4.0.0

What's Changed

Security

• Fixed multiple local privilege-escalation and authentication-boundary issues, including:
  • Binding PamChangeAuthToken requests to the connecting peer so non-root callers can only change their own Hello PIN. Fixes GHSA-6gp8-pp9v-gx45.
  • Rejecting RFC2307 UID/GID values in systemd’s DynamicUser range to prevent identity collisions with privileged services. Fixes GHSA-6gp8-pp9v-gx45.
  • Rejecting subordinate ID account names containing : or control characters before writing /etc/subuid and /etc/subgid. Fixes GHSA-x259-23ph-65m5.
  • Restricting the Office 365 URL handler to a Microsoft 365 origin allowlist before dispatching links to Electron-based Office wrappers. Fixes GHSA-4f5j-9xgm-8pvr.
• Fixed profile photo path traversal in AccountsService writes by validating account IDs and using O_NOFOLLOW when writing generated files.
• Tightened token validation so alias-domain matches also require the UPN local part to match, preventing a different user from unlocking another user’s GDM session via QR/Bluetooth passkey authentication.
• Hardened HSM PIN file handling with explicit path validation and corrected the allowlist to include the real daemon state and systemd credential directories.
• Hardened the SQLite authentication cache by creating database files with owner-only permissions.
• Replaced the vulnerable RustCrypto rsa dependency with an aws-lc-rs backed compatibility shim.
• Patched or updated dependencies for security advisories, including OpenTelemetry baggage propagation, anyhow, aws-lc, rustls-webpki, OpenSSL, and related transitive crates.
• Restricted SSPR Hello fallback behavior to local login scenarios and blocked remote Hello PIN and Hello password reauthentication paths while offline.
• Delayed break-glass password caching until MFA succeeds, avoiding premature credential persistence when multi-factor authentication has not completed.
• Validated OIDC group UUIDs before performing name matching, reducing the risk of ambiguous or malformed group-claim handling.
• Authenticated the systemd daemon-call bypass path to prevent unauthenticated callers from reaching privileged daemon operations.

Authentication and MFA

• Added automatic MFA fallback when a configured MFA method is unavailable on the user’s account, preventing repeated password prompts and infinite retry loops. Fixes #1390.
• Retried initial device enrollment with MFA when Entra requires strong authentication for device registration, allowing first login to complete in tenants that enforce MFA for join operations. Fixes #1344.
• Added support for OIDC Resource Owner Password Credential flow for local console password-only authentication when the provider advertises support, with fallback to device flow when MFA or other provider behavior requires it.
• Added configurable OIDC account ID claims and OIDC login group filtering using group and role claims.
• Skipped Entra-specific post-authentication tasks, such as Kerberos cache and profile photo fetches, when authenticating through OIDC.
• Fixed password-change handling in password-only authentication so first-login or expired-password users are routed through the PAM password-change conversation instead of receiving a generic error. Fixes #1432.
• Improved password-change retry behavior by reporting provider failures and prompting for a new password again without discarding the original password.
• Added enable_passwordless, enable_passwordless_security_key, and enable_passwordless_qr_bluetooth configuration controls for passwordless authentication behavior.
• Added cross-device FIDO2/passkey login using QR/Bluetooth caBLE for supported graphical display managers, while retaining security-key based passwordless login.
• Improved WebAuthn and FIDO user-facing errors and greeter prompts, including security-key icons, touch animation, configurable prompts, and clearer user-verification failures.
• Added configurable mfa_poll_prompt_services so services such as SSH and Cockpit can use the PAM prompt-flush workaround. Fixes #1453.
• Added a PAM try_unseal mode for local mapped users, allowing a matching local login password to asynchronously unseal the Himmelblau secret without blocking or failing the login.
• Added no_info_prompt PAM option to fold informational text into the password prompt for clients that cannot handle standalone PAM_TEXT_INFO, improving compatibility with OpenSSH and MariaDB PAM clients.
• Fixed local user password changes by returning PAM_IGNORE during both password-change phases for local users, allowing pam_unix to handle them correctly. Fixes #1199.
• Preserved orchestrator-derived password prompts, long prompts, and text inputs through PAM conversations.

