Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[v16] Add auto-enroll troubleshooting to docs #47698

Open
wants to merge 2 commits into
base: branch/v16
Choose a base branch
from
Open

[v16] Add auto-enroll troubleshooting to docs #47698

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2e4f90c
Add auto-enroll troubleshooting to docs
codingllama Oct 17, 2024
7b662ba
Call out auto-enroll audit log version
codingllama Oct 18, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions docs/pages/includes/device-trust/troubleshooting.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,28 @@ for a different solution, we recommend creating udev rules similar to the ones
shipped by the [TPM2 Software Stack](
https://github.com/tpm2-software/tpm2-tss/blob/ede63dd1ac1f0a46029d457304edcac2162bfab8/dist/tpm-udev.rules#L4).

### Auto enrollment not working

Auto-enrollment ceremonies, due to their automated nature, are stricter than
regular enrollment. Additional auto-enrollment checks include:

1. Verifying device profile data, such as data originated from Jamf, against the
actual device
2. Verifying that the device is not enrolled by another user (auto-enroll cannot
take devices that are already enrolled)

Check you audit log for clues: look for failed "Device Enroll Token Created"
events and see the "message" field in the details (auto-enroll audit log details
available since Teleport v16.4.x).
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note to reviewers: marked do-not-merge because auto-enroll audit details are not on v16 yet. I'll update this line once it's out.


If you suspect (1) is the issue, compare the actual device against its inventory
definition (`tsh device collect` executed in the actual device vs `tctl get
device/<asset_tag>`). Tweaking the device profile, manual enrollment or waiting
for the next MDM sync may solve the issue.

If you suspect (2), you can unenroll the device using `tctl edit
device/<asset_tag>` and changing the "enroll_status" field to "not_enrolled".

### App access and "access to this app requires a trusted device"

Follow the instructions in the [Web UI troubleshooting section](
Expand Down
Loading