fleetdm
diff --git a/‎.github/workflows/fleet-desktop-macos-build.yml‎
Lines changed: 75 additions & 13 deletions b/‎.github/workflows/fleet-desktop-macos-build.yml‎
Lines changed: 75 additions & 13 deletions
diff --git a/‎apps/fleet-desktop-macos/FleetDesktop/FleetDesktop.entitlements‎
Lines changed: 14 additions & 0 deletions b/‎apps/fleet-desktop-macos/FleetDesktop/FleetDesktop.entitlements‎
Lines changed: 14 additions & 0 deletions
diff --git a/‎apps/fleet-desktop-macos/FleetPSSOExtension/AuthenticationViewController+Networking.swift‎
Lines changed: 126 additions & 0 deletions b/‎apps/fleet-desktop-macos/FleetPSSOExtension/AuthenticationViewController+Networking.swift‎
Lines changed: 126 additions & 0 deletions
diff --git a/‎apps/fleet-desktop-macos/FleetPSSOExtension/AuthenticationViewController+PSSO.swift‎
Lines changed: 100 additions & 0 deletions b/‎apps/fleet-desktop-macos/FleetPSSOExtension/AuthenticationViewController+PSSO.swift‎
Lines changed: 100 additions & 0 deletions
@@ -1,8 +1,20 @@
 name: Build Fleet Desktop (macOS)
 
-# Builds the native macOS Fleet Desktop app (apps/fleet-desktop-macos/), code signs
-# and notarizes it with Fleet's Developer ID certificates, and uploads the signed
+# Builds the native macOS Fleet Desktop app (apps/fleet-desktop-macos/) and its
+# embedded Platform SSO extension (FleetPSSOExtension.appex), code signs and
+# notarizes them with Fleet's Developer ID certificates, and uploads the signed
 # .pkg as a workflow artifact. No GitHub Release is created.
+#
+# The app and extension carry managed Associated Domains entitlements
+# (com.apple.developer.associated-domains{,.mdm-managed}). Those are restricted
+# entitlements: codesign only honors them when a Developer ID provisioning
+# profile that grants them is embedded in the bundle. The profiles are provided
+# as base64 repo secrets (never committed) and embedded at sign time — see the
+# README's "Signing secrets" section.
+#
+# This workflow always signs and notarizes. If the certs or provisioning
+# profiles are unavailable (e.g. a fork PR that can't read secrets), it fails
+# loudly rather than producing an unsigned artifact.
 
 on:
   push:
@@ -36,6 +48,8 @@ env:
   # of Fleet's macOS artifacts (orbit Fleet Desktop, fleetd-base.pkg).
   APPLICATION_SIGNING_IDENTITY_SHA1: 604D877399AAEB7630A78B84F288E2D28A2EDE42
   INSTALLER_SIGNING_IDENTITY_SHA1: 4608F71FB42E1845C7FC9B2D2B6A7A8D11BBD940
+  # Embedded SSO extension bundle (relative to Fleet Desktop.app/Contents).
+  APPEX_REL_PATH: PlugIns/FleetPSSOExtension.appex
 
 jobs:
   build:
@@ -52,7 +66,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Build app and create pkg
+      - name: Build app (with embedded extension) and create pkg
         run: |
           chmod +x build.sh build-pkg.sh
           ./build-pkg.sh
@@ -69,7 +83,7 @@ jobs:
           security default-keychain -s build.keychain
           security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
 
-          # Developer ID Application certificate — signs the .app (codesign).
+          # Developer ID Application certificate — signs the .app/.appex (codesign).
           echo "$APPLE_APPLICATION_CERTIFICATE" | base64 --decode > application.p12
           security import application.p12 -k build.keychain -P "$APPLE_APPLICATION_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
           rm application.p12
@@ -82,24 +96,71 @@ jobs:
           security set-key-partition-list -S apple-tool:,apple:,codesign:,productsign: -s -k "$KEYCHAIN_PASSWORD" build.keychain
           security find-identity -vv
 
