canonical / canonical/authd

Issue: Ubuntu 24.04 LTS: Issues with Entra ID (authd) and Intune (intune-portal) Integration Causing Login and Enrollment Problems

Open
#731 27 comments 3 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
308
Forks
41
Avg merge
2d 4h
Merged PRs (30d)
58

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues and found none that matched mine

### Describe the issue

I am using a clean installation of Ubuntu 24.04 LTS and have configured the authd service and Intune Portal following the official documentation for both systems.

The installation and configuration steps I followed are detailed in the script available here:
https://justpaste.it/authd-intune-portal-ubuntu24

This script reflects the exact step-by-step instructions provided in both the authd and Intune Portal documentation, which I adhered to rigorously.

The observed behavior is as follows:

With a local user:
After logging in with a local user on the machine, I can open the Intune Portal application without any issues. The application successfully presents the option to register the device in Intune, and the registration completes without errors.

With an Entra ID user:
When logging in using an authd (Entra ID) authenticated user, I open the Intune Portal and attempt to register the device. Initially, the process appears to work as I am prompted to provide:

Username (Entra ID)
Password
Two-factor authentication code
However, after correctly entering these details, I receive the following error code on the Intune Portal interface: [4u3gb].

Additional Notes:
It is important to highlight that when logging in with a local user, I can authenticate and register the device without any issues.
The problem only occurs when using an Entra ID user.
I have confirmed that my application has all the necessary permissions as described in the documentation.
This issue seems to affect the combined use of authd (Entra ID) and Intune Portal on Ubuntu 24.04, particularly with device registration when using Entra ID users.

Script used: https://justpaste.it/authd-intune-portal-ubuntu24
Article (authd): https://canonical-authd.readthedocs-hosted.com/en/latest/
Article (intune): Microsoft Intune (App Linux): https://learn.microsoft.com/en-us/mem/intune/user-help/microsoft-intune-app-linux

**ATTENTION/NOTE:** I found other people facing the same issue, but no one has managed to solve it yet. This issue is very important to me because I was the one who convinced the company to adopt Linux. Now, with internal policies, we are required to use EntraID with the Intune Portal. I need to solve this quickly to avoid everyone having to migrate to Windows.

### Steps to reproduce

**Steps to Reproduce**:
Perform a clean installation of Ubuntu 24.04 LTS.
Install and configure authd by following the official procedure:
https://canonical-authd.readthedocs-hosted.com/en/latest/
Install the Intune Portal application by following the official guide:
https://learn.microsoft.com/en-us/mem/intune/user-help/microsoft-intune-app-linux
Restart the machine after completing the installations.
Log in to the system using an Entra ID authenticated user (via authd).
Open the Intune Portal application.
Log in to the Intune Portal with the Entra ID user credentials, providing:
Username
Password
Two-factor authentication code
Observe the error that occurs during this process. Specifically, the following error code is displayed on the Intune Portal interface: [4u3gb].

![image](https://github.com/user-attachments/assets/615847ab-7ea9-4ecb-a6de-bd285f9d137d)

### System information and logs

cat authd-system-info-1Jqsbg.md
#### authd version
```
authd 0.3.7
```

#### authd-msentraid broker version
```
name: authd-msentraid
summary: MSEntra ID broker for authd
publisher: Canonical**
store-url: https://snapcraft.io/authd-msentraid
license: GPL-3.0
description: |
This is the MS Entra ID broker snap for authd to provide MS Entra ID OIDC
based authentication on Ubuntu with authd.
services:
authd-msentraid: simple, enabled, active
snap-id: vS3oJLMss6lgWwoFcPqYDUA2HB20I1Dc
tracking: 0.x/stable
refresh-date: today at 12:10 -03
channels:
0.x/stable: 0.1+267a15c.f272cc1 2024-12-10 (89) 18MB -
0.x/candidate: ^
0.x/beta: ^
0.x/edge: 0.2.0-pre1+f8f25eb.77053b4 2025-01-15 (117) 19MB -
installed: 0.1+267a15c.f272cc1 (89) 18MB -
```

#### gnome-shell version
```
gnome-shell:
Instalado: 46.3.1-1ubuntu1~24.04.1authd2
Candidato: 46.3.1-1ubuntu1~24.04.1authd2
Tabela de versão:
*** 46.3.1-1ubuntu1~24.04.1authd2 500
500 https://ppa.launchpadcontent.net/ubuntu-enterprise-desktop/authd/ubuntu noble/main amd64 Packages
100 /var/lib/dpkg/status
46.0-0ubuntu6~24.04.5 500
500 http://br.archive.ubuntu.com/ubuntu noble-updates/main amd64 Packages
46.0-0ubuntu6~24.04.3 500
500 http://security.ubuntu.com/ubuntu noble-security/main amd64 Packages
46.0-0ubuntu5 500
500 http://br.archive.ubuntu.com/ubuntu noble/main amd64 Packages
```

#### Distribution
```
Distributor ID: Ubuntu
Description: Ubuntu 24.04.1 LTS
Release: 24.04
Codename: noble
```

#### Logs
```
-- No entries --
```

#### authd broker configuration
#### /etc/authd/brokers.d/msentraid.conf
```
# This section is used by authd to identify and communicate with the broker.
# It should not be edited.
[authd]
name = Microsoft Entra ID
brand_icon = /snap/authd-msentraid/current/broker_icon.png
dbus_name = com.ubuntu.authd.MSEntraID
dbus_object = /com/ubuntu/authd/MSEntraID
```

#### authd-msentraid configuration
```
[oidc]
issuer = https://login.microsoftonline.com//v2.0
client_id =
# Client secret is needed for some specific auth flows depending on the provider.
# Only enable it if this is needed for your particular configuration.
# client_secret =

[users]
# The directory where the home directory will be created for new users.
# Existing users will keep their current directory.
# The user home directory will be created in the format of {home_base_dir}/{username}
# home_base_dir = /home

# The username suffixes that are allowed to login via ssh without existing previously in the system.
# The suffixes must be separated by commas.
# ssh_allowed_suffixes = @example.com,@anotherexample.com
ssh_allowed_suffixes = @convertcompany.com.br,@convert.app.br
```

### Double check your logs

- [X] I have redacted any sensitive information from the logs

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the reported flow on Ubuntu 24.04.1 with authd 0.3.7 and authd-msentraid 0.1+267a15c.f272cc1, following the linked authd and Intune instructions. Review /etc/authd/brokers.d/msentraid.conf, the broker configuration, and authd-system-info-1Jqsbg.md; done means identifying why Entra ID users receive [4u3gb] during Intune enrollment and documenting a verified resolution.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, linux
Domain
authentication, desktop, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.