[PR #5977] feat: Entra/Intune device authentication as a new peer-registration method #27240

New Issue

saavagebueno · 2026-08-05T07:08:25-04:00

saavagebueno commented

2026-08-05 07:08:25 -04:00

📋 Pull Request Information

Original PR: https://github.com/netbirdio/netbird/pull/5977
Author: @thvevirtue
Created: 4/24/2026
Status: 🔄 Open

Base: main ← Head: feature/entra-device-auth

📝 Commits (10+)

bd3a7e4 entra_device: Phase 1 server skeleton
09c4bc2 entra_device: wire into AccountManager + HTTP router
8c921a7 entra_device: unit tests for enrolment flow + peer-registration integration
e7667d5 entra_device: test harness (Dockerfile + compose + synthetic client) + dex CGO shim
783117e enroll-tester: add --demo mode for in-process end-to-end verification
b47a05a docs: user-facing documentation for Entra device auth
17e718d entra-test: fix docker-compose flags + config for real bring-up
9b27c0f entra-test: seed-account helper + expose Postgres port
50c249d docs: record live-tenant verification matrix
d38984e client/entradevice: PFX CertProvider + Enroller + tests (Phase 2 core)

📊 Changes

53 files changed (+7647 additions, -95 deletions)

View changed files

➕ client/cmd/entra_enroll.go (+330 -0)
📝 client/cmd/root.go (+1 -0)
➕ client/internal/enroll/entradevice/enroller.go (+256 -0)
➕ client/internal/enroll/entradevice/enroller_test.go (+250 -0)
➕ client/internal/enroll/entradevice/provider.go (+145 -0)
➕ client/internal/enroll/entradevice/state.go (+41 -0)
📝 client/internal/profilemanager/config.go (+7 -0)
➕ client/internal/profilemanager/config_entra.go (+19 -0)
➕ docs/ENTRA_DEVICE_AUTH.md (+523 -0)
📝 go.mod (+1 -0)
📝 go.sum (+2 -0)
📝 idp/dex/config.go (+1 -1)
📝 idp/dex/provider.go (+2 -4)
➕ idp/dex/sqlite_cgo.go (+18 -0)
➕ idp/dex/sqlite_nocgo.go (+20 -0)
➕ management/Dockerfile.entra-test (+89 -0)
📝 management/internals/server/boot.go (+24 -1)
➕ management/server/entra_device_enroll.go (+329 -0)
📝 management/server/http/handler.go (+181 -87)
➕ management/server/http/handlers/entra_device_auth/e2e_test.go (+395 -0)

...and 33 more files

📄 Description

Entra / Intune Device Authentication — a third peer-registration method

What this PR adds

A new way for devices to join a NetBird network, alongside setup keys and SSO: the device itself authenticates using an Entra-issued certificate, with zero user interaction. Admins map Entra security groups to NetBird auto-groups; the device ends up in the right NetBird groups based on its Entra membership.

The feature is served on a dedicated endpoint path (/join/entra) so it never mixes with the existing gRPC Login/Sync surface or the admin /api surface.

Deployment story

Intune PKCS Certificate profile → PFX on device
                ↓
netbird entra-enroll --management-url https://<mgmt>/join/entra \
                     --entra-tenant YOUR_TENANT \
                     --entra-pfx    device.pfx \
                     --entra-pfx-password-env NB_ENTRA_PFX_PASSWORD
                ↓
netbird up                  ← normal gRPC login, peer already registered

Design in one page

Admin configures an EntraDeviceAuth integration (tenant id, app credentials, compliance requirements) and EntraDeviceAuthMapping rows that pair Entra security group IDs with NetBird auto-groups.
Device calls GET /join/entra/challenge → server issues a single-use 32-byte nonce (60s TTL).
Device signs the nonce with its device cert private key (RSA-PSS / PKCS1v15 / ECDSA all accepted).
Device POSTs /join/entra/enroll with cert chain + signed nonce + WG pubkey.
Server validates:
- Cert chain + nonce signature (cryptographic proof of private-key possession).
- Microsoft Graph lookup: device exists + accountEnabled == true; optionally complianceState == compliant via Intune.
- Transitive group membership enumeration via Graph.
- Mapping resolution (strict_priority or union mode, with wildcard + tenant-only fallback options).
Peer is created in NetBird's DB, assigned to the resolved auto-groups + the All group, with proper IP allocation + DNS label + integrated peer validator hooks (approval workflow still applies).
Server emits a PeerAddedWithEntraDevice activity event with full audit meta (device id, matched mapping ids, resolution mode, applied auto-groups).
Server returns a LoginResponse-shaped JSON + a one-shot bootstrap token. The client persists state and proceeds with normal gRPC Login using the WG pubkey the server already knows about.

What's landed

Server

management/server/types/entra_device_auth.go — domain model (EntraDeviceAuth, EntraDeviceAuthMapping, MappingResolution).
management/server/integrations/entra_device/ — cert validator (RSA/ECDSA), Graph client (OAuth2 client-credentials, device lookup, transitiveMemberOf, compliance), single-use nonce store, strict_priority + union mapping resolver, gorm-backed Store, manager orchestrator, activity codes.
management/server/http/handlers/entra_join/ — public /join/entra/{challenge,enroll} routes.
management/server/http/handlers/entra_device_auth/ — admin CRUD on /api/integrations/entra-device-auth{,/mappings}.
management/server/entra_device_enroll.go — DefaultAccountManager.EnrollEntraDevicePeer (reuses IP allocation, retries, group assignment, integrated peer validator, activity events).
management/server/permissions/modules/module.go — new EntraDeviceAuth permission module.
idp/dex/{config,provider}.go + sqlite_{cgo,nocgo}.go — bonus fix: split Dex SQLite3 construction behind a CGO build tag so builds work under CGO_ENABLED=0 (was a pre-existing upstream break).

