Identity Provider references
Register an external OIDC identity source (Keycloak, Okta, Azure AD, GitHub…) in IPA so users log in through the device authorization flow and still obtain a Kerberos ticket.
An Identity Provider reference is the registration of an external OAuth 2.0 / OIDC server. Once a user's authentication type includes "External Identity Provider" with a reference, login uses the device authorization flow (RFC 8628): the client prints a URL and a one-time code, the user completes the login at the IdP in a browser, the KDC polls the IdP and issues a ticket carrying the idp authentication indicator. No licence module involved.
Fits when the primary identity lives in a SaaS IdP and IPA only manages Linux hosts, or when corporate SSO's MFA should cover ssh logins. Does not fit unattended service accounts; a person with a browser is part of the flow.
Fields
| Field | Meaning |
|---|---|
| Identity Provider reference name | local name, referenced from a user's authentication settings |
| Client identifier / Secret | the OAuth client registered at the IdP; the IdP must allow the device authorization grant |
| Scope | requested scopes, default openid email |
| External IdP user identifier attribute | which claim from the IdP is matched against the IPA user, default email; the IPA user's e-mail must be identical |
| Authorization / Device authorization / Token / User info URI | endpoints. The CLI --provider= templates (keycloak, okta, google, github, microsoft) fill them; the UI form takes them by hand |
| JWKS URI / Issuer URL | for validating the ID token |
With a template:
ipa idp-add keycloak-sso --provider=keycloak --client-id=idmatrix \
--org=<realm> --base-url=https://sso.example.com/auth --secretEnabling it on a user
On the user's detail page tick External Identity Provider under User authentication types, then choose the reference and enter the user's identifier at the IdP (the value of the "External IdP user identifier attribute"). It can be ticked together with Password; either method then works.
Client requirements
sssd 2.7+ and the sssd-idp package in addition to krb5-pkinit; ipa-client-install 4.10+ pulls it in. An ssh login then prints:
Authenticate at https://sso.example.com/auth/realms/rst/device?user_code=ABCD-EFGH and press ENTER.Boundaries
- The IPA user must exist before the first login; the IdP does not create users.
- Graphical login (gdm) and the console's own login page do not support the flow; ssh /
kinit/ terminal logins do. - With the IdP unreachable the user cannot log in; there is no offline cache.
OTP tokens
TOTP / HOTP token fields, user self-service, enabling two-factor on a user, how password + OTP is entered, and resynchronising a drifted token.
Certificate mapping
Requires the ca module. How a client certificate or smart card is matched to a user: matching and mapping rule syntax, priority, the global "prompt for username" switch, and checking a rule on the match page.