SSO-MIB-TOOL(1)

📦 version 0.10.1, in ubuntu stonking

💅 sso-mib-tool — bestie's guide to the Microsoft Identity Broker (section 1 of the manual, user commands, iykyk)

okay so first things first: this page is literally called sso-mib-tool(1) and it's giving "user commands, section 1" energy. it ships with sso-mib version 0.10.1 and it's dated 2025 — keep that in your notes for later, we're doing a cute sign-off at the end. 🎀

✨ NAME ✨

sso-mib-tool — the way you interact with the Microsoft Identity Broker for SSO on Azure Entra ID. yes bestie, that's the whole job. 👑

🌸 SYNOPSIS 🌸

sso-mib-tool COMMAND [OPTION]...

that's it. command first, options after, no cap. 🦋

💖 DESCRIPTION 💖

so sso-mib-tool is a command-line frontend to the sso-mib library, and its whole thing is talking to a Microsoft Identity Broker over DBus. like, that's the vibe.

what can it do? literally so much:

  • list accounts
  • acquire authentication tokens — both silently and interactively
  • obtain PRT SSO cookies
  • generate signed HTTP requests using Proof-of-Possession (PoP) tokens

and the tea is: this tool implements support for the OIDC extension MS-OAPXBC, which includes requesting Primary Refresh Tokens and exchanging them for Access Tokens. iconic behavior, honestly. 🔥

🫶 COMMANDS 🫶

  • getAccounts — lists every single account registered with the broker. and if you throw -A at it, it hands you back just one account matching the User Principal Name you gave it.
  • removeAccount — removes an account from the broker. use -a to say which account index you're coming for. bye bestie 👋
  • acquirePrtSsoCookie — acquires a PRT SSO cookie for the selected account. heads up: it requires a registered account. default scope is https://graph.microsoft.com/.default.
  • acquireTokenSilent — acquires an access token silently, meaning no user interaction, using the Primary Refresh Token. also requires a registered account. sneaky, quiet, efficient. 💀
  • acquireTokenInteractive — acquires an access token interactively. this one will prompt the user for authentication via the broker. making it everyone's business, fr.
  • getLinuxBrokerVersion — queries and displays the version of the Linux identity broker. slay, we love knowing things.
  • generateSignedHttpRequest — generates a signed HTTP request token for the selected account. requires Proof-of-Possession parameters to be specified with -P. no -P, no token, periodt.

✨ OPTIONS ✨

  • -a index — select account by index (default: 0). the account index corresponds to the position in the list returned by getAccounts. so like, know your index, bestie.
  • -A upn — select account by User Principal Name (UPN), e.g. user@example.com.
  • -d — decode JWT tokens in the output. requires libjwt support at compile time. ngl this one's the fun one.
  • -f format — set output format. supported values are text (default) and json.
  • -h — print a help message and exit. the classic. 🎀
  • -I — enforce interactive token acquisition, even when a cached token is available. yes, even then. main character energy, refusing the shortcut.
  • -P params — Proof-of-Possession parameters as a JSON string. required for generateSignedHttpRequest. the JSON object supports the following keys:
    • authenticationScheme — either "PoP" or "Bearer".
    • resourceRequestMethod — HTTP method: "GET", "POST", or "PUT".
    • resourceRequestUri — the target resource URI.
    • shrClaims — (optional) additional SHR claims.
    • shrNonce — (optional) SHR nonce value.
  • -r uri — OIDC redirect URI for the client application.
  • -s client_id — Azure client application ID (default: Microsoft Edge on Linux, d7b530a4-7680-4c23-a8bf-c52c121d2e87).
  • -S scope — OIDC scope to request. this option can be specified multiple times to request multiple scopes. if not specified, defaults to https://graph.microsoft.com/.default.
  • -t token — provide a token for renewal (used with acquireTokenSilent).
  • -x authority — Entra ID (Azure AD) authority URL (default: https://login.microsoftonline.com/common).

😭 EXIT STATUS 😭

  • 0 — success. we ate. 💅
  • 1 — an error occurred (e.g., no accounts found, invalid parameters, broker communication failure). it happens to the best of us.

🌈 ENVIRONMENT 🌈

  • G_MESSAGES_DEBUG=ssomib — enable debug logging of DBus call parameters via GLib's message logging system. for when you need to see everything. 👀

🍓 EXAMPLES 🍓

list all registered accounts:

$ sso-mib-tool getAccounts

get account details by UPN in JSON format:

$ sso-mib-tool getAccounts -A user@example.com -f json

acquire a token silently with decoded JWT output:

$ sso-mib-tool acquireTokenSilent -d

acquire a token interactively for SMTP access:

$ sso-mib-tool acquireTokenInteractive -f json \
    -s <client_id> \
    -r https://login.microsoftonline.com/common/oauth2/nativeclient \
    -x https://login.microsoftonline.com/<tenant_id> \
    -S 'https://outlook.office365.com/SMTP.Send'

generate a signed HTTP request with PoP parameters:

$ sso-mib-tool generateSignedHttpRequest \
    -P '{"authenticationScheme":"PoP","resourceRequestMethod":"POST","resourceRequestUri":"https://example.com/"}'

🧚 SIGNALS 🧚

  • SIGINT — cancels any in-flight broker operations gracefully. press Ctrl+C and it leaves the party politely. 🫶

💜 SEE ALSO 💜

go read that one too, bestie. ✨

👑 AUTHORS 👑

  • Felix Moessbauer <felix.moessbauer@siemens.com>
  • Andreas Ziegler <ziegler.andreas@siemens.com>

Copyright (C) 2025 Siemens AG. Licensed under GPL-2.0-only.

and that's the whole page, fr fr. 💕 this was sso-mib version 0.10.1, dated 2025, signed off by your girl SSO-MIB-TOOL(1). stay hydrated, keep your tokens fresh, and never pass -P a JSON string you didn't mean. mwah. 🎀✨🦋

📦 where this page comes from