Client

client/internal/enroll/entradevice/ — pluggable CertProvider interface + PFX-backed implementation + challenge/enroll orchestrator + structured server-error decoding.
client/cmd/entra_enroll.go — netbird entra-enroll subcommand with full CLI.
client/internal/profilemanager/config.go — EntraEnroll *EntraEnrollState field persisted per profile so re-enrolment is skipped on subsequent runs.

Test harness

tools/entra-test/docker-compose.yml + Dockerfile.entra-test — full local deployment (Postgres + management, auto-migrated tables).
tools/entra-test/enroll-tester/ — synthetic client with --demo mode (in-process handler + fake Graph) for zero-dependency E2E verification.
tools/entra-test/seed-account/ — creates a minimal NetBird account row for testing without an IdP.
tools/entra-test/make-pfx/ — generates test PFX files.
tools/entra-test/TESTING.md — step-by-step walkthrough.

Docs

docs/ENTRA_DEVICE_AUTH.md — user/admin-facing documentation: concepts, resolution semantics, error codes, REST API reference, enrolment protocol reference, security notes, live-tenant verification matrix, future work.

Testing

Unit tests (all green)

management/server/integrations/entra_device/ — 20+ tests covering mapping resolution (priority, union, tie-break, revoked/expired filtering, wildcard, fallback), nonce store (single-use, TTL, concurrent), cert validator (RSA-PSS, PKCS1v15, ECDSA, tampered sig, expired, garbage), manager (happy path, union merge, unknown tenant, disabled integration, bad nonce, disabled device, missing device, fail-closed Graph errors, compliance pass/fail/API-failure, no mapping matched, device-id mismatch, nonce single-use), store (CRUD + bootstrap token lifecycle).
management/server/http/handlers/entra_join/ — 4 tests with full HTTP round-trip (real cert + signed nonce, error code mapping, malformed JSON).
client/internal/enroll/entradevice/ — 7 tests covering PFX load (happy, wrong password, missing file), enroller round-trip, structured server error decode, input validation, trailing /join/entra tolerance.

Live-tenant verification

Run end-to-end against a real Entra tenant using the Docker harness:

Scenario	Input	Expected	Actual
Happy path, wildcard mapping	real device, compliance off	success, peer created	✅
Happy path, specific-group mapping	same real device	success, peer created	✅
Device not in mapped Entra group	real device, non-matching mapping	`403 no_mapping_matched`	✅
Device absent from Entra	bogus device GUID	`403 device_disabled`	✅
Compliance on, compliant device	compliant device id	success, peer created	✅
Compliance on, non-compliant device	non-compliant device id	`403 device_not_compliant`	✅

Every reject path is atomic — zero rows written on any 4xx/5xx outcome. See docs/ENTRA_DEVICE_AUTH.md#live-tenant-verification-results for the full matrix.

End-to-end Phase 2 client run

Built netbird.exe from this branch; ran:

netbird entra-enroll --management-url http://localhost:33073/join/entra \
  --entra-tenant 5a7a81b2-99cc-45fc-b6d1-cd01ba176c26 \
  --entra-pfx device.pfx \
  --entra-pfx-password-env NB_ENTRA_PFX_PASSWORD

→ ENROLMENT SUCCESS. Peer appeared in Postgres (peers + group_peers rows), /join/entra stripped from the saved ManagementURL, EntraEnroll state persisted to the profile config file.

Explicit non-goals / follow-ups

Windows cert store + TPM-backed CNG signing. Scoped, researched, deliberately deferred. CertProvider interface is shaped so it drops in next to PFXProvider without enroller changes. Two routes documented: CGO+smimesign vs pure-Go ncrypt.dll syscalls. See docs/ENTRA_DEVICE_AUTH.md#future-work.
enrollmentBootstrapToken proto field on LoginRequest. Manager.ValidateBootstrapToken is implemented + tested but not yet invoked from the gRPC Login path (requires a proto regen). Post-enrolment Login currently works because the WG pubkey already identifies the peer; the bootstrap token just adds belt-and-braces for a narrow race window.
Continuous revalidation (Phase 5). Reserved field revalidation_interval exists on the integration; no background scheduler yet.
Auto-routing in netbird up. Today entra-enroll is a separate subcommand. A follow-up can detect /join/entra in the URL passed to up and run the enrolment automatically.
Dashboard UI (Phase 4). Admin configuration happens via the REST API today. UI work in netbirdio/dashboard is a separate PR.

Compatibility + safety

Zero breaking changes. All new types live in new packages; the only existing file modifications are:
- management/server/http/handler.go — adds two bypass paths (/join/entra/*) + one installEntraDeviceAuth call (best-effort — logs a warning and skips if interfaces don't match).
- management/server/permissions/modules/module.go — adds one Module constant.
- client/internal/profilemanager/config.go — adds one nullable EntraEnroll field.
- idp/dex/{config,provider}.go — route SQLite3 construction through a build-tagged shim.
Feature-flagged by data. If no EntraDeviceAuth row exists for an account, the /join/entra endpoints simply return 404 integration_not_found. No observable behaviour change for existing deployments.
Server accepts CGO_ENABLED=0 builds. Everything new compiles on the standard pipeline without a C toolchain.

