Okta conditional access configs (#34566)

getvictor · mna · commit 3c969674d9ea · 2025-10-27T09:11:32.000-04:00
**Related issue:** Resolves #34533 This is the first sub-task out of several. Changes file will be added in a subsequent PR. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements) ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## New Fleet configuration settings - [x] Setting(s) is/are explicitly **excluded** from GitOps  ## Summary by CodeRabbit * **New Features** * Added Okta Conditional Access support (IDP, ACS URL, audience, certificate) and exposed conditional access in AppConfig/API * App activity logging for adding/removing Okta conditional access * **Bug Fixes** * Fixed typo in conditional access validation messaging * **Tests** * Added tests for Okta Conditional Access lifecycle, license gating, and GitOps export exclusion * **Documentation** * Added audit-log entries for Okta conditional access add/delete
diff --git a/cmd/fleetctl/fleetctl/generate_gitops_test.go b/cmd/fleetctl/fleetctl/generate_gitops_test.go
@@ -17,6 +17,7 @@ import (
 	"github.com/fleetdm/fleet/v4/server/ptr"
 	"github.com/ghodss/yaml"
 	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/urfave/cli/v2"
 )
@@ -758,6 +759,56 @@ func TestGeneratedOrgSettingsNoSSO(t *testing.T) {
 	require.NoError(t, err)
 }
 