Browser-Orchestrated OIDC Sign-In

• Added the new himmelblaud-orchestrator component for browser-driven OIDC MFA flows, with provider definitions, container integration, IPC, systemd packaging, and fallback behavior.
• Added Keycloak as the first browser-orchestrated provider, including support for password updates, new-user required actions, OTP setup, profile verification prompts, retrying rejected prompts, and terminal failure handling.
• Added Okta device activation support as an additional orchestrator provider.
• Added DOM-based branching and prompt extraction so provider flows can react to visible browser state without provider-specific Rust code.
• Rendered Keycloak TOTP setup as QR prompts in the greeter, including username-based labels to make authenticator entries easier to identify.
• Marked orchestrator configuration as experimental and made the package a suggestion rather than a default recommended install to keep base daemon installations lighter.

Reliability and Login Behavior

• Fixed an offline-authentication deadlock that could occur after resume or network loss when online authentication failed while database locks were still held. This addresses the root cause of the HB1206 class of hangs.
• Shortened daemon startup waits during PAM authentication to avoid long login stalls when himmelblaud is unavailable.
• Added timeout-aware online probe clients for Entra and OIDC providers so network checks honor the configured request_timeout instead of waiting on long TCP timeouts.
• Added configurable request_timeout for environments where DNS returns many addresses or connections require longer Happy Eyeballs fallback windows. Fixes #1297.
• Added configurable IP version selection, allowing administrators to disable IPv6 or otherwise control address-family behavior.
• Retried transient or throttled user-existence lookups with jittered backoff before denying sign-in.
• Fixed bad-domain PAM authentication lockups.
• Fixed a decoupled Hello key PRT authentication deadlock by reducing mutex hold time and bounding PRT refresh attempts.
• Fixed daemon/provider locking issues by reducing lock scope, avoiding re-entrant locking in OIDC paths, and using OnceCell for provider initialization.
• Preserved desktop session selection across profile handling.
• Fixed broker token expiration unit handling so expiresOn is consistently reported in milliseconds.
• Preserved PRTs across service restarts using systemd FD Store, reducing forced reauthentication after package upgrades or service restarts.
• Added opportunistic PRT refresh after four hours and corrected token-cache purging for stale entries.
• Added systemd watchdog support for services and bounded custom compliance script execution to prevent hung tenant scripts from killing the task daemon.
• Hid problematic EFI MOK variable paths from himmelblaud-tasks so mokutil-based compliance scripts do not spin indefinitely under restricted capabilities.

NSS, PAM, Groups, and Local Identity

• Added NSS shadow lookups for Himmelblau users so pam_unix account checks and systemd user sessions work correctly with NSS-resolved Entra users. Fixes SUSE bsc#1267997.
• Avoided locked synthetic shadow entries that caused GDM to hide Himmelblau users.
• Implemented targeted NSS initgroups_dyn support to avoid slow full group enumeration during session setup.
• Restored an initgroups fallback path when targeted group lookup returns no supplemental groups.
• Rejected non-directory names before probing Entra GetCredentialType, preventing system users, greeter users, and invalid names from consuming tenant or per-IP throttling. Refs #1392.
• Added periodic local group reconciliation so cached Entra users remain aligned with configured sudo_groups between logins.
• Fixed local group membership parsing.
• Fixed pam_allow_groups enforcement on Debian/Ubuntu by making account-phase denials terminal while preserving local-user fallback through PAM_IGNORE.
• Preserved Debian PAM account jumps generated by pam-auth-update, avoiding broken generated PAM stacks.
• Added tests for sudo_groups behavior.
• Blocked local group-name collisions in NSS group lookup to preserve protections against privileged local group shadowing.

Hello, TOTP, Break-Glass, and Offline Authentication

• Added offline Hello TOTP setup during offline PIN authentication when enabled but not yet enrolled.
• Skipped Hello TOTP for local password-only sessions while continuing to require it for configured remote sessions.
• Provided the Hello TOTP secret alongside the QR code for enrollment flows.
• Reset Hello TOTP material when a Hello PIN change provisions a replacement Hello key. Fixes #1393.
• Cleared Hello-bound refresh tokens and TOTP secrets during full Hello cache clearing to avoid stale sealed secrets. Fixes #1393.
• Counted too-short PIN attempts toward the PIN reset counter.
• Rejected Hello password reauthentication while offline and blocked remote Hello PIN during offline authentication.
• Made SSPR fallback for Hello users more permissive only in local-login contexts so users can reach a browser to complete enrollment without weakening remote/offline behavior.