Branch commits

9f04a0c entra_device: address SonarCloud feedback (complexity + creds)
688239f docs: bump Entra device auth status header (Phase 2 shipped)
cb3c676 entra_device: defer Windows cert-store provider to a follow-up
d4228d8 client: netbird entra-enroll subcommand (Phase 2 complete)
d38984e client/entradevice: PFX CertProvider + Enroller + tests (Phase 2 core)
50c249d docs: record live-tenant verification matrix
9b27c0f entra-test: seed-account helper + expose Postgres port
17e718d entra-test: fix docker-compose flags + config for real bring-up
b47a05a docs: user-facing documentation for Entra device auth
783117e enroll-tester: add --demo mode for in-process end-to-end verification
e7667d5 entra_device: test harness (Dockerfile + compose + synthetic client) + dex CGO shim
8c921a7 entra_device: unit tests for enrolment flow + peer-registration integration
09c4bc2 entra_device: wire into AccountManager + HTTP router
bd3a7e4 entra_device: Phase 1 server skeleton

~6,300 insertions, 43 files. Every line committed has been either unit-tested or live-tested.

Summary by CodeRabbit

New Features
- Entra/Intune device authentication: challenge/enroll flow, tenant/device enrollment, mapping resolution (strict/union), one-shot bootstrap tokens, and admin APIs for integrations and mappings.
- CLI enrollment: new command to perform device enrollment, persist enrollment state locally, and display enrollment result (peer ID, URL, resolved groups).
Documentation
- Full Entra device auth guide and end-to-end testing docs.
Tests & Tools
- Extensive tests and local tooling (enroll-tester, demo server, make-pfx, seed-account, Docker Compose).

