Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[v14] Add auto-enroll troubleshooting to docs #47700

Merged
merged 2 commits into from
Oct 31, 2024
Merged

[v14] Add auto-enroll troubleshooting to docs #47700

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
326dad4
Add auto-enroll troubleshooting to docs (#47681)
codingllama Oct 18, 2024
c9cb11d
Update version to v14.3.33
codingllama Oct 31, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions docs/pages/includes/device-trust/enroll-troubleshooting.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,3 +10,25 @@ A trusted device needs to be registered and enrolled before it is recognized by
Teleport as such. Follow the [registration](../../admin-guides/access-controls/device-trust/device-management.mdx) and
[enrollment](../../admin-guides/access-controls/device-trust/device-management.mdx) steps
and make sure to `tsh logout` and `tsh login` after enrollment is done.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note that we use a different file in this branch, so copied the block manually.

### Auto enrollment not working

Auto-enrollment ceremonies, due to their automated nature, are stricter than
regular enrollment. Additional auto-enrollment checks include:

1. Verifying device profile data, such as data originated from Jamf, against the
actual device
2. Verifying that the device is not enrolled by another user (auto-enroll cannot
take devices that are already enrolled)

Check you audit log for clues: look for failed "Device Enroll Token Created"
events and see the "message" field in the details (auto-enroll audit log details
available since Teleport v14.3.33).

If you suspect (1) is the issue, compare the actual device against its inventory
definition (`tsh device collect` executed in the actual device vs `tctl get
device/<asset_tag>`). Tweaking the device profile, manual enrollment or waiting
for the next MDM sync may solve the issue.

If you suspect (2), you can unenroll the device using `tctl edit
device/<asset_tag>` and changing the "enroll_status" field to "not_enrolled".
Loading