Who Authenticates Linux? Rethinking PAM & NSS in the Age of Cloud Identity
summary
An open-source daemon called Himmelblau glues Azure Entra ID into PAM and NSS by reverse-engineering web flows, scraping JavaScript configs, polling undocumented JSON endpoints, and replaying fake redirects; it successfully yields tokens and enables logins but is brittle and provider-specific. Current fallback is the device authorization grant QR/code flow, which works but is annoying, exclusionary, and unacceptable for SSH or offline/serial access; a standardized browser‑independent OIDC MFA extension is proposed.
AI-written summary · about
chapters (8)
- 0:00Introduction and speaker background
- 1:44Limitations of PAM and NSS
- 3:28Browser dependency in modern MFA
- 6:38Reverse engineering IDP flows
- 9:52Device Authorization Grant issues
- 13:24Need for standardized MFA protocol
- 20:59Systemd and GNOME OS initiatives
- 24:31Q&A and future directions
related talks
32mPasswordless Auth: a JSON-Based Approach for modern authentication w/ SSSD & GNOME
47mPasswordless in PAM: Myth or Reality?
31mAuthentication/Authorization Starters Battle
50mNOPASSWD: Building a Passwordless Cloud Infrastructure
28mBuilding Identity for an Open Perimeter
57mSelf-Verifying Authentication – A Framework For Safer Integrations of Single-Sign-On Services
54mState of authentication and identity in Fedora
01h 12mIdentity 2.0: the what, why and how of social and federated login