NAME¶

sso-mib-tool - interact with the Microsoft Identity Broker for SSO on Azure Entra ID

SYNOPSIS¶

sso-mib-tool COMMAND [OPTION]...

DESCRIPTION¶

sso-mib-tool is a command-line frontend to the sso-mib library for interacting with a Microsoft Identity Broker via DBus. It can be used to list accounts, acquire authentication tokens (both silently and interactively), obtain PRT SSO cookies, and generate signed HTTP requests using Proof-of-Possession (PoP) tokens.

The tool implements support for the OIDC extension MS-OAPXBC, including requesting Primary Refresh Tokens and exchanging them for Access Tokens.

COMMANDS¶

getAccounts

List all accounts registered with the broker. When used with -A, returns a single account matching the given User Principal Name.

removeAccount

Remove an account from the broker. Use -a to specify the account index.

acquirePrtSsoCookie

Acquire a PRT SSO cookie for the selected account. Requires a registered account. Default scope is https://graph.microsoft.com/.default.

acquireTokenSilent

Acquire an access token silently (without user interaction) using the Primary Refresh Token. Requires a registered account.

acquireTokenInteractive

Acquire an access token interactively. This will prompt the user for authentication via the broker.

getLinuxBrokerVersion

Query and display the version of the Linux identity broker.

generateSignedHttpRequest

Generate a signed HTTP request token for the selected account. Requires Proof-of-Possession parameters to be specified with -P.

OPTIONS¶

-a index

Select account by index (default: 0). The account index corresponds to the position in the list returned by getAccounts.

-A upn

Select account by User Principal Name (UPN), e.g. user@example.com.

-d

Decode JWT tokens in the output. Requires libjwt support at compile time.

-f format

Set output format. Supported values are text (default) and json.

-h

Print a help message and exit.

-I

Enforce interactive token acquisition, even when a cached token is available.

-P params

Proof-of-Possession parameters as a JSON string. Required for generateSignedHttpRequest. The JSON object supports the following keys:

-r uri

OIDC redirect URI for the client application.

-s client_id

Azure client application ID (default: Microsoft Edge on Linux, d7b530a4-7680-4c23-a8bf-c52c121d2e87).

-S scope

OIDC scope to request. This option can be specified multiple times to request multiple scopes. If not specified, defaults to https://graph.microsoft.com/.default.

-t token

Provide a token for renewal (used with acquireTokenSilent).

-x authority

Entra ID (Azure AD) authority URL (default: https://login.microsoftonline.com/common).

EXIT STATUS¶

0

Success.

1

An error occurred (e.g., no accounts found, invalid parameters, broker communication failure).

ENVIRONMENT¶

G_MESSAGES_DEBUG=ssomib

Enable debug logging of DBus call parameters via GLib's message logging system.

EXAMPLES¶

List all registered accounts:

$ sso-mib-tool getAccounts

Get account details by UPN in JSON format:

$ sso-mib-tool getAccounts -A user@example.com -f json

Acquire a token silently with decoded JWT output:

$ sso-mib-tool acquireTokenSilent -d

Acquire a token interactively for SMTP access:

$ sso-mib-tool acquireTokenInteractive -f json \


    -s <client_id> \


    -r https://login.microsoftonline.com/common/oauth2/nativeclient \


    -x https://login.microsoftonline.com/<tenant_id> \


    -S 'https://outlook.office365.com/SMTP.Send'

Generate a signed HTTP request with PoP parameters:

$ sso-mib-tool generateSignedHttpRequest \


    -P '{"authenticationScheme":"PoP","resourceRequestMethod":"POST","resourceRequestUri":"https://example.com/"}'

SIGNALS¶

SIGINT

Cancels any in-flight broker operations gracefully.

SEE ALSO¶

sso-mib-gch-smtp-o365(1)

AUTHORS¶

Felix Moessbauer <felix.moessbauer@siemens.com>
Andreas Ziegler <ziegler.andreas@siemens.com>

COPYRIGHT¶

Copyright (C) 2025 Siemens AG. Licensed under GPL-2.0-only.