sbose/sssd-idp

Project ID: 136413

Description

This repository contains the current state of the development of the direct integration of SSSD with an external IdP. Currently Keycloak and Entra ID are supported.

You can find a short video with a demo at https://sbose.fedorapeople.org/sssd-idp-demo/sssd-idp-demo.mp4. There is also an extended demo with more details on Youtube.

The code is based on the git trees:

Feel free to leave comments, questions and suggestions on github.

Installation Instructions

After installing the packages form this repository, especially the sssd-idp package, create a sssd.conf file like e.g.:

[sssd]
config_file_version = 2
services = nss, pam
domains = YOU.onmicrosoft.com, keycloak

[domain/YOU.onmicrosoft.com]
id_provider = idp
auto_private_groups = true
use_fully_qualified_names = true
debug_level = 9
idp_client_id = UUID_of_YOUR_Entra_ID_client
idp_client_id = Password_of_YOUR_Entra_ID_client
idp_token_endpoint = https://login.microsoftonline.com/YOUR_Entra_ID_tennant_UUID/oauth2/v2.0/token
idp_device_auth_endpoint = https://login.microsoftonline.com/YOUR_Entra_ID_tennant_UUID/oauth2/v2.0/devicecode
idp_userinfo_endpoint = https://graph.microsoft.com/v1.0/me
idp_id_scope = https%3A%2F%2Fgraph.microsoft.com%2F.default
idp_auth_scope = openid profile email

[domain/keycloak]
idp_type = keycloak:https://master.keycloak.test:8443/auth/admin/realms/master/
id_provider = idp
auto_private_groups = true
use_fully_qualified_names = true
debug_level = 9
idp_client_id = YourKeycloakClient
idp_client_secret = YourKeycloakClientPassword
idp_token_endpoint = https://master.keycloak.test:8443/auth/realms/master/protocol/openid-connect/token
idp_userinfo_endpoint = https://master.keycloak.test:8443/auth/realms/master/protocol/openid-connect/userinfo
idp_device_auth_endpoint = https://master.keycloak.test:8443/auth/realms/master/protocol/openid-connect/auth/device
idp_id_scope = profile
idp_auth_scope = openid profile email

[nss]
debug_level = 9
default_shell = /bin/bash
fallback_homedir = /home/%f

Please note that the IdP clients must have the permission to read user and group attributes.

Active Releases

The following unofficial repositories are provided as-is by owner of this project. Contact the owner directly for bugs or issues (IE: not bugzilla).

Release	Architectures	Repo Download
Centos-stream 10	x86_64 (1529)*	Centos-stream 10 (48 downloads)
Centos-stream 8	x86_64 (9)*	Centos-stream 8 (54 downloads)
Centos-stream 9	x86_64 (1512)*	Centos-stream 9 (48 downloads)
EPEL 8	x86_64 (11)*	EPEL 8 (70 downloads)
EPEL 9	x86_64 (3031)*	EPEL 9 (276 downloads)
Fedora 39	aarch64 (948), s390x (854), x86_64 (920)*	Fedora 39 (0 downloads)
Fedora 40	aarch64 (1469), ppc64le (1482), s390x (1369), x86_64 (2209)	Fedora 40 (67 downloads)
Fedora 41	aarch64 (395), ppc64le (425), s390x (509), x86_64 (1707)	Fedora 41 (61 downloads)
Fedora 42	aarch64 (64), ppc64le (596), s390x (579), x86_64 (166)	Fedora 42 (11 downloads)
Fedora eln	x86_64 (570)*	Fedora eln (39 downloads)
Fedora rawhide	aarch64 (1417), ppc64le (1385), s390x (1444), x86_64 (1569)	Fedora rawhide (41 downloads)