Skip to content
ssoossh
Search
Ctrl
K
Cancel
GitHub
Select theme
Dark
Light
Auto
Menu
Why ssoossh
Adoption FAQ
Getting started
Installing from packages
How it works
How ssoossh works
Keys and certificates compared
Interactive user certificates
Illustrated walkthrough
Options and lifetime resolution
Service certificates
sudo and su through PAM
The console login flow
Passwords, tokens, and pam_ssoossh
Security model
User guide
The ssoossh client
ssh_config integration
Client configuration
The web UI
Approving in the browser
Service accounts
Diagnostics
User FAQ
Host administration
Hosts overview
Trusting the CA in sshd
pam
Installing pam_ssoossh
sudo and su
Console login
sshd keyboard-interactive
The principals map
The trusted CA file
pam_ssoossh reference
PAM troubleshooting
Directory users on a host (ssoossh-nss)
Client settings enforcement
Host admin FAQ
Server operations
Deployment overview
Installing the server
Identity provider
TLS and reverse proxies
Startup modes
Multi-instance and NATS
Database
Certificate lifetime policy
Key ID templates
Roles and containment
Email notifications
LDAP enrichment
LDAP schema presets
NSS directory
Audit log
Deployment diagnostics
HSM and PKCS#11
Operator FAQ
The CA key in an ssh-agent
Examples
Server configuration examples
Reference
Configuration (ssoosshd.yaml)
Overview
Top-level keys
logging
db
http
Overview
access_logging
cert_request_rate_limit
tls
queue
authentication
ldap
Overview
sync
logging
nss
Overview
attributes
admin
audit
hsm
ssh_key_agent
pubsub
cert_options
Overview
user
service
pam
console
mail
Overview
smtp
logging
branding
version
ssoossh (client)
ssoossh
ca
host
Overview
check
mapping
Overview
add
list
remove
principals
service
Overview
enroll
retrieve
ssh
Overview
config
inspect
login
logout
proxycommand
version
ssoosshd (server)
ssoosshd
config
Overview
check
identity
Overview
echo
ldap
Overview
probe
sync
serve
Overview
api
full
sign
version
HTTP API
Overview
client
Overview
The CA public key
Create a console login certificate request
Create a PAM certificate request
Wait for a request's outcome (SSE)
Create a service enrollment request
Redeem an enrollment code for a certificate
Create a user certificate request
web
Overview
The caller's issued-certificate history
View a certificate's full details
What the caller would be approving
Approve a request
Deny a request
A service enrollment's retrieval log
Resolve a console login code
The caller's approved service enrollments
Who holds an enrollment's service account
Set an enrollment's notification address
The caller's denied certificate requests
The fleet key lifetimes
List the fleet API keys the caller's groups manage
Create a fleet API key
One fleet API key
Change a fleet API key
End a fleet API key's previous secret early
Revoke a fleet API key
Rotate a fleet API key
A fleet API key's rotation report
A fleet API key's usage
The caller's own identity
Update the caller's own web UI detail level
The caller's own notification preferences
Update the caller's own notification preferences
auth
Overview
Redeem a bootstrap echo link
OIDC callback
Start the OIDC login flow
End the session
nss
Overview
Look a POSIX group up by gid
Look a POSIX group up by name
Look a POSIX user up by name
Look a POSIX user up by uid
admin
View the recent audit event feed (auditor-only)
View certificate history across all users (auditor-only)
View effective server configuration (admin only)
Run deployment self-checks (admin-only)
List all service enrollments (auditor-only)
Get enrollment details (auditor-only)
Expire an enrollment (admin or SOC)
Start a claims echo (admin-only)
Probe the directory (admin-only, read-only)
Directory sync status and probe target (admin-only)
Run the directory sync now (admin-only)
List uid, gid and name collisions (admin only)
List the stored NSS groups (auditor and above)
Read one stored NSS group (auditor and above)
Accept a group's pending gid (admin only)
View a stored NSS group's audit history (auditor and above)
List a stored NSS group's membership rows (auditor and above)
Purge a tombstoned group early (admin only)
List every fleet API key (auditor and above, or fleet key admin)
List pending uid and gid changes (admin only)
List the stored NSS accounts (auditor and above)
Read one stored NSS account (auditor and above)
Accept an account's pending uid or gid (admin only)
View a stored NSS account's audit history (auditor and above)
Purge a tombstoned account early (admin only)
List all users (auditor-only)
Get user details (auditor-only)
View a user's audit timeline (auditor-only)
Disable a user (admin or SOC)
Re-enable a user (admin or SOC)
public
Get branding configuration
Get organization logo image
Get server version
enrollments
Expire a service enrollment code you hold
Operations
Liveness probe
Liveness probe, plain text
Internals
Signing pipeline
Invariants
Host context
Wire types
Design brief
Project
Decisions
Release notes
Roadmap
Dependency scanning
Contributing
GitHub
Select theme
Dark
Light
Auto
Overview
nss
Section titled “nss”
Called by the ssoossh-nss host daemon, authenticated by a fleet API key
Operations
Section titled “Operations”
GET
/api/nss/group/gid/{gid}
GET
/api/nss/group/name/{name}
GET
/api/nss/user/name/{name}
GET
/api/nss/user/uid/{uid}