Ujust intune support feature request

[L0g0ff]

For compliance: https://morgansimonsen.com/2024/12/12/microsoft-intune-compliance-on-fedora-workstation/

I only want to do this with optional extra rpm-ostree layering on the host system. Not in the build itself.

[L0g0ff]

Working Solution for Intune on Immutable Fedora 43

I've successfully tested Microsoft Intune agent installation on immutable Fedora 43. Here's the working procedure:

Prerequisites

• Immutable Fedora 43 (tested on Silverblue)
• rpm-ostree package manager
• sudo privileges

Installation Steps

Import Microsoft GPG Key**

sudo rpm --import https://packages.microsoft.com/keys/microsoft.asc

Add Microsoft RHEL 9 Repository

sudo curl -o /etc/yum.repos.d/microsoft-rhel9.0-prod.repo \
 https://packages.microsoft.com/yumrepos/microsoft-rhel9.0-prod/config.repo

Download Java 11 OpenJDK from Fedora 41

Fedora 43 removed java-11-openjdk (required by microsoft-identity-broker), so we need to pull it from Fedora 41:

cd ~/Downloads

wget https://kojipkgs.fedoraproject.org/packages/java-11-openjdk/11.0.29.0.7/1.fc41/x86_64/java-11-openjdk-11.0.29.0.7-1.fc41.x86_64.rpm

wget https://kojipkgs.fedoraproject.org/packages/java-11-openjdk/11.0.29.0.7/1.fc41/x86_64/java-11-openjdk-headless-11.0.29.0.7-1.fc41.x86_64.rpm

Layer All Packages with rpm-ostree

sudo rpm-ostree install \
 ~/Downloads/java-11-openjdk-11.0.29.0.7-1.fc41.x86_64.rpm \
 ~/Downloads/java-11-openjdk-headless-11.0.29.0.7-1.fc41.x86_64.rpm \
 microsoft-identity-broker \
 intune-portal

Reboot System

sudo systemctl reboot

• Configure Intune Portal (After Reboot)

• Launch the Microsoft Intune application

• Sign in with your organizational credentials

• Complete the enrollment process

  ---

  ⚠️ Important Caveats

  • Unsupported Configuration: Microsoft officially supports only Ubuntu (22.04/24.04 LTS) and RHEL (8/9). Fedora is NOT officially supported.
  • Compatibility Risk: Using RHEL 9 packages on Fedora 43 may cause issues with future updates.
  • Java Version Mismatch: Pulling java-11 from F41 is a workaround; long-term stability unknown.

  Potential ujust Recipe Implementation

  For KompassOS, this could be implemented as a ujust recipe:

  ujust install-intune

  The recipe would automate:

  • Repository configuration
  • Java 11 dependency resolution
  • rpm-ostree layering
  • Post-install guidance

Let's think if we want this...

Reference: Based on https://morgansimonsen.com/2024/12/12/microsoft-intune-compliance-on-fedora-workstation/

[L0g0ff]

There is a certificate issue

Working Fix (Claude code generated but tested!)

#!/bin/bash
# Fix Microsoft Intune OpenSSL compatibility issue on Fedora 43
# Based on: https://github.com/recolic/microsoft-intune-archlinux
set -e

echo "================================"
echo "  Intune OpenSSL 3.2.4 Fix"
echo "================================"

# Create temp directory
mkdir -p /tmp/.ossl332
cd /tmp/.ossl332

# Download OpenSSL 3.2.4 from Fedora Koji (compatible version, older than 3.4)
echo "[1/4] Downloading OpenSSL 3.2.4 from Fedora 41..."
wget -q https://kojipkgs.fedoraproject.org/packages/openssl/3.2.4/2.fc41/x86_64/openssl-libs-3.2.4-2.fc41.x86_64.rpm

# Extract the RPM
echo "[2/4] Extracting libraries..."
rpm2cpio openssl-libs-3.2.4-2.fc41.x86_64.rpm | cpio -idm 2>/dev/null

# Copy libraries to user's local lib directory (immutable Fedora workaround)
echo "[3/4] Installing compatibility libraries to ~/.local/lib..."
mkdir -p ~/.local/lib
cp ./usr/lib64/libcrypto.so.3 ~/.local/lib/libcrypto-compat.so
cp ./usr/lib64/libssl.so.3 ~/.local/lib/libssl-compat.so

# Detect intune-portal path
if command -v intune-portal >/dev/null 2>&1; then
    INTUNE_BIN=$(command -v intune-portal)
elif [ -f /opt/microsoft/intune/bin/intune-portal ]; then
    INTUNE_BIN=/opt/microsoft/intune/bin/intune-portal
elif [ -f /usr/bin/intune-portal ]; then
    INTUNE_BIN=/usr/bin/intune-portal
else
    INTUNE_BIN="<path-to-intune-portal>"
fi

echo "[4/4] Creating launcher script..."

# Create a wrapper script
cat > ~/launch-intune.sh << 'EOF'
#!/bin/bash
# Intune Portal with OpenSSL 3.2.4 compatibility layer (immutable Fedora)
export LD_PRELOAD="$HOME/.local/lib/libcrypto-compat.so:$HOME/.local/lib/libssl-compat.so"
exec /usr/bin/intune-portal "$@"
EOF

chmod +x ~/launch-intune.sh

# Cleanup
cd ~
rm -rf /tmp/.ossl332

echo ""
echo "✅ Fix applied successfully!"
echo ""
echo "Compatibility libraries installed to: ~/.local/lib/"
echo ""
echo "To launch Intune Portal, use:"
echo "  ~/launch-intune.sh"
echo ""
echo "Or run directly:"
echo "  env LD_PRELOAD=\"\$HOME/.local/lib/libcrypto-compat.so:\$HOME/.local/lib/libssl-compat.so\" $INTUNE_BIN"
echo ""

After you start intune this way:

Device is registered successfully