Chapter 5. Configuring SSSD to use a generic identity provider

1. SSSD generates a user-friendly URL and a unique device code.
2. The user opens the URL on a separate device (such as a smartphone or laptop).
3. The user enters the code to authorize the RHEL login session, and, if the user is not already logged in, authenticates with the IdP.
4. SSSD automatically detects the authorization and grants access to the RHEL session.

Procedure

1. Log in to the Keycloak Admin Console and select your Realm.
2. Navigate to Clients > Create client and select OpenID Connect as the Client type.
3. Specify a Client ID, for example, RHELSSSDClient and click Next.
4. Specify a name for the client, for example RHELSSSDClient.

5. Click Next and ensure the following settings are enabled for the SSSD client:

   • Client authentication is on.
   • Under Authentication flow, ensure the OAuth 2.0 Device Authorization Grant and Service accounts roles are both enabled.
6. Click Next and click Save.
7. On your SSSD client page, click Service account roles to add the required roles to your client.

8. Click Assign Roles and select the following roles from the list:

   • View-groups
   • Query-groups
   • Query-users
   • View-users
9. Click Assign.
10. Click Clients > RHELSSSDClient.
11. Select the Credentials tab.

12. Click the copy icon beside the Client Secret to save it to your clipboard.

    Use this Client Secret to configure SSSD for generic IdP authentication.

Procedure

1. Sign in to the Microsoft Entra admin center.
2. Go to Identity > Applications > App registrations > New registration.
3. Enter a meaningful name for your application, for example RHELSSSDClient, and select the supported account types.

4. Under Authentication, choose one of the following:

   1. If you are using the device code flow without a secret, ensure Allow public client flows is set to Yes.
   2. If you are configuring a confidential client, navigate to Certificates & secrets and create a Client secret.
5. Copy the Application (client) ID and Directory (tenant) ID.

6. Grant the registered application specific Application Permissions (not Delegated) to allow SSSD to retrieve user and group metadata via Client Credentials. Configure these under Manage > API permissions in the Azure Portal:

   • Group.Read.All
   • GroupMember.Read.All
   • User.Read.All (enables SSSD to look up other users during the identity phase)
   • User.Read

   • Admin Consent: All Application level permissions require a status of Granted for [Organization] to take effect.

     Note

     You must grant Admin Consent for User.Read. Without it, user authentication might fail if the SSSD option idp_auth_scope excludes the user.read scope.

Procedure

1. To enable the generic IdP provider, open /etc/sssd/sssd.conf in a text editor.

2. Define the domain configuration for either Red Hat Build of Keycloak or Microsoft Entra ID using the id_provider=idp option.

   1. To define the configuration for Red Hat Build of Keycloak, add the following to the sssd.conf file:

      [sssd]
      services = nss, pam
      domains = keycloak
      
      [domain/keycloak]
      idp_type = keycloak:https://master.keycloak.test:8443/auth/admin/realms/master/
      id_provider = idp
      auto_private_groups = true
      use_fully_qualified_names = true
      idp_client_id = <RHELSSSDClient>
      idp_client_secret = <RHELSSSDClientPassword>
      idp_token_endpoint = https://master.keycloak.test:8443/auth/realms/master/protocol/openid-connect/token
      idp_userinfo_endpoint = https://master.keycloak.test:8443/auth/realms/master/protocol/openid-connect/userinfo
      idp_device_auth_endpoint = https://master.keycloak.test:8443/auth/realms/master/protocol/openid-connect/auth/device
      idp_id_scope = profile
      idp_auth_scope = openid profile email
      
      [nss]
      default_shell = /bin/bash
      fallback_homedir = /home/%f

   2. To define the configuration for Microsoft Entra ID, add the following to the sssd.conf file:

      [sssd]
      services = nss, pam
      domains = entra_id
      
      [domain/entra_id]
      id_provider = idp
      auto_private_groups = true
      use_fully_qualified_names = true
      idp_client_id = <UUID_of_your_Entra_ID_client>
      idp_client_id = <Password_of_your_Entra_ID_client>
      idp_token_endpoint = https://login.microsoftonline.com/<your_Entra_ID_tennant_UUID>/oauth2/v2.0/token
      idp_device_auth_endpoint = https://login.microsoftonline.com/<your_Entra_ID_tennant_UUID>/oauth2/v2.0/devicecode
      idp_userinfo_endpoint = https://graph.microsoft.com/v1.0/me
      idp_id_scope = https%3A%2F%2Fgraph.microsoft.com%2F.default
      idp_auth_scope = openid profile email
      
      [nss]
      default_shell = /bin/bash
      fallback_homedir = /home/%f

3. Remove any remaining logs and clear the cache:

   # sssctl logs-remove

   # sssctl cache-remove -ops

4. Restart SSSD:

   # systemctl restart sssd

Verification

1. Attempt to look up a user defined in your IdP:

   # getent password <user_name>@keycloak

   <user_name>@keycloak:*:955808455:955808455::/home/<user_name>@keycloak:/bin/bash

2. Attempt to log in as a user defined in your IdP:

   # ssh -l <user_name>@keycloak localhost

   (<user_name>@keycloak@localhost) Authenticate at https://master.keycloak.test:8443/auth/realms/device?user_code=NVCT-RUFA

3. Copy the URL to your web browser.

   Note

   Ensure that you are not logged into the Keycloak Admin Console as another user or this attempt to log in fails.

4. Enter your username and password to sign in. Note that the first time you log in, you have to change to a new password.
5. On the Grant Access to YourKeycloakSSSDClient window, select Yes.
6. Return to the SSSD configuration window and press ENTER.

7. You should be logged in. Verify you are logged in as <user_name>:

   [<user_name>@keycloak@client ~] $ id

   uid=955808455(<user_name>@keycloak) gid=955808455(<user_name>@keycloak) groups=955808455(<user_name>@keycloak),955844066(group2@keycloak),955943585(group1@keycloak)