr 10, 2026

ksykulev requested a review from Copilot April 10, 2026 16:35

Copilot started reviewing on behalf of ksykulev April 10, 2026 16:35 View session

Copilot AI reviewed Apr 10, 2026

View reviewed changes

client/orbit_client_eua_test.go Outdated Show resolved Hide resolved

ksykulev temporarily deployed to Docker Hub April 10, 2026 18:41 — with GitHub Actions Inactive

ksykulev and others added 4 commits April 10, 2026 14:40

Orbit passes EUA token during enrollment

587ee5a

format correctly

22a99cd

linting errors

b3cc54e

Update client/orbit_client_eua_test.go

6e1a51e

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

ksykulev force-pushed the 41379-eua-orbit branch from 7f7d6f2 to 6e1a51e Compare April 10, 2026 19:40

ksykulev temporarily deployed to Docker Hub April 10, 2026 19:42 — with GitHub Actions Inactive

getvictor approved these changes Apr 11, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Orbit passes EUA token during enrollment#43369

Orbit passes EUA token during enrollment#43369
ksykulev wants to merge 4 commits into41381-eua-ms-installerfrom
41379-eua-orbit

ksykulev commented Apr 9, 2026 •

edited

Loading

Uh oh!

claude bot left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

codecov bot commented Apr 9, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

getvictor left a comment

Uh oh!

getvictor Apr 11, 2026

Uh oh!

getvictor Apr 11, 2026

Uh oh!

getvictor Apr 11, 2026

Uh oh!

getvictor Apr 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		@@ -0,0 +1 @@
		* Orbit passes EUA token during enrollment request No newline at end of file

Conversation

ksykulev commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist for submitter

Testing

fleetd/orbit/Fleet Desktop

Uh oh!

claude bot left a comment

Choose a reason for hiding this comment

Claude Code Review

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

codecov bot commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

getvictor left a comment

Choose a reason for hiding this comment

Uh oh!

getvictor Apr 11, 2026

Choose a reason for hiding this comment

Uh oh!

getvictor Apr 11, 2026

Choose a reason for hiding this comment

Uh oh!

getvictor Apr 11, 2026

Choose a reason for hiding this comment

Uh oh!

getvictor Apr 11, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ksykulev commented Apr 9, 2026 •

edited

Loading

codecov bot commented Apr 9, 2026 •

edited

Loading