Opinion: Entra does not belong in pynitrokey

Nitrokeys
1

I package pynitrokey for Gentoo, I saw that with the 0.13.0 release, code for enrolling into Microsoft Entra was added into pynitrokey (the nitropy tool). I haven’t studied what exactly it does in detail, it doesn’t seem to be called from anywhere else other than when nitropy is ran with the right command line arguments. It connects to the Microsoft Entra API (via http to Microsoft servers).

I don’t think pynitrokey is the place for such code. No other part of pynitrokey serves to connect to any other remote non-local API, why should Entra be an exception?

It would make sense to me that since this is a tool specifically for Microsoft Entra, it’s not useful to anyone else that doesn’t use Entra, so it should be a separate tool. pynitrokey should stay as it was, just for administering and human interaction with Nitrokeys.

(I tried to create this as an issue on the Github repo but I don’t have permission to create issues there, I’ve created issues there before so I don’t know the reason for this new restriction)

2

Besides being able to update firmware via Nitrokey’s github you probably mean.

3

The Entra API is only used if explicitly requested by calling the fido2 provision-credential command with a valid configuration. There is no way to accidentally trigger an API call. Also, it just sends an HTTP request, so there are no additional dependencies required for this feature or any other cost caused by it. Can you please elaborate why you object to it?

Besides the downloads of the firmware release, there is also the nethsm command that sends HTTP requests to NetHSM instances.

I tried to create this as an issue on the Github repo but I don’t have permission to create issues there, I’ve created issues there before so I don’t know the reason for this new restriction

There should be no such restriction. Can you please share the exact error message?