Installation

Himmelblau is distributed as native packages for each supported Linux distribution. Visit the Himmelblau Downloads Page to fetch the appropriate packages for your distribution.

Packages

Himmelblau is split into several packages. Install all of them unless you have a specific reason to exclude one:

Package	Description
`himmelblau`	The core daemon (`himmelblaud` and `himmelblaud-tasks`). Required.
`nss-himmelblau`	The NSS module (`libnss_himmelblau.so`). Enables `getent passwd` and group resolution for Entra ID identities. Required.
`pam-himmelblau`	The PAM module (`pam_himmelblau.so`). Enables PAM-based authentication against Entra ID. Required.
`himmelblau-sso`	The SSO broker helper. Enables browser and desktop applications (Chrome, Firefox) to acquire tokens silently. Recommended.

Installation by distribution

Packages built from the development branch are intended for testing and evaluation only. Do not deploy development builds to production systems. Use a stable release from the Downloads Page for production deployments.

openSUSE Tumbleweed
openSUSE Leap / SLE
Fedora & RHEL
Debian & Ubuntu
NixOS

Himmelblau is available directly from the standard repository on Tumbleweed. Refresh and install in one step:

sudo zypper ref && sudo zypper in himmelblau nss-himmelblau pam-himmelblau himmelblau-sso

First, add the appropriate repository for your version:

# Leap 15.6 or SUSE Linux Enterprise 15 SP6
sudo zypper ar https://download.opensuse.org/repositories/network:/idm/15.6/network:idm.repo

# Leap 15.5 or SUSE Linux Enterprise 15 SP5
sudo zypper ar https://download.opensuse.org/repositories/network:/idm/15.5/network:idm.repo

Then refresh and install:

sudo zypper ref && sudo zypper in himmelblau nss-himmelblau pam-himmelblau himmelblau-sso

Download the RPM packages from the Downloads Page, then install them with dnf:

sudo dnf install ./himmelblau-<version>.rpm \
  ./himmelblau-sshd-config-<version>.rpm \
  ./himmelblau-sso-<version>.rpm \
  ./nss-himmelblau-<version>.rpm \
  ./pam-himmelblau-<version>.rpm

Replace <version> with the version string from the downloaded filenames. This applies to Fedora, Red Hat Enterprise Linux, and RHEL-compatible distributions such as Rocky Linux.

Download the DEB packages from the Downloads Page, then install them with apt:

sudo apt install ./himmelblau_<version>.deb \
  ./himmelblau-sshd-config_<version>.deb \
  ./himmelblau-sso_<version>.deb \
  ./nss-himmelblau_<version>.deb \
  ./pam-himmelblau_<version>.deb

Replace <version> with the version string from the downloaded filenames.

Himmelblau provides a NixOS module that installs and configures the daemon, PAM module, and NSS module automatically.For full NixOS setup instructions including flake-based, NPINS, and classic configurations, see the NixOS platform guide.A minimal flake-based example:

{
  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
    himmelblau.url = "github:himmelblau-idm/himmelblau/main";
    himmelblau.inputs.nixpkgs.follows = "nixpkgs";
  };
  outputs = { self, nixpkgs, himmelblau }: {
    nixosConfigurations."your-machine" = nixpkgs.lib.nixosSystem {
      system = "x86_64-linux";
      modules = [
        himmelblau.nixosModules.himmelblau
        {
          services.himmelblau.enable = true;
          services.himmelblau.settings = {
            domain = "your-tenant.onmicrosoft.com";
            pam_allow_groups = [ "ENTRA-GROUP-GUID-HERE" ];
          };
        }
        ./configuration.nix
      ];
    };
  };
}

Post-install steps

After installing packages, disable the legacy nscd daemon. It conflicts with Himmelblau’s own identity cache:

sudo systemctl stop nscd
sudo systemctl disable nscd
sudo systemctl mask nscd

Then proceed to the Quickstart to configure your domain, NSS, and PAM.

Get Started

Configuration

Authentication

Operations

Platform Guides

Packages

Installation by distribution

Post-install steps

Build docs developers (and LLMs) love

Get Started

Configuration

Authentication

Operations

Platform Guides

​Packages

​Installation by distribution

​Post-install steps

Build docs developers (and LLMs) love

Packages

Installation by distribution

Post-install steps