cyberninjas/libnss_aad

Name Service Switch (NSS) Module for performing user lookups against the Azure Active Directory (AAD).

libnss_aad's Issues

Segfault on Ubuntu 18.04.2

cat /var/log/messages
Jun  7 12:16:41 remote kernel: (imesyncd)[472]: segfault at 0 ip 00007fd931c094de sp 00007ffe862ad2c0 error 4 in libnss_aad.so.2[7fd931c08000+3000]
Jun  7 12:16:41 remote kernel: (imesyncd)[536]: segfault at 0 ip 00007fd930c074de sp 00007ffe862ad2c0 error 4 in libnss_aad.so.2[7fd930c06000+3000]
Jun  7 12:16:41 remote kernel: (imesyncd)[541]: segfault at 0 ip 00007fd930c074de sp 00007ffe862ad2c0 error 4 in libnss_aad.so.2[7fd930c06000+3000]
Jun  7 12:16:41 remote kernel: (imesyncd)[556]: segfault at 0 ip 00007fd930c074de sp 00007ffe862ad2c0 error 4 in libnss_aad.so.2[7fd930c06000+3000]
Jun  7 12:16:41 remote kernel: (imesyncd)[574]: segfault at 0 ip 00007fd930c074de sp 00007ffe862ad2c0 error 4 in libnss_aad.so.2[7fd930c06000+3000]

uname -a
Linux remote 4.15.0-1040-aws #42-Ubuntu SMP Fri May 17 13:47:10 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

apt list --installed | grep libnss-aad
libnss-aad/bionic,now 0.0.3-0~201906051458~ubuntu18.04.1 amd64 [installed]

Backport to Amazon Linux (AMI) 2018.03

https://aws.amazon.com/amazon-linux-ami

See also: CyberNinjas/pam_aad#30

Azure AD Graph API being deprecated in favor of Microsoft Graph API

• Rename RESOURCE_ID -> RESOURCE, and assign the value to https://graph.microsoft.com.
• Change HTTP request in verify_user(), to https://graph.microsoft.com/v1.0/me.
• Abstract libcurl logic, (See: pam_aad.c).

See: Microsoft Graph or the Azure AD Graph

Resources:

• Working with Azure Active Directory resources in Microsoft Graph

Replace usage of crypt_make_salt with libxcrypt

• Convert code to use new library
• Add new dependency to travis (Debian/Ubuntu only).
• Compile from source on CentOS/RHEL/Amazon Linux.

https://github.com/besser82/libxcrypt

--

See: linux-pam/linux-pam#110

error: PAM: User account has expired when used in combination with pam_aad

User is created on successful directory lookup, however a password is currently not set for the user, causing authentication to fail.

See: CyberNinjas/pam_aad#24 (comment)

Segfault on su

su - jnchi                                                                          
returned odata.error                                                                                   
Segmentation fault

Unified configuration file for pam_aad and libnss_aad

Instead of /etc/libnss-aad.conf, and /etc/pam_aad.conf, both should use a unified configuration, /etc/aad.conf , or in the case where the values don't match, /etc/aad/pam.conf, and /etc/aad/nss.conf.

# /etc/aad/{{service}}.conf
/etc/aad/libnss.conf
/etc/aad/openssh.conf
/etc/aad/openvpn.conf

Replace cJSON with jansson

Missing Public Key in Travis Build

The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7638D0442B90D010 NO_PUBKEY 04EE7237B7D453EC

Source: https://travis-ci.org/CyberNinjas/libnss_aad/builds/547901757

returned odata.error on tab i.e., bash completion for unprivileged user

ls /returned odata.error
returned odata.error

bin/            dev/            home/           initrd.img.old  lib64/          media/          opt/            root/           sbin/           sys/            usr/            vmlinuz
boot/           etc/            initrd.img      lib/            lost+found/     mnt/            proc/           run/            srv/            tmp/            var/            vmlinuz.old

Check and assign group membership from Azure Active Directory

If user A is part of security group Foo in the Azure portal, and user B is part of security group Bar; group Foo should map to the sudoers group, while group Bar should map to the users group.