Intune, Compliance, and Policy Application

• Added aad-tool compliance-check support and a per-user systemd timer that can run compliance checks every eight hours for logged-in users.
• Moved automatic Intune policy application after successful PAM authentication into a background task so logins are not blocked by policy processing.
• Added throttling for automatic policy application to avoid spawning repeated enforcement on frequent logins.
• Added a configurable logon script timeout using the daemon task wait timeout.
• Bounded custom compliance script execution to 60 seconds, kills the process group on timeout, and logs runtime details so administrators can diagnose slow or hung tenant scripts.
• Disabled automatic apply_policy by default, requiring administrators to opt in when they want login-triggered policy application.
• Skipped Intune policy token requests for OIDC authentication paths.

Broker, SSO, and Microsoft 365 Integration

• Added interactive broker token acquisition using pinentry, including support for FIDO2 PIN prompts.
• Added Proof-of-Possession token support for broker token acquisition, enabling scenarios such as Azure Virtual Desktop / Cloud PC scopes that require PoP tokens.
• Added support for caller-supplied redirect URIs in broker token acquisition.
• Added aad-tool test-auth --force-reauth to force a full authentication flow for applications with login-frequency policies.
• Fixed broker interactive flows to prefer Hello PIN for Interactive Edge authentication and avoid sending Unicode QR art through pinentry.
• Updated the Linux Entra SSO browser extension policy to newer Siemens Linux Entra SSO releases and replaced older managed Mozilla policy URLs during upgrades.
• Added Thunderbird, Betterbird, Firefox, and Chrome/Chromium SSO policy improvements, including install/remove handling and missing update URL fixes.
• Cleaned SSO policies correctly during RPM erase and improved Mozilla policy logging.

QR Greeter and Graphical Login

• Added QR display for device authentication flows and replaced static QR image assets with generated QR SVG/geometry.
• Fixed QR greeter handling for Microsoft’s 9-character no-hyphen user code format.
• Embedded user codes in QR rendering to avoid overlap on small screens.
• Kept QR greeter SVG files private under the runtime directory.
• Avoided font usage inside sandboxed GNOME QR SVG rendering to prevent blank QR containers under glycin/librsvg sandboxing.
• Preserved untagged multi-line messages so GDM displays the full prompt instead of only the last line.
• Added GNOME Shell 50 support for the QR greeter extension.
• Improved QR greeter package install/remove behavior across Debian, Fedora, and GDM user variants.

Configuration and Compatibility

• Added layered configuration file support following the UAPI configuration files specification, including /usr, /run, and /etc hierarchy handling, masking, and drop-ins.
• Installed default configuration under /usr/lib, allowing administrators to override configuration cleanly in /etc or runtime layers.
• Updated SELinux and AppArmor policy to allow layered configuration paths.
• Generated the example himmelblau.conf from configuration metadata so examples stay aligned with supported options.
• Removed deprecated domain-specific configuration examples from the shipped sample configuration.
• Added or documented new configuration options for:
  • request_timeout
  • ip_version
  • passwordless authentication controls
  • FIDO prompts and timeout
  • QR/Bluetooth prompt
  • orchestrator settings
  • OIDC account ID claims
  • OIDC group filtering behavior
  • Kerberos cache enablement
  • profile picture fetching
  • local group reconciliation interval
  • logon script timeout
  • MFA poll prompt services
• Restored the requirement that a provider be explicitly configured via domain or oidc_issuer_url, preventing unscoped any-tenant authentication.
• Updated the Rust MSRV to 1.85.

Kerberos and Token Handling

• Added Kerberos TGT storage using libkrimes and moved Kerberos credentials into the kernel keyring.
• Added configuration for enabling Kerberos cache creation and profile picture fetching.
• Wrote Kerberos configuration snippets through the resolver interface and ensured the Kerberos config directory exists.
• Removed obsolete/non-working packaged Kerberos snippet handling and dead ccache directory code.
• Added PrivateTmp back to the tasks daemon now that Kerberos credentials no longer depend on the system /tmp.

