SSS\_SSH\_AUTHORIZEDKE(1) SSSD Manual pages SSS\_SSH\_AUTHORIZEDKE(1)

.SH "NAME" sss\_ssh\_authorizedkeys - get OpenSSH authorized keys

.SH "SYNOPSIS"

.HP 552u

**sss\_ssh\_authorizedkeys**  
\[*options*]  
*USER*

.SH "DESCRIPTION"

.PP **sss\_ssh\_authorizedkeys** acquires SSH public keys for user *USER* and outputs them in OpenSSH authorized\_keys format (see the “AUTHORIZED\_KEYS FILE FORMAT” section of [**sshd**(8)](/man/enterprise-packages/sssd/sshd.8) for more information).

.PP [**sshd**(8)](/man/enterprise-packages/sssd/sshd.8) can be configured to use **sss\_ssh\_authorizedkeys** for public key user authentication if it is compiled with support for “AuthorizedKeysCommand” option. Please refer to the [**sshd\_config**(5)](/man/enterprise-packages/sssd/sshd_config.5) man page for more details about this option.

.PP If “AuthorizedKeysCommand” is supported, [**sshd**(8)](/man/enterprise-packages/sssd/sshd.8) can be configured to use it by putting the following directives in [**sshd\_config**(5)](/man/enterprise-packages/sssd/sshd_config.5):

```


  AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys


  AuthorizedKeysCommandUser nobody
```

.SS "KEYS FROM CERTIFICATES"

.PP In addition to the public SSH keys for user *USER* **sss\_ssh\_authorizedkeys** can return public SSH keys derived from the public key of a X.509 certificate as well.

.PP To enable this the “ssh\_use\_certificate\_keys” option must be set to true (default) in the \[ssh] section of sssd.conf. If the user entry contains certificates (see “ldap\_user\_certificate” in [**sssd-ldap**(5)](/man/enterprise-packages/sssd/sssd-ldap.5) for details) or there is a certificate in an override entry for the user (see [**sss\_override**(8)](/man/enterprise-packages/sssd/sss_override.8) or [**sssd-ipa**(5)](/man/enterprise-packages/sssd/sssd-ipa.5) for details) and the certificate is valid SSSD will extract the public key from the certificate and convert it into the format expected by sshd.

.PP Besides “ssh\_use\_certificate\_keys” the options

•ca\_db

•p11\_child\_timeout

•certificate\_verification

can be used to control how the certificates are validated (see [**sssd.conf**(5)](/man/enterprise-packages/sssd/sssd.conf.5) for details).

.PP The validation is the benefit of using X.509 certificates instead of SSH keys directly because e.g. it gives a better control of the lifetime of the keys. When the ssh client is configured to use the private keys from a Smartcard with the help of a PKCS#11 shared library (see [**ssh**(1)](/man/enterprise-packages/sssd/ssh.1) for details) it might be irritating that authentication is still working even if the related X.509 certificate on the Smartcard is already expired because neither **ssh** nor **sshd** will look at the certificate at all.

.PP It has to be noted that the derived public SSH key can still be added to the authorized\_keys file of the user to bypass the certificate validation if the **sshd** configuration permits this.

.SH "OPTIONS"

.PP **-d**,**--domain** *DOMAIN*

Search for user public keys in SSSD domain *DOMAIN*.

.RE  
.PP **-?**,**--help**

Display help message and exit.

.SH "EXIT STATUS"

.PP In case of success, an exit value of 0 is returned. Otherwise, 1 is returned.

.SH "SEE ALSO"

.PP [**sssd**(8)](/man/enterprise-packages/sssd/sssd.8), [**sssd.conf**(5)](/man/enterprise-packages/sssd/sssd.conf.5), [**sssd-ldap**(5)](/man/enterprise-packages/sssd/sssd-ldap.5), [**sssd-ldap-attributes**(5)](/man/enterprise-packages/sssd/sssd-ldap-attributes.5), [**sssd-krb5**(5)](/man/enterprise-packages/sssd/sssd-krb5.5), [**sssd-simple**(5)](/man/enterprise-packages/sssd/sssd-simple.5), [**sssd-ipa**(5)](/man/enterprise-packages/sssd/sssd-ipa.5), [**sssd-ad**(5)](/man/enterprise-packages/sssd/sssd-ad.5), [**sssd-sudo**(5)](/man/enterprise-packages/sssd/sssd-sudo.5), [**sssd-session-recording**(5)](/man/enterprise-packages/sssd/sssd-session-recording.5), [**sss\_cache**(8)](/man/enterprise-packages/sssd/sss_cache.8), [**sss\_debuglevel**(8)](/man/enterprise-packages/sssd/sss_debuglevel.8), [**sss\_obfuscate**(8)](/man/enterprise-packages/sssd/sss_obfuscate.8), [**sss\_seed**(8)](/man/enterprise-packages/sssd/sss_seed.8), [**sssd\_krb5\_locator\_plugin**(8)](/man/enterprise-packages/sssd/sssd_krb5_locator_plugin.8), [**sss\_ssh\_authorizedkeys**(1)](/man/enterprise-packages/sssd/sss_ssh_authorizedkeys.1), [**sss\_ssh\_knownhosts**(1)](/man/enterprise-packages/sssd/sss_ssh_knownhosts.1), [**sssd-ifp**(5)](/man/enterprise-packages/sssd/sssd-ifp.5), [**pam\_sss**(8)](/man/enterprise-packages/sssd/pam_sss.8). [**sss\_rpcidmapd**(5)](/man/enterprise-packages/sssd/sss_rpcidmapd.5)

# [AUTHORS](#AUTHORS)

**The SSSD upstream - https://github.com/SSSD/sssd/**

10/09/2026 SSSD

---

Document: sss_ssh_authorizedkeys(1) from sssd 2.13.1-r5 (Chainguard OS)
Source: https://github.com/SSSD/sssd.git