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/netbirdio/netbird/pull/5977 **Author:** [@thvevirtue](https://github.com/thvevirtue) **Created:** 4/24/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `feature/entra-device-auth` --- ### 📝 Commits (10+) - [`bd3a7e4`](https://github.com/netbirdio/netbird/commit/bd3a7e4b303d96dc17276846f2b22f9fee3fbf83) entra_device: Phase 1 server skeleton - [`09c4bc2`](https://github.com/netbirdio/netbird/commit/09c4bc2b15f709fa232fc79f8ceaf1181ce25e80) entra_device: wire into AccountManager + HTTP router - [`8c921a7`](https://github.com/netbirdio/netbird/commit/8c921a7fb73d0b04c67ea2a0ccaba298b03abd6d) entra_device: unit tests for enrolment flow + peer-registration integration - [`e7667d5`](https://github.com/netbirdio/netbird/commit/e7667d5c9654808568e91e3ad15e586c75eb6308) entra_device: test harness (Dockerfile + compose + synthetic client) + dex CGO shim - [`783117e`](https://github.com/netbirdio/netbird/commit/783117e437fb59b2b56164a8b402aee3a7e217e8) enroll-tester: add --demo mode for in-process end-to-end verification - [`b47a05a`](https://github.com/netbirdio/netbird/commit/b47a05adf24a79d7eb7e93ed4a07da0b6da7ce60) docs: user-facing documentation for Entra device auth - [`17e718d`](https://github.com/netbirdio/netbird/commit/17e718d9d4a8e4d28934cddabd0778592d3a3e8c) entra-test: fix docker-compose flags + config for real bring-up - [`9b27c0f`](https://github.com/netbirdio/netbird/commit/9b27c0f37580c7453778c3337caed193de5449bb) entra-test: seed-account helper + expose Postgres port - [`50c249d`](https://github.com/netbirdio/netbird/commit/50c249d77da6e2f2e082788a007e66559b9e39b8) docs: record live-tenant verification matrix - [`d38984e`](https://github.com/netbirdio/netbird/commit/d38984e580d916521da7252b6f7b979eae75a62d) client/entradevice: PFX CertProvider + Enroller + tests (Phase 2 core) ### 📊 Changes **53 files changed** (+7647 additions, -95 deletions) <details> <summary>View changed files</summary> ➕ `client/cmd/entra_enroll.go` (+330 -0) 📝 `client/cmd/root.go` (+1 -0) ➕ `client/internal/enroll/entradevice/enroller.go` (+256 -0) ➕ `client/internal/enroll/entradevice/enroller_test.go` (+250 -0) ➕ `client/internal/enroll/entradevice/provider.go` (+145 -0) ➕ `client/internal/enroll/entradevice/state.go` (+41 -0) 📝 `client/internal/profilemanager/config.go` (+7 -0) ➕ `client/internal/profilemanager/config_entra.go` (+19 -0) ➕ `docs/ENTRA_DEVICE_AUTH.md` (+523 -0) 📝 `go.mod` (+1 -0) 📝 `go.sum` (+2 -0) 📝 `idp/dex/config.go` (+1 -1) 📝 `idp/dex/provider.go` (+2 -4) ➕ `idp/dex/sqlite_cgo.go` (+18 -0) ➕ `idp/dex/sqlite_nocgo.go` (+20 -0) ➕ `management/Dockerfile.entra-test` (+89 -0) 📝 `management/internals/server/boot.go` (+24 -1) ➕ `management/server/entra_device_enroll.go` (+329 -0) 📝 `management/server/http/handler.go` (+181 -87) ➕ `management/server/http/handlers/entra_device_auth/e2e_test.go` (+395 -0) _...and 33 more files_ </details> ### 📄 Description # Entra / Intune Device Authentication — a third peer-registration method ## What this PR adds A new way for devices to join a NetBird network, alongside setup keys and SSO: **the device itself authenticates using an Entra-issued certificate, with zero user interaction**. Admins map Entra security groups to NetBird auto-groups; the device ends up in the right NetBird groups based on its Entra membership. The feature is served on a **dedicated endpoint path** (`/join/entra`) so it never mixes with the existing gRPC `Login`/`Sync` surface or the admin `/api` surface. ## Deployment story ``` Intune PKCS Certificate profile → PFX on device ↓ netbird entra-enroll --management-url https://<mgmt>/join/entra \ --entra-tenant YOUR_TENANT \ --entra-pfx device.pfx \ --entra-pfx-password-env NB_ENTRA_PFX_PASSWORD ↓ netbird up ← normal gRPC login, peer already registered ``` ## Design in one page 1. **Admin configures** an `EntraDeviceAuth` integration (tenant id, app credentials, compliance requirements) and `EntraDeviceAuthMapping` rows that pair Entra security group IDs with NetBird auto-groups. 2. **Device calls** `GET /join/entra/challenge` → server issues a single-use 32-byte nonce (60s TTL). 3. **Device signs** the nonce with its device cert private key (RSA-PSS / PKCS1v15 / ECDSA all accepted). 4. **Device POSTs** `/join/entra/enroll` with cert chain + signed nonce + WG pubkey. 5. **Server validates**: - Cert chain + nonce signature (cryptographic proof of private-key possession). - Microsoft Graph lookup: device exists + `accountEnabled == true`; optionally `complianceState == compliant` via Intune. - Transitive group membership enumeration via Graph. - Mapping resolution (`strict_priority` or `union` mode, with wildcard + tenant-only fallback options). 6. **Peer is created** in NetBird's DB, assigned to the resolved auto-groups + the All group, with proper IP allocation + DNS label + integrated peer validator hooks (approval workflow still applies). 7. **Server emits** a `PeerAddedWithEntraDevice` activity event with full audit meta (device id, matched mapping ids, resolution mode, applied auto-groups). 8. **Server returns** a `LoginResponse`-shaped JSON + a one-shot bootstrap token. The client persists state and proceeds with normal gRPC Login using the WG pubkey the server already knows about. ## What's landed ### Server - `management/server/types/entra_device_auth.go` — domain model (`EntraDeviceAuth`, `EntraDeviceAuthMapping`, `MappingResolution`). - `management/server/integrations/entra_device/` — cert validator (RSA/ECDSA), Graph client (OAuth2 client-credentials, device lookup, transitiveMemberOf, compliance), single-use nonce store, `strict_priority` + `union` mapping resolver, gorm-backed Store, manager orchestrator, activity codes. - `management/server/http/handlers/entra_join/` — public `/join/entra/{challenge,enroll}` routes. - `management/server/http/handlers/entra_device_auth/` — admin CRUD on `/api/integrations/entra-device-auth{,/mappings}`. - `management/server/entra_device_enroll.go` — `DefaultAccountManager.EnrollEntraDevicePeer` (reuses IP allocation, retries, group assignment, integrated peer validator, activity events). - `management/server/permissions/modules/module.go` — new `EntraDeviceAuth` permission module. - `idp/dex/{config,provider}.go` + `sqlite_{cgo,nocgo}.go` — **bonus fix**: split Dex SQLite3 construction behind a CGO build tag so builds work under `CGO_ENABLED=0` (was a pre-existing upstream break). ### Client - `client/internal/enroll/entradevice/` — pluggable `CertProvider` interface + PFX-backed implementation + challenge/enroll orchestrator + structured server-error decoding. - `client/cmd/entra_enroll.go` — `netbird entra-enroll` subcommand with full CLI. - `client/internal/profilemanager/config.go` — `EntraEnroll *EntraEnrollState` field persisted per profile so re-enrolment is skipped on subsequent