-      - name: Code sign app
+      - name: Embed provisioning profiles
+        env:
+          APPLE_FLEET_DESKTOP_APP_PROFILE_B64: ${{ secrets.APPLE_FLEET_DESKTOP_APP_PROFILE_B64 }}
+          APPLE_PSSO_EXT_PROFILE_B64: ${{ secrets.APPLE_PSSO_EXT_PROFILE_B64 }}
+        run: |
+          APP="build/Fleet Desktop.app"
+          APPEX="$APP/Contents/$APPEX_REL_PATH"
+
+          if [ -z "$APPLE_FLEET_DESKTOP_APP_PROFILE_B64" ] || [ -z "$APPLE_PSSO_EXT_PROFILE_B64" ]; then
+            echo "::error::Missing provisioning profile secrets (APPLE_FLEET_DESKTOP_APP_PROFILE_B64 / APPLE_PSSO_EXT_PROFILE_B64). The app and extension carry restricted Associated Domains entitlements that codesign cannot honor without them."
+            exit 1
+          fi
+
+          # Developer ID profiles authorizing the restricted entitlements.
+          echo "$APPLE_PSSO_EXT_PROFILE_B64" | base64 --decode > "$APPEX/Contents/embedded.provisionprofile"
+          echo "$APPLE_FLEET_DESKTOP_APP_PROFILE_B64" | base64 --decode > "$APP/Contents/embedded.provisionprofile"
+
+      - name: Verify profiles authorize the signing certificate
+        run: |
+          APP="build/Fleet Desktop.app"
+          APPEX="$APP/Contents/$APPEX_REL_PATH"
+
+          # AMFI requires the signing certificate to be listed in the embedded
+          # profile's DeveloperCertificates, or it SIGKILLs the app at launch.
+          # codesign, Gatekeeper, and notarization all pass regardless — so
+          # without this check a profile cut against the wrong cert produces a
+          # signed, notarized pkg that silently won't launch. Even two certs from
+          # the same team will result in a broken, unusable app - they must be the
+          # same cert
+          check='import sys,plistlib,hashlib; pl=plistlib.loads(sys.stdin.buffer.read()); h=[hashlib.sha1(bytes(c)).hexdigest().upper() for c in pl.get("DeveloperCertificates",[])]; print("  authorizes:",h); sys.exit(0 if sys.argv[1].upper() in h else 1)'
+          for prof in "$APPEX/Contents/embedded.provisionprofile" "$APP/Contents/embedded.provisionprofile"; do
+            echo "Checking $prof"
+            if ! security cms -D -i "$prof" | python3 -c "$check" "$APPLICATION_SIGNING_IDENTITY_SHA1"; then
+              echo "::error::$prof does not authorize signing certificate $APPLICATION_SIGNING_IDENTITY_SHA1. AMFI will SIGKILL the app at launch (notarization does NOT catch this). Regenerate the Developer ID provisioning profile selecting that certificate."
+              exit 1
+            fi
+          done
+
+      - name: Code sign app and extension
         run: |
-          BINARY_PATH="build/Fleet Desktop.app/Contents/MacOS/FleetDesktop"
+          APP="build/Fleet Desktop.app"
+          APPEX="$APP/Contents/$APPEX_REL_PATH"
 
-          # Sign the universal binary first, then the bundle (no --deep).
+          # Sign inside-out: the embedded extension first, then the host app.
+          # Each bundle is sealed with its own entitlements + embedded profile.
+          codesign --force --sign "$APPLICATION_SIGNING_IDENTITY_SHA1" \
+            --options runtime --timestamp "$APPEX/Contents/MacOS/FleetPSSOExtension"
           codesign --force --sign "$APPLICATION_SIGNING_IDENTITY_SHA1" \
-            --options runtime --timestamp "$BINARY_PATH"
-          codesign --verify --verbose "$BINARY_PATH"
+            --options runtime --timestamp \
+            --entitlements FleetPSSOExtension/FleetPSSOExtension.entitlements "$APPEX"
 
           codesign --force --sign "$APPLICATION_SIGNING_IDENTITY_SHA1" \
-            --options runtime --timestamp "build/Fleet Desktop.app"
+            --options runtime --timestamp "$APP/Contents/MacOS/FleetDesktop"
+          codesign --force --sign "$APPLICATION_SIGNING_IDENTITY_SHA1" \
+            --options runtime --timestamp \
+            --entitlements FleetDesktop/FleetDesktop.entitlements "$APP"
 
-          codesign --verify --deep --strict --verbose=2 "build/Fleet Desktop.app"
-          codesign --display --verbose=4 "build/Fleet Desktop.app"
+          codesign --verify --deep --strict --verbose=2 "$APP"
+          codesign --display --verbose=4 "$APP"
+          codesign --display --entitlements - "$APPEX"
 
       - name: Rebuild pkg with signed app
         run: |
-          # build-pkg.sh reuses the already-signed app (ditto preserves the signature).
+          # build-pkg.sh reuses the already-signed app (ditto preserves the
+          # signature and the embedded, signed appex).
           ./build-pkg.sh
 
       - name: Sign pkg
@@ -156,6 +217,7 @@ jobs:
           spctl --assess --type install --verbose "$PKG_PATH"
 
       - name: Cleanup keychain
+        if: always()
         run: security delete-keychain build.keychain || true
 