+func TestGeneratedOrgSettingsOktaConditionalAccessNotIncluded(t *testing.T) {
+	// Get the test app config.
+	fleetClient := &MockClient{}
+	appConfig, err := fleetClient.GetAppConfig()
+	require.NoError(t, err)
+
+	// Set Okta conditional access fields (these should NOT appear in GitOps output)
+	appConfig.ConditionalAccess = &fleet.ConditionalAccessSettings{
+		MicrosoftEntraTenantID:             "test-tenant-id",
+		MicrosoftEntraConnectionConfigured: true,
+		OktaIDPID:                          optjson.SetString("https://okta.example.com/idp"),
+		OktaAssertionConsumerServiceURL:    optjson.SetString("https://okta.example.com/acs"),
+		OktaAudienceURI:                    optjson.SetString("https://okta.example.com/audience"),
+		OktaCertificate:                    optjson.SetString("-----BEGIN CERTIFICATE-----\ntest\n-----END CERTIFICATE-----"),
+	}
+
+	// Create the command.
+	cmd := &GenerateGitopsCommand{
+		Client:       fleetClient,
+		CLI:          cli.NewContext(&cli.App{}, nil, nil),
+		Messages:     Messages{},
+		FilesToWrite: make(map[string]interface{}),
+		AppConfig:    appConfig,
+	}
+
+	// Generate the org settings.
+	orgSettingsRaw, err := cmd.generateOrgSettings()
+	require.NoError(t, err)
+	require.NotNil(t, orgSettingsRaw)
+	var orgSettings map[string]any
+	b, err := yaml.Marshal(orgSettingsRaw)
+	require.NoError(t, err)
+	err = yaml.Unmarshal(b, &orgSettings)
+	require.NoError(t, err)
+
+	// Verify that conditional_access section does not exist in the output
+	// (Okta configs are not supported in GitOps)
+	_, hasConditionalAccess := orgSettings["conditional_access"]
+	assert.False(t, hasConditionalAccess, "conditional_access section should not be present in GitOps output as Okta configs are not supported")
+
+	// Also verify by checking the YAML string directly
+	yamlStr := string(b)
+	assert.NotContains(t, yamlStr, "okta_idp_id", "Okta IDP ID should not be in GitOps output")
+	assert.NotContains(t, yamlStr, "okta_assertion_consumer_service_url", "Okta ACS URL should not be in GitOps output")
+	assert.NotContains(t, yamlStr, "okta_audience_uri", "Okta Audience URI should not be in GitOps output")
+	assert.NotContains(t, yamlStr, "okta_certificate", "Okta Certificate should not be in GitOps output")
+	assert.NotContains(t, yamlStr, "microsoft_entra_tenant_id", "Microsoft Entra Tenant ID should not be in GitOps output")
+	assert.NotContains(t, yamlStr, "microsoft_entra_connection_configured", "Microsoft Entra connection status should not be in GitOps output")
+}
+
 func TestGenerateOrgSettingsInsecure(t *testing.T) {
 	// Get the test app config.
 	fleetClient := &MockClient{}
diff --git a/cmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigJson.json b/cmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigJson.json
@@ -41,6 +41,14 @@
       "activity_expiry_enabled": false,
       "activity_expiry_window": 0
     },
+    "conditional_access": {
+      "microsoft_entra_tenant_id": "",
+      "microsoft_entra_connection_configured": false,
+      "okta_idp_id": null,
+      "okta_assertion_consumer_service_url": null,
+      "okta_audience_uri": null,
+      "okta_certificate": null
+    },
     "features": {
       "enable_host_users": true,
       "enable_software_inventory": false
diff --git a/cmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigTeamMaintainerJson.json b/cmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigTeamMaintainerJson.json
@@ -26,6 +26,14 @@
       "activity_expiry_enabled": false,
       "activity_expiry_window": 0
     },
+    "conditional_access": {
+      "microsoft_entra_tenant_id": "",
+      "microsoft_entra_connection_configured": false,
+      "okta_idp_id": null,
+      "okta_assertion_consumer_service_url": null,
+      "okta_audience_uri": null,
+      "okta_certificate": null
+    },
     "features": {
       "enable_host_users": true,
       "enable_software_inventory": false
diff --git a/cmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigTeamMaintainerYaml.yml b/cmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigTeamMaintainerYaml.yml
@@ -10,6 +10,13 @@ spec:
   activity_expiry_settings:
     activity_expiry_enabled: false
     activity_expiry_window: 0
+  conditional_access:
+    microsoft_entra_tenant_id: ""
+    microsoft_entra_connection_configured: false
+    okta_idp_id: null
+    okta_assertion_consumer_service_url: null
+    okta_audience_uri: null
+    okta_certificate: null
   features:
     enable_host_users: true
     enable_software_inventory: false
diff --git a/cmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigYaml.yml b/cmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigYaml.yml
@@ -10,6 +10,13 @@ spec:
   activity_expiry_settings:
     activity_expiry_enabled: false
     activity_expiry_window: 0
+  conditional_access:
+    microsoft_entra_tenant_id: ""
+    microsoft_entra_connection_configured: false
+    okta_idp_id: null
+    okta_assertion_consumer_service_url: null
+    okta_audience_uri: null
+    okta_certificate: null
   features:
     enable_host_users: true
     enable_software_inventory: false
diff --git a/cmd/fleetctl/fleetctl/testdata/expectedGetConfigIncludeServerConfigJson.json b/cmd/fleetctl/fleetctl/testdata/expectedGetConfigIncludeServerConfigJson.json
@@ -41,6 +41,14 @@
       "activity_expiry_enabled": false,
       "activity_expiry_window": 0
     },
+    "conditional_access": {
+      "microsoft_entra_tenant_id": "",
+      "microsoft_entra_connection_configured": false,
+      "okta_idp_id": null,
+      "okta_assertion_consumer_service_url": null,
+      "okta_audience_uri": null,
+      "okta_certificate": null
+    },
     "features": {
       "enable_host_users": true,
       "enable_software_inventory": false
diff --git a/cmd/fleetctl/fleetctl/testdata/expectedGetConfigIncludeServerConfigYaml.yml b/cmd/fleetctl/fleetctl/testdata/expectedGetConfigIncludeServerConfigYaml.yml
@@ -10,6 +10,13 @@ spec:
   activity_expiry_settings:
     activity_expiry_enabled: false
     activity_expiry_window: 0
+  conditional_access:
+    microsoft_entra_tenant_id: ""
+    microsoft_entra_connection_configured: false
+    okta_idp_id: null
+    okta_assertion_consumer_service_url: null
+    okta_audience_uri: null
+    okta_certificate: null
   features:
     enable_host_users: true
     enable_software_inventory: false
diff --git a/cmd/fleetctl/fleetctl/testdata/macosSetupExpectedAppConfigEmpty.yml b/cmd/fleetctl/fleetctl/testdata/macosSetupExpectedAppConfigEmpty.yml
@@ -13,6 +13,13 @@ spec:
   activity_expiry_settings:
     activity_expiry_enabled: false
     activity_expiry_window: 0
+  conditional_access:
+    microsoft_entra_tenant_id: ""
+    microsoft_entra_connection_configured: false
+    okta_idp_id: null
+    okta_assertion_consumer_service_url: null
+    okta_audience_uri: null
+    okta_certificate: null
   integrations:
     conditional_access_enabled: null
     google_calendar: null
diff --git a/cmd/fleetctl/fleetctl/testdata/macosSetupExpectedAppConfigSet.yml b/cmd/fleetctl/fleetctl/testdata/macosSetupExpectedAppConfigSet.yml
@@ -13,6 +13,13 @@ spec:
   activity_expiry_settings:
     activity_expiry_enabled: false
     activity_expiry_window: 0
+  conditional_access:
+    microsoft_entra_tenant_id: ""
+    microsoft_entra_connection_configured: false
+    okta_idp_id: null
+    okta_assertion_consumer_service_url: null
+    okta_audience_uri: null
+    okta_certificate: null
   integrations:
     conditional_access_enabled: null
     google_calendar: null
diff --git a/docs/Contributing/reference/audit-logs.md b/docs/Contributing/reference/audit-logs.md
@@ -2068,6 +2068,18 @@ Generated when Microsoft Entra is integration is disconnected.
 
