diff --git a/lib/CF/Controller/SSO.pm b/lib/CF/Controller/SSO.pm
new file mode 100644
index 0000000000000000000000000000000000000000..f93a1207cc5ea876830fbbabc34755a609d88bcd
--- /dev/null
+++ b/lib/CF/Controller/SSO.pm
@@ -0,0 +1,117 @@
+package CF::Controller::SSO;
+
+use Mojo::Base 'Mojolicious::Controller';
+use Mojo::Pg::PubSub;
+use feature 'signatures';
+no warnings qw{ experimental::signatures };
+use Mojo::UserAgent;
+
+sub subjects ($c) {
+    $c->openapi->valid_input or return;
+    my $args = $c->validation->output;
+
+    my ( $groups, $users, @subjects );
+
+    if ( $args->{class} =~ /all|group/ ) {
+        @subjects = $c->_groups( $args->{search} );
+    }
+
+    if ( $args->{class} =~ /all|user/ ) {
+        @subjects = (@subjects, $c->_users( $args->{search} ));
+    }
+
+    $c->render(openapi => \@subjects);
+}
+
+sub _groups ($c, $search) {
+
+    my $ua = Mojo::UserAgent->new;
+    my @groups = ();
+    my $groups;
+
+    eval {
+        $groups = $ua->get(
+            sprintf($c->config->{iapi_get_groups}, $search)
+        )->result->json;
+    };
+
+    if ( $groups && ref $groups eq 'ARRAY' ) {
+        my @tmp      = ();
+
+        # vyssi priorita pri vyskytu na zacatku
+        GROUP:
+        foreach my $group ( @{ $groups } ) {
+
+            next if $group->{code} =~ /^_group/; # nezarazene skupiny
+            next if $group->{name} =~ /^@/; # zavinacove skupiny
+
+            $group->{priority} = 0;
+            $group->{priority} = 1 if $group->{name}  =~ /^$search/i;
+            $group->{priority} = 2 if $group->{code}  =~ /^$search/i;
+            push @tmp, $group,
+        }
+
+        GROUP:
+        foreach my $group ( sort {
+            $b->{priority} <=> $a->{priority} or
+            lc($a->{name}) cmp lc($b->{name}) or
+            lc($a->{code}) cmp lc($b->{code})
+        } @tmp ) {
+            push @groups, {
+                class => 'group',
+                value => $group->{code},
+                label => $group->{name},
+            };
+        }
+    }
+
+    return @groups;
+
+}
+
+sub _users ($c, $search) {
+
+    my $ua = Mojo::UserAgent->new;
+    my @users = ();
+    my $users;
+
+    eval {
+        $users = $ua->get(
+            sprintf($c->config->{iapi_get_users}, $search)
+        )->result->json;
+    };
+
+    if ( $users && ref $users eq 'ARRAY' ) {
+        my @tmp      = ();
+
+        # vyssi priorita pri vyskytu na zacatku
+        USER:
+        foreach my $user ( @{ $users } ) {
+            $user->{priority} = 0;
+            $user->{priority} = 1 if $user->{lastname}  =~ /^$search/i;
+            $user->{priority} = 2 if $user->{username}  =~ /^$search/i;
+            $user->{priority} = 3 if $user->{firstname} =~ /^$search/i;
+            push @tmp, $user,
+        }
+
+        USER:
+        foreach my $user ( sort {
+            $b->{priority}      <=> $a->{priority}  or
+            lc($a->{firstname}) cmp lc($b->{firstname}) or
+            lc($a->{lastname})  cmp lc($b->{lastname})
+        } @tmp ) {
+            push @users, {
+                class => 'user',
+                value => $user->{username},
+                label => $user->{displayname}
+                      || $user->{firstname} . ' ' . $user->{lastname},
+            };
+        }
+    }
+
+    return @users;
+
+}
+
+
+1;
diff --git a/openapi.yaml b/openapi.yaml
index 2e4991a7057fe416e9734c3637087a780cf0b13a..625cfcb85d1c152f9206eca95ac41467cda31692 100644
--- a/openapi.yaml
+++ b/openapi.yaml
@@ -98,6 +98,15 @@ components:
           type: integer
         my_vote:
           type: integer
+    Option:
+      type: object
+      properties:
+        class:
+          type: string
+        value:
+          type: string
+        label:
+          type: string
     PostHistoryItem:
       type: object
       properties:
@@ -215,6 +224,42 @@ paths:
         204:
           description: Program entry updated
 
+  /sso/subjects:
+    get:
+      x-mojo-to: SSO#subjects
+      tags:
+        - config
+      summary: "Subjekty SSO"
+      operationId: getSubjects
+      parameters:
+      - name: search
+        in: query
+        description: "Retezec pro vyhledavani"
+        required: true
+        schema:
+          type: string
+          minLength: 3
+          pattern: '^[\w:\.\-]{3,}$'
+          example: 'cen:'
+      - name: class
+        in: query
+        description: "Trida subjektu"
+        required: true
+        schema:
+          type: string
+          enum: [all, user, group]
+          example: group
+          default: all
+      responses:
+        200:
+          description: Seznam subjektu
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/Option'
+
   /program:
     get:
       x-mojo-to: program#entries