runs. ### Test harness - `tools/entra-test/docker-compose.yml` + `Dockerfile.entra-test` — full local deployment (Postgres + management, auto-migrated tables). - `tools/entra-test/enroll-tester/` — synthetic client with `--demo` mode (in-process handler + fake Graph) for zero-dependency E2E verification. - `tools/entra-test/seed-account/` — creates a minimal NetBird account row for testing without an IdP. - `tools/entra-test/make-pfx/` — generates test PFX files. - `tools/entra-test/TESTING.md` — step-by-step walkthrough. ### Docs - `docs/ENTRA_DEVICE_AUTH.md` — user/admin-facing documentation: concepts, resolution semantics, error codes, REST API reference, enrolment protocol reference, security notes, live-tenant verification matrix, future work. ## Testing ### Unit tests (all green) - `management/server/integrations/entra_device/` — **20+ tests** covering mapping resolution (priority, union, tie-break, revoked/expired filtering, wildcard, fallback), nonce store (single-use, TTL, concurrent), cert validator (RSA-PSS, PKCS1v15, ECDSA, tampered sig, expired, garbage), manager (happy path, union merge, unknown tenant, disabled integration, bad nonce, disabled device, missing device, fail-closed Graph errors, compliance pass/fail/API-failure, no mapping matched, device-id mismatch, nonce single-use), store (CRUD + bootstrap token lifecycle). - `management/server/http/handlers/entra_join/` — **4 tests** with full HTTP round-trip (real cert + signed nonce, error code mapping, malformed JSON). - `client/internal/enroll/entradevice/` — **7 tests** covering PFX load (happy, wrong password, missing file), enroller round-trip, structured server error decode, input validation, trailing `/join/entra` tolerance. ### Live-tenant verification Run end-to-end against a real Entra tenant using the Docker harness: | Scenario | Input | Expected | Actual | |---|---|---|---| | Happy path, wildcard mapping | real device, compliance off | success, peer created | ✅ | | Happy path, specific-group mapping | same real device | success, peer created | ✅ | | Device not in mapped Entra group | real device, non-matching mapping | `403 no_mapping_matched` | ✅ | | Device absent from Entra | bogus device GUID | `403 device_disabled` | ✅ | | Compliance on, compliant device | compliant device id | success, peer created | ✅ | | Compliance on, non-compliant device | non-compliant device id | `403 device_not_compliant` | ✅ | Every reject path is atomic — zero rows written on any 4xx/5xx outcome. See `docs/ENTRA_DEVICE_AUTH.md#live-tenant-verification-results` for the full matrix. ### End-to-end Phase 2 client run Built `netbird.exe` from this branch; ran: ``` netbird entra-enroll --management-url http://localhost:33073/join/entra \ --entra-tenant 5a7a81b2-99cc-45fc-b6d1-cd01ba176c26 \ --entra-pfx device.pfx \ --entra-pfx-password-env NB_ENTRA_PFX_PASSWORD ``` → `ENROLMENT SUCCESS`. Peer appeared in Postgres (`peers` + `group_peers` rows), `/join/entra` stripped from the saved `ManagementURL`, `EntraEnroll` state persisted to the profile config file. ## Explicit non-goals / follow-ups 1. **Windows cert store + TPM-backed CNG signing.** Scoped, researched, deliberately deferred. `CertProvider` interface is shaped so it drops in next to `PFXProvider` without enroller changes. Two routes documented: CGO+smimesign vs pure-Go `ncrypt.dll` syscalls. See `docs/ENTRA_DEVICE_AUTH.md#future-work`. 2. **`enrollmentBootstrapToken` proto field on `LoginRequest`.** `Manager.ValidateBootstrapToken` is implemented + tested but not yet invoked from the gRPC Login path (requires a proto regen). Post-enrolment Login currently works because the WG pubkey already identifies the peer; the bootstrap token just adds belt-and-braces for a narrow race window. 3. **Continuous revalidation (Phase 5).** Reserved field `revalidation_interval` exists on the integration; no background scheduler yet. 4. **Auto-routing in `netbird up`.** Today `entra-enroll` is a separate subcommand. A follow-up can detect `/join/entra` in the URL passed to `up` and run the enrolment automatically. 5. **Dashboard UI (Phase 4).** Admin configuration happens via the REST API today. UI work in `netbirdio/dashboard` is a separate PR. ## Compatibility + safety - **Zero breaking changes.** All new types live in new packages; the only existing file modifications are: - `management/server/http/handler.go` — adds two bypass paths (`/join/entra/*`) + one `installEntraDeviceAuth` call (best-effort — logs a warning and skips if interfaces don't match). - `management/server/permissions/modules/module.go` — adds one `Module` constant. - `client/internal/profilemanager/config.go` — adds one nullable `EntraEnroll` field. - `idp/dex/{config,provider}.go` — route SQLite3 construction through a build-tagged shim. - **Feature-flagged by data.** If no `EntraDeviceAuth` row exists for an account, the `/join/entra` endpoints simply return `404 integration_not_found`. No observable behaviour change for existing deployments. - **Server accepts CGO_ENABLED=0 builds.** Everything new compiles on the standard pipeline without a C toolchain. ## Branch commits ``` 9f04a0c entra_device: address SonarCloud feedback (complexity + creds) 688239f docs: bump Entra device auth status header (Phase 2 shipped) cb3c676 entra_device: defer Windows cert-store provider to a follow-up d4228d8 client: netbird entra-enroll subcommand (Phase 2 complete) d38984e client/entradevice: PFX CertProvider + Enroller + tests (Phase 2 core) 50c249d docs: record live-tenant verification matrix 9b27c0f entra-test: seed-account helper + expose Postgres port 17e718d entra-test: fix docker-compose flags + config for real bring-up b47a05a docs: user-facing documentation for Entra device auth 783117e enroll-tester: add --demo mode for in-process end-to-end verification e7667d5 entra_device: test harness (Dockerfile + compose + synthetic client) + dex CGO shim 8c921a7 entra_device: unit tests for enrolment flow + peer-registration integration 09c4bc2 entra_device: wire into AccountManager + HTTP router bd3a7e4 entra_device: Phase 1 server skeleton ``` ~6,300 insertions, 43 files. Every line committed has been either unit-tested or live-tested.  ## Summary by CodeRabbit * **New Features** * Entra/Intune device authentication: challenge/enroll flow, tenant/device enrollment, mapping resolution (strict/union), one-shot bootstrap tokens, and admin APIs for integrations and mappings. * CLI enrollment: new command to perform device enrollment, persist enrollment state locally, and display enrollment result (peer ID, URL, resolved groups). * **Documentation** * Full Entra device auth guide and end-to-end testing docs. * **Tests & Tools** * Extensive tests and local tooling (enroll-tester, demo server, make-pfx, seed-account, Docker Compose).  --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

