Direct Password and MFA Authentication with MS Entra ID

.github/workflows/e2e-tests-run.yaml

@@ -23,6 +23,8 @@ on:
         required: false
       E2E_MSENTRA_CLIENT_ID:
         required: false
+      E2E_MSENTRA_CLIENT_SECRET:
+        required: false
       E2E_MSENTRA_USERNAME:
         required: false
       E2E_MSENTRA_PASSWORD:
@@ -225,6 +227,7 @@ jobs:
             export E2E_USER="${{ secrets.E2E_MSENTRA_USERNAME }}"
             export E2E_PASSWORD="${{ secrets.E2E_MSENTRA_PASSWORD }}"
             export TOTP_SECRET="${{ secrets.E2E_MSENTRA_TOTP_SECRET }}"
+            export AUTHD_MSENTRAID_CLIENT_SECRET="${{ secrets.E2E_MSENTRA_CLIENT_SECRET }}"
           elif [ "${{ inputs.broker }}" = "authd-google" ]; then
             export E2E_USER="${{ secrets.E2E_GOOGLE_USERNAME }}"
             export E2E_PASSWORD="${{ secrets.E2E_GOOGLE_PASSWORD }}"

AGENTS.md

@@ -122,6 +122,8 @@ Explain why, not what — the diff shows what changed.
 - For bug fixes, describe the observable symptom before the root cause
 - Document non-obvious decisions and rejected alternatives
 - One-liners are fine for mechanical changes; anything behavioral needs a body
+- Try to keep the subject line at 72 characters or less; wrap body lines at 72 characters
+  (URLs that cannot be split are the only accepted exception)
 
 Don't narrate your activity ("Fixed X as requested") or describe the diff
 ("Add null check before calling Process()").

authd-oidc-brokers/cmd/authd-oidc/daemon/export_test.go

@@ -70,16 +70,22 @@ func GenerateBrokerConfig(t *testing.T, p, providerURL string) {
 	require.NoError(t, err, "Setup: could not create parent broker configuration directory for tests")
 
 	brokerCfg := fmt.Sprintf(`
-	[authd]
-	name = %[1]s
-	brand_icon = broker_icon.png
-	dbus_name = com.ubuntu.authd.%[1]s
-	dbus_object = /com/ubuntu/authd/%[1]s
-
-	[oidc]
-	issuer = %[2]s
-	client_id = client_id
-	`, strings.ReplaceAll(t.Name(), "/", "_"), providerURL)
+[authd]
+name = %[1]s
+brand_icon = broker_icon.png
+dbus_name = com.ubuntu.authd.%[1]s
+dbus_object = /com/ubuntu/authd/%[1]s
+
+[oidc]
+issuer = %[2]s
+client_id = client_id
+
+[flows]
+# These tests don't exercise the entra_password flow, and the default
+# (enabled) would fail startup validation under the withmsentraid tag
+# because no client_secret or register_device is configured here.
+entra_password = false
+`, strings.ReplaceAll(t.Name(), "/", "_"), providerURL)
 	err = os.WriteFile(p, []byte(brokerCfg), 0600)
 	require.NoError(t, err, "Setup: could not create broker configuration for tests")
 }

authd-oidc-brokers/conf/variants/msentraid/broker.conf

@@ -6,6 +6,9 @@ issuer = https://login.microsoftonline.com/<ISSUER_ID>/v2.0
 ## The client ID of the application registered in Entra ID.
 client_id = <CLIENT_ID>
 
+## Optional: Client secret for the OIDC application registered in Entra ID.
+#client_secret = <CLIENT_SECRET>
+
 ## Force verification with the identity provider during login.
 ##
 ## When enabled, authd always verifies during login that the user still
@@ -93,3 +96,18 @@ client_id = <CLIENT_ID>
 ## (see 'owner' option) will be added to these groups.
 ## Example: owner_extra_groups = sudo,lpadmin
 #owner_extra_groups =
+
+[flows]
+## Control which authentication flows are offered to users.
+##
+## device_auth: When true (default), users can authenticate with the
+## device code flow (scanning a QR code or visiting a URL and entering
+## a code).
+#device_auth = true
+
+## entra_password: When true (default), users can authenticate by entering
+## their Microsoft Entra ID password directly, followed by MFA verification.
+##
+## Note: If both flows are disabled, no authentication will be available
+## and users will not be able to log in.
+#entra_password = true

authd-oidc-brokers/internal/broker/authmodes/consts.go

@@ -13,14 +13,27 @@ const (
 
 	// NewPassword is the ID of the new password configuration method.
 	NewPassword = "newpassword"
+
+	// EntraPassword is the ID of the Entra ID password + MFA authentication method.
+	EntraPassword = "entra_password"
+
+	// EntraMFAWait is the ID of the poll-based MFA follow-up mode.
+	EntraMFAWait = "entra_mfa_wait"
+
+	// EntraMFACode is the ID of the code-entry MFA follow-up mode.
+	EntraMFACode = "entra_mfa_code"
 )
 
 var (
 	// Label is a map of auth mode IDs to their display labels.
+	//nolint:gosec // G101: These are auth mode display labels, not credentials.
 	Label = map[string]string{
-		Password:    "Local Password Authentication",
-		Device:      "Device Authentication",
-		DeviceQr:    "Device Authentication",
-		NewPassword: "Define your local password",
+		Password:      "Local Password Authentication",
+		Device:        "Device Authentication",
+		DeviceQr:      "Device Authentication",
+		NewPassword:   "Define your local password",
+		EntraPassword: "Entra ID password",
+		EntraMFAWait:  "Waiting for MFA approval",
+		EntraMFACode:  "Enter your MFA code",
 	}
 )

authd-oidc-brokers/internal/broker/authresponses.go

@@ -2,13 +2,20 @@ package broker
 
 import "github.com/canonical/authd/authd-oidc-brokers/internal/providers/info"
 
+// cachedPasswordMessage is the user-facing notice attached to a granted
+// response after the user's Entra password is saved as the local password
+// (during the Entra password + MFA flow). It is broker-owned so it can be
+// localized independently of authd.
+const cachedPasswordMessage = "Your local password has been set to your Entra password"
+
 type isAuthenticatedDataResponse interface {
 	isAuthenticatedDataResponse()
 }
 
 // userInfoMessage represents the user information message that is returned to authd.
 type userInfoMessage struct {
 	UserInfo info.User `json:"userinfo"`
+	Message  string    `json:"message,omitempty"`
 }
 
 func (userInfoMessage) isAuthenticatedDataResponse() {}