Stay up-to-date with everything Linux!
Content directly fetched from the subreddit just for you.
Powered by : @r_channels
Post #42923
59
LI @r_linux
Showing posts older than #42924 · Back to latest
<remote-hostname> must match the hostname exactly as registered in Entra ID, and must actually resolve (DNS or /etc/hosts) — an IP address will not work for this auth flow./w:, /h:, and /smart-sizing fixed a real rendering bug — reconnecting to a previously-disconnected session rendered the remote desktop content squashed into a small corner of the window with the rest black. Explicitly forcing the resolution and enabling smart-sizing (which scales/stretches remote content to fill the client window regardless of the session's actual internal resolution) fixed this completely.mstsc.exe "use a web account" experience, just self-compiled.rdp-aad instead of remembering the whole command:#!/usr/bin/env bash
set -euo pipefail
DEFAULT_HOST="your-vm-hostname"
DEFAULT_USER="youruser@yourdomain.com"
TENANT_ID="your-entra-tenant-id"
FREERDP_BIN="$HOME/FreeRDP/build/client/SDL/SDL2/sdl-freerdp"
RES_WIDTH="2560"
RES_HEIGHT="1440"
HOST="${1:-$DEFAULT_HOST}"
USERNAME="${2:-$DEFAULT_USER}"
if [[ ! -x "$FREERDP_BIN" ]]; then
echo "FreeRDP binary not found at $FREERDP_BIN"
exit 1
fi
if ! getent hosts "$HOST" > /dev/null 2>&1; then
echo "Warning: '$HOST' does not resolve. AAD auth needs a resolvable hostname"
echo "matching the device name registered in Entra ID."
read -r -p "Continue anyway? [y/N] " reply
[[ "$reply" =~ ^[Yy]$ ]] || exit 1
fi
exec "$FREERDP_BIN" \
/v:"$HOST" \
/sec:aad \
/azure:tenantid:"$TENANT_ID" \
/u:"$USERNAME" \
/cert:ignore \
/dynamic-resolution \
/w:"$RES_WIDTH" \
/h:"$RES_HEIGHT" \
/smart-sizing
mstsc.exe.freerdp (3.29/3.30 from Fedora's repos) supports the AAD auth flow, but it's built without the native in-app login popup — you get a URL printed to the terminal instead, and you have to manually copy the redirect URL back in after signing in through your normal browser. Functional, but clunky, and in my case actually broken by my org's Conditional Access policy behavior.xfreerdp /buildconfig | tr ' ' '\n' | grep -i webview
WITH_WEBVIEW=OFF. That flag controls whether FreeRDP's SDL client can pop up a native browser window for the AAD sign-in, instead of the manual copy/paste flow.sudo dnf install cmake ninja-build gcc-c++ git \
systemd-devel libuuid-devel pulseaudio-libs-devel \
libXrandr-devel gsm-devel pam-devel fuse3-devel \
opus-devel lame-devel openssl-devel libX11-devel \
libXext-devel libXinerama-devel libXcursor-devel \
libXi-devel libXdamage-devel libXv-devel libxkbfile-devel \
alsa-lib-devel openh264-devel libavcodec-free-devel \
libavformat-free-devel libavutil-free-devel \
libswresample-free-devel libswscale-free-devel \
libusb1-devel uriparser-devel SDL2-devel SDL2_ttf-devel \
pkcs11-helper-devel krb5-devel cjson-devel cairo-devel \
soxr-devel wayland-devel wayland-protocols-devel \
cups-devel webkitgtk6.0-devel
cups-devel — missed this initially, build fails at the printer channel with "Could NOT find Cups" if it's absent.webkitgtk6.0-devel — this is the actual key package. FreeRDP's webview feature pulls in a small external helper library (akallabeth/webview via CMake FetchContent) which searches for WebKitGTK in this priority order: webkitgtk-6.0 → webkit2gtk-4.1 → webkit2gtk-4.0. Current Fedora has deprecated/removed webkit2gtk-4.0, but webkitgtk-6.0 (GTK4-based) is available and works fine — no need to chase the old deprecated package.git clone https://github.com/FreeRDP/FreeRDP.git
cd FreeRDP
mkdir build && cd build
cmake -GNinja -DWITH_WEBVIEW=ON -DWITH_CLIENT_SDL=ON -DWITH_AAD=ON ..
grep -i "webview\|gtk4" CMakeCache.txt
gtk4/webkitgtk-6.0 in the configure output, with "Configuring done" at the end and no errors.ninja
find . -iname "*freerdp*" -executable -type f
./client/SDL/SDL2/sdl-freerdp
./client/SDL/SDL2/sdl-freerdp \
/v:<remote-hostname> \
/sec:aad \
/azure:tenantid:<your-entra-tenant-id> \
/u:<user>@<yourdomain>.com \
/cert:ignore \
/dynamic-resolution \
/w:2560 \
/h:1440 \
/smart-sizing
/sec:aad is required alongside /azure:. Using /azure: alone let the client fall through to a default NLA/Kerberos negotiation attempt, which failed outright with Cannot find KDC for realm since there's no Kerberos realm configured on a home Linux box. Explicitly forcing /sec:aad skips