Azure / Azure/azure-linux-extensions

AADLoginForLinux: AAD users aren't in correct linux groups on first login

Open
#1,226 0 comments 1 reaction 0 assignees View on GitHub
Dominant language
Python
Stars
333
Forks
278
Avg merge
2d 9h
Merged PRs (30d)
4

Description

On the first log in of an Active Directory user to a VM with the AAD plugin installed, users are not considered to be in any groups by sshd, despite them being in a group with that user's name. On subsequent logins the groups are correct.

Hence on a system with sshd_config including something like `AllowGroups *`, AAD users will be unable to log in on first attempt despite the configuration permitting them.

The relevant codepath in openssh is https://github.com/openssh/openssh-portable/blob/V_8_0/auth2.c#L287-L302

getpwnamallow decides that the user is not in any groups. The process later hits an internal error in pam-auth and the login fails.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the first-login and subsequent-login behavior for an AAD user, then trace the plugin's group handling alongside the referenced OpenSSH auth2.c codepath and pam-auth failure. Done means an AAD user is recognized as belonging to the expected group on the first login and can log in when sshd_config uses AllowGroups.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, linux
Domain
authentication, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.