From ad585699689d35b45e3dafe58642e23067bd3016 Mon Sep 17 00:00:00 2001 From: Misthios Date: Mon, 19 Oct 2026 11:19:46 +0000 Subject: [PATCH] fedora-intune: Entra SSO in Microsoft Edge himmelblau-sso registers its native messaging host and force-installs the Linux Entra SSO extension only for Chrome, Chromium and Firefox. Edge reads /etc/opt/edge, so ship the same two files there. Co-Authored-By: Claude Opus 5.5 (1M context) --- images/fedora-intune/files/edge-himmelblau-policy.json | 5 +++++ images/fedora-intune/files/edge-linux_entra_sso.json | 9 +++++++++ images/fedora-intune/microsoft-edge.yaml | 8 ++++++++ 3 files changed, 22 insertions(+) create mode 100644 images/fedora-intune/files/edge-himmelblau-policy.json create mode 100644 images/fedora-intune/files/edge-linux_entra_sso.json diff --git a/images/fedora-intune/files/edge-himmelblau-policy.json b/images/fedora-intune/files/edge-himmelblau-policy.json new file mode 100644 index 0000000..0dbdbcf --- /dev/null +++ b/images/fedora-intune/files/edge-himmelblau-policy.json @@ -0,0 +1,5 @@ +{ + "ExtensionInstallForcelist": [ + "jlnfnnolkbjieggibinobhkjdfbpcohn;https://clients2.google.com/service/update2/crx" + ] +} diff --git a/images/fedora-intune/files/edge-linux_entra_sso.json b/images/fedora-intune/files/edge-linux_entra_sso.json new file mode 100644 index 0000000..50a0e32 --- /dev/null +++ b/images/fedora-intune/files/edge-linux_entra_sso.json @@ -0,0 +1,9 @@ +{ + "name": "linux_entra_sso", + "description": "Entra ID SSO via Microsoft Identity Broker", + "path": "/usr/bin/linux-entra-sso", + "type": "stdio", + "allowed_origins": [ + "chrome-extension://jlnfnnolkbjieggibinobhkjdfbpcohn/" + ] +} diff --git a/images/fedora-intune/microsoft-edge.yaml b/images/fedora-intune/microsoft-edge.yaml index a61069a..1b6530d 100644 --- a/images/fedora-intune/microsoft-edge.yaml +++ b/images/fedora-intune/microsoft-edge.yaml @@ -1,7 +1,15 @@ # Microsoft Edge, from the microsoft-edge repo (repos/microsoft.repo). # Conditional Access to Microsoft 365 web apps on Linux requires Edge. +# +# Entra SSO in Edge: himmelblau-sso only registers its native messaging host +# and force-installs the Linux Entra SSO extension for Chrome, Chromium and +# Firefox. Edge reads /etc/opt/edge, so add the same two files there. repo-packages: - repo: microsoft-edge packages: - microsoft-edge-stable + +add-files: + - ["edge-linux_entra_sso.json", "/etc/opt/edge/native-messaging-hosts/linux_entra_sso.json"] + - ["edge-himmelblau-policy.json", "/etc/opt/edge/policies/managed/himmelblau.json"]