SSSD-IDP(5)

💖 sssd-idp 💖

okay so bestie, this is sssd-idp(5) — a page from the File Formats and Conventions section of the manual (section 5, iykyk), and it's literally all about the SSSD IdP provider. grab a strawberry drink 🍓 and let's get into it.

---

✨ NAME ✨

sssd-idp — the SSSD IdP provider, no cap 💅

---

🦋 DESCRIPTION 🦋

This manual page describes the configuration of the IdP provider for sssd(8). If you want the full detailed syntax reference, go read the “FILE FORMAT” section of the sssd.conf(5) manual page — it's the main character of syntax docs, fr fr.

The IdP provider is a back end used to connect to an OAuth 2.0 and REST based identity provider (IdP). Here's the tea though: since different products might have their own individual implementation of the REST API for looking up user and group attributes, dedicated code might be required — check the “idp_type” option for the details, okay? 👀

Also, IdPs typically do not provide POSIX attributes like, say, user Id (UID) or home directory. So SSSD's IdP provider will just autogenerate the needed attributes for you — iconic, honestly. The default algorithm to generate user IDs (UIDs) and group IDs (GIDs) aims to create reproducible IDs on different systems. The drawback? 😭 It might happen that the algorithm assigns the same ID to different objects, and then only the first one requested via SSSD will be available. So like... first come, first served, basically.

---

🎀 CONFIGURATION OPTIONS 🎀

Refer to the section “DOMAIN SECTIONS” of the sssd.conf(5) manual page for the details on configuring an SSSD domain — that's your homework, bestie 📚.

• idp_type (string) — Required option that specifies the IdP product. Currently Entra ID (entra_id) and Keycloak (keycloak) are supported.

Depending on the IdP product, additional platform specific options might follow the name separated by a colon (:). E.g. for Keycloak the base URI for the user and group REST API must be given. For Entra ID the base URI for the Microsoft Graph API can be given to use sovereign or government cloud endpoints instead of the default (https://graph.microsoft.com/v1.0). E.g. “entra_id:https://graph.microsoft.us/v1.0” for the US government cloud (GCC High) 🇺🇸.

Default: Not set (Required)

• idp_client_id (string) — ID of the IdP client used by SSSD to authenticate users and as a client to lookup user and group attributes. This client must offer device authorization according to RFC-8628 and must have permissions to search and read user and group attributes. like, it needs the permissions, no shortcuts 💅

Default: Not set (Required)

• idp_client_secret (string) — Password of the IdP client. The password is required for the id_provider. If it's only used as auth_provider it depends on the server side configuration if it is required or not. shrug 🫶

Default: Not set

• idp_token_endpoint (string) — IdP endpoint for requesting access tokens. 🔑

Default: Not set (Required)

• idp_device_auth_endpoint (string) — IdP endpoint for device authorization according to RFC-8628. This is required for user authentication.

Default: Not set

• idp_userinfo_endpoint (string) — IdP userinfo endpoint to request user attributes after a successful authentication of the user. Required for authentication. 💖

Default: Not set

• idp_id_scope (string) — Scope required for looking up user and group attributes with the REST API. The scopes are used by the server to determine which attributes/claims are returned to the caller.

Note: In previous versions of SSSD, this option was expected to already be URL-encoded. ⚠️ so if you're carrying old configs around, heads up!

Default: Not set

• idp_auth_scope (string) — Scope required during authentication. The scopes are used by the server to determine which attributes/claims are returned to the caller.

Currently the tokens returned during user authentication are not used for other purposes, hence the only important claim is the subject identifier 'sub' which is used to check if the authenticated user is the one trying to log in. This might change in future, so don't get too comfy 👑

Default: Not set

• idp_request_timeout (integer) — Timeout in seconds for an individual request to the IdP. ⏱️

Default: 10

• idp_auto_refresh (boolean) — Refresh tokens automatically, after they have reached about half their lifetime. cute little self-care routine for your tokens 🌸

Note: Scheduled token refreshes are not preserved across restarts of SSSD. ⚠️

Default: false

• idmap_range_min (integer) — Specifies the lower (inclusive) bound of the range of POSIX IDs to use for mapping IdP users and group to POSIX IDs. It is the first POSIX ID which can be used for the mapping.

The interval between “idmap_range_min” and “idmap_range_max” will be split into smaller ranges of size “idmap_range_size” which will be used by an individual IdP domain. math! we love her 🔢

Default: 200000

• idmap_range_max (integer) — Specifies the upper (exclusive) bound of the range of POSIX IDs to use for mapping IdP users and groups to POSIX IDs. It is the first POSIX ID which will not be used for POSIX ID-mapping anymore. 🚫

Default: 2000200000

• idmap_range_size (integer) — Specifies the number of POSIX IDs available for a single IdP domain.

Default: 200000

---

🌈 EXAMPLE 🌈

here's the whole thing in action — copy-paste energy, but read it first bestie 🫶

[domain/entra_id]
id_provider = idp
idp_type = entra_id
idp_client_id = 12345678-abcd-0101-efef-ba9876543210
idp_client_secret = YOUR-CLIENT-SCERET
idp_token_endpoint = https://login.microsoftonline.com/TENNANT-ID/oauth2/v2.0/token
idp_userinfo_endpoint = https://graph.microsoft.com/v1.0/me
idp_device_auth_endpoint = https://login.microsoftonline.com/TENNANT-ID/oauth2/v2.0/devicecode
idp_id_scope = https://graph.microsoft.com/.default
idp_auth_scope = openid profile email

[domain/keycloak]
idp_type = keycloak:https://master.keycloak.test:8443/auth/admin/realms/master/
id_provider = idp
idp_client_id = myclient
idp_client_secret = YOUR-CLIENT-SCERET
idp_token_endpoint = https://master.keycloak.test:8443/auth/realms/master/protocol/openid-connect/token
idp_userinfo_endpoint = https://master.keycloak.test:8443/auth/realms/master/protocol/openid-connect/userinfo
idp_device_auth_endpoint = https://master.keycloak.test:8443/auth/realms/master/protocol/openid-connect/auth/device
idp_id_scope = profile
idp_auth_scope = openid profile email

---

🧚 SEE ALSO 🧚

the whole friend group, omg 💜

sssd(8), sssd.conf(5), sssd-ldap(5), sssd-ldap-attributes(5), sssd-krb5(5), sssd-simple(5), sssd-ipa(5), sssd-ad(5), sssd-idp(5), sssd-sudo(5), sssd-session-recording(5), sss_cache(8), sss_debuglevel(8), sss_obfuscate(8), sss_seed(8), sssd_krb5_locator_plugin(8), sss_ssh_authorizedkeys(1), sss_ssh_knownhosts(1), sssd-ifp(5), pam_sss(8). sss_rpcidmapd(5) sssd-systemtap(5)

---

👑 AUTHORS 👑

The SSSD upstream — https://github.com/SSSD/sssd/ ✨

---

and that's the page!! 🎀 brought to you by SSSD, dated 09/08/2026 — mwah, go configure something iconic 💅🦋