Azure / Azure/azure-linux-extensions
AADLoginForLinux: AAD users aren't in correct linux groups on first login
- Dominant language
- Python
- Stars
- 333
- Forks
- 278
- Avg merge
- 2d 9h
- Merged PRs (30d)
- 4
Description
On the first log in of an Active Directory user to a VM with the AAD plugin installed, users are not considered to be in any groups by sshd, despite them being in a group with that user's name. On subsequent logins the groups are correct.
Hence on a system with sshd_config including something like `AllowGroups *`, AAD users will be unable to log in on first attempt despite the configuration permitting them.
The relevant codepath in openssh is https://github.com/openssh/openssh-portable/blob/V_8_0/auth2.c#L287-L302
getpwnamallow decides that the user is not in any groups. The process later hits an internal error in pam-auth and the login fails.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the first-login and subsequent-login behavior for an AAD user, then trace the plugin's group handling alongside the referenced OpenSSH auth2.c codepath and pam-auth failure. Done means an AAD user is recognized as belonging to the expected group on the first login and can log in when sshd_config uses AllowGroups.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, linux
- Domain
- authentication, operating-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100