Azure AD authentication comes to Ubuntu Desktop 23.04

Ubuntu Desktop 23.04 is the first and only Linux distribution to enable native user authentication with Azure Active Directory (Azure AD). The adoption of cloud-based identity providers in the enterprise is skyrocketing and this has been one of the most requested features. With Ubuntu Desktop 23.04 we decided to act on the feedback and offer a way to natively let enterprise users authenticate Ubuntu Desktops with the same credentials they use for Microsoft 365 or their Windows clients.

This is made possible thanks to the aad-auth package, currently in public preview. This feature is available to try in Ubuntu 23.04 and will be later ported to LTS versions of Ubuntu.

Why Ubuntu Desktop authentication is moving to the cloud

Remote working and the operational challenges involved in adequately securing on-premise Active Directory tenants are only a few of the factors that are driving the meteoric rise in adoption of cloud identity providers. The most popular among these is Azure AD, particularly because it is the backbone component of Microsoft 365, Azure and Outlook.

Despite having a similar name, Active Directory Domain Services (the traditional, on premise AD) and Azure Active Directory make use of fundamentally different technologies and protocols. While the latter relies on older technologies like Kerberos, Azure AD makes use of the more internet friendly OpenID Connect protocol. This allows user authentication to be performed securely over the internet, without the need for complex VPN setups. 

Linux workstations are one  of the latest systems that require organisations to run on premise tenants, or implement complex and costly configurations involving third party access gateways or AD connect services. By bringing native Azure AD authentication to Ubuntu desktops and servers we aim to remove this need, allowing IT administrators to complete their Identity Provider SaaS transition, unifying Windows and Linux workstation access on the cloud and reducing their identity attack surface area.

Integrate Ubuntu Desktop with Azure AD

We have released the following video to show how easy it is to configure Azure AD authentication with your desktop:

Since Azure AD uses a different protocol stack than AD Domain Services we decided to build a new client rather than integrating the new features in SSO. When installed, aad-auth creates the following components:

1. A PAM module for authentication.
2. An NSS module to query the password, group and shadow databases.
3. A command line tool to manage the local cache for offline authentication and the system’s configuration.

Giving users access to their desktops is made possible by creating an enterprise application in Azure AD and adding its details in the package configuration files. Access controls can then be performed in Azure AD by adding or removing users or groups to the application. 

It is also important to note that the desktop needs to be connected to the internet and able to reach the configured Azure AD tenant for the authentication to occur. However, should that not be possible,  credentials can be cached for a preconfigured period of time (the default is 90 days, mirroring Windows behaviour).

Get the new feature

The new feature is available today in public preview and freely available for all Ubuntu Desktop 23.04 users. We encourage everyone to try out the new features and provide feedback or suggestions through Github.

In the coming months we are planning to improve the package based on your feedback and port it to the latest LTS version of Ubuntu Desktop, making it available for free. 

If you want to learn more about Ubuntu Desktop, Ubuntu Pro or our other advanced Active Directory integration features please do not hesitate to contact us to discuss your needs with one of our advisors.

Find out more

• Ubuntu Desktop for organisations
• Ubuntu compliance monitoring with Microsoft Intune
• Improve your endpoint security with Ubuntu Pro
• Advanced Active Directory integration with ADsys
• Announcing Authd: OIDC authentication for Ubuntu Desktop and Server