fedora-intune: use Himmelblau instead of the Microsoft Intune app

Go with Entra ID sign-in through Himmelblau for fedora-intune and drop
the Microsoft Intune app (intune-portal, identity broker) variant. With
a single image, the workstation, Edge and Defender manifests move back
from images/shared into images/fedora-intune, and CI builds just that
image again. The Microsoft repo is now limited to mdatp and Edge.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

images/fedora-intune/build.conf

@@ -4,7 +4,7 @@ BUILD_MODE=upstream
 
 UPSTREAM_REPO="https://gitlab.com/fedora/ostree/ci-test.git"
 
-# Stable only; Microsoft builds the Intune app against RHEL, not rawhide.
+# Stable only; Defender comes from Microsoft's RHEL 10 repo, not rawhide.
 declare -A UPSTREAM_REFS=(
   [44]=f44
 )

images/fedora-intune/custom.yaml

@@ -0,0 +1,55 @@
+# Minimal GNOME workstation.
+
+packages:
+  # Fedora integration normally provided by the upstream fedora.yaml (which we
+  # opt out of to avoid the Firefox RPM).
+  - fedora-release
+  - fedora-release-ostree-desktop
+  - fedora-flathub-remote
+
+  # GNOME desktop: gdm pulls gnome-session, gnome-settings-daemon,
+  # accountsservice, dconf and gnome-keyring-pam. gnome-initial-setup creates
+  # the first local user on first boot.
+  - gdm
+  - gnome-shell
+  - gnome-control-center
+  - gnome-initial-setup
+  - nautilus
+  - ptyxis
+  - pipewire
+  - pipewire-pulseaudio
+  - wireplumber
+  - xdg-desktop-portal-gnome
+  - xdg-user-dirs-gtk
+  - flatpak
+
+  # Session infrastructure base-atomic lacks with recommends off; see
+  # fedora-remote/custom.yaml.
+  - dbus-daemon
+  - systemd-pam
+  - mesa-dri-drivers
+  - mesa-libEGL
+
+  # The upstream initramfs config adds dracut's tpm2-tss module, which needs the
+  # tpm2 binary. fedora-remote gets it through Kanidm; list it explicitly here.
+  - tpm2-tools
+
+  # Proxmox guest integration (agent, console clipboard and resizing).
+  - qemu-guest-agent
+  - spice-vdagent
+
+# Microsoft Edge is the browser (Conditional Access needs it).
+exclude-packages:
+  - firefox
+
+add-files:
+  - ["50-workstation.preset", "/usr/lib/systemd/system-preset/50-workstation.preset"]
+  # Key-only SSH for local accounts.
+  - ["10-workstation-sshd.conf", "/etc/ssh/sshd_config.d/10-workstation-sshd.conf"]
+
+postprocess:
+  # uresourced breaks the GDM greeter's user manager; see fedora-remote.
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    ln -sf /dev/null /etc/systemd/system/uresourced.service

images/fedora-intune/defender.yaml

@@ -0,0 +1,46 @@
+# Microsoft Defender for Endpoint on Linux (mdatp), RHEL 10 build, from the
+# microsoft-rhel10 repo (repos/microsoft.repo).
+#
+# mdatp's %post does the real install: units, SELinux module, and per-machine
+# state under /var/opt/microsoft/mdatp (machine GUID, definitions database,
+# logs). In a compose /var is read-only, and that state must not be shared
+# between machines anyway, so the %post is saved into the image and run once on
+# first boot by mdatp-firstboot.service. mdatp.service waits for it.
+#
+# Onboarding is per tenant and not part of the image: run the onboarding script
+# from the Defender portal on the device.
+
+repo-packages:
+  - repo: microsoft-rhel10
+    packages:
+      - mdatp
+
+packages:
+  # The %post is a bash script; Defender's inventory scripts and the
+  # onboarding script are Python.
+  - bash
+  - python3
+
+add-files:
+  - ["mdatp-firstboot", "/usr/libexec/mdatp-firstboot"]
+  - ["mdatp-firstboot.service", "/usr/lib/systemd/system/mdatp-firstboot.service"]
+  - ["mdatp-firstboot.conf", "/usr/lib/systemd/system/mdatp.service.d/10-firstboot.conf"]
+  - ["50-defender.preset", "/usr/lib/systemd/system-preset/50-defender.preset"]
+
+postprocess:
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    # The %post wrote the units during the compose; fail the build if a newer
+    # mdatp stops doing that, rather than shipping a Defender that never starts.
+    for unit in mdatp.service mde_netfilter_v2.service mde_netfilter_v2.socket; do
+      test -f "/usr/lib/systemd/system/${unit}"
+    done
+    # rpm-ostree keeps /opt content in /usr/lib/opt until the commit.
+    for root in /usr/lib/opt /opt; do
+      pp="${root}/microsoft/mdatp/conf/selinux_policies/out/mdatp_service.pp"
+      [[ -f "${pp}" ]] && break
+    done
+    semodule -n -i "${pp}"
+    rpm -q --qf '%{POSTIN}' mdatp > /usr/libexec/mdatp-postinst
+    chmod 0755 /usr/libexec/mdatp-firstboot /usr/libexec/mdatp-postinst

