native part (linux-entra-sso.py) is incompatible with broker version > 2.0.1

[PookyFan]

I'm trying to troubleshoot why Linux Entra SSO extension doesn't work for me, although it used to a few months ago.

I set up the extension to work on my Intune enrolled Linux system and it was working fine, but that was some time ago and since then I haven't really used it for various reasons. Now, when I try to log in to my company's services, they don't recognize my system as enrolled. I think this is because at some point Linux Entra SSO stopped working.

The most apparent problem, apart from lack of access to the services, is that whenever I click extension icon in extensions panel in browser, it starts to get very laggy and suddenly my browser starts using much more RAM and CPU than it should. The less apparent one is that there seems to be some exception thrown when the extension is working. The following are the logs from when I ran my browser in the terminal:

Running as native messaging instance.
For interactive mode, start with --interactive
Traceback (most recent call last):
File "/usr/libexec/linux-entra-sso/linux-entra-sso.py", line 352, in
run_as_native_messaging()
~~~~~~~~~~~~~~~~~~~~~~~^^
File "/usr/libexec/linux-entra-sso/linux-entra-sso.py", line 256, in run_as_native_messaging
ssomib = SsoMib(daemon=True)
File "/usr/libexec/linux-entra-sso/linux-entra-sso.py", line 85, in init
self._introspect_broker(fail_on_error=False)
~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^
File "/usr/libexec/linux-entra-sso/linux-entra-sso.py", line 92, in _introspect_broker
self.broker = self._bus.get(self.BROKER_NAME, self.BROKER_PATH)
~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/pydbus/proxy.py", line 59, in get
return CompositeInterface(introspection)(self, bus_name, object_path)
~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/pydbus/proxy.py", line 118, in CompositeInterface
raise KeyError("object does not export any interfaces; you might need to pass object path as the 2nd argument for get()")
KeyError: 'object does not export any interfaces; you might need to pass object path as the 2nd argument for get()'

I ran python3 ./linux-entra-sso.py --interactive acquirePrtSsoCookie as suggested for troubleshooting, and it gives me the same error.

I am using latest (1.7.1) version of the extension on up-to-date Debian 13 system. The browser I'm using is Vivaldi, so Chromium version of the extension applies in my case. I have Intune and MS Identity Broker installed and I double checked that Intune shows my system as successfully checked for compliance.

[fmoessbauer]

Hi, thanks for the initial analysis. The stack trace gives a good indication that something with the broker communication is broken. I'm wondering if the root-cause is the same as in #106.

We definitely need better error handling in the python script to report these errors back to the extension via the native messaging interface. It looks like chrome does not like it when the native part just terminates.

Which version of the microsoft-identity-broker are you using? Does the introspection of the service work? You can check with busctl --user introspect com.microsoft.identity.broker1 /com/microsoft/identity/broker1 and provide the output here.

I am using latest (1.7.1) version of the extension on up-to-date Debian 13 system.

I'm also on a Debian trixie system with broker version 2.0.1 and there it works perfectly fine.

I'll look into this issue after the Christmas vacation.

[PookyFan]

$ apt-cache policy microsoft-identity-broker
microsoft-identity-broker:
Installed: 2.0.4

$ busctl --user introspect com.microsoft.identity.broker1 /com/microsoft/identity/broker
NAME TYPE SIGNATURE RESULT/VALUE FLAGS

But for busctl I can have just a single slash without com/microsoft/etc and it gives the same output.

Maybe the broker is "too new" and it actually breaks something? On the other hand I think I need at least 2.0.2 broker version for Intune on my machine, so I don't really want to downgrade it too much.

EDIT: I didn't think of it before but I took a screenshot of the extension menu while trying to log in to MS account, as expected the extension has no connection to broker.

I also checked if the broker service is actually running, and it looks like it's not by default. But even when it's running (from either starting it manually or by launching Intune), it doesn't change anything, including busctl command output.

EDIT 2: Downgrading MS Identity broker to 2.0.2 yields same results.

[fmoessbauer]

Thanks for the feedback.

I quickly checked the broker versions on https://packages.microsoft.com/ubuntu/24.04/prod/pool/main/m/microsoft-identity-broker/. It looks like the 2.0.1 is the last Java based version (which contains bug #33 ), however this one correctly implements dbus introspection.

The more recent broker versions are C++ based and (according to your test from above) do not implement the introspection interface. What a mess to have such a breaking change in a patch version! (2.0.1 -> 2.0.2).

By that, as of now, the linux-entra-sso extension is not compatible with broker versions > 2.0.1, because PyDBus uses introspection to create the dbus proxy objects. Once I'm back, I'll rewrite the linux-entra-sso.py script to not rely on introspection, then things should be working again.

If you have time, feel free to build the sso-mib-tool from https://github.com/siemens/sso-mib and try to acquire a PrtSsoCookie. If this still works, at least the interfaces are still working.

# you should get a cookie-name and cookie-value.
# don't paste the output here, it contains credentials.
sso-mib-tool acquirePrtSsoCookie

cc @bluca

[PookyFan]

I don't think they are working either...

$ ./sso-mib-tool acquirePrtSsoCookie

(process:5835): ssomib-WARNING **: 16:52:16.091: invalid cookie data
Error[acquirePrtSsoCookie]: Failed to acquire PRT SSO cookie

But as a workaround I'll try to downgrade broker to 2.0.1, if Intune has problem with it I'll try downgrading it too.

EDIT: I successfully downgraded broker to version 2.0.1 and the extension is working again. Thank you for your insight, for the time being I can use this version, but I'll also be waiting for the news about making Linux Entra SSO working on more up-to-date broker versions. One never knows when IT will force us to update these MS tools to keep compliance on our machines...

[fmoessbauer]

@PookyFan : I had a look at making the extension compatible with broker versions > 2.0.1, however there are many protocol changes and some I cannot test (because the can't make the broker to issue tokens).

As this is getting more complex, I started implementing the support in the sso-mib. For the extension, we need at least the acquireTokenSilently (TODO) and acquirePrtSsoCookie (works) methods. It would be great, if you could try this MR on your machine to see if the errors in acquireTokenSilently are only happening on my machine.

siemens/sso-mib#26

[PookyFan]

Seems like it's working for me. This is printed on broker version 2.0.2 (with sensitive stuff redacted ofc):

./sso-mib-tool acquireTokenSilent
access-token: [...]
id-token: [...]
access-token type: bearer
client-info: [...]
granted-scopes:[...]
expires-on: [...]
account:
# client-info: [...]
# environment: [...]
# family-name: [...]
# given-name: [...]
# home-account-id: [...]
# local-account-id: [...]
# name: [...]
# password-expiry: 0
# realm: [...]
# username: [...]

I'll check 2.0.4 version next, as the currently most up-to-date broker version.

EDIT: sso-mib-tool on broker version 2.0.4 behaves seemingly the same with your PR applied.

What errors do you have on your side? I'm wondering if it's only working for me because of stuff cached by previous broker version, and it may stop working for me sooner or later, too. Is there any way to clear all MS identity caches on my machine to enforce fetching them anew, so I could retry your changes on "fresh" data, just to be extra sure?