Description
This repository contains the current state of the development of the direct integration of SSSD with an external IdP. Currently Keycloak and Entra ID are supported.
You can find a short video with a demo at https://sbose.fedorapeople.org/sssd-idp-demo/sssd-idp-demo.mp4. There is also an extended demo with more details on Youtube.
The code is based on the git trees:
- https://github.com/sumit-bose/sssd/tree/sss_idmap_4_idp
- https://github.com/sumit-bose/sssd/tree/oidc_entra_id_users_groups
- https://github.com/sumit-bose/sssd/tree/id_provider_idp
Feel free to leave comments, questions and suggestions on github.
Installation Instructions
After installing the packages form this repository, especially the sssd-idp
package, create a sssd.conf
file like e.g.:
[sssd]
config_file_version = 2
services = nss, pam
domains = YOU.onmicrosoft.com, keycloak
[domain/YOU.onmicrosoft.com]
id_provider = idp
auto_private_groups = true
use_fully_qualified_names = true
debug_level = 9
idp_client_id = UUID_of_YOUR_Entra_ID_client
idp_client_id = Password_of_YOUR_Entra_ID_client
idp_token_endpoint = https://login.microsoftonline.com/YOUR_Entra_ID_tennant_UUID/oauth2/v2.0/token
idp_device_auth_endpoint = https://login.microsoftonline.com/YOUR_Entra_ID_tennant_UUID/oauth2/v2.0/devicecode
idp_userinfo_endpoint = https://graph.microsoft.com/v1.0/me
idp_id_scope = https%3A%2F%2Fgraph.microsoft.com%2F.default
idp_auth_scope = openid profile email
[domain/keycloak]
idp_type = keycloak:https://master.keycloak.test:8443/auth/admin/realms/master/
id_provider = idp
auto_private_groups = true
use_fully_qualified_names = true
debug_level = 9
idp_client_id = YourKeycloakClient
idp_client_secret = YourKeycloakClientPassword
idp_token_endpoint = https://master.keycloak.test:8443/auth/realms/master/protocol/openid-connect/token
idp_userinfo_endpoint = https://master.keycloak.test:8443/auth/realms/master/protocol/openid-connect/userinfo
idp_device_auth_endpoint = https://master.keycloak.test:8443/auth/realms/master/protocol/openid-connect/auth/device
idp_id_scope = profile
idp_auth_scope = openid profile email
[nss]
debug_level = 9
default_shell = /bin/bash
fallback_homedir = /home/%f
Please note that the IdP clients must have the permission to read user and group attributes.
Active Releases
The following unofficial repositories are provided as-is by owner of this project. Contact the owner directly for bugs or issues (IE: not bugzilla).
Release | Architectures | Repo Download |
---|---|---|
![]() |
x86_64 (1583)* | Centos-stream 10 (58 downloads) |
![]() |
x86_64 (9)* | Centos-stream 8 (64 downloads) |
![]() |
x86_64 (1519)* | Centos-stream 9 (61 downloads) |
![]() |
x86_64 (12)* | EPEL 8 (79 downloads) |
![]() |
x86_64 (5337)* | EPEL 9 (420 downloads) |
![]() |
aarch64 (1577)*, ppc64le (1525)*, s390x (1409)*, x86_64 (2358)* | Fedora 40 (0 downloads) |
![]() |
aarch64 (1283)*, ppc64le (526)*, s390x (658)*, x86_64 (2527)* | Fedora 41 (137 downloads) |
![]() |
aarch64 (110)*, ppc64le (707)*, s390x (681)*, x86_64 (351)* | Fedora 42 (35 downloads) |
![]() |
x86_64 (1057)* | Fedora eln (47 downloads) |
![]() |
aarch64 (2353)*, ppc64le (1962)*, s390x (1831)*, x86_64 (2066)* | Fedora rawhide (47 downloads) |
* Total number of downloaded packages.