Use Entra Id password instead of local password

[0s0b4m4sk]

Hello, I would like to know if it is possible to use only Entra Id authentication to connect to our ubuntu session (created with Entra Id). Here the goal is to be able to manage passwords from Entra Id.

Currently I have the link between my Entra Id and my Ubuntu workstation, I have linked my user, I have authenticated via device (where I have to scan the QR code or go to Microsoft). Then I set my local password. From what I understand seen in this discussion (#655) , it will be possible by configuring the broker, to use only the password Entra Id.

If possible, do you have any documentation or advice to help me meet my needs?
Thank you, and have a nice day!

[MrJohanssons]

Yeah, I don't see why a local password is needed unless passwordless mode is used. Why is authd designed to be used with devicelogin instead of password login?
When using SSSD & on-prem AD users can use their normal username & password to logon and if they leave the network the account is cached.

Why is this not possible when it comes to EntraID?

[dubK]

Why even bother with authd if it can't be used to authenticate against EntraID every new session. I can understand the point of having a local password in case something goes wrong with the connection to Azure though. But local authentication should only be used as secondary method if the connection to Azure fails imo.

[netean]

I'm also wondering about why AuthD exists.
We're currently testing the Google Workspace integration and it too uses local passwords so when the Google account is suspended the user can still log in to their laptop. I'm genuinely confused why the goal with authd is.

I was really hoping it would be something like Active Directory authentication where suspending the account would suspend desktop login

[netean]

I'm currently testing Google Workspace authentication and it also requires a local password and can't use the G.W. one

[MrJohanssons]

Interesting. How does it work on Windows & Mac? Do you use passwordless solutions or is it just G. W. username & password?

[MrJohanssons]

Just talked to our Mac guy and he told me there is two solutions for Entra join.
Platform SSO & Secure Enclave.

Platform SSO is newer and allows user to logon with their EntraID username & password. Secure Enclave uses a local account, similar to authd.

If Platform SSO can manage EntraID logon via username/password I don't see why authd couldn't use the same approach unless it requires proprietary code from MS.

[dubK]

I just want to let you know that it ain't possible in the current state of authd to enforce OIDC authentication and disable local password login unfortunately. This is a huge bummer since, I at least, thought it would do exactly that.

Well, we'll have to wait and see if that option is coming or not. According to one of the developers they have yet to decide whether to add that option or not.