Connecting to an Azure Join Windows Machine Using Web Authentication From Linux

# Got native Entra ID (AAD) webview login working with FreeRDP on Fedora/Nobara — full writeup

Wanted to share this since it took some digging to get right. Background: I wanted to RDP from my Linux desktop into an Entra ID-joined Windows 11 box using modern auth (Conditional Access, MFA, the works) — basically the Linux equivalent of checking "Use a web account to sign in" in mstsc.exe.

The distro-packaged freerdp (3.29/3.30 from Fedora's repos) supports the AAD auth flow, but it's built without the native in-app login popup — you get a URL printed to the terminal instead, and you have to manually copy the redirect URL back in after signing in through your normal browser. Functional, but clunky, and in my case actually broken by my org's Conditional Access policy behavior.

Here's what it took to get the real in-app popup working.

## The problem with the stock package

Checking the build config on the distro package:

xfreerdp /buildconfig | tr ' ' '\n' | grep -i webview

showed WITH_WEBVIEW=OFF. That flag controls whether FreeRDP's SDL client can pop up a native browser window for the AAD sign-in, instead of the manual copy/paste flow.

## Step 1 — Install build dependencies

sudo dnf install cmake ninja-build gcc-c++ git \

  systemd-devel libuuid-devel pulseaudio-libs-devel \

  libXrandr-devel gsm-devel pam-devel fuse3-devel \
 
  opus-devel lame-devel openssl-devel libX11-devel \
 
  libXext-devel libXinerama-devel libXcursor-devel \
 
  libXi-devel libXdamage-devel libXv-devel libxkbfile-devel \
  
 alsa-lib-devel openh264-devel libavcodec-free-devel \
 
  libavformat-free-devel libavutil-free-devel \
 
  libswresample-free-devel libswscale-free-devel \
 
  libusb1-devel uriparser-devel SDL2-devel SDL2_ttf-devel \
 
  pkcs11-helper-devel krb5-devel cjson-devel cairo-devel \
 
  soxr-devel wayland-devel wayland-protocols-devel \
 
  cups-devel webkitgtk6.0-devel

Two things worth calling out specifically:

- cups-devel — missed this initially, build fails at the printer channel with "Could NOT find Cups" if it's absent.
- webkitgtk6.0-devel — this is the actual key package. FreeRDP's webview feature pulls in a small external helper library (akallabeth/webview via CMake FetchContent) which searches for WebKitGTK in this priority order: webkitgtk-6.0 → webkit2gtk-4.1 → webkit2gtk-4.0. Current Fedora has deprecated/removed webkit2gtk-4.0, but webkitgtk-6.0 (GTK4-based) is available and works fine — no need to chase the old deprecated package.

## Step 2 — Clone and configure

git clone https://github.com/FreeRDP/FreeRDP.git
cd FreeRDP
mkdir build && cd build
cmake -GNinja -DWITH_WEBVIEW=ON -DWITH_CLIENT_SDL=ON -DWITH_AAD=ON ..

Confirm the config actually picked up webview support before building:

grep -i "webview\|gtk4" CMakeCache.txt

You want to see it successfully checking for and finding gtk4/webkitgtk-6.0 in the configure output, with "Configuring done" at the end and no errors.

## Step 3 — Build

ninja

Took about 10 minutes on a Ryzen 7 5800X3D. Just let it run.

## Step 4 — Find the actual binary

The build output binary is not at the path you might expect from the source tree layout:

find . -iname "*freerdp*" -executable -type f

Mine landed at:

./client/SDL/SDL2/sdl-freerdp

## Step 5 — The actual working connection command

./client/SDL/SDL2/sdl-freerdp \
  /v:<remote-hostname> \
  /sec:aad \
  /azure:tenantid:<your-entra-tenant-id> \
  /u:<user>@<yourdomain>.com \
  /cert:ignore \
  /dynamic-resolution \
  /w:2560 \
  /h:1440 \
  /smart-sizing

A few flags that turned out to matter, that I'd have missed otherwise:

- /sec:aad is required alongside /azure:. Using /azure: alone let the client fall through to a default NLA/Kerberos negotiation attempt, which failed outright with Cannot find KDC for realm since there's no Kerberos realm configured on a home Linux box. Explicitly forcing /sec:aad skips