 This activity does not contain any detail fields.
 
+## added_conditional_access_okta
+
+Generated when Okta is configured or edited for conditional access.
+
+This activity does not contain any detail fields.
+
+## deleted_conditional_access_okta
+
+Generated when Okta conditional access configuration is removed.
+
+This activity does not contain any detail fields.
+
 ## enabled_conditional_access_automations
 
 Generated when conditional access automations are enabled for a team.
diff --git a/ee/server/service/teams.go b/ee/server/service/teams.go
@@ -283,6 +283,7 @@ func (svc *Service) ModifyTeam(ctx context.Context, teamID uint, payload fleet.T
 		if payload.Integrations.ConditionalAccessEnabled.Set {
 			if err := fleet.ValidateConditionalAccessIntegration(ctx,
 				svc,
+				appCfg.ConditionalAccess,
 				team.Config.Integrations.ConditionalAccessEnabled.Value,
 				payload.Integrations.ConditionalAccessEnabled.Value,
 			); err != nil {
@@ -1160,6 +1161,7 @@ func (svc *Service) createTeamFromSpec(
 	if spec.Integrations.ConditionalAccessEnabled != nil {
 		if err := fleet.ValidateConditionalAccessIntegration(ctx,
 			svc,
+			appCfg.ConditionalAccess,
 			false,
 			*spec.Integrations.ConditionalAccessEnabled,
 		); err != nil {
@@ -1476,6 +1478,7 @@ func (svc *Service) editTeamFromSpec(
 	if spec.Integrations.ConditionalAccessEnabled != nil {
 		if err := fleet.ValidateConditionalAccessIntegration(ctx,
 			svc,
+			appCfg.ConditionalAccess,
 			team.Config.Integrations.ConditionalAccessEnabled.Value,
 			*spec.Integrations.ConditionalAccessEnabled,
 		); err != nil {
diff --git a/frontend/interfaces/activity.ts b/frontend/interfaces/activity.ts
@@ -130,6 +130,8 @@ export enum ActivityType {
   DisabledAndroidMdm = "disabled_android_mdm",
   ConfiguredMSEntraConditionalAccess = "added_conditional_access_integration_microsoft",
   DeletedMSEntraConditionalAccess = "deleted_conditional_access_integration_microsoft",
+  AddedConditionalAccessOkta = "added_conditional_access_okta",
+  DeletedConditionalAccessOkta = "deleted_conditional_access_okta",
   // enable/disable above feature for a team
   EnabledConditionalAccessAutomations = "enabled_conditional_access_automations",
   DisabledConditionalAccessAutomations = "disabled_conditional_access_automations",
diff --git a/frontend/pages/DashboardPage/cards/ActivityFeed/GlobalActivityItem/GlobalActivityItem.tsx b/frontend/pages/DashboardPage/cards/ActivityFeed/GlobalActivityItem/GlobalActivityItem.tsx
@@ -1291,6 +1291,10 @@ const TAGGED_TEMPLATES = {
   deletedMSEntraConditionalAccess: () => (
     <> deleted Microsoft Entra conditional access configuration.</>
   ),
+  addedConditionalAccessOkta: () => <> configured Okta conditional access.</>,
+  deletedConditionalAccessOkta: () => (
+    <> deleted Okta conditional access configuration.</>
+  ),
   enabledConditionalAccessAutomations: (activity: IActivity) => {
     const teamName = activity.details?.team_name;
     return (
@@ -1869,6 +1873,12 @@ const getDetail = (activity: IActivity, isPremiumTier: boolean) => {
     case ActivityType.DeletedMSEntraConditionalAccess: {
       return TAGGED_TEMPLATES.deletedMSEntraConditionalAccess();
     }
+    case ActivityType.AddedConditionalAccessOkta: {
+      return TAGGED_TEMPLATES.addedConditionalAccessOkta();
+    }
+    case ActivityType.DeletedConditionalAccessOkta: {
+      return TAGGED_TEMPLATES.deletedConditionalAccessOkta();
+    }
     case ActivityType.EnabledConditionalAccessAutomations: {
       return TAGGED_TEMPLATES.enabledConditionalAccessAutomations(activity);
     }
diff --git a/server/fleet/activities.go b/server/fleet/activities.go
@@ -224,6 +224,8 @@ var ActivityDetailsList = []ActivityDetails{
 
