search

aad-for-linux / pam_aad

Azure Active Directory PAM Module
GNU General Public License v3.0
22 stars 9 forks source link

Allow access if group_id is an empty string #7

Open oxr463 opened 2 years ago

oxr463 commented 2 years ago

This change makes it so that the group membership check is skipped if group_id is empty.

The reasoning is that if our azure app is not authorised to read group membership with /checkMemberGroups, then this is a way to make pam_aad not worry about it, rather than error. (And group based access can be enforced with other PAM modules, if required.)

Source: https://github.com/CyberNinjas/pam_aad/pull/61