| SSSD-IFP(5) | File Formats and Conventions | SSSD-IFP(5) |
.SH "NAME" sssd-ifp - SSSD InfoPipe responder
.SH "DESCRIPTION"
.PP This manual page describes the configuration of the InfoPipe responder
for sssd(8). For a detailed syntax reference, refer to the
“FILE FORMAT” section of the sssd.conf(5) manual
page.
.PP The InfoPipe responder provides a public D-Bus interface accessible over
the system bus. The interface allows the user to query information about
remote users and groups over the system bus.
.SS "FIND BY VALID CERTIFICATE"
.PP The following options can be used to control how the certificates are
validated when using the FindByValidCertificate() API:
For more details about the options see sssd.conf(5).
.SH "CONFIGURATION OPTIONS"
.PP These options can be used to configure the InfoPipe responder.
.PP allowed_uids (string)
Specifies the comma-separated list of UID values or user names that are
allowed to access the InfoPipe responder. User names are resolved to UIDs at
startup.
Default: 0 (only the root user is allowed to access the InfoPipe
responder)
Please note that although the UID 0 is used as the default it will be
overwritten with this option. If you still want to allow the root user to
access the InfoPipe responder, which would be the typical case, you have to
add 0 to the list of allowed UIDs as well.
.RE
.PP user_attributes (string)
Specifies the comma-separated list of white or blacklisted attributes. This
option only applies to the “Users” interface. The deprecated
“GetUserAttr” interface does not utilize this option, it
allows any attribute requested.
By default, the InfoPipe responder `/Users` interface only allows the default
set of POSIX attributes to be requested. This set is the same as returned by
getpwnam(3) and includes:
.PP name
user's login name
.RE
.PP uidNumber
user ID
.RE
.PP gidNumber
primary group ID
.RE
.PP gecos
user information, typically full name
.RE
.PP homeDirectory
home directory
.RE
.PP loginShell
user shell
.RE
.sp
It is possible to add another attribute to this set by using
“+attr_name” or explicitly remove an attribute using
“-attr_name”. Added attributes will be made available in the
“extraAttributes” array. For example, to allow
“telephoneNumber” but deny “loginShell”, you
would use the following configuration:
user_attributes = +telephoneNumber, -loginShell
Default: not set. Only the default set of POSIX attributes is allowed.
.RE
.PP wildcard_limit (integer)
Specifies an upper limit on the number of entries that are downloaded during
a wildcard lookup that overrides caller-supplied limit.
Default: 0 (let the caller set an upper limit)
.RE
.SH "SEE ALSO"
.PP sssd(8), sssd.conf(5), sssd-ldap(5),
sssd-ldap-attributes(5), sssd-krb5(5), sssd-simple(5),
sssd-ipa(5), sssd-ad(5), sssd-sudo(5),
sssd-session-recording(5), sss_cache(8),
sss_debuglevel(8), sss_obfuscate(8), sss_seed(8),
sssd_krb5_locator_plugin(8), sss_ssh_authorizedkeys(1),
sss_ssh_knownhosts(1), sssd-ifp(5), pam_sss(8).
sss_rpcidmapd(5)
AUTHORS
The SSSD upstream - https://github.com/SSSD/sssd/
| 10/11/2026 | SSSD |