       - name: Upload pkg artifact
 
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.application-identifier</key>
+    <string>8VBZ3948LU.com.fleetdm.fleet-desktop</string>
+    <key>com.apple.developer.team-identifier</key>
+    <string>8VBZ3948LU</string>
+    <key>com.apple.developer.associated-domains</key>
+    <array/>
+    <key>com.apple.developer.associated-domains.mdm-managed</key>
+    <true/>
+</dict>
+</plist>
@@ -0,0 +1,126 @@
+// AuthenticationViewController+Networking.swift
+// FleetPSSOExtension
+//
+// Direct URLSession networking against the Fleet server. Device registration
+// must POST directly (no web view): Password-mode registration has no browser
+// auth step, and the prior(to macOS 26) pattern of using a WKWebView isn't
+// functional during Setup Assistant (EnableRegistrationDuringSetup) — this was
+// found to silently skip registration, so the later token request presents an
+// unregistered key.
+//
+// TODO: If we ever want to add support for a browser-based registration flow(e.g.
+// in lieu of, or when the registration token is bad) we may need to figure out how
+// to support a web view
+
+import Foundation
+import Security
+
+extension AuthenticationViewController {
+
+    // loginRequestEncryptionKey fetches Fleet's JWKS and returns the public key
+    // marked use:"enc" as a SecKey, or nil if the request fails or no such key
+    // is published. macOS uses it to encrypt the password into the login
+    // assertion. Fleet always publishes an encryption key, so the caller treats
+    // nil as fatal rather than proceeding with password encryption disabled.
+    func loginRequestEncryptionKey(jwksURL: URL) async -> SecKey? {
+        guard let (data, resp) = try? await URLSession.shared.data(from: jwksURL),
+              let http = resp as? HTTPURLResponse,
+              (200...299).contains(http.statusCode),
+              let jwks = try? JSONDecoder().decode(JWKSet.self, from: data)
+        else { return nil }
+
+        for jwk in jwks.keys where jwk.use == "enc" {
+            if let key = jwk.ecPublicSecKey() {
+                return key
+            }
+        }
+        return nil
+    }
+
+    // postDeviceRegistration POSTs the registration payload to Fleet and
+    // returns true on a 2xx response.
+    func postDeviceRegistration(payload: [String: String]) async -> Bool {
+        guard let endpoint = registrationEndpointURL else { return false }
+        var req = URLRequest(url: endpoint)
+        req.httpMethod = "POST"
+        req.setValue("application/x-www-form-urlencoded",
+                     forHTTPHeaderField: "Content-Type")
+        let items = payload.map { URLQueryItem(name: $0.key, value: $0.value) }
+        req.httpBody = formURLEncodedBody(items)
+        guard let (_, resp) = try? await URLSession.shared.data(for: req),
+              let http = resp as? HTTPURLResponse else {
+            return false
+        }
+        return (200...299).contains(http.statusCode)
+    }
+
+    // formURLEncodedBody serializes query items as an x-www-form-urlencoded
+    // body, percent-encoding everything outside the RFC 3986 unreserved set so
+    // '+', '/', '=', spaces and newlines in PEM values survive intact.
+    private func formURLEncodedBody(_ items: [URLQueryItem]) -> Data {
+        var allowed = CharacterSet.alphanumerics
+        allowed.insert(charactersIn: "-._~")
+        let pairs = items.map { item -> String in
+            let name = item.name.addingPercentEncoding(withAllowedCharacters: allowed) ?? item.name
+            let value = (item.value ?? "").addingPercentEncoding(withAllowedCharacters: allowed) ?? ""
+            return "\(name)=\(value)"
+        }
+        return Data(pairs.joined(separator: "&").utf8)
+    }
+}
+
+// JWKSet / JWK model just enough of RFC 7517 to pull an EC public key out of
+// Fleet's PSSO JWKS.
+private struct JWKSet: Decodable {
+    let keys: [JWK]
+}
+
+private struct JWK: Decodable {
+    let kty: String
+    let crv: String?
+    let x: String?
+    let y: String?
+    let use: String?
+
+    // ecPublicSecKey rebuilds the ANSI X9.63 uncompressed point (0x04 || X || Y)
+    // from the JWK coordinates and imports it as a P-256 public SecKey — the form
+    // loginRequestEncryptionPublicKey expects.
+    func ecPublicSecKey() -> SecKey? {
+        guard kty == "EC", crv == "P-256",
+              let xStr = x, let yStr = y,
+              let xData = Data(base64URLEncoded: xStr),
+              let yData = Data(base64URLEncoded: yStr),
+              xData.count == 32, yData.count == 32
+        else { return nil }
+        var raw = Data([0x04])
+        raw.append(xData)
+        raw.append(yData)
+        let attrs: [String: Any] = [
+            kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,
+            kSecAttrKeyClass as String: kSecAttrKeyClassPublic,
+        ]
+        return SecKeyCreateWithData(raw as CFData, attrs as CFDictionary, nil)
+    }
+}
+
+extension Data {
+    func base64URLEncodedString() -> String {
