Re: [kitten] [saag] SSH Protocol Extensions

Or look into already published RFC 6616 for OpenID in SASL or RFC 6595
on SAML in SASL.  SAML-EC avoids the web loop, and may indeed be more
relevant depending on use-case.

I believe the problem with these mechanisms has been:

1) They are stateless -- if you need to open many connections, or open
them often, you need one OpenID/SAML authentication per connection which
results in poor user experience.

2) They are tied to a particular federation system.  Sometimes this is
not a problem, but I imagine sometimes the client/server does not know
what system is the most appriate to use until a web loop has been
invoked.

The OAuth SASL mechanism (long delayed, still being worked on) may also
be relevant to look into, but it does not support GSS-API so SSH support
is not a given.

I believe there is room for improvement in this area, so Phil, please
let us know about your progress.  If you send me an email I may assist
offlist with some advice too.

/Simon

> I think that  RFC 4462 plus the SAML ECP mechanism
> (draft-ietf-kitten-sasl-saml-ec) can do what you're talking about and
> is probably a fairly good secure way of using a SAML assertion to
> authenticate to SSH.
> >>>>> "Phil" == Phil Lello <phil@dunlop-lello.uk> writes:
> 
>     Phil>    Hi, I'm currently working on extensions to the SSH
>     Phil> protocol; as I believe the SecSH WG is effectively dormant,
>     Phil> is this list the best place to discuss the proposals?
>     Phil> Briefly, I am seeking to add support for federated/asserted
>     Phil> identities to SSH, for scenarios where the protocol is used
>     Phil> as an application transport (e.g. git, svn). This involves
>     Phil> the client sending a desired username for authentication,
>     Phil> along with a authentication token from a trusted 3rd
>     Phil> party.  In the initial implementation, this would be a SAML
>     Phil> assertion, although I intend to make the implementation
>     Phil> generic enough to support other mechanisms. Trust
>     Phil> relationships for valid IdPs would be handled according to
>     Phil> local policy.  A related extension will be a formal
>     Phil> websocket binding for SSH, and I expect the reference
>     Phil> implementation of this to be a patch to Gerrit (a git-based
>     Phil> code review tool that contains an embedded Java SSH
>     Phil> server).  Phil Lello
>     Phil> _______________________________________________ saag
>     Phil> mailing list saag@ietf.org
>     Phil> https://www.ietf.org/mailman/listinfo/saag