Cloud identity for Linux

SSO, MFA, compliance, and TPM-backed keys across Entra ID/Intune and OIDC providers such as Keycloak and Okta — with a practical path toward sovereign cloud identity.

Start installation See how it works
Scroll to explore

One identity plane

Your cloud identity should follow users to every Linux session.

Remote servers and graphical workstations are different security contexts. Himmelblau gives each the right authentication experience while connecting both to the same Entra ID, PAM, and NSS foundation.

Remote accessCloud credentials + native MFA Desktop accessDevice-bound Hello PIN

For administrators

MFA-secured SSH, directly against your cloud identity.

Resolve Entra or OIDC users through NSS, authenticate through PAM, complete the tenant’s MFA challenge, and enter the shell. Remote sessions require MFA by default.

A terminal initiating an SSH connection for the Entra user tux
SSH prompting the user for their Entra ID password
SSH displaying a Microsoft Authenticator number-matching challenge
The Entra user successfully signed in to a Linux shell over SSH
01

Connect as a Cloud user

Himmelblau resolves the cloud identity as a Linux account through NSS—without pre-creating a local user.

02

Authenticate with the Identity Provider

PAM hands the request to Himmelblau. The exact credential flow follows the authentication methods configured by the Identity Provider.

03

Complete native MFA

MFA happens inside the SSH experience.

04

Enter the shell

The authenticated cloud identity arrives as a normal POSIX session, ready for shared hosts, remote administration, and group-based access control.

For workstations

The first desktop login becomes a secure daily habit.

Users establish their identity, satisfy MFA, and enroll a Hello PIN bound to that Linux device. Linux Hello can optionally be disabled, requiring MFA at every desktop login.

GNOME login screen with a local user and the Not listed option
Entering the Entra username tux at the GNOME login screen
GNOME prompting for the Entra ID password
Entering the Entra ID password at the GNOME login screen
GNOME displaying a Microsoft Authenticator number-matching prompt
GNOME asking the user to set up a new Hello PIN
The user entering a new device-bound Hello PIN
GNOME asking the user to confirm the Hello PIN
Himmelblau enrolling the confirmed Hello PIN
The Entra user signed in to the GNOME desktop
01

Choose the cloud account

“Not listed?” opens a prompt for entering your Cloud identity username.

02

Establish identity

The user signs in with their Cloud credentials and the tenant’s configured authentication requirements.

03

Satisfy MFA

Native MFA is presented at the Linux greeter, keeping the first-login journey in one coherent flow.

04

Enroll a Hello PIN

The PIN unlocks a cryptographic credential tied to this device. With a hardware TPM configured, key material can be hardware-backed.

05

Start the session

The desktop opens as the Cloud user, with the identity and token foundation needed by browser and application SSO.

The next login

Enroll once. Return with the device-bound PIN.

Hello PIN is intended for local authentication by default: convenient at the workstation, without weakening the remote SSH boundary.

GNOME lock screen
GNOME asking Tux Penguin for the Linux Hello PIN
GNOME validating the entered Hello PIN
The local desktop unlocked successfully
01

Wake the workstation

Return to the familiar local lock screen on the enrolled Linux device.

02

Enter the device-bound PIN

The user authenticates locally with the Hello PIN enrolled during their first sign-in.

03

Unlock the protected credential

Himmelblau validates the PIN and unlocks the cryptographic credential bound to this device.

04

Continue the workday

The desktop opens with native SSO integration.

The session continues

Sign in to Linux. Open the workday already authenticated.

The authenticated session can carry SSO into Firefox, Thunderbird, and Microsoft 365 web applications, while packaged launchers make the suite feel at home on the desktop.

Microsoft 365 application launchers pinned to the GNOME dash
Firefox already signed in to the Microsoft Azure portal as the Entra user
Outlook running as a Linux desktop web application
A Microsoft Teams meeting running on the Linux desktop
Microsoft Word running as a Linux desktop web application
Microsoft Excel running as a Linux desktop web application
Microsoft PowerPoint running as a Linux desktop web application
01

Applications feel native

Launch Outlook, Teams, Word, Excel, and PowerPoint from the desktop rather than rebuilding the workday around browser tabs.

02

Browser SSO

PRT-based authentication lets supported browsers reach Entra-protected services without another full sign-in.

03

Microsoft 365 on Linux

Mail, meetings, documents, spreadsheets, and presentations remain connected to the same authenticated identity.

Intune integration

Linux devices, visible and compliant.

Himmelblau brings Linux devices into the Intune view and can apply compliance at authentication time.

  • Linux device registration
  • Compliance status in Intune
  • Policy enforcement during authentication
Explore Intune policy integration →
Microsoft Intune admin center showing two openSUSE Linux devices with Compliant status
Linux devices reporting compliant in the Intune admin center.

Trusted in the open

Identity infrastructure you can inspect, test, and improve.

GPLv3+Open source by design

Review the implementation, follow development, and contribute on GitHub.

 Security programGitHub Secure Open Source Fund

Himmelblau participated in GitHub’s project security initiative.
Security engineeringPatch the Planet participant

Himmelblau is participating in the OpenAI and Trail of Bits initiative that pairs AI-assisted research with expert review to find, validate, and patch security issues in open-source software.

Program overview →OpenAI announcement →
iX MagazineFeatured in iX MagazineRead independent technical coverage of Himmelblau.

Evaluating your options?

Compare Himmelblau with Authd, SSSD, and Intune for Linux.

Compare solutions →

Ready when you are

Bring your Linux systems into the identity plane.

The guided installer uses the native package manager, configures the identity provider, and starts the Himmelblau services.

curl -fsSL https://himmelblau-idm.org/install | sh

Review scripts before running them in your environment.

Package optionsDeployment documentation
SUSEopenSUSEUbuntuMintDebianFedoraRHELRockyOracleAlmaAmazonNixOS
Built by and for the community.

Ask questions, report issues, help test, or support continued development.