images/fedora-intune/files/10-workstation-sshd.conf

@@ -0,0 +1,6 @@
+# Key-only SSH for local accounts (add keys to ~/.ssh/authorized_keys).
+PubkeyAuthentication yes
+PermitRootLogin no
+PasswordAuthentication no
+PermitEmptyPasswords no
+KbdInteractiveAuthentication no

images/fedora-intune/files/50-defender.preset

@@ -0,0 +1,4 @@
+# Defender: first-boot setup, the daemon and its network filter.
+enable mdatp-firstboot.service
+enable mdatp.service
+enable mde_netfilter_v2.socket

images/fedora-intune/files/50-himmelblau-user.preset

@@ -0,0 +1,3 @@
+# Intune compliance check at login and on a timer, for every user.
+enable himmelblau-compliance-check.service
+enable himmelblau-compliance-check.timer

images/fedora-intune/files/50-himmelblau.preset

@@ -0,0 +1,4 @@
+# Himmelblau daemons; they pull in their sockets with Requires=.
+enable himmelblaud.service
+enable himmelblaud-tasks.service
+enable himmelblau-hsm-pin-init.service

images/fedora-intune/files/50-intune.preset

@@ -1,3 +0,0 @@
-# Intune daemon (socket-activated). The device identity broker is D-Bus
-# activated and has no [Install] section, so it needs no preset.
-enable intune-daemon.socket

images/fedora-intune/files/50-workstation.preset

@@ -0,0 +1,3 @@
+enable gdm.service
+enable qemu-guest-agent.service
+enable sshd.service

images/fedora-intune/files/himmelblau.conf

@@ -0,0 +1,17 @@
+# Himmelblau configuration. See himmelblau.conf(5) and
+# https://himmelblau-idm.org/docs/reference/himmelblau-conf/
+#
+# No tenant settings are needed: `domain` defaults to the domain of the first
+# user who signs in, and that user joins the device to Entra ID. Restrict who
+# may sign in with pam_allow_groups (group object IDs or UPNs).
+
+[global]
+# Enroll the device in Intune and apply/report compliance policies.
+apply_policy = true
+# Fedora's admin group; members of sudo_groups (Entra group object IDs) are
+# added to it.
+local_sudo_group = wheel
+# Home directories named after the account (e.g. /home/jdoe), with a UPN alias.
+home_attr = CN
+home_alias = SPN
+use_etc_skel = true

images/fedora-intune/files/mdatp-firstboot

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Finish the Defender (mdatp) install on first boot by running the package's
+# own %post, saved at build time: it creates the machine GUID, state, logs and
+# definitions database under /var and then enables and starts mdatp.service.
+set -euo pipefail
+
+MARKER=/var/lib/mdatp-firstboot.done
+
+[[ -f "${MARKER}" ]] && exit 0
+
+# mdatp.service only starts once the marker exists (10-firstboot.conf), and the
+# %post starts it, so create the marker first and drop it again on failure.
+touch "${MARKER}"
+if ! bash /usr/libexec/mdatp-postinst 1; then
+  rm -f "${MARKER}"
+  exit 1
+fi

images/fedora-intune/files/mdatp-firstboot.conf

@@ -0,0 +1,3 @@
+# Don't start Defender before mdatp-firstboot.service has created its state.
+[Unit]
+ConditionPathExists=/var/lib/mdatp-firstboot.done

images/fedora-intune/files/mdatp-firstboot.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=Finish the Microsoft Defender for Endpoint install on first boot
+Documentation=https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-linux
+After=network-online.target
+Wants=network-online.target
+ConditionPathExists=!/var/lib/mdatp-firstboot.done
+
+[Service]
+Type=oneshot
+ExecStart=/usr/libexec/mdatp-firstboot
+RemainAfterExit=yes
+TimeoutStartSec=15min
+
+[Install]
+WantedBy=multi-user.target