 	ActivityTypeAddedConditionalAccessIntegrationMicrosoft{},
 	ActivityTypeDeletedConditionalAccessIntegrationMicrosoft{},
+	ActivityTypeAddedConditionalAccessOkta{},
+	ActivityTypeDeletedConditionalAccessOkta{},
 	ActivityTypeEnabledConditionalAccessAutomations{},
 	ActivityTypeDisabledConditionalAccessAutomations{},
 
@@ -2823,6 +2825,28 @@ func (a ActivityTypeDeletedConditionalAccessIntegrationMicrosoft) Documentation(
 		"This activity does not contain any detail fields.", ""
 }
 
+type ActivityTypeAddedConditionalAccessOkta struct{}
+
+func (a ActivityTypeAddedConditionalAccessOkta) ActivityName() string {
+	return "added_conditional_access_okta"
+}
+
+func (a ActivityTypeAddedConditionalAccessOkta) Documentation() (string, string, string) {
+	return "Generated when Okta is configured or edited for conditional access.",
+		"This activity does not contain any detail fields.", ""
+}
+
+type ActivityTypeDeletedConditionalAccessOkta struct{}
+
+func (a ActivityTypeDeletedConditionalAccessOkta) ActivityName() string {
+	return "deleted_conditional_access_okta"
+}
+
+func (a ActivityTypeDeletedConditionalAccessOkta) Documentation() (string, string, string) {
+	return "Generated when Okta conditional access configuration is removed.",
+		"This activity does not contain any detail fields.", ""
+}
+
 type ActivityTypeEnabledConditionalAccessAutomations struct {
 	TeamID   *uint  `json:"team_id"`
 	TeamName string `json:"team_name"`
diff --git a/server/fleet/app.go b/server/fleet/app.go
@@ -85,12 +85,32 @@ type SSOSettings struct {
 }
 
 // ConditionalAccessSettings holds the global settings for the "Conditional access" feature.
+// This struct is used in API responses, combining Microsoft Entra (from database) and Okta (from AppConfig).
 type ConditionalAccessSettings struct {
 	// MicrosoftEntraTenantID is the Entra's tenant ID.
 	MicrosoftEntraTenantID string `json:"microsoft_entra_tenant_id"`
 	// MicrosoftEntraConnectionConfigured is true when the tenant has been configured
 	// for "Conditional access" on Entra and Fleet.
 	MicrosoftEntraConnectionConfigured bool `json:"microsoft_entra_connection_configured"`
+
+	// Okta conditional access settings - using optjson for partial updates
+	// All four fields must be set together or all must be empty.
+	OktaIDPID                       optjson.String `json:"okta_idp_id"`
+	OktaAssertionConsumerServiceURL optjson.String `json:"okta_assertion_consumer_service_url"`
+	OktaAudienceURI                 optjson.String `json:"okta_audience_uri"`
+	OktaCertificate                 optjson.String `json:"okta_certificate"`
+}
+
+// OktaConfigured returns true if all Okta conditional access fields are configured.
+// All four fields must be set together for Okta conditional access to be considered configured.
+func (c *ConditionalAccessSettings) OktaConfigured() bool {
+	if c == nil {
+		return false
+	}
+	return c.OktaIDPID.Valid && c.OktaIDPID.Value != "" &&
+		c.OktaAssertionConsumerServiceURL.Valid && c.OktaAssertionConsumerServiceURL.Value != "" &&
+		c.OktaAudienceURI.Valid && c.OktaAudienceURI.Value != "" &&
+		c.OktaCertificate.Valid && c.OktaCertificate.Value != ""
 }
 
