Attempting Device Authentication but prompted to "Create a local password"

[jbrucato-eci]

Running into an issue here (Ubuntu 24.04 fully patched). Auth seems to function when code is submitted, but I drop down into a local password loop:

_>>ssh username@[[email protected]](mailto:[email protected])
(username@[[email protected]](mailto:[email protected])) == Broker selection ==
1 - local
2 - Microsoft Entra ID
Select broker: 2
Insert 'r' to cancel the request and go back
(username@[[email protected]](mailto:[email protected])) Enter your local password:
(username@[[email protected]](mailto:[email protected])) == Authentication mode selection (use 'r' to go back) ==
1 - Local Password Authentication
2 - Device Authentication
Select authentication mode: 2
Scan the QR code or access "https://microsoft.com/devicelogin" and use the provided login code
https://microsoft.com/devicelogin
AQCEFPFAE

(username@[[email protected]](mailto:[email protected])) == Qr Code authentication (use 'r' to go back) ==
1 - Wait for the QR code scan result
2 - Request new login code
Select action: 1
Insert 'r' to cancel the request and go back
(username@[[email protected]](mailto:[email protected])) Create a local password:_

Periodically seeing the following in Authd logs:

Nov 12 18:02:06 MYSERVER systemd[1]: Stopping authd.service - Authd daemon service...
Nov 12 18:02:06 MYSERVER systemd[1]: authd.service: Deactivated successfully.
Nov 12 18:02:06 MYSERVER systemd[1]: Stopped authd.service - Authd daemon service.
Nov 12 18:02:06 MYSERVER systemd[1]: Starting authd.service - Authd daemon service...
Nov 12 18:02:06 MYSERVER systemd[1]: Started authd.service - Authd daemon service.
Nov 12 18:05:11 MYSERVER authd[3654]: 2024/11/12 18:05:11 WARN rpc error: code = NotFound desc =
Nov 12 18:10:11 MYSERVER authd[3654]: 2024/11/12 18:10:11 WARN rpc error: code = NotFound desc =
lines 48-79/79 (END)

Auth logs during attempt:

2024-11-12T18:16:26.427587+00:00 MYSERVER sshd[3891]: pam_aad(sshd:account): AadAuthorize, Version: 1.0.028680001; CorrelationId: XXXXXXX
2024-11-12T18:16:26.427804+00:00 MYSERVER sshd[3891]: pam_aad(sshd:account): This is an Azure machine
2024-11-12T18:16:26.578334+00:00 MYSERVER sshd[3891]: pam_aad(sshd:account): Login denied for user [[email protected]](mailto:[email protected]).
2024-11-12T18:16:26.578795+00:00 MYSERVER sshd[3888]: error: PAM: User account has expired for [[email protected]](mailto:[email protected]) from x.x.x.x
2024-11-12T18:16:26.640504+00:00 MYSERVER sshd[3888]: fatal: monitor_read: unpermitted request 104

[3v1n0]

That's the expected behavior... Currently you need a local password to be set.

Technically I suppose it could be disabled adding an option to the broker for specific setups, but then you wouldn't be able to login in case of missing connection.

[dubK]

We're considering supporting an option to disable the local password, i.e. to always enforce OIDC authentication, but we haven't made a decision yet.

Make a decision and listen to Nike: Just Do It!
Why not give us the option? That would honestly be a key feature and a game changer for a lot of businesses, including mine.
I can also see that I'm not the only one with these thoughts.

If you decide to implement the option for us to always enforce OIDC (ofc you will, right?) then I'd gladly use this so DM me!

[vitich]

We're considering supporting an option to disable the local password, i.e. to always enforce OIDC authentication, but we haven't made a decision yet.

Please make it possible to disable the local password. This is the only thing currently stopping me from using authd in favor of himmelblau-idm.org

[adombeck]

@vitich We plan to support an option to force token refresh during login, so that user accounts which were disabled or removed from the identity provider can't log in anymore. Will that help for your use case?

[ajm370]

@vitich We plan to support an option to force token refresh during login, so that user accounts which were disabled or removed from the identity provider can't log in anymore. Will that help for your use case?

While the 'option to force token refresh during login' would indeed be a valuable feature, I think implementing that would be solving a different problem.

My organisation (similar to what others have mentioned above) have a requirement to use the MS EntraID passphrase for authd-based login; additionally, if this can then be extended to general SSO (i.e. when using the browser to access resources within our 365 tenant) that would be extremely useful also.

The MS EntraID passphrase for Ubuntu authd-based login would be the main request in any case. Is there a particular barrier to being able to implement this? Many thanks

[ShaunOLeary]

Adding support for this - I need ssh to only ever allow oidc login for remote access. Perhaps this could be an option in pam and it could be selected as needed for a given configuration.