saavagebueno added the pull-request label 2026-08-05 07:08:25 -04:00

Sign in to join this conversation.

Branches Tags

main

add-management-ent-dashboard

fix/migrate-enterprise-ghcr-image

disambiguate_p2p_metrics

embedded-vnc

feat-post_quantum_ml_kem

mdm_integration

affected-peer-jwt-sync

debug-ui-memprofile-lazy-windows

refactor/ui-lazy-windows

add-atomic-cache-ops

debug-ui-memprofile

feat/agent-network-per-account-serving

fix_wg_watcher_cleanup

fix/wails-go-vendor

relay_transport_down_no_offer_storm

revert/component-types

wins_nrpt_dns_delegation

dependabot/github_actions/actions-a940c7c866

fix/quickstart-subnet-and-domain-alias

notification-localization

ssh-settings-elevation

refactor/peer-event-bus

fix/relay-proxy-redirect-when-ice-active

claude/agent-network-test-cases-p743vw

android/gui-integration

ice-stun-wg-demux

dependabot/npm_and_yarn/proxy/web/npm_and_yarn-b39864987c

agent-network-setup-poc

dependabot/go_modules/aws-sdk-8f849ebaed

dependabot/go_modules/otel-e34c790afd

dependabot/go_modules/testcontainers-de325c0dd6

dependabot/go_modules/wireguard-dbd6b95108

dependabot/go_modules/pion-5f703e1eca

dependabot/go_modules/gorm-2271c8195b

fix-login-needed-check

dependabot/go_modules/google.golang.org/grpc-1.82.1

revert/component-types-hookup

feature/ios-ssh

docs/agent-network-docs-update

dependabot/go_modules/github.com/aws/aws-sdk-go-v2/service/s3-1.106.3

dependabot/go_modules/github.com/pion/stun/v3-3.1.5

fix-ssh-authorized-users-multi-rule

peer-acl-multi-source

reverse-proxy-crowdsec-appsec

reverse-proxy-allow-match-or

client-local-metrics

lazy-conn-per-peer

lazy-conn-rosenpass

dependabot/go_modules/github.com/gopacket/gopacket-1.7.0

dependabot/go_modules/goauthentik.io/api/v3-3.2026050.6

dependabot/go_modules/github.com/pires/go-proxyproto-0.15.0

dependabot/go_modules/github.com/jackc/pgx/v5-5.10.0

dependabot/go_modules/github.com/oapi-codegen/runtime-1.6.0

dependabot/go_modules/github.com/eko/gocache/lib/v4-4.2.4

dependabot/go_modules/github.com/pkg/sftp-1.13.11

dependabot/go_modules/github.com/coreos/go-oidc/v3-3.20.0

ssh-windows-privilege-check

fix/explicit-cors-handling

fix/remove-math-rand

test/gui-memory-leak-fix

fix/ui-status-dispatch

install-script-ui-dependencies

fix/grpc-get-network-map

fix/subscribe-status-coalesce

fix/tray-menu-item-leak

fix/windows-tray-race

feature/changeset

worktree-dns-route-qtype-fallthrough

mlsmaycon-patch-2

feat/agent-network-ollama

proxy-tunnel-cache-ttl-env

coderabbitai/utg/1e5b0a5

grpc-acl

test/battery-drain

components-impl-drop-indexes-use-xids-no-resource-policy-map

fix/nmap-relevant-groups

e2e-guardrail-blocks-unselected-model

fix/lazyconn-cold-start-allowed-ips

vertex-guardrails-model-access-e2e

refactor/relay-foreign-cache

ci/trigger-release-tests

feature/kimi-3-agent-networks-dns-warmup

feature/dns-lazy-conn-warmup

daemon-ipc-acl

feature/ui-translation-key-parity-check

refactor/relay-foreign-cache-tests

fix/lazyconn-idle-keep-wg-peer

dmitri-propagate-auth-grant-types-on-combined

0.74.7-branch

diagnose-empty-vs-corrupt-state

windows-sleep-detector

fix/cli-up-wait-for-daemon

rp_key_persistency

feature/native-grpc

0.74.6-branch

0.74.6-branch-sync

0.74.5-branch-sync

0.74.4-branch

fix/remove-stale-peers-removal

fix/remove-stale-proxy-logic

fix/nsis-preserve-autostart-on-upgrade

dependabot/go_modules/goauthentik.io/api/v3-3.2026050.3

dependabot/go_modules/github.com/pkg/sftp-1.13.10

components-impl-drop-indexes

fix-reset-aggregation-window-flake

dependabot/go_modules/github.com/pion/dtls/v3-3.1.5

0.74.x

fix/relay-states-lock

update-process-pkg

update-gopsutil-v4

fix/relay_states_lock

increase-sysinfo-timeout

dependabot/go_modules/github.com/Azure/go-ntlmssp-0.1.1

dependabot/go_modules/github.com/eko/gocache/store/redis/v4-4.2.6

dependabot/go_modules/github.com/eko/gocache/lib/v4-4.2.3

fix/fail-to-create-upnp-port-mapping-on-opnsense-firewall

0.74.3-branch

fix/routeselector-atomic-exit-node

netmap_progressive_alignment

nmap/components-impl

dependabot/go_modules/github.com/jackc/pgx/v5-5.9.2

dependabot/go_modules/github.com/oapi-codegen/runtime-1.4.2

dependabot/go_modules/github.com/gopacket/gopacket-1.6.1

dependabot/go_modules/github.com/coreos/go-oidc/v3-3.19.0

dependabot/go_modules/github.com/pires/go-proxyproto-0.12.0

fix/signal-watchdog-sync-stop

docs/agent-network

test/affected-logic

fix/revert-ice-filter

refactor/simplify-affected-peers

pascal-filter-policies-by-direction

claude/lock-contention-peer-connect-g8t6au

dmitri-filter-policies-by-direction

refactor/migrate-profiles-to-go

profile-bindings-ios

fix/skip-restart-unchanged-route

fix/mgmt-cache-async-resolve

refactor/wails-update-105

