Applies to SUSE Linux Enterprise Server 15 SP7

7 Authenticating with Microsoft Entra ID using Himmelblau #

Revision History: Security and Hardening Guide

Himmelblau integrates Microsoft Entra ID authentication with Linux authentication services. This chapter describes the system configuration needed on SUSE Linux Enterprise Server: installing the required packages, enabling the PAM module, enabling NSS lookups, configuring the Entra ID domain and starting the Himmelblau services.

7.1 Installing Himmelblau #

Install the Himmelblau daemon, PAM module and NSS module:

> sudo zypper install himmelblau pam-himmelblau libnss_himmelblau2

To allow Entra ID users to sign in over SSH, also install the SSH configuration package:

> sudo zypper install himmelblau-sshd-config

7.2 Configuring Himmelblau authentication #

The following procedure configures SUSE Linux Enterprise Server to resolve and authenticate Entra ID users through Himmelblau.

Edit /etc/himmelblau/himmelblau.conf and set the primary Entra ID domain in the [global] section:
```
[global]
domain = example.com
```
Add Himmelblau to the system PAM configuration:
```
> sudo pam-config --add --himmelblau
```
Edit /etc/nsswitch.conf and add himmelblau to the passwd, group and shadow databases. Keep the existing sources for your system and append himmelblau. For example:
```
passwd: files systemd himmelblau
group:  files systemd himmelblau
shadow: files systemd himmelblau
```

Enable and start the Himmelblau services:

> sudo systemctl enable --now himmelblaud himmelblaud-tasks

If you installed himmelblau-sshd-config, restart the SSH daemon:
```
> sudo systemctl restart sshd.service
```

After the system is configured, an Entra ID user can sign in locally or, when SSH support is installed, over SSH. The first successful sign-in may register the device with Entra ID and prompt for the authentication factors required by your tenant policy.

7.3 Verifying the configuration #

Check that the daemons are running:

> sudo systemctl status himmelblaud himmelblaud-tasks

Check that the Himmelblau daemon is reachable:

> sudo aad-tool status

Verify that NSS can resolve an Entra ID user:

> getent passwd USER
> id USER

For troubleshooting, inspect the system journal:

> sudo journalctl -u himmelblaud -u himmelblaud-tasks

7.4 Restricting who can sign in #

If pam_allow_groups is not configured, all users from the configured Entra ID domain can authenticate. To restrict access, add a comma-separated list of allowed user principal names and Entra ID group object IDs to /etc/himmelblau/himmelblau.conf:

[global]
pam_allow_groups = user@example.com,00000000-1111-2222-3333-444444444444

Restart both Himmelblau services after changing the configuration:

> sudo systemctl restart himmelblaud himmelblaud-tasks

7.5 Enabling Intune policy enforcement #

To allow Himmelblau to evaluate Intune compliance policy locally, enable policy processing in /etc/himmelblau/himmelblau.conf:

[global]
apply_policy = true

Restart both Himmelblau services after changing the configuration:

> sudo systemctl restart himmelblaud himmelblaud-tasks