SSO-MIB-TOOL(1)

NAME
sso-mib-tool - interact with the Microsoft Identity Broker for SSO on Azure Entra ID

SYNOPSIS
sso-mib-tool COMMAND [OPTION]...

DESCRIPTION
sso-mib-tool is a command-line frontend to the sso-mib library for interacting with a Microsoft Identity Broker via DBus. It can be used to list accounts, acquire authentication tokens (both silently and interactively), obtain PRT SSO cookies, and generate signed HTTP requests using Proof-of-Possession (PoP) tokens.

The tool implements support for the OIDC extension MS-OAPXBC, including requesting Primary Refresh Tokens and exchanging them for Access Tokens.

COMMANDS

getAccounts
    List all accounts registered with the broker. When used with -A, returns a single account matching the given User Principal Name.

removeAccount
    Remove an account from the broker. Use -a to specify the account index.

acquirePrtSsoCookie
    Acquire a PRT SSO cookie for the selected account. Requires a registered account. Default scope is https://graph.microsoft.com/.default.

acquireTokenSilent
    Acquire an access token silently (without user interaction) using the Primary Refresh Token. Requires a registered account.

acquireTokenInteractive
    Acquire an access token interactively. This will prompt the user for authentication via the broker.

getLinuxBrokerVersion
    Query and display the version of the Linux identity broker.

generateSignedHttpRequest
    Generate a signed HTTP request token for the selected account. Requires Proof-of-Possession parameters to be specified with -P.

OPTIONS

-a index
    Select account by index (default: 0). The account index corresponds to the position in the list returned by getAccounts.

-A upn
    Select account by User Principal Name (UPN), e.g. user@example.com.

-d  Decode JWT tokens in the output. Requires libjwt support at compile time.

-f format
    Set output format. Supported values are text (default) and json.

-h  Print a help message and exit.

-I  Enforce interactive token acquisition, even when a cached token is available.

-P params
    Proof-of-Possession parameters as a JSON string. Required for generateSignedHttpRequest. The JSON object supports the following keys:

    authenticationScheme
        Either "PoP" or "Bearer".

    resourceRequestMethod
        HTTP method: "GET", "POST", or "PUT".

    resourceRequestUri
        The target resource URI.

    shrClaims
        (Optional) Additional SHR claims.

    shrNonce
        (Optional) SHR nonce value.

-r uri
    OIDC redirect URI for the client application.

-s client_id
    Azure client application ID (default: Microsoft Edge on Linux, d7b530a4-7680-4c23-a8bf-c52c121d2e87).

-S scope
    OIDC scope to request. This option can be specified multiple times to request multiple scopes. If not specified, defaults to https://graph.microsoft.com/.default.

-t token
    Provide a token for renewal (used with acquireTokenSilent).

-x authority
    Entra ID (Azure AD) authority URL (default: https://login.microsoftonline.com/common).

EXIT STATUS

0   Success.

1   An error occurred (e.g., no accounts found, invalid parameters, broker communication failure).

ENVIRONMENT

G_MESSAGES_DEBUG=ssomib
    Enable debug logging of DBus call parameters via GLib's message logging system.

EXAMPLES
List all registered accounts:

    $ sso-mib-tool getAccounts

Get account details by UPN in JSON format:

    $ sso-mib-tool getAccounts -A user@example.com -f json

Acquire a token silently with decoded JWT output:

    $ sso-mib-tool acquireTokenSilent -d

Acquire a token interactively for SMTP access:

    $ sso-mib-tool acquireTokenInteractive -f json \
        -s <client_id> \
        -r https://login.microsoftonline.com/common/oauth2/nativeclient \
        -x https://login.microsoftonline.com/<tenant_id> \
        -S 'https://outlook.office365.com/SMTP.Send'

Generate a signed HTTP request with PoP parameters:

    $ sso-mib-tool generateSignedHttpRequest \
        -P '{"authenticationScheme":"PoP","resourceRequestMethod":"POST","resourceRequestUri":"https://example.com/"}'

SIGNALS

SIGINT
    Cancels any in-flight broker operations gracefully.

SEE ALSO
sso-mib-gch-smtp-o365(1)

AUTHORS
@PACKAGE_AUTHORS@

COPYRIGHT
Copyright (C) 2025 Siemens AG. Licensed under GPL-2.0-only.