So I have a daemon which is used to authenticate users via Azure Entra Id (the daemon is Himmelblaud). I’m writing a session D-Bus service (the bare bones here) to provide SSO creds to various apps that are running (such as MS apps, browser plugins, gnome-online-accounts, etc). This D-Bus service will mimic the MS Intune D-Bus service. Essentially I’m providing a opensource drop-in replacement for MS’s proprietary binaries.

So the question is, how do I securely transmit the appropriate credentials between the daemon (which runs under a systemd dynamic user) and the session D-Bus service (which runs as the authenticated user who needs the creds)? There is no way to access those creds outside of getting them somehow from that daemon.

I’m thinking along the lines of a unix socket, but validate that the connecting D-Bus session is from the user who is authorized to request those creds. Is this secure though?

The situation I want to avoid is a system with multiple authenticated users, and to have some user communicate with the daemon and ask for someone else’s access token for Entra Id, etc.