Apple Business Manager connection is broken/uneditable after ABM user is deleted

[pacamaster]

Fleet version: <!-- Copy this from the "My account" page in the Fleet UI, or run fleetctl --version --> Fleet 4.52.0 Web browser and operating system: Current Browser and OS

---

💥  Actual behavior

🧑‍💻  Steps to reproduce

1. Setup ABM on Fleet UI
2. Revoke Apple ID that downloaded the token from the business manager
3. go back to Fleet UI and try to edit ABM

🕯️ More info (optional)

Related Log error

{"component":"nanodep-syncer","cron":"apple_mdm_dep_profile_assigner","cursor":"MTAwMDowOjE3MTk0MDkzNTUxMREDACTED","err":"Post \"https://mdmenrollment.apple.com/server/devices\": DEP auth error: 403 Forbidden: FORBIDDEN","level":"info","msg":"error syncing","name":"fleet","phase":"fetch","ts":"2024-06-28T16:13:11.002633489Z"}

{
  "message": "Bad request",
  "errors": [
    {
      "name": "base",
      "reason": "Get \"https://mdmenrollment.apple.com/account\": DEP auth error: 403 Forbidden: FORBIDDEN"
    }
  ],
  "uuid": "b52e50af-c339-REDACTED"
}

[noahtalerman]

George: Wrong token (token/key mismatch). This will happen for MSP users.

• Noah: We thought there was validation for this one. Don't we talk to Apple? George: It looks we don't talk to Apple.

George: Delete the ABM user that created the token. This happened to the customer.

Copy: Invalid token. Please renew your token.

George: We're showing the banner when we get a 400.

[noahtalerman]

Hey @gillespi314! I'm working on some wireframes to update the UI/error message.

UPDATE: Here's the Figma: https://www.figma.com/design/HcEkSUyyqAtUuJ0lbKohOF/%F0%9F%AA%B2-%2320090-Apple-Business-Manager-connection-is-broken%2Funeditable-after-ABM-user-is-deleted?node-id=2-130&t=7bQUlB2o52APs0sa-1

[noahtalerman]

Hey @gillespi314 heads up, I moved this bug to the release board and assigned you (I forgot to on Friday).

I moved the bug to the awaiting QA column because it looks like your PR was merged.

cc @georgekarrv @PezHub

[JoStableford]

Related to a Slack conversation

[PezHub]

Went thru a couple different scenarios (as did the rest of the mdm team) to repro the broken state and was able to successfully renew after the fix was in place. Made sure to click the disable automatic enrollment button as well and can confirm it functions as expected.

Banner and copy updates look good too. (note: the laptop pic for "something went wrong" doesn't display in our dev env)

Note: If the customer no longer has a copy of the public-key.cert they will need to go thru the disable workflow. But at least now the UI will present them with options.

[fleet-release]

Broken link no more, Fleet mends the Apple tie, Cloud city restored.