oidc_child: support Entra onPremisesImmutableId identifiers - #9038
Open
mmpleake wants to merge 1 commit into
Open
oidc_child: support Entra onPremisesImmutableId identifiers#9038mmpleake wants to merge 1 commit into
mmpleake wants to merge 1 commit into
Conversation
mmpleake
marked this pull request as draft
August 4, 2026 16:52
mmpleake
marked this pull request as ready for review
August 4, 2026 21:54
justin-stephenson
left a comment
justin-stephenson
left a comment
Contributor
There was a problem hiding this comment.
Thank you for submitting this PR, it looks quite well done including documentation and tests.
Can you please remove the Merge branch 'SSSD:master' into entra-hybrid-onprem-immutable-id merge commit?
@sumit-bose will likely have more comments on this PR.
mmpleake
force-pushed
the
entra-hybrid-onprem-immutable-id
branch
2 times, most recently
from
August 17, 2026 21:55
32954f6 to
5ba5d84
Compare
Add support for mapping users via the Entra ID onPremisesImmutableId attribute in the IdP/OIDC provider, enabling AD + Entra hybrid deployments to resolve on-prem identities. Refactor oidc_child response handling into a dedicated oidc_child_user_id module so user-id extraction and response matching are more modular and independently testable, and add cmocka coverage in test_oidc_user_id.c. Update Makefile.am for the new sources and the string_utils reference, and document the new option in sssd-idp.5. Assisted-By: Claude (Anthropic), and other generative AI tools (multiple models) using the AI Incubator sandbox provided by the Center for AI at Pacific Northwest National Laboratory (PNNL)
mmpleake
force-pushed
the
entra-hybrid-onprem-immutable-id
branch
from
August 17, 2026 21:59
5ba5d84 to
1b8d3a4
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
IDP: Add Entra onPremisesImmutableId option
Hybrid AD and Entra ID deployments can use the AD objectGUID as the
SSSD user UUID while Entra ID returns a cloud-generated id from the
userinfo endpoint. This causes the IdP authentication result to fail
matching the cached AD user entry.
Add idp_auth_user_identifier_attr so deployments can explicitly choose
which userinfo attribute oidc_child should return as the user
identifier. When set to onPremisesImmutableId, oidc_child decodes the
base64-encoded AD objectGUID, converts it from Microsoft GUID byte
order, and returns the canonical UUID string.
The default behavior is unchanged. Existing IdP configurations continue
to use their current provider defaults unless the new option is set.
Resolves: #8574
:config: Added idp_auth_user_identifier_attr for IdP authentication.
This allows hybrid AD and Entra ID deployments to use
onPremisesImmutableId as the authentication identifier.