client_lifetime_serialization_refactor

fix/browser-ssh-2

fix/ipv6-and-netstack-accept-loop

fix/browser-ssh

profile-id-name-test

refactor/mgmt-bootstrap

feat/getting-started-unified-wizard

socket-grpc-permissions

fix/mysql-index-migration

windows-dns-firewall

tests/enable-race-on-tests

ui-refactor-gtk3

feature/affected-peers-grpc

profile-id

lazyconn-first-packet-fix-v2

claude/focused-gates-VMTgb

ui-tray-linux-leftclick

fix/ctx-enrichment

daemon-owner

feature/android-client-ssh

worktree-accept-ra-forwarding

nmap/combined-deploy

task/align_protobuff_toolset

feature/session-extend

add-json-yaml-flags

refactor/ephemeral-cleanup

claude/webtransport-relay-wasm-mUjY9

claude/vnc-udp-feasibility-6KB1U

fix/wgport-config

e2e-windows-dns-combined

fix/login-cmd-root-flags

feat/reseller-openapi-spec

github-issue-resolver

add-steamos-support

fix-darwin-uninstaller

flutter-test

ci/freebsd-pkg-bootstrap

cached-serial-check-on-sync

fix-mgmt-cache-bypass-overlay

revert-easyjson-5938

revert-ice-5820

revert-firewalld-5928

refactor/permissions-manager

revert-dns-5935-systemd-resolved

revert-dns-5935-5945

revert-dns-5945-mgmt-cache

feature/log-most-busy-peers

prototype/ui-wails

coderabbitai/utg/8ae8f20

feature/use-peer-fqdn-on-https

release/0.68.3

add-slack-channel

claude/rdp-token-passthrough-eNcqW

transparent-proxy

fix/macos-stale-route-eexist

crowdsec-selfhosted

fix/remove-otel-units

entire/checkpoints/v1

fix/getting-started

feat/static-connectors-combined-server

feature/use-local-keys-embedded

feature/fleetdm

set-env-only-if-not-fork

feature/expose-has-channel

fix/connection-status-race

fix/filter-cgnat-cni-ice-candidates

feature/check-cert-locker-before-acme

test/proxy-fixes

test/proxy-mtu

prototype/ui-tauri

test/proxy-speed

fix-reused-ports

feat/migrate-to-embedded-idp

feature/add-serial-to-proxy-merged

deploy/proxy-serial

test/connection

feature/disable-legacy-port

feature/flag-to-disable-legacy-port

test/perftest

fix/http-redirect

poc-token-command

dn-reverse-proxy

prototype/reverse-proxy-rename

prototype/reverse-proxy-logs-pagination

feature/client-metrics

prototype/reverse-proxy-clusters

debug-dns-route

fix/win-dns-batch

add-extra-route-logs

job-stream-notify-disconnection-eof

deploy/secrets-manager

trigger-proxy-update

bug/update-ios-client-code-build-tags

sync-client-netmap-serial

log/conn-disconn

nmap/compaction-deploy

ci-win-test

feature/disk-encryption-check

wasm-debug

swap-dns-prio

fix/dex-config

feature/migrate-auto-groups-to-table

nmap/compaction

dex-nocgo-stub

feature/exclude-terraform-from-rate-limiting

test-freebsd

retries-refactor

coderabbitai/docstrings/b7e98ac

feat/integrate-zitadel

bug/ios-hanging-reconection

zitadel-idp

feat/network-map-serial

refactor/get-account-no-users

feat/auto-upgrade

feature/report-high-pat-id

feature/temporary-access-for-resource

fix/nmap-fwrules

dont-restart-dns

prototype/ui

update-gomobile

go-dns-for-ice

wasm-ldflags

test-ldflags

wasmbuild-test

feature/networks-s2s

vk/compare-nmaps

dbg/bothmaps

reorder-dns-shutdown

fix/relay-reconnection-race

fix/nmap-exitnodes

vk/debug/nmap-both

move-licensed-code

feat/better-daemon-connection-lost-message

feat/auto-update-2

test/timings

refactor/getaccount-raw

tests/nmap-getaccount

refactor/nmap

refactor/nmap-limit-buffer

feature/detect-mac-wakeup

feature/extract-modules

quick-setings

feat/sync-limiter

feature/store-cache-impl

fix-install-version

feature/store-metrics

feature/metrics-on-store

feature/use-gorm-cache

loadtest-signal

unsymmetrical-squash

refactor/reducate-signaling

test/update-reduce

feature/store-cache

feature/remote-debug

cli-ws-proxy-backend-addr

feat/mgmt-map-serial

snyk-fix-d9d0081a4c7f9137bdb59d0d50a141a2

snyk-fix-7415cea5a11acd66753540ca2c598c63

job-yml-update

feature/android-allow-selecting-routes

fix/up-sequence

fix/dns-hash-update

snyk-fix-967adae9863f17f108ce8948d9117b8d

log/getaccount-by-peer

signal-suppressor

dns-exit-node

feature/auto-updates

feature/cache-srv-key

merged-fixes

fix/missed-offers-and-debug

debug-and-fixes

poc-wasm-clean-backend-s2s

test/remote-debug

debug-api

fix/remove-gpo-if-empty

fix/test-freebsd

fix/mysql-setup

fix/remove-logout-btn

handle-existing-domain-user

chore/unify-domain-validation

snyk-fix-c5fafc8a50ce1f29046e25a1fc346185

feat/profile-edit-btn

snyk-fix-a54966211e18d4cf67e5a2757cc006d1

log-short-id

feat/logout-ephemeral

log-checks

batch-wg-ops

nb-interface-default

feat/aws-integration

add/race-test

feature/relay-feature-versioning

fix/systemd-service-logs

poc/preprocessed-map

add-account-onboarding

bind-ipv6

fix/merge-main

logs/peerlogs-addpeer

