Use generated UUID for mdm_idp_account table on Linux and Windows

[lucasmrod]

Resolves #47626.

• Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.

Testing

• Added/updated automated tests
• QA'd all new/changed functionality manually

Summary by CodeRabbit

• Bug Fixes
  • Fixed Fleet re-enrollment on Linux for end-user authentication SSO when the re-enrollment email differs from the original enrollment email.
  • Re-enrollment now remaps the device to the correct SSO account, with no SSO callback/login errors, and does not reuse the prior account UUID.
• Tests
  • Added a regression test covering re-enrollment with the same device host UUID but a different IdP user/email, validating email updates and account UUID change.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 5e908491-0d6c-4881-9000-0aa0053fe7b4

📥 Commits

Reviewing files that changed from the base of the PR and between 4a5f82b and a8886bf.

📒 Files selected for processing (1)

• server/service/integration_mdm_test.go

🚧 Files skipped from review as they are similar to previous changes (1)

• server/service/integration_mdm_test.go

---

Walkthrough

MDM SSO account insertion no longer assigns the account UUID from the host UUID. A Setup Experience login helper was added for integration tests. New regression coverage configures MDM SSO, performs an initial enrollment, re-enrolls with the same host UUID and a different IdP email, and verifies successful redirects plus updated account identity data. A changelog note documents the re-enrollment fix.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main change: generating UUIDs for mdm_idp_account instead of reusing the host UUID.
Description check	✅ Passed	The description includes the required issue reference, changes file, testing, and manual QA checklist items, so it is mostly complete.
Linked Issues check	✅ Passed	The changes address the re-enrollment failure by decoupling the account UUID from the host UUID and adding regression coverage for the different-email case.
Out of Scope Changes check	✅ Passed	The modified files stay focused on the MDM SSO re-enrollment fix, test support, and changelog, with no unrelated changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 47626-use-generated-uuid-for-mdm_idp_account

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ast-grep (0.44.1)

server/service/integration_mdm_test.go

ast-grep timed out on this file

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@changes/47626-use-generated-uuid-for-mdm_idp_account`:
- Line 1: Correct the changelog sentence by changing “the one use in the first
enrollment” to “the one used in the first enrollment.”

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: a91d50d2-89aa-43e5-81fd-be3cc1667084

📥 Commits

Reviewing files that changed from the base of the PR and between 56782e2 and 84e2528.

📒 Files selected for processing (4)

• changes/47626-use-generated-uuid-for-mdm_idp_account
• ee/server/service/mdm.go
• server/service/integration_mdm_test.go
• server/service/testing_client_test.go

💤 Files with no reviewable changes (1)

• ee/server/service/mdm.go

[Copilot]

Warning

• Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Pull request overview

This PR addresses an MDM end-user authentication (SSO) regression on Linux/Windows “Orbit Setup Experience” re-enrollment by decoupling mdm_idp_accounts.uuid from the device host UUID, preventing primary-key collisions when the same host re-enrolls with a different IdP email.

Changes:

• Stop setting MDMIdPAccount.UUID to HostUUID during the MDM SSO callback handling.
• Add an integration regression test that exercises the setup-experience initiator with a stable host UUID and two different IdP users.
• Add a test helper to drive the setup-experience MDM SSO flow (including host_uuid) in integration tests.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated no comments.

File	Description
ee/server/service/mdm.go	Removes the coupling of IdP account UUID to HostUUID in mdmSSOHandleCallbackAuth, relying on generated UUIDs instead.
server/service/testing_client_test.go	Adds a helper to initiate the setup-experience MDM SSO flow with host_uuid in the request body.
server/service/integration_mdm_test.go	Adds a regression test ensuring re-enrollment with the same host UUID but a different IdP email succeeds and re-points the host→account link.
changes/47626-use-generated-uuid-for-mdm_idp_account	User-visible change note (content excluded by policy; not reviewed).

Files excluded by content exclusion policy (1)

• changes/47626-use-generated-uuid-for-mdm_idp_account

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[lucasmrod]

CI failures seem unrelated (TestIntegrationsMDM/TestMigrateMDMDeviceWebhookErrors)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 67.99%. Comparing base (f4ee5c6) to head (a8886bf).
⚠️ Report is 19 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #49215      +/-   ##
==========================================
+ Coverage   67.95%   67.99%   +0.04%     
==========================================
  Files        3768     3768              
  Lines      239079   239078       -1     
  Branches    12427    12427              
==========================================
+ Hits       162457   162561     +104     
+ Misses      61894    61752     -142     
- Partials    14728    14765      +37     

Flag	Coverage Δ
backend	69.56% <ø> (+0.05%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.