ak-sysd: make managed-domain selection and lifecycle deterministic - #1359
Open
PeshekDotDev wants to merge 2 commits into
Open
ak-sysd: make managed-domain selection and lifecycle deterministic#1359PeshekDotDev wants to merge 2 commits into
PeshekDotDev wants to merge 2 commits into
Conversation
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #1359 +/- ##
==========================================
+ Coverage 42.84% 42.86% +0.02%
==========================================
Files 161 161
Lines 14706 14719 +13
Branches 9721 9734 +13
==========================================
+ Hits 6301 6310 +9
- Misses 8270 8274 +4
Partials 135 135 Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. |
Contributor
|
🚀 Deployed on https://pr-1359--authentik-pkg.netlify.app |
PeshekDotDev
force-pushed
the
fix/sysd-active-domain-token
branch
from
August 11, 2026 23:51
2cec743 to
b9e7241
Compare
PeshekDotDev
changed the title
2 tasks
PeshekDotDev
force-pushed
the
fix/sysd-active-domain-token
branch
from
August 12, 2026 06:07
b9e7241 to
31c686d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Details
What does this PR change?
Three related changes to how sysd handles domains, all in
cfg/domain.rs:active()skips domains with no token. It previously returned the firstenableddomain regardless of whether it could authenticate.active()prefers an MDM-managed domain when one is usable, falling back to the first usable domain otherwise.load_managed()removes the managed domain when its config is gone, which its doc comment ("Loads (or re-enrolls, or removes)…") already promised but never did.active()also now logs which domain it selected.Why is this change needed?
load_managedadds anak-mdm-manageddomain alongside any user-enrolled ones, so a machine routinely has two.active()took the firstenabledentry inread_dirorder. On a real macOS hostak-mdm-managed.jsonsorts beforemac.json, and its enrollment had produced no token — so every Platform SSO registration authenticated asBearer+agentand came back:while a perfectly good domain sat second in the list. Nothing logged which domain had been chosen, so this presented as "PSSO registration is broken" and took a long time to attribute.
Ordering is also mutable at runtime, not just arbitrary:
save_domaindoesretain(…)thenpush(…), so re-runningdomains joinmoves that domain to the end of the list — re-enrolling a domain makes it less likely to be selected until the next restart.Preferring the managed domain gives a rule that can be stated in a sentence: MDM policy beats a hand-run
domains join. The managed enrollment carries the connector and device group the organisation assigned; a manual join may point elsewhere.The teardown matters because
load_allreloads every*.jsonwhether or not the config that created it still exists. A machine that was managed once keeps a phantom managed domain forever — never refreshed, never revocable by removing the profile, and still competing to be active. Observed on a live host:ak-mdm-managed.jsonpersisted for hours after its managed preferences stopped resolving.How was this tested?
cargo check -p ak-sysd. Verified on macOS 26.6 with both a token-lessak-mdm-managedand a workingmacdomain: before,RegisterDevicereturned 403 "credentials were not provided"; after, sysd selectsmacand the request authenticates.Known limitation
This makes selection deterministic; it does not resolve the underlying split. The storage layer holds N domains and exposes
DomainList/DomainEnroll/DomainUnenroll, but nine call sites (ping,auth/apple,auth/token,auth/interactive,session,directory) each takeactive()and ignore the rest — onlydevicecheck-in andhealthcheck_allfan out. If a machine is deliberately enrolled with two authentik instances, those paths will silently use one of them. Making multi-domain genuinely work means binding a domain to each call site, which is a larger design decision for whoever owns the domain model.Linked issues
One of several macOS regressions found alongside the Rust migration (#1262), with #1358 and #1360.
Checklist
make all)make docs)