Re: [kitten] [saag] SSH Protocol Extensions

I think that  RFC 4462 plus the SAML ECP mechanism
(draft-ietf-kitten-sasl-saml-ec) can do what you're talking about and is
probably a fairly good secure way of using a SAML assertion to
authenticate to SSH.
>>>>> "Phil" == Phil Lello <phil@dunlop-lello.uk> writes:

    Phil>    Hi, I'm currently working on extensions to the SSH
    Phil> protocol; as I believe the SecSH WG is effectively dormant, is
    Phil> this list the best place to discuss the proposals?  Briefly, I
    Phil> am seeking to add support for federated/asserted identities to
    Phil> SSH, for scenarios where the protocol is used as an
    Phil> application transport (e.g. git, svn). This involves the
    Phil> client sending a desired username for authentication, along
    Phil> with a authentication token from a trusted 3rd party.  In the
    Phil> initial implementation, this would be a SAML assertion,
    Phil> although I intend to make the implementation generic enough to
    Phil> support other mechanisms. Trust relationships for valid IdPs
    Phil> would be handled according to local policy.  A related
    Phil> extension will be a formal websocket binding for SSH, and I
    Phil> expect the reference implementation of this to be a patch to
    Phil> Gerrit (a git-based code review tool that contains an embedded
    Phil> Java SSH server).  Phil Lello
    Phil> _______________________________________________ saag mailing
    Phil> list saag@ietf.org https://www.ietf.org/mailman/listinfo/saag