[MSAL Migration] device code flow is not supported in Managed Device in Conditional Access about kubelogin HOT 12 CLOSED

@weinong I think you should keep this open until ADAL is fully removed from the repo (or track in a different issue). The library was deprecated a while ago and presents a security risk.

from kubelogin.

pending on token cache feature in Azure/azure-sdk-for-go#6602

from kubelogin.

AzureAD/microsoft-authentication-library-for-go#58
Azure/azure-sdk-for-go#6602 (comment)

from kubelogin.

Azure/azure-sdk-for-go#16643

from kubelogin.

adapter between ADAL and AzIdentity
https://github.com/jongio/azidext/blob/master/go/azidext/azure_identity_credential_adapter.go

from kubelogin.

The device code flow is much less convenient than interactive browser, so please migrate.

Additionally, ADAL has been deprecated and will no longer receive security updates:

If you choose not to migrate to MSAL before ADAL support ends in December, 2022, you put your app's security at risk.

from kubelogin.

Hi @aelij, yes, completely agree with you. I'm ramping up a new hire on this project. Hopefully we can tackle it soon. Though, I'm curious to learn what "inconvenience" you are referring to?

from kubelogin.

The fact that you have to copy the device code, open the browser, paste it and login, rather than having the browser simply open :)

from kubelogin.

Azure/azure-sdk-for-go#16643

from kubelogin.

Any update on the progress to migrate kubelogin to MSAL?

Would changing to MSAL result in the access_token be included in the _claim_sources member when a distrubted claim is returned?

We can't use kubelogin with anything other than AKS due to this limitation when users have more than 200 groups.

from kubelogin.

@fherbert we have some login modes implemented in msal such as interactive. Though, none of this would help you. That being said, I'd recommend configure your AAD app and k8s to use app roles for authorization instead of using groups

from kubelogin.

closing this issue as web interactive login mode is compatible with conditional access policy

from kubelogin.