SSSD-IFP(5)

💖 SSSD-IFP(5) 💖

okay bestie, so this is a page from File Formats and Conventions — and it's literally the whole lore drop on the SSSD InfoPipe responder. grab a snack, we're doing this. 🎀

---

✨ NAME ✨

sssd-ifp — the SSSD InfoPipe responder, bestie. that's it, that's the name. 💅

---

🌸 DESCRIPTION 🌸

So this manual page? It describes how you configure the InfoPipe responder for sssd(8). If you want the full detailed syntax reference, go read the “FILE FORMAT” section of the sssd.conf(5) manual page — that's where the real syntax tea is. 🫖

The InfoPipe responder hands you a public D-Bus interface that lives on the system bus. What does that mean for you, queen? It means you can query info about remote users and groups over the system bus. that's the whole vibe. ✨

🔎 FIND BY VALID CERTIFICATE

These next options control how certificates get validated when you're using the FindByValidCertificate() API. Look at them, love them:

• ca_db
• p11_child_timeout
• certificate_verification

For more deets on any of these options, go check sssd.conf(5). 💖

---

⚙️ CONFIGURATION OPTIONS ⚙️

These are the options you use to actually configure the InfoPipe responder. Let's go one by one, no skipping, we don't do that here. 🦋

• allowed_uids (string) — Specifies the comma-separated list of UID values or user names that are allowed to access the InfoPipe responder. User names get resolved to UIDs at startup, periodt.

Default: 0 — meaning only the root user is allowed to access the InfoPipe responder.

⚠️ okay so important: even though 0 is the default, this option will overwrite it. So if you still want root to be able to access the InfoPipe responder (which, ngl, is usually the case), you have to add 0 to your list of allowed UIDs too. don't forget, bestie, or you'll be locked out wondering why. 😭

• user_attributes (string) — Specifies the comma-separated list of white- or blacklisted attributes. Heads up: this option only applies to the “Users” interface. The deprecated “GetUserAttr” interface does not use this option — it allows any attribute you ask for. 🙈

By default, the InfoPipe responder /Users interface only lets you request the default set of POSIX attributes. That set is literally the same one getpwnam(3) returns, and it includes:

• name — user's login name
• uidNumber — user ID
• gidNumber — primary group ID
• gecos — user information, typically full name
• homeDirectory — home directory
• loginShell — user shell

You can add another attribute to this set by using “+attr_name”, or explicitly remove one using “-attr_name”. Anything you add becomes available in the “extraAttributes” array. For example, to allow “telephoneNumber” but deny “loginShell”, you'd use this config:

user_attributes = +telephoneNumber, -loginShell

Default: not set. Only the default set of POSIX attributes is allowed.

• wildcard_limit (integer) — Specifies an upper limit on the number of entries that get downloaded during a wildcard lookup, which overrides the caller-supplied limit. iconic, honestly. 👑

Default: 0 — meaning let the caller set an upper limit.

---

👀 SEE ALSO 👀

go read these too, iykyk:

sssd(8), sssd.conf(5), sssd-ldap(5), sssd-ldap-attributes(5), sssd-krb5(5), sssd-simple(5), sssd-ipa(5), sssd-ad(5), sssd-idp(5), sssd-sudo(5), sssd-session-recording(5), sss_cache(8), sss_debuglevel(8), sss_obfuscate(8), sss_seed(8), sssd_krb5_locator_plugin(8), sss_ssh_authorizedkeys(1), sss_ssh_knownhosts(1), sssd-ifp(5), pam_sss(8). sss_rpcidmapd(5) sssd-systemtap(5)

---

🫶 AUTHORS 🫶

The SSSD upstream — https://github.com/SSSD/sssd/

---

and that's the page, bestie!! 🌈 no cap, you're now fully certified in InfoPipe responder configuration. mwah. 💜

SSSD · 07/08/2026 · SSSD-IFP(5) — slay, bye! 💅✨