+        base64EncodedString()
+            .replacingOccurrences(of: "+", with: "-")
+            .replacingOccurrences(of: "/", with: "_")
+            .replacingOccurrences(of: "=", with: "")
+    }
+
+    // base64URLEncoded decodes the base64url (RFC 4648 §5) coordinates in a JWK,
+    // re-padding to a multiple of 4 for Foundation's base64 decoder.
+    init?(base64URLEncoded input: String) {
+        var s = input
+            .replacingOccurrences(of: "-", with: "+")
+            .replacingOccurrences(of: "_", with: "/")
+        let remainder = s.count % 4
+        if remainder > 0 {
+            s.append(String(repeating: "=", count: 4 - remainder))
+        }
+        self.init(base64Encoded: s)
+    }
+}
@@ -0,0 +1,100 @@
+// AuthenticationViewController+PSSO.swift
+// FleetPSSOExtension
+//
+// ASAuthorizationProviderExtensionRegistrationHandler conformance. The
+// framework hands us a login manager; we ask it for the shared device
+// signing + encryption keys, build a registration payload, and configure
+// the SSO endpoints from extensionData supplied by the configuration
+// profile. Apple owns the private key material — we only see SecKey
+// handles and derive public PEMs from them.
+
+import AuthenticationServices
+import CryptoKit
+import Foundation
+import IOKit
+import Security
+
+@available(macOS 14.0, *)
+extension AuthenticationViewController:
+    ASAuthorizationProviderExtensionRegistrationHandler {
+
+    func beginDeviceRegistration(
+        loginManager: ASAuthorizationProviderExtensionLoginManager,
+        options: ASAuthorizationProviderExtensionRequestOptions,
+        completion: @escaping (ASAuthorizationProviderExtensionRegistrationResult) -> Void
+    ) {
+        self.loginManager = loginManager
+        guard let signKey = loginManager.key(for: .sharedDeviceSigning),
+              let encKey = loginManager.key(for: .sharedDeviceEncryption) else {
+            completion(.failed)
+            return
+        }
+        guard let registrationToken = loginManager.registrationToken, !registrationToken.isEmpty else {
+            completion(.failed)
+            return
+        }
+        // applyLoginConfiguration fetches the server's encryption key over HTTP,
+        // so it runs on the Task alongside the registration POST. Report success
+        // only once Fleet has stored the keys, so the framework can't proceed to
+        // authentication with an unregistered key (which 404s at the token
+        // endpoint). This is what makes the Setup Assistant flow work.
+        Task {
+            do {
+                try await self.applyLoginConfiguration(loginManager)
+            } catch {
+                completion(.failed)
+                return
+            }
+            let payload = self.registrationPayload(
+                signing: signKey,
+                encryption: encKey,
+                registrationToken: registrationToken)
+            // A failed key export leaves empty PEM/KID fields (see keyID /
+            // pemRepresentation). Refuse to register an incomplete payload
+            // instead of POSTing keys the server can only reject.
+            let requiredFields = ["device_signing_key", "device_encryption_key",
+                                  "signing_key_id", "encryption_key_id"]
+            guard requiredFields.allSatisfy({ !(payload[$0] ?? "").isEmpty }) else {
+                completion(.failed)
+                return
+            }
+            let ok = await self.postDeviceRegistration(payload: payload)
+            completion(ok ? .success : .failed)
+        }
+    }
+
+    func beginUserRegistration(
+        loginManager: ASAuthorizationProviderExtensionLoginManager,
+        userName: String?,
+        method: ASAuthorizationProviderExtensionAuthenticationMethod,
+        options: ASAuthorizationProviderExtensionRequestOptions,
+        completion: @escaping (ASAuthorizationProviderExtensionRegistrationResult) -> Void
+    ) {
+        // Persist the user login configuration. Without this the framework
+        // reports "no user configuration for user" and never finishes binding
+        // the PSSO user to the local account, so the unlock-key/SecureToken
+        // setup stays incomplete and key unwrap fails at login ("previous
+        // password required"). For password mode saving the config is all the
+        // extension needs to do.
+        guard let userName, !userName.isEmpty else {
+            completion(.failed)
+            return
+        }
+        let config = ASAuthorizationProviderExtensionUserLoginConfiguration(loginUserName: userName)
+        do {
+            try loginManager.saveUserLoginConfiguration(config)
+        } catch {
+            completion(.failed)
+            return
+        }
+        completion(.success)
+    }
+
+    func protocolVersion() -> ASAuthorizationProviderExtensionPlatformSSOProtocolVersion {
+        .version2_0
+    }
+
+    func supportedGrantTypes() -> ASAuthorizationProviderExtensionSupportedGrantTypes {
+        .password
+    }
+}