images/fedora-intune/himmelblau.yaml

@@ -0,0 +1,68 @@
+# Himmelblau: Entra ID sign-in (PAM/NSS), Entra join, Hello PIN, Intune
+# enrollment and compliance, and browser SSO.
+
+repo-packages:
+  - repo: himmelblau
+    packages:
+      - himmelblau
+      - pam-himmelblau
+      - nss-himmelblau
+      - himmelblau-selinux
+      # Shows a QR code on the login screen for the MFA/device-code prompts.
+      - himmelblau-qr-greeter
+      # Entra SSO in Edge (native messaging host) via the Himmelblau broker.
+      - himmelblau-broker
+      - himmelblau-sso
+
+packages:
+  - authselect
+  - nss-altfiles
+  # himmelblau-selinux compiles its policy module at install time.
+  - make
+  - selinux-policy-devel
+
+add-files:
+  - ["himmelblau.conf", "/etc/himmelblau/himmelblau.conf"]
+  - ["50-himmelblau.preset", "/usr/lib/systemd/system-preset/50-himmelblau.preset"]
+  - ["50-himmelblau-user.preset", "/usr/lib/systemd/user-preset/50-himmelblau-user.preset"]
+
+postprocess:
+  # The package's %post selects its authselect vendor profile but drops
+  # with-altfiles; without it system users (gdm, pipewire, mdatp, ...) in
+  # /usr/lib/passwd do not resolve and the login screen never starts.
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    authselect select himmelblau with-altfiles with-pam-gnome-keyring --force --nobackup
+    for user in gdm mdatp; do
+      getent passwd "${user}" >/dev/null
+    done
+    grep -q pam_himmelblau.so /etc/pam.d/system-auth
+
+  # himmelblau-selinux builds and loads its module in %posttrans, which does
+  # nothing in a compose; do it here.
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    tmp="$(mktemp -d)"
+    cp /usr/share/selinux/packages/himmelblaud/himmelblaud.{te,if,fc} "${tmp}/"
+    make -C "${tmp}" -f /usr/share/selinux/devel/Makefile himmelblaud.pp
+    semodule -n -i "${tmp}/himmelblaud.pp"
+    rm -rf "${tmp}"
+
+  # Show the QR greeter on the GDM login screen, not only in user sessions.
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    install -d /etc/dconf/db/gdm.d
+    cat > /etc/dconf/db/gdm.d/01-himmelblau-qr-greeter <<'CONF'
+    [org/gnome/shell]
+    enabled-extensions=['qr-greeter@himmelblau-idm.org']
+    CONF
+    dconf update
+
+  # Compliance check (user timer) and broker for every user.
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    systemctl --user --global preset-all

images/fedora-intune/intune.yaml

@@ -1,71 +0,0 @@
-# Microsoft Intune app for Linux (intune-portal) and the Microsoft identity
-# broker, from the microsoft-rhel10 repo (shared/repos/microsoft.repo).
-#
-# Fedora is not a supported Intune distribution. The RHEL 10 builds are used
-# because they link against the same library generation as Fedora 44.
-
-repo-packages:
-  - repo: microsoft-rhel10
-    packages:
-      - intune-portal
-      - microsoft-identity-broker
-
-packages:
-  # intune-portal scriptlet dependencies (authselect profile + SELinux module)
-  # and the sssd base its authselect profile is derived from.
-  - authselect
-  - checkpolicy
-  - policycoreutils
-  - sssd-client
-  - nss-altfiles
-  # Secret storage for the identity broker tokens.
-  - gnome-keyring
-  - libsecret
-
-add-files:
-  - ["50-intune.preset", "/usr/lib/systemd/system-preset/50-intune.preset"]
-
-postprocess:
-  # The intune-portal %post builds an authselect profile with pam_intune.so and
-  # an SELinux module, but neither reliably survives a compose (no running
-  # SELinux, authselect state under /etc). Redo both here so the image is
-  # deterministic either way.
-  - |
-    #!/usr/bin/env bash
-    set -xeuo pipefail
-    profile=/etc/authselect/custom/intune-profile
-    if [[ ! -d "${profile}" ]]; then
-      authselect create-profile intune-profile -b sssd --symlink-meta --symlink-pam
-    fi
-    for f in system-auth password-auth; do
-      grep -q pam_intune.so "${profile}/${f}" && continue
-      sed -i \
-        -e 's/^\(auth[[:space:]]\+\)sufficient\([[:space:]]\+pam_unix.so\)/\1required  \2/' \
-        -e 's/^\(password[[:space:]]\+\)sufficient\([[:space:]]\+pam_unix.so\)/\1required  \2/' \
-        "${profile}/${f}"
-      sed -i \
-        -e '/^auth[[:space:]]\+required[[:space:]]\+pam_unix.so/a auth        sufficient                                   pam_intune.so' \
-        -e '/^password[[:space:]]\+required[[:space:]]\+pam_unix.so/a password    sufficient                                   pam_intune.so' \
-        -e '/^session[[:space:]]\+required[[:space:]]\+pam_unix.so/a session     optional                                     pam_intune.so' \
-        "${profile}/${f}"
-    done
-    # with-altfiles: system users (gdm, pipewire, mdatp, ...) live in
-    # /usr/lib/passwd on rpm-ostree systems, not in /etc/passwd as on RHEL.
-    authselect select custom/intune-profile with-altfiles --force --nobackup
-    getent passwd gdm >/dev/null
-
-  - |
-    #!/usr/bin/env bash
-    set -xeuo pipefail
-    cd /usr/share/selinux/packages/intune
-    tmp="$(mktemp -d)"
-    checkmodule -M -m -o "${tmp}/intune.mod" intune.te
-    semodule_package -o "${tmp}/intune.pp" -m "${tmp}/intune.mod"
-    semodule -n -i "${tmp}/intune.pp"
-    rm -rf "${tmp}"
-
-  # intune-agent (user timer) reports compliance; enable it for every user.
-  - |
-    #!/usr/bin/env bash
-    set -xeuo pipefail
-    systemctl --user --global preset-all

