Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Passkey Integration for PS 5.1 and Improve Overall Support for Secondary Accounts #2846

Open
nkasco opened this issue Jul 11, 2024 · 3 comments
Labels
type:feature New experience request

Comments

@nkasco
Copy link

nkasco commented Jul 11, 2024

Is your feature request related to a problem? Please describe the problem.

I use a secondary account for Graph API interactions. I have Passkey setup where if I login to it from Chrome or Edge, I get a QR code to use as the passkey. However, when I login to this account through this module I am always prompted with a MFA MS Authenticator code.

Enabling WAM to use WHfB is not an option, as this account does not login to Windows.

There also seems to be issues unique to this module that cause a sign in loop, where you click sign in, it starts to think about it with the sign in indeterminant progress bar, then kicks you right back to the account picker. It seems like this has to do with the fact that this account's password rotates daily, so I can only really repro this 1x per day. Recovery from this is that you have to completely sign out of the account in the module then start fresh, very poor UX. (feel free to add the bug tag for this piece, but it felt like the 2 go together given the theme of secondary accounts)

Describe the solution you'd like.

  1. Introduce consistent and inclusive Passkey integration for both primary and secondary accounts. Modern Browsers support it and webview2 is likely already on the machine.
  2. In addition to the above, allow users to provide their own browser cache location via a parameter on Connect-MgGraph so that users can point to Chrome or Edge caches (or any other browser based on Chromium). If I've just signed in with a Passkey on Chrome (say to access the Intune portal), I don't want to do it again immediately after when I use this module.
  3. Ensure secondary accounts don't trigger a loop when attempting to sign in

Additional context?

When this occurs, sometimes you also see this message:
image

@nkasco nkasco added status:waiting-for-triage An issue that is yet to be reviewed or assigned type:feature New experience request labels Jul 11, 2024
@nkasco nkasco changed the title Improve WHfB Integration and Overall Support for Secondary Accounts Add Passkey Integration and Improve Overall Support for Secondary Accounts Jul 11, 2024
@nkasco
Copy link
Author

nkasco commented Jul 11, 2024

Issue occurs on PowerShell 5.1 btw

@nkasco
Copy link
Author

nkasco commented Jul 11, 2024

The more I think about this, making it so that PowerShell 5.1 can auth the same way PowerShell 7 for delegated flows where the browser pops up, might render this entire thing mute.

@nkasco nkasco changed the title Add Passkey Integration and Improve Overall Support for Secondary Accounts Add Passkey Integration for PS 5.1 and Improve Overall Support for Secondary Accounts Jul 11, 2024
@timayabi2020
Copy link
Contributor

@CarolKigoonya have a look at this.

@timayabi2020 timayabi2020 removed the status:waiting-for-triage An issue that is yet to be reviewed or assigned label Jul 25, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type:feature New experience request
Projects
None yet
Development

No branches or pull requests

2 participants