Azure / Azure/azure-linux-extensions

AADLoginForLinux pam_aad.so enhancements

Open
#779 2 comments 5 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
333
Forks
278
Avg merge
2d 9h
Merged PRs (30d)
4

Description

Currently the aad pam module works by sending a code to the terminal output:

`To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code XXXXXX to authenticate. Press ENTER when ready.`

The user goes to the web page and enters the device code, and voilà! it works.

This "workflow" , however, does not work if the application using the pam_aad.so (or in this case /etc/pam.d/common-auth routine) does not have valid output to send the code to (e.g. a web service that uses pam for authentication). An alternative mechanism for these kind of cases could be to send the code to the user email (as in https://github.com/CyberNinjas/pam_aad, https://github.com/CyberNinjas/pam_aad/issues/24 ).

This behaviour should be modifiable in the pam modules with e.g. (file /etc/pam.d/common-auth):

sends code to output (original):
`auth [success=2 user_unknown=ignore default=die] pam_aad.so`

sends code to email (modified):
`auth [success=2 user_unknown=ignore default=die email=true] pam_aad.so`
or
`auth [success=2 user_unknown=ignore default=die] pam_aad_email.so`

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.