feature/net-297-network-migration

feature/support-skip-auto-apply-exit-node-routes

set-cmd

set-command-with-cursor

feature/limit-update-channel

stop-using-locking-share

feature/poc-lazy-detection

feature/net-248-removal-of-sync-mutex-locks

test/multiple-peer-logging

preresolve

add-ns-punnycode-support

apply-routes-early

windows-search-domains

fix/connecting-route-filter

feature/management/rest-client/impersonate

debug-local-records

resource-fields-snake-case

test/grpc-rate-limit

traffic-correlation-policy

feature/rest-client-options

feat/events-metrics

feature/buf-cli

test/add-ratelimiter

test/remove-write-lock-on-add-peer

fix/add-peer-semaphore

feature/users-roles-endpoint

mlsmaycon-patch-1

debug-user-role

chore/primary-key-on-networks

feature/update-account-peers-buffer-startup

remove-ubuntu2004-runners

refactor/permissions-no-pat-allowed

ref/logrus-factory

use-conntrack-zone

deploy/permissions-account

feature/lazy-connection-idle

ref/improve-test-cov

restore-pr-3440

test/increase-grpc-timeouts

feat/buffer-account-peers-update

test/networkmapgeneration-changes

feature/base-manager

feature/flow-receiver

chore/benchmark-with-large-runner

refactor/handshake-initiator

client/ui-update-systray-icons

userspace-router

wgwatcher-test

output-if-key-already-exists

fix/relay-reconnection

feature/port-forwarding-client-codecleaning

detached2

test/callbacks-nil-iceconninfo

refactor/optimize-peer-expiration

enable-udp-port-for-docker-template

fix/relay-update

feature/apply-posture-netmap

fix/group-update-existing-resource

conntrack-stats

upgrade-okta-sdk

multi-price

test/conn-stat

set-min-parallel-tests-for-management

dns-interceptor

debug-dns

router-dns

add-static-system-info

debug-0.29.4

debug-0.33.0

account-refactoring

relay/2800_quic

route-get-account-refactoring

test/seed-random-routes

feature/get-account-refactoring

test/reconnect-race-condition

refactor/get-account-usage

feature/add-session-id-to-update-channel

improve-ipv4conn

fix/async-pion-event-handling

debug

add-offload

feature/validate-group-association-debug

fix/limit-conn-for-sqlite

test/engine-iface

test/transaction-for-jwt-sync

fix/engine-stop-in-foreground

feature/add-mysql-support

test-migration

refactor/header-size-values

relay/eliminate-gob

test/signal-dispatcher-with-relay

relay/debug

validate-icon

feature/ipv6-support

use-pre-expanded-peers-map

feature/use-signal-dispatcher

validate/peer-status

add-read-write-times

fix/sync-peer-race

feature/relay-status

netmap

evaluate/network-map-hash

fix/lower-dns-resolve-interval-on-fail

feature/relay

fix/go-mod-version

upgrade-nftables

synology-userspace-mode

fix/use-ip-for-default-routes-on-darwin

fix/proxy_close

enable-release-workflow-on-pr

deploy/peer-performance

feature/permanent-turn

feature/permanent-turn-proxy

deploy/posture-check-sqlite

feature/optimize_sqlite_save

debug-ios-behavior

fix/delete-route-only-after-adding

tshoot/windows-logger

remove-new-routing

refactor/eliminate-repo-dependency

add-arm-to-ci

refactor-demo-account-object

test/abc2

test/abc

send-ssh-rosenpass-config-meta

refactor-demo

ensure-schedule-never-runs-non-positive

feature/peer-validator-groupmgm

feature/peer-validator-fix

fix/include-active-dashboard-users

fix/handle-canceling-schedule

fix/geo-download

debug-google-workspace

yury/resolve-ip-to-location

feature/extend-sysinfo

sqlite-async-peer-status

yury/add-postgresql-store

fix/route

test-build

posture-checks-poc

debug-keycloak-idp

poc/netstack

for-pascal-tmp

peer-logout-management

manual-peer-logout

detached

chore/refactor-management

test/dns-bind

fix/enforce-acl-for-containers

yury/use-sync-map-in-updatechannel

fix/events-key-handling

filter-cache-on-load-account

fix/user-expiration

handle-user-context-cancellation

nb-client-k8s-statefulset

fake-addr

fix/iptables_in_docker

ebpf-debug

update-getting-started-flow-use-postgres

fix/peer_list_notification

feature/device-authentication-with-client-secret

feature/keep_alive

feat-groups-from-jwt

separate_proxy_from_wgconfig

fix/wg_conn

wg_conn_fix

wg_bind_parallel_processing

fix-rollback-get-acls

proxy_cfg_cleanup

performance-improvement-rego

update-lock-log-level

feat-client-side-acl

refactor/move_grpcserver_logic_to_account_manager

feature/event-storage

feature/update-idp-redeeming-invite

feature/api-peer-info

return-groupminimum-setupkey

feature/interface-bind

documentation_enhancement

fix-peer-registration

ssh

users_cache

pass-client-caller

client_caller_type

revert-283-feat-fix-windows-installer

periodic-peer-updates

ebpf

braginini/wasm

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: DYNR/netbird#27240