Authentication via TAMU NetID (OIDC)

[KRI3G]

• Register your ContainerSSH app with TAMU’s Microsoft Entra (OIDC) system

• Retrieve and store: Client ID, Client Secret, Discovery URL

• Configure auth.oauth2 section in containerssh.yaml

• Set keyboardInteractive: oauth2, provider: oidc, and TAMU endpoints

• Create fallback test user in static auth.password for dev purposes

• Test login flow with sample user: SSH → Link + Code → Browser auth → shell

[KRI3G]

Extremely useful documentation
https://docs.security.tamu.edu/docs/identity-security/authentication/
https://apps.identity.tamu.edu/login

[KRI3G]

oidc details are loaded through docker compose using a .env file. Please document this appropriately

[KRI3G]

Be sure to enable Device Code Flow in your App Registration from TAMU's self service Entra ID Integration.
From your Microsoft Entra Admin Center go App registrations > Supported account types > Platform configurations > Advanced settings and toggle "Allow public client flows"

This seems to be what allows device flow without requiring a redirect URI

[KRI3G]

This https://containerssh.io/v0.5/reference/auth-oauth2/ and https://docs.security.tamu.edu/docs/identity-security/authentication/options/entra-id/implementation/ are godsends

[KRI3G]

ContainerSSH doesnt require the full .well-known/openid-configuration, just FYI. so it's
https://login.microsoftonline.com/<tenant>/v2.0/
not
https://login.microsoftonline.com/<tenant>/v2.0/.well-known/openid-configuration
when inputting auth info into config file