Forum Discussion

Matthew Mellon's avatar
Matthew Mellon
Copper Contributor
Sep 29, 2017

Azure AD and schema for SSH public keys

We are considering migrating our Novell eDirectory on-premise directory to AAD DS. One thing that we use our current directory for is storing SSH public keys for users, which are in turn used to allow users to log in to Linux instances.

 

I have seen documentation that states that AAD DS does not allow extending the LDAP schema (including adding User object attributes), but I cannot find documentation stating what the default schema looks like.

 

Is it possible to store users' public keys for SSH in AAD DS? Where can I see the documentation for the default schema (I'd like to know what I'm buying before I dive in)?

Azure Active Directory (AAD)
  • Fons Ullings's avatar
    Fons Ullings
    Copper Contributor
    Aug 17, 2018

    Dear Matthew Mellon

     

    Did you indeed discover a method to store users public keys in a AAD ?

    many thanks

     

    Fons Ullings

    Amsterdam UMC

     

    • Fons Ullings's avatar
      Fons Ullings
      Copper Contributor
      Feb 14, 2020

      Indeed we found the solution within the Azure AD and we have even managed to provision complete Azure AD accounts via secure LDAP using this field. The field can also be out-of-the-box configured to be used in Linux distributions like RedHat, Ubunto, CentOS so that seamless SSH login is provided to our researchers. The Azure AD attribute field is: altSecurityIdentities

      and configure Linux instaces:

       

      # Once domain joined, add the following to the /etc/sssd/sssd.conf file under the [domain/] section:
      ldap_user_extra_attrs = altSecurityIdentities:altSecurityIdentities
      ldap_user_ssh_public_key = altSecurityIdentities
      ldap_use_tokengroups = True

      # and under the [sssd] section add:
      services = nss, pam, sudo, ssh
      default_domain_suffix = XXXXXXXXX.onmicrosoft.com


      # Then to the /etc/ssh/sshd_config add:
      AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys [--domain XXXXXXXXX.onmicrosoft.com]
      AuthorizedKeysCommandUser root

       

       

      Regards

      Fons Ullings

      • yaegashi's avatar
        yaegashi
        Copper Contributor
        Nov 16, 2020

        Fons Ullings What's the Azure AD resource property for altSecurityIdentities you found?  I couldn't find any property with that name in Azure AD user resource.  I found alternativeSecurityIds in device resource that's translated to AD's altSecurityIdentities for devices, but I don't think it appropriate to store SSH public keys for user authentication.

         

        Can we modify altSecurityIdentities via Microsoft Graph API?

Resources