The project history
Linux cloud identity, built in the open.
Himmelblau began with a question inside the Samba community: could Linux participate fully in the new generation of cloud identity protocols? The answer grew from an experiment into a production platform—and into shared infrastructure used beyond Himmelblau itself.
Follow the story
From an idea to an ecosystem
A history shaped by interoperability.
Some early conversations happened informally and their dates are approximate.
-
2019
The first idea
A conversation at SambaXP
Around SambaXP 2019, David Mulder and Microsoft engineer Tom Talpey discussed whether Samba’s Winbind could grow beyond traditional domain authentication and support a new generation of cloud identity protocols.
The setting mattered. Microsoft was presenting a Windows Hello for Business protocol deep dive at the conference, while Talpey was arguing for closer collaboration between Microsoft and the Samba Team. The idea that Linux might one day speak those protocols natively had taken root.
Tom Talpey in discussion at SambaXP 2025. His long advocacy for sustained Microsoft–Samba collaboration helped create the setting for Himmelblau’s earliest conversations. -
2022
The need becomes real
Linux vendors confront cloud identity
The subject returned around SambaXP 2022 as Microsoft explored a Linux solution for Azure AD (now Microsoft Entra ID). David joined an ongoing conversation between Microsoft engineers and representatives from Red Hat, Canonical, and SUSE.
Microsoft’s proposed direction centered on a proprietary authentication plugin that Linux distributions could consume. Distribution engineers had practical concerns about timing, maintainability, and asking the Linux community to support code it could not inspect.
While those broader conversations continued, Canonical had been developing its own implementation in the background. The arrival of aad-auth made clear that the distributions did not need to wait for a future Microsoft component to emerge.
-
May 2023
Himmelblau is born
An open implementation begins
David initially tried to package aad-auth for openSUSE. That evaluation exposed authentication and MFA behavior that did not meet the requirements of a production, community-supported identity component. Rather than ship something the community could not confidently maintain, he started a new implementation.
Initial commit David Mulder committed 5bd4ac4 on May 22, 2023himmelblauThe early client drew on Kanidm’s Rust architecture and components. Within weeks it had a daemon, PAM and NSS modules, persistent caching, and open-source MSAL integration. Password authentication came first; Device Authorization Grant support followed when Entra ID required MFA. Version 0.1.0 arrived in September 2023.
-
2024
A standalone stack
Still connected to Samba
An effort to integrate Himmelblau directly into the Samba source tree was ultimately set aside in favor of an independent project. The architectural connection remained: the protocol engine became libhimmelblau, owned by the Samba Team and maintained by David.
That separation let both layers advance quickly. In 2024, the project added device registration, Windows Hello for Business provisioning and PIN authentication, Kerberos credential support, and browser single sign-on.
-
2025
A production platform
From authentication to managed devices
Himmelblau grew into a complete Entra ID and Intune interoperability suite. TPM-backed credentials, offline login and SSO, broader Linux packaging, custom compliance checks, and Intune policy enforcement moved the project well beyond its original login prototype.
Himmelblau 1.0 was tagged on July 30, 2025. Earlier that year, David presented the daemon’s proposed Samba integration and the underlying OAuth 2.0 work at SambaXP, bringing the project’s story back to the community where it began.
-
2025
The ecosystem converges
Shared infrastructure wins
Canonical archived aad-auth in May 2024 and replaced it with the broader Authd project. In 2025, Authd’s Entra broker began consuming libhimmelblau for device registration and native MFA, building on the protocol work already completed by the Himmelblau and Samba communities.
The convergence was public and practical. In an Authd community discussion, a Canonical engineer described the goal of using libhimmelblau to bring Himmelblau’s device-registration work into Authd. A library born from one implementation was now improving another.
-
2025–2026
Beyond Entra ID
Himmelblau embraces OIDC
Himmelblau’s next step was to apply its Linux login experience beyond Microsoft’s identity platform. Generic OpenID Connect authentication arrived in late 2025, opening the same PAM and NSS foundation to providers such as Keycloak and Okta.
In 2026, browser-orchestrated MFA brought richer, provider-agnostic authentication into native Linux sign-in. What began as an Entra ID interoperability project had grown into a broader open platform for cloud identity.
The work continues
Open identity infrastructure is a community project.
Himmelblau is maintained by David Mulder, Samuel Cabrero, William Brown, and a growing community of contributors, with SUSE as its primary sponsor. Its participation in the GitHub Secure Open Source Fund reflects the same principle that shaped its beginning: identity infrastructure should be inspectable, testable, and improved in the open.