Azure AD Authentication for Ubuntu

[@bramapanday9505]

Tested an confirmed working. Please note there is a guide on linked in , specific name found in sub comments below, google search returns pdf. Pretty Coool!! Thanks you Canonical an people in comments section on the video and also creator of the guide ! Much appreciated!

[@BrunoSilva-dq2nn]

Thanks for sharing, I've been waiting for this feature for a long time!

[@gerbenr01]

There seem to be some restrictions: - No AAD group info usable (to restrict ssh login only to certain AAD groups) - successful SSH login only after first successful GDM login (Using only SSH fails, it seems because of the wrong web client according to MS Entra admin log center) - no 2FA via auth app

[@RussellMeyer-e5i]

Previously I saw it could join AADDS and could do groups for sudo mgmt...can I assume that will not be avail with this?

[@_Jayonics]

I know everyone is complaining about it not working but honestly i think people are being too hasty. Ubuntu is an entirely different OS with an equally different Kernel from Windows. Microsoft has had well over a decade to build Azure from the ground up to work around Windows authentication methods and integrate it with the OS since its inception. While the Active Directory and Azure functionality Canonical is putting into Ubuntu is far from the level of integration Windows has, I think this is an amazing move in the right direction for not only Canonical, but will benefit Linux as a whole. The more Ubuntu integrates with Microsoft ecosystems: 1. The more traditional Windows Sys Admins will consider allowing Ubuntu Desktops into their AD/Hybrid/Cloud networks due to the ease of integration into existing management and... 2. The reverse on the server side. Easier and more centralised management of servers in mixed Windows and Linux environments, consequently improving security as policies can be configured and monitored in one place. I think Canonical has the master plan to open up the Windows enterprise and Azure spaces here and we all benefit. WSL, adsys, azure Ad, Intune... Keep up the amazing work! (But not Snaps 😉)

[@bvborge]

It sort of works, but the user should be prompted for MFA so the Sign-In Log in Azure AD says 'Status: Interrupted'

[@ivanskachkov9163]

Can you share some details of AWS App config?

[@MaxlenSantos]

Is it possible to authenticate with FIDO/MFA devices in AAD?

[@legionlinoge3658]

Does this support MFA? User needs to perform multi-factor authentication. There could be multiple things requiring multi-factor, e.g. Conditional Access policies, per-user enforcement, requested by client, among others.

[@premaxhotpl]

Hello, do you confirm that E3/E5 or Entra P1/P2 plan is required for this feature and why?

[@ivanskachkov9163]

To those who did the integration, can you share the details of how to create the Azure Application, should we do anything special. Because with the instructions of MS and this VIdeo, it doesn't work. I'm sure we doing something wrong.

[@andrewabbate7691]

Agreed, I feel like there's some secret sauce for the App Registration that isn't being called out yet.

[@RodHatley-cf1rf]

Yes, the Ubuntu side is straight forward, but the Azure AD side is not obvious. If you have a reference or link, that would be awesome. Other than the generic MS one talking about creating an App Registration...

[@andrewabbate7691]

Not sure why I'm not seeing Rafa Clemente's comment here, but it showed up in email. His link to his doc got me 90% of the way there. The key piece was enabling "Allow public client flows" in the App Registration. This nearly fixed me. The other change I had to make was the Manifest file in the App Registration where I had to change "acceptMappedClaims" from null to true Once I did that, my login via AAD was successful!

[@ivanskachkov9163]

@@andrewabbate7691 because KZbin delete it is published on pangeanic company blog and his Rafa Clemente LinkedIn

[@dxcrooze6486]

it work tx ! when is this coming to LTS?

[@damiendye6623]

how does it map UID's and GID's from azure where do you set them

[@surisurendrababu]

can you do video for kde linux and centos 7(cli version)

[@MihaelNovak-t5r]

It is possible to use this for ssh login over AD?

[@gabeintothe1106]

It works great, just tested. Does it work with ssdm + kde too ?

[@ivanskachkov9163]

can you explain how you created the AZad app?

[@gabeintothe1106]

@@ivanskachkov9163 i already replied but yt must have filteted the comment. I will tell u

[@broddiedcalhoun]

Hello, were you able to pull AzureAD groups and group membership as well?

[@r.robbi.s3319]

E: Unable to locate package libpam-aad E: Unable to locate package libnss-aad how to fix this?

[@foorack]

What version of Ubuntu are you on?

[@johnjoseph871]

Its possible logon with MFA?

[@Yllidervishi]

It doesn't work!

[@ivanskachkov9163]

As you maybe noticed the solution was published by Rafael Clemente on his linkedin and in blog of pangeanic company

[@papastanley]

Sound is way quiet?

[@RAZR_Channel]

Having anything to do with Microsoft products is a bad move