Packaging / Build / CI

• Added Arch Linux packaging, including PKGBUILD, install hooks, make arch, pacman host detection, and package builder support.
• Added Ubuntu 26.04 / Resolute and Fedora 44 packaging targets.
• Added ARM64 RPM tooling to target images and regression coverage for generated ARM64 RPM Dockerfiles.
• Fixed RPM upgrades so existing himmelblau.conf files restored from .rpmsave are not lost during package layout changes.
• Fixed SSHD configuration ordering on Fedora/RHEL by installing Himmelblau’s sshd drop-in earlier so keyboard-interactive authentication is enabled. Fixes #1348.
• Added AppArmor package split/support files and fixed Debian AppArmor takeover relationships for upgrades from affected nightlies.
• Added AppArmor rules for runc, crun, cupsd, fusermount3, unix-chkpwd, and the orchestrator container.
• Improved SELinux policy coverage for newer distributions, task daemon capabilities, image builds, and additional Fedora/openSUSE denials.
• Added tpm2-tss as an accepted RPM provider for the tss user dependency.
• Migrated Nix builds to crate2nix, added generated Cargo.nix, added checks to ensure it stays current, and improved Nix shell/module support.
• Added Nix module fixes for cache directories, read/write paths, AF_INET/AF_INET6 sandboxing, and string-list defaults.
• Rewrote idmap from C to safe Rust, removing vendored C sources and bindgen/cc usage while preserving behavior and adding parity tests.
• Added release automation for GitHub Releases, linked external package artifacts, SBOM links, release-note generation, and stable branch handling.
• Added OBS stable branch automation and limited OBS credential exposure.
• Added CI coverage for formatting, unused dependency detection, cargo-udeps, dependency-breadth analysis, crate2nix freshness, Socket firewall checks, fuzz build recursion, and generated Dockerfiles.
• Added tooling for dependency cleanup, patch/mask shim generation, local cargo-vet diffs, and cargo-vet metadata refreshes.
• Updated many Rust dependencies and GitHub Actions, including libhimmelblau, libwebauthn, reqwest, tokio, rustls, zbus, serde, clap, uuid, futures, actions/checkout, actions/cache, CodeQL, Scorecard, Harden Runner, and Nix-related actions.

Documentation

• Added gettext/i18n infrastructure for authentication prompts and Weblate-style PO catalogs.
• Added translations for many locales, including German, French, Spanish, Hindi, Serbian Latin, Canadian French, Portuguese, Catalan, Urdu, Amharic, Afaan Oromoo, Tigrinya, Simplified Chinese, Japanese, Italian, Turkish, Uzbek, Arabic, Dutch, Indonesian, Korean, Bulgarian, Bengali, Czech, Danish, Greek, Finnish, Hebrew, Hungarian, Norwegian Bokmål, Polish, Romanian, Slovak, Swedish, Thai, Ukrainian, Vietnamese, Estonian, Croatian, Lithuanian, Latvian, and Slovenian.
• Added i18n helper scripts for updating POT/PO files, compiling translations, checking catalogs, and generating translations.
• Regenerated and corrected man pages for aad-tool, himmelblau.conf, and pam_himmelblau.
• Documented layered configuration precedence and the new PAM options.
• Added documentation and examples for new authentication, OIDC, orchestrator, policy, and configuration options.
• Added contributor policy, updated contributor guidance, and introduced stricter PR templates/checks for system-integration changes.
• Updated README and platform documentation for new distribution targets and packaging behavior.

Known Issues

• The browser-orchestrated OIDC flow is still marked experimental. Administrators should explicitly enable and test it with their identity provider before deploying it broadly.
• The orchestrator depends on container/runtime integration and provider-specific flow definitions; unsupported or customized provider login pages may still require fallback to the existing device authorization flow.

---

Packages

• Stable packages: https://packages.himmelblau-idm.org/stable/4.0.0/
• SBOM: https://packages.himmelblau-idm.org/stable/4.0.0/sbom/sbom.json