---
name: "sss_ssh_authorizedkeys"
section: "1"
platform: "linux"
package: "sssd"
version: "2.13.1-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/sss_ssh_authorizedkeys"
---

# sss\_ssh\_authorizedkeys(1)

get OpenSSH authorized keys

## NAME

sss\_ssh\_authorizedkeys - get OpenSSH authorized keys

## SYNOPSIS

**sss\_ssh\_authorizedkeys** \[*options*\] *USER*

## DESCRIPTION

**sss\_ssh\_authorizedkeys** acquires SSH public keys for user *USER* and outputs them in OpenSSH authorized\_keys format (see the “AUTHORIZED\_KEYS FILE FORMAT” section of [**sshd**(8)](/sshd/8.md) for more information).

[**sshd**(8)](/sshd/8.md) can be configured to use **sss\_ssh\_authorizedkeys** for public key user authentication if it is compiled with support for “AuthorizedKeysCommand” option. Please refer to the [**sshd\_config**(5)](/sshd_config/5.md) man page for more details about this option.

If “AuthorizedKeysCommand” is supported, [**sshd**(8)](/sshd/8.md) can be configured to use it by putting the following directives in [**sshd\_config**(5)](/sshd_config/5.md):

```
  AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys
  AuthorizedKeysCommandUser nobody
```

### KEYS FROM CERTIFICATES

In addition to the public SSH keys for user *USER* **sss\_ssh\_authorizedkeys** can return public SSH keys derived from the public key of a X.509 certificate as well.

To enable this the “ssh\_use\_certificate\_keys” option must be set to true (default) in the \[ssh\] section of sssd.conf. If the user entry contains certificates (see “ldap\_user\_certificate” in [**sssd-ldap**(5)](/sssd-ldap/5.md) for details) or there is a certificate in an override entry for the user (see [**sss\_override**(8)](/sss_override/8.md) or [**sssd-ipa**(5)](/sssd-ipa/5.md) for details) and the certificate is valid SSSD will extract the public key from the certificate and convert it into the format expected by sshd.

Besides “ssh\_use\_certificate\_keys” the options

• ca\_db

• p11\_child\_timeout

• certificate\_verification

can be used to control how the certificates are validated (see [**sssd.conf**(5)](/sssd.conf/5.md) for details).

The validation is the benefit of using X.509 certificates instead of SSH keys directly because e.g. it gives a better control of the lifetime of the keys. When the ssh client is configured to use the private keys from a Smartcard with the help of a PKCS#11 shared library (see [**ssh**(1)](/ssh/1.md) for details) it might be irritating that authentication is still working even if the related X.509 certificate on the Smartcard is already expired because neither **ssh** nor **sshd** will look at the certificate at all.

It has to be noted that the derived public SSH key can still be added to the authorized\_keys file of the user to bypass the certificate validation if the **sshd** configuration permits this.

## OPTIONS

- **-d**,**--domain** *DOMAIN*

  Search for user public keys in SSSD domain *DOMAIN*.

- **-?**,**--help**

  Display help message and exit.

## EXIT STATUS

In case of success, an exit value of 0 is returned. Otherwise, 1 is returned.

## SEE ALSO

[**sssd**(8)](/sssd/8.md), [**sssd.conf**(5)](/sssd.conf/5.md), [**sssd-ldap**(5)](/sssd-ldap/5.md), [**sssd-ldap-attributes**(5)](/sssd-ldap-attributes/5.md), [**sssd-krb5**(5)](/sssd-krb5/5.md), [**sssd-simple**(5)](/sssd-simple/5.md), [**sssd-ipa**(5)](/sssd-ipa/5.md), [**sssd-ad**(5)](/sssd-ad/5.md), [**sssd-idp**(5)](/sssd-idp/5.md), [**sssd-sudo**(5)](/sssd-sudo/5.md), [**sssd-session-recording**(5)](/sssd-session-recording/5.md), [**sss\_cache**(8)](/sss_cache/8.md), [**sss\_debuglevel**(8)](/sss_debuglevel/8.md), [**sss\_obfuscate**(8)](/sss_obfuscate/8.md), [**sss\_seed**(8)](/sss_seed/8.md), [**sssd\_krb5\_locator\_plugin**(8)](/sssd_krb5_locator_plugin/8.md), [**sss\_ssh\_authorizedkeys**(1)](/sss_ssh_authorizedkeys/1.md), [**sss\_ssh\_knownhosts**(1)](/sss_ssh_knownhosts/1.md), [**sssd-ifp**(5)](/sssd-ifp/5.md), [**pam\_sss**(8)](/pam_sss/8.md). [**sss\_rpcidmapd**(5)](/sss_rpcidmapd/5.md)

## AUTHORS

**The SSSD upstream - https://github.com/SSSD/sssd/**