images/fedora-intune/manifest.yaml

@@ -1,10 +1,10 @@
-# Minimal GNOME workstation with the Microsoft Intune app, Microsoft Edge and
-# Microsoft Defender for Endpoint, for testing Intune enrollment and Linux
-# compliance policies. Local accounts only: no Kanidm, because the Intune app
-# needs its own authselect profile (pam_intune) for the password checks.
+# Minimal GNOME workstation where users sign in with their Entra ID account
+# (Himmelblau), with Microsoft Edge and Microsoft Defender for Endpoint.
+# Himmelblau joins the device to Entra ID at the first sign-in and, with
+# apply_policy, enrolls it in Intune and reports compliance.
 
 metadata:
-  summary: Fedora minimal GNOME workstation with Microsoft Intune and Defender
+  summary: Fedora minimal GNOME workstation with Entra ID sign-in and Intune
 
 variables:
   # Opt out of the upstream fedora.yaml so we don't pull the Firefox RPM.
@@ -21,18 +21,19 @@ ref: fedora-intune/${releasever_ref}/${basearch}/intune
 # Ship /opt as a plain read-only directory instead of a symlink to /var/opt.
 # Defender installs to /opt/microsoft/mdatp and keeps its state in
 # /var/opt/microsoft/mdatp; with the default symlink those are the same,
-# read-only directory. Needs composefs, which upstream enables.
+# read-only directory. Needs composefs, which upstream enables. The vendor
+# directories are linked into /opt by finalize.d/60-opt-links.
 opt-usrlocal: root
 
 repos:
+  - himmelblau
   - microsoft-rhel10
   - microsoft-edge
 
 include:
   - base-atomic.yaml
-  # Shared with fedora-intune-himmelblau (images/shared).
-  - workstation.yaml
+  - custom.yaml
+  # Entra ID sign-in and Intune.
+  - himmelblau.yaml
   - microsoft-edge.yaml
   - defender.yaml
-  # Microsoft Intune app.
-  - intune.yaml

images/fedora-intune/microsoft-edge.yaml

@@ -0,0 +1,7 @@
+# Microsoft Edge, from the microsoft-edge repo (repos/microsoft.repo).
+# Conditional Access to Microsoft 365 web apps on Linux requires Edge.
+
+repo-packages:
+  - repo: microsoft-edge
+    packages:
+      - microsoft-edge-stable

images/fedora-intune/repos/himmelblau.repo

@@ -0,0 +1,9 @@
+# Himmelblau Community Nightly packages (free development builds). The
+# maintained Stable repositories need a subscription entitlement token:
+# https://himmelblau-idm.org/stable-repositories/
+[himmelblau]
+name=Himmelblau Community Nightly (Fedora 44)
+baseurl=https://packages.himmelblau-idm.org/nightly/latest/rpm/fedora44
+enabled=1
+gpgcheck=1
+gpgkey=https://packages.himmelblau-idm.org/himmelblau.asc

images/fedora-intune/repos/microsoft.repo

@@ -0,0 +1,19 @@
+# packages.microsoft.com, limited with includepkgs to the packages the image
+# uses, so nothing else from the RHEL repo can replace a Fedora package.
+
+[microsoft-rhel10]
+name=Microsoft Production (RHEL 10)
+baseurl=https://packages.microsoft.com/rhel/10/prod/
+enabled=1
+gpgcheck=1
+repo_gpgcheck=1
+gpgkey=https://packages.microsoft.com/keys/microsoft-2025.asc
+includepkgs=mdatp
+
+[microsoft-edge]
+name=Microsoft Edge
+baseurl=https://packages.microsoft.com/yumrepos/edge/
+enabled=1
+gpgcheck=1
+gpgkey=https://packages.microsoft.com/keys/microsoft.asc
+includepkgs=microsoft-edge-stable