Azure / Azure/azure-linux-extensions
AADLoginForLinux pam_aad.so enhancements
- Dominant language
- Python
- Stars
- 333
- Forks
- 278
- Avg merge
- 2d 9h
- Merged PRs (30d)
- 4
Description
Currently the aad pam module works by sending a code to the terminal output:
`To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code XXXXXX to authenticate. Press ENTER when ready.`
The user goes to the web page and enters the device code, and voilà! it works.
This "workflow" , however, does not work if the application using the pam_aad.so (or in this case /etc/pam.d/common-auth routine) does not have valid output to send the code to (e.g. a web service that uses pam for authentication). An alternative mechanism for these kind of cases could be to send the code to the user email (as in https://github.com/CyberNinjas/pam_aad, https://github.com/CyberNinjas/pam_aad/issues/24 ).
This behaviour should be modifiable in the pam modules with e.g. (file /etc/pam.d/common-auth):
sends code to output (original):
`auth [success=2 user_unknown=ignore default=die] pam_aad.so`
sends code to email (modified):
`auth [success=2 user_unknown=ignore default=die email=true] pam_aad.so`
or
`auth [success=2 user_unknown=ignore default=die] pam_aad_email.so`
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.