Has anyone ever tried to get Entra to work as a backend authenticator? #168
Replies: 7 comments
-
|
Just to add a little more flavor to this: 3780: 09:35:38.291 0/00000000: 107.207.216.225 connection request from 107.207.216.225 (realm: default) It basically dies here ^ which is where the mavis script should kick in. Jason |
Beta Was this translation helpful? Give feedback.
-
|
Hi, there are sample scripts in mavis/python/ that illustrate custom Python backends for MAVIS. Cheers, Marc |
Beta Was this translation helpful? Give feedback.
-
|
I suppose my question would be geared more towards where the best place would be to put the calling of the python file: for example I had it in here: id = mavisd { id = entra { and that wasnt working so I put it in tacplus's config file and that doesnt seem to work either. I did have it as the following also - which didnt make it get called and why i made a wrapper bash script in its place: exec = /usr/bin/python3 /etc/tacacs-ng/mavis.d/entra-auth.py Neither samples really go over this, unless Im missing something, which may be the case. Regards, |
Beta Was this translation helpful? Give feedback.
-
|
Hi Jason, is the right place for the backend script. The backend script is expected to communicate with the "external" module via stdin/stdout, and messing with those inside your wrapper (e.g. by redirecting stdout to a file) will break that. Cheers, Marc |
Beta Was this translation helpful? Give feedback.
-
|
understood, thanks Ill play some more. Jason |
Beta Was this translation helpful? Give feedback.
-
|
just in case anyone else wants it. this now works: tacplus config: mavis module = external { entra-auth.py file: #!/opt/entra-auth-venv/bin/python3 import sys === Configuration ===CLIENT_ID = "" Logging setupLOG_FILE = "/var/log/entra-auth.log" def log(msg): def main(): if name == "main": Thanks for the push in the right direction Marc |
Beta Was this translation helpful? Give feedback.
-
|
Hi Jason, nice, thanks for sharing! Cheers, Marc |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Good evening,
Im trying to get entra ID as an authenticator for tacplus ng and getting stuck having the mavis backend execute either my python script or my bash script which wraps the python script. When I run the script manually it correctly authenticates to entra without issue so I know that part will work.
Below is a snippet of the various configuration files (scrubbed for obvious reasons):
tacplus.conf:
#!/usr/local/sbin/tac_plus-ng
id = spawnd {
listen { address = 0.0.0.0 port = 49 }
spawn = {
exec = /usr/local/sbin/mavisd
config = /etc/tacacs-ng/mavis.conf
}
spawn = {
exec = /usr/local/sbin/tac_plus-ng
config = /etc/tacacs-ng/tacplus.conf
}
background = yes
}
id = tac_plus-ng {
log authzlog { destination = /var/log/tac_plus/authz/%Y/%m/%d.log }
log authclog { destination = /var/log/tac_plus/authc/%Y/%m/%d.log }
log acctlog { destination = /var/log/tac_plus/acct/%Y/%m/%d.log }
accounting log = acctlog
authentication log = authclog
authorization log = authzlog
user backend = mavis
login backend = mavis
pap backend = mavis
mavis module = external {
exec = /etc/tacacs-ng/mavis.d/entra-auth-wrapper.sh
}
host = world {
#Allow any device to connect
address = 0.0.0.0/0
Give a prompt to the user when they log in.
welcome banner = "My warning to you"
key =
}
}
mavis.conf:
debug = 255
id = mavisd {
chain = entra
}
id = entra {
module = entra {
exec = /etc/tacacs-ng/mavis.d/entra-auth-wrapper.sh
}
}
entra-auth-wrapper.sh:
#!/bin/bash
LOG_FILE="/var/log/entra-auth-wrapper.log"
TIMESTAMP=$(date -Iseconds)
echo "[$TIMESTAMP] entra-auth-wrapper.sh was invoked with arguments: $@" >> "$LOG_FILE"
Call the actual Python script
/opt/entra-auth-venv/bin/python3 /etc/tacacs-ng/mavis.d/entra-auth.py "$@" >> "$LOG_FILE" 2>&1
entra-auth.py:
#!/opt/entra-auth-venv/bin/python3
try:
with open("/var/log/entra-auth.log", "a") as f:
f.write(f"[{datetime.now().isoformat()}] entra-auth.py script called (TOP OF SCRIPT)\n")
except Exception as e:
pass
import sys
import json
import msal
import datetime
import logging
from msal import ConfidentialClientApplication
=== Configuration ===
CLIENT_ID = ""
TENANT_ID = ""
AUTHORITY = f"https://login.microsoftonline.com/{TENANT_ID}"
SCOPES = ["https://graph.microsoft.com/.default"]
Optional: enable debugging log file
LOG_FILE = "/var/log/entra-auth.log"
logging.basicConfig(
filename='/var/log/entra-auth.log',
level=logging.DEBUG,
format='%(asctime)s %(levelname)s %(message)s'
)
def log(msg):
logging.debug(msg)
try:
with open(LOG_FILE, "a") as f:
timestamp = datetime.datetime.now().isoformat()
f.write(f"{timestamp} - {msg}\n")
except Exception:
pass
def main():
try:
# Parse MAVIS input
user = None
password = None
for line in sys.stdin:
line = line.strip()
if line == "":
break
if line.startswith("user = "):
user = line.split("=", 1)[1].strip()
elif line.startswith("password = "):
password = line.split("=", 1)[1].strip()
if name == "main":
main()
Now the entra-auth.py and wrapper scripts works but I feel like Im missing some connection to get tacplus to call it correctly. Any help is appreciated. I feel like I'm THIS close..
Regards,
Jason
Beta Was this translation helpful? Give feedback.
All reactions