 // SMTPSettings is part of the AppConfig which defines the wire representation
@@ -596,6 +616,10 @@ type AppConfig struct {
 
 	YaraRules []YaraRule `json:"yara_rules,omitempty"`
 
+	// ConditionalAccess holds the Okta conditional access settings that are stored in AppConfig.
+	// Note: In API responses, this is combined with Microsoft Entra settings from the database.
+	ConditionalAccess *ConditionalAccessSettings `json:"conditional_access,omitempty"`
+
 	// when true, strictDecoding causes the UnmarshalJSON method to return an
 	// error if there are unknown fields in the raw JSON.
 	strictDecoding bool
@@ -789,6 +813,12 @@ func (c *AppConfig) Copy() *AppConfig {
 		clone.YaraRules = rules
 	}
 
+	// ConditionalAccess: deep copy the pointer to avoid shared state
+	if c.ConditionalAccess != nil {
+		conditionalAccess := *c.ConditionalAccess
+		clone.ConditionalAccess = &conditionalAccess
+	}
+
 	return &clone
 }
 
diff --git a/server/fleet/integrations.go b/server/fleet/integrations.go
@@ -403,37 +403,37 @@ type Integrations struct {
 }
 
 // ValidateConditionalAccessIntegration validates "Conditional access" can be enabled on a team/"No team".
-// It checks the global setup of the feature has been made.
+// It checks the global setup of the feature has been made (either Microsoft Entra or Okta).
 func ValidateConditionalAccessIntegration(
 	ctx context.Context,
 	g interface {
 		ConditionalAccessMicrosoftGet(context.Context) (*ConditionalAccessMicrosoftIntegration, error)
 	},
+	conditionalAccessSettings *ConditionalAccessSettings,
 	currentConditionalAccessEnabled bool,
 	newConditionalAccessEnabled bool,
 ) error {
 	switch {
 	case currentConditionalAccessEnabled == newConditionalAccessEnabled:
-		// No change, mothing to do.
+		// No change, nothing to do.
 	case currentConditionalAccessEnabled && !newConditionalAccessEnabled:
 		// Disabling feature on team/no-team, nothing to do.
 	case !currentConditionalAccessEnabled && newConditionalAccessEnabled:
 		// Enabling feature on team/no-team.
-		var settings *ConditionalAccessSettings
+		// Check that at least one integration is configured (Microsoft Entra or Okta)
 		conditionalAccessIntegration, err := g.ConditionalAccessMicrosoftGet(ctx)
 		if err != nil {
 			return fmt.Errorf("load conditional access microsoft: %w", err)
 		}
-		if conditionalAccessIntegration != nil {
-			settings = &ConditionalAccessSettings{
-				MicrosoftEntraTenantID:             conditionalAccessIntegration.TenantID,
-				MicrosoftEntraConnectionConfigured: conditionalAccessIntegration.SetupDone,
-			}
-		}
-		if settings == nil || !settings.MicrosoftEntraConnectionConfigured {
+		entraConfigured := conditionalAccessIntegration != nil && conditionalAccessIntegration.SetupDone
+
+		// Check Okta configuration from ConditionalAccessSettings
+		oktaConfigured := conditionalAccessSettings.OktaConfigured()
+
+		if !entraConfigured && !oktaConfigured {
 			return NewInvalidArgumentError(
 				"integrations.conditional_access_enabled",
-				"Couldn't enable because the integration isn't configured",
+				"Couldn't enable because no conditional access integration is configured",
 			)
 		}
 	}
diff --git a/server/service/appconfig.go b/server/service/appconfig.go
diff --git a/server/service/integration_core_test.go b/server/service/integration_core_test.go
diff --git a/server/service/integration_enterprise_test.go b/server/service/integration_enterprise_test.go
diff --git a/tools/cloner-check/generated_files/appconfig.txt b/tools/cloner-check/generated_files/appconfig.txt
