diff --git a/selinux/ipa.fc b/selinux/ipa.fc
index f6e3f6732..e17f5ca66 100644
--- a/selinux/ipa.fc
+++ b/selinux/ipa.fc
@@ -8,6 +8,7 @@
 
 /usr/libexec/ipa-otpd		--	gen_context(system_u:object_r:ipa_otpd_exec_t,s0)
 /usr/libexec/ipa/ipa-otpd		--	gen_context(system_u:object_r:ipa_otpd_exec_t,s0)
+/usr/libexec/sssd/oidc_child 	-- gen_context(system_u:object_r:ipa_otpd_exec_t,s0)
 
 /usr/libexec/ipa/ipa-ods-exporter	--	gen_context(system_u:object_r:ipa_ods_exporter_exec_t,s0)
 
@@ -17,6 +18,7 @@
 /usr/libexec/ipa/oddjob/com\.redhat\.idm.*  --  gen_context(system_u:object_r:ipa_helper_exec_t,s0)
 /usr/libexec/ipa/oddjob/org\.freeipa.*  --  gen_context(system_u:object_r:ipa_helper_exec_t,s0)
 
+
 /var/lib/ipa(/.*)?              gen_context(system_u:object_r:ipa_var_lib_t,s0)
 
 /var/log/ipa(/.*)?              gen_context(system_u:object_r:ipa_log_t,s0)
diff --git a/selinux/ipa.te b/selinux/ipa.te
index d18a4010d..75bcf0b49 100644
--- a/selinux/ipa.te
+++ b/selinux/ipa.te
@@ -14,6 +14,12 @@ type ipa_otpd_t, ipa_domain;
 type ipa_otpd_exec_t;
 init_daemon_domain(ipa_otpd_t, ipa_otpd_exec_t)
 
+# for oidc_child communication with IdPs
+corenet_tcp_connect_http_port(ipa_otpd_t)
+kernel_dgram_send(ipa_otpd_t)
+allow ipa_otpd_t self:unix_dgram_socket { create getopt setopt };
+allow ipa_otpd_t ipa_otpd_exec_t:file execute_no_trans;
+
 type ipa_dnskey_t, ipa_domain;
 type ipa_dnskey_exec_t;
 init_daemon_domain(ipa_dnskey_t, ipa_dnskey_exec_t)
@@ -115,6 +121,7 @@ optional_policy(`
 	sssd_stream_connect(ipa_otpd_t)
 ')
 
+logging_send_syslog_msg(ipa_otpd_t)
 ########################################
 #
 # password policy local policy
@@ -490,4 +497,4 @@ optional_policy(`
         type oddjob_t;
     ')
 	ipa_helper_noatsecure(oddjob_t)
-')
\ No newline at end of file
+')