Ubuntu's authd (formerly aadauth)

[dmulder]

This is a general topic to discuss Ubuntu's Entra Id solution called authd.
Authd lacks a number of fundamentals, and frankly, from a security perspective, implements their solution all wrong.

Here are some things to consider:

• Authd doesn't support device enrollment.
• Authd doesn't support SSO.
• Authd doesn't request a PRT.
• Authd only supports MFA via a DAG (Device Authorization Grant).
  • Granted their DAG flow with a QR code is better than Himmelblau's DAG fallback.
• Authd can't request a Kerberos cloud or on-prem TGT (this is because they don't do enrollment or request a PRT).

[dmulder]

See this issue: ubuntu/authd-oidc-brokers#259
FYI, @APokorny

[dmulder]

Another issue:
Authd doesn't implement the MS intune broker at com.microsoft.identity.broker1. They claim to implement a broker, but they don't understand fundamentally how MS's Broker even works.