ak-sysd: read managed preferences via CFPreferences, not defaults(1) - #1361
Merged
Conversation
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #1361 +/- ##
==========================================
- Coverage 42.84% 42.84% -0.01%
==========================================
Files 161 161
Lines 14706 14715 +9
Branches 9721 9730 +9
==========================================
+ Hits 6301 6304 +3
- Misses 8270 8277 +7
+ Partials 135 134 -1 Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. |
Contributor
|
🚀 Deployed on https://pr-1361--authentik-pkg.netlify.app |
PeshekDotDev
force-pushed
the
fix/sysd-managed-prefs
branch
from
August 12, 2026 06:10
703950d to
a8f817c
Compare
BeryJu
approved these changes
Aug 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Details
What does this PR change?
load_managed_configon macOS no longer shells out todefaults read io.goauthentik.platform. It callsCFPreferencesCopyAppValue, gated onCFPreferencesAppValueIsForced.Why is this change needed?
defaults read <app-id>does not resolve the MDM-managed preferences layer. On a host with the profile installed:So
load_managed_configreturnedNoneandload_managedbailed on its first line — MDM-driven enrollment has been a silent no-op on macOS since the migration to Rust. There is no error; the machine simply never enrolls.The existing comment anticipated this:
It turns out to matter.
CFPreferencesCopyAppValueconsults the managed layer;defaults readby app-id does not.The
IsForcedguard is deliberate.CopyAppValuereturns the effective value, which can come from ordinary user defaults. This value decides which authentik instance a root daemon enrolls against, so only MDM-delivered values are accepted.core-foundationwas already vendored viaak-platform-keyring, andcore-foundation-sysalready ships both bindings, so no hand-written FFI is needed.How was this tested?
cargo check -p ak-sysd. Both functions were exercised against the live managed profile on a macOS 26.6 host viactypes, asconnorand asroot:Both resolve, and both report as forced — where
defaults readreports the domain does not exist.Ordering note
This should land after #1359. Once managed enrollment starts working again, machines that also have a user-enrolled domain will have two, and #1359 is what makes the choice between them deterministic (managed wins) and cleans up stale managed domains. Merging this first would turn a silent no-op into a nondeterministic choice of authentik instance.
Linked issues
One of several macOS regressions found alongside the Rust migration (#1262), with #1358, #1359 and #1360.
Checklist
make all)make docs)