From 1c7bec421e8667f9fd9c9a88fc8f5bda92fad846 Mon Sep 17 00:00:00 2001
From: Jens Du Four <jens.dufour@outlook.com>
Date: Thu, 28 Mar 2024 09:33:44 +0100
Subject: [PATCH] Add files via upload

---
 .../001_aad_authentication.sh                 | 47 +++++++++++++++++++
 .../002_delete_local_users.sh                 | 11 +++++
 .../003_sudo_aad_user.sh                      |  4 ++
 .../004_intune_join.sh                        | 37 +++++++++++++++
 4 files changed, 99 insertions(+)
 create mode 100644 EntraID_Ubuntu_Authentication/001_aad_authentication.sh
 create mode 100644 EntraID_Ubuntu_Authentication/002_delete_local_users.sh
 create mode 100644 EntraID_Ubuntu_Authentication/003_sudo_aad_user.sh
 create mode 100644 EntraID_Ubuntu_Authentication/004_intune_join.sh

diff --git a/EntraID_Ubuntu_Authentication/001_aad_authentication.sh b/EntraID_Ubuntu_Authentication/001_aad_authentication.sh
new file mode 100644
index 0000000..94ce038
--- /dev/null
+++ b/EntraID_Ubuntu_Authentication/001_aad_authentication.sh
@@ -0,0 +1,47 @@
+#!/bin/bash
+
+# Replace these two variables with your relevant Tenant ID and Client Secret Value  
+tenant_id="<tenant-id>"
+app_id="<app-id>"
+domain="<domain>"
+
+# Check if the script has already run
+if [ -f /var/run/aad_ubuntu.lock ]; then
+    echo "Script has already run. Exiting..."
+    exit 0
+fi
+
+# Create lock file to indicate that the script has run
+sudo touch /var/run/aad_ubuntu.lock
+
+# Check Ubuntu version
+if [[ $(lsb_release -sr 2>/dev/null) == "23.04" || $(lsb_release -sr 2>/dev/null) == "23.10" ]]; then
+    echo "Ubuntu version is supported."
+else
+    echo "Unsupported Ubuntu version."
+    exit 1
+fi
+
+# Install required packages
+sudo apt-get update
+sudo apt-get install -y libpam-aad libnss-aad aad-cli
+
+# Configure Azure Active Directory Authentication
+echo "auth [success=1 default=ignore] pam_aad.so" | sudo tee -a /etc/pam.d/common-auth
+
+# Enable home directory creation on login
+sudo pam-auth-update --enable mkhomedir
+
+# Add your tenant details to the configuration file
+sudo truncate -s 0 /etc/aad.conf
+echo "tenant_id = $tenant_id" | sudo tee -a /etc/aad.conf
+echo "app_id = $app_id" | sudo tee -a /etc/aad.conf
+echo "[$domain]" | sudo tee -a /etc/aad.conf
+echo "offline_credentials_expiration = 30" | sudo tee -a /etc/aad.conf
+echo "homedir = /home/$domain/%u" | sudo tee -a /etc/aad.conf
+echo "shell = /bin/zsh" | sudo tee -a /etc/aad.conf
+
+# Restart services
+sudo systemctl restart systemd-logind.service
+echo "Entra ID Authentication setup complete."
+exit 0
diff --git a/EntraID_Ubuntu_Authentication/002_delete_local_users.sh b/EntraID_Ubuntu_Authentication/002_delete_local_users.sh
new file mode 100644
index 0000000..b529950
--- /dev/null
+++ b/EntraID_Ubuntu_Authentication/002_delete_local_users.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+group="users"
+
+# Get all users that are members of the group
+users=$(getent group $group | cut -d: -f4)
+
+# Delete each user
+for user in $users; do
+    userdel $user
+done
diff --git a/EntraID_Ubuntu_Authentication/003_sudo_aad_user.sh b/EntraID_Ubuntu_Authentication/003_sudo_aad_user.sh
new file mode 100644
index 0000000..227b5ad
--- /dev/null
+++ b/EntraID_Ubuntu_Authentication/003_sudo_aad_user.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+
+# Add the current user to the sudo group
+sudo usermod -aG sudo $(whoami)
diff --git a/EntraID_Ubuntu_Authentication/004_intune_join.sh b/EntraID_Ubuntu_Authentication/004_intune_join.sh
new file mode 100644
index 0000000..1ba2022
--- /dev/null
+++ b/EntraID_Ubuntu_Authentication/004_intune_join.sh
@@ -0,0 +1,37 @@
+#!/bin/bash
+
+# Check if the script has already run
+if [ -f /var/run/aad_ubuntu_prereq.lock ]; then
+    echo "Script has already run. Exiting..."
+    exit 0
+fi
+
+# Create lock file to indicate that the script has run
+sudo touch /var/run/aad_ubuntu_prereq.lock
+
+# Check Ubuntu version
+if [[ $(lsb_release -sr 2>/dev/null) == "23.04" || $(lsb_release -sr 2>/dev/null) == "23.10" ]]; then
+    echo "Ubuntu version is supported."
+else
+    echo "Unsupported Ubuntu version."
+    exit 1
+fi
+
+# Install the Microsoft GPG key
+wget -O - https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor > microsoft.gpg
+sudo install -o root -g root -m 644 microsoft.gpg /usr/share/keyrings/ 
+sudo sh -c 'echo "deb [arch=amd64 signed-by=/usr/share/keyrings/microsoft.gpg] https://packages.microsoft.com/ubuntu/22.04/prod jammy main" > /etc/apt/sources.list.d/microsoft-ubuntu-jammy-prod.list' 
+sudo sh -c 'echo "deb [arch=amd64 signed-by=/usr/share/keyrings/microsoft.gpg] https://packages.microsoft.com/repos/edge stable main" > /etc/apt/sources.list.d/microsoft-edge.list'
+sudo rm microsoft.gpg
+sudo apt update
+
+# Update Java for Microsoft Intune
+sudo apt install -y openjdk-11-jre
+
+# Install Microsoft Edge
+sudo apt install -y microsoft-edge-stable
+
+# Install Microsoft Intune
+sudo apt install -y intune-portal
+
+echo "Installation complete."