SSSD-IDP(5) File Formats and Conventions SSSD-IDP(5) NAME sssd-idp - SSSD IdP provider DESCRIPTION This manual page describes the configuration of the IdP provider for sssd(8). For a detailed syntax reference, refer to the "FILE FORMAT" sec- tion of the sssd.conf(5) manual page. The IdP provider is a back end used to connect to an OAuth 2.0 and REST based identity provider (IdP). Since products might have individual imple- mentation of the REST API for looking up user and group attributes dedi- cated code might be required, see the "idp_type" option for details. IdPs typically do not provide POSIX attributes like e.g. user Id (UID) or home directory. SSSD's IdP provider will autogenerate the needed attrib- utes. The default algorithm to generate user IDs (UIDs) and group IDs (GIDs) aims to create reproducible IDs on different systems. As a drawback it might happen that the algorithm assigns the same ID to different objects and only the first one requested via SSSD will be available. CONFIGURATION OPTIONS Refer to the section "DOMAIN SECTIONS" of the sssd.conf(5) manual page for details on the configuration of an SSSD domain. idp_type (string) Required option that specifies the IdP product. Currently Entra ID (en- tra_id) and Keycloak (keycloak) are supported. Depending on the IdP product additional platform specific options might follow the name separated by a colon (:). E.g. for Keycloak the base URI for the user and group REST API must be given. For Entra ID the base URI for the Microsoft Graph API can be given to use sovereign or government cloud endpoints instead of the default (https://graph.mi- crosoft.com/v1.0). E.g. "entra_id:https://graph.microsoft.us/v1.0" for the US government cloud (GCC High). Default: Not set (Required) idp_client_id (string) ID of the IdP client used by SSSD to authenticate users and as a client to lookup user and group attributes. This client must offer device au- thorization according to RFC-8628 and must have permissions to search and read user and group attributes. Default: Not set (Required) idp_client_secret (string) Password of the IdP client. The password is required for the id_provider. If only used as auth_provider it depends on the server side configuration if it is required or not. Default: Not set idp_token_endpoint (string) IdP endpoint for requesting access tokens. Default: Not set (Required) idp_device_auth_endpoint (string) IdP endpoint for device authorization according to RFC-8628. This is required for user authentication. Default: Not set idp_userinfo_endpoint (string) IdP userinfo endpoint to request user attributes after a successful au- thentication of the user. Required for authentication. Default: Not set idp_id_scope (string) Scope required for looking up user and group attributes with the REST API. The scopes are used by the server to determine which attrib- utes/claims are returned to the caller. Note: In previous versions of SSSD, this option was expected to already be URL-encoded. Default: Not set idp_auth_scope (string) Scope required during authentication. The scopes are used by the server to determine which attributes/claims are returned to the caller. Currently the tokens returned during user authentication are not used for other purposes hence the only important claim is the subject iden- tifier 'sub' which is used to check if the authenticated user is the one trying to log in. This might change in future. Default: Not set idp_request_timeout (integer) Timeout in seconds for an individual request to the IdP. Default: 10 idp_auto_refresh (boolean) Refresh tokens automatically, after they have reached about half their lifetime. Note: Scheduled token refreshes are not preserved across restarts of SSSD. Default: false idmap_range_min (integer) Specifies the lower (inclusive) bound of the range of POSIX IDs to use for mapping IdP users and group to POSIX IDs. It is the first POSIX ID which can be used for the mapping. The interval between "idmap_range_min" and "idmap_range_max" will be split into smaller ranges of size "idmap_range_size" which will be used by an individual IdP domain. Default: 200000 idmap_range_max (integer) Specifies the upper (exclusive) bound of the range of POSIX IDs to use for mapping IdP users and groups to POSIX IDs. It is the first POSIX ID which will not be used for POSIX ID-mapping anymore. Default: 2000200000 idmap_range_size (integer) Specifies the number of POSIX IDs available for a single IdP domain. Default: 200000 EXAMPLE [domain/entra_id] id_provider = idp idp_type = entra_id idp_client_id = 12345678-abcd-0101-efef-ba9876543210 idp_client_secret = YOUR-CLIENT-SCERET idp_token_endpoint = https://login.microsoftonline.com/TENNANT-ID/oauth2/v2.0/token idp_userinfo_endpoint = https://graph.microsoft.com/v1.0/me idp_device_auth_endpoint = https://login.microsoftonline.com/TENNANT-ID/oauth2/v2.0/devicecode idp_id_scope = https://graph.microsoft.com/.default idp_auth_scope = openid profile email [domain/keycloak] idp_type = keycloak:https://master.keycloak.test:8443/auth/admin/realms/master/ id_provider = idp idp_client_id = myclient idp_client_secret = YOUR-CLIENT-SCERET idp_token_endpoint = https://master.keycloak.test:8443/auth/realms/master/protocol/openid-connect/token idp_userinfo_endpoint = https://master.keycloak.test:8443/auth/realms/master/protocol/openid-connect/userinfo idp_device_auth_endpoint = https://master.keycloak.test:8443/auth/realms/master/protocol/openid-connect/auth/device idp_id_scope = profile idp_auth_scope = openid profile email SEE ALSO sssd(8), sssd.conf(5), sssd-ldap(5), sssd-ldap-attributes(5), sssd-krb5(5), sssd-simple(5), sssd-ipa(5), sssd-ad(5), sssd-idp(5), sssd-sudo(5), sssd- session-recording(5), sss_cache(8), sss_debuglevel(8), sss_obfuscate(8), sss_seed(8), sssd_krb5_locator_plugin(8), sss_ssh_authorizedkeys(1), sss_ssh_knownhosts(1), sssd-ifp(5), pam_sss(8). sss_rpcidmapd(5) AUTHORS The SSSD upstream - https://github.com/SSSD/sssd/ SSSD 08/27/2026 SSSD-IDP(5)
NAME | DESCRIPTION | CONFIGURATION OPTIONS | EXAMPLE | SEE ALSO | AUTHORS
Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=sssd-idp&sektion=5&manpath=FreeBSD+Ports+15.1.quarterly>