Re: [saag] SSH Protocol Extensions

Many thanks Stefan, I wasn't aware of the ABFAB WG, I will review their
specs.

Phil

On Wed, Aug 12, 2015 at 12:25 PM, Stefan Winter <stefan.winter@restena.lu>
wrote:

> Hi,
>
> > Briefly, I am seeking to add support for federated/asserted identities
> > to SSH, for scenarios where the protocol is used as an application
> > transport (e.g. git, svn). This involves the client sending a desired
> > username for authentication, along with a authentication token from a
> > trusted 3rd party.
> >
> > In the initial implementation, this would be a SAML assertion
>
> The above is pretty much exactly what the ABFAB working group has been
> working on for the last couple of years. Federated SSH access is their
> number one real-life case AFAICT.
>
> Did you review their specs yet?
>
> Greetings,
>
> Stefan Winter
>
> , although
> > I intend to make the implementation generic enough to support other
> > mechanisms. Trust relationships for valid IdPs would be handled
> > according to local policy.
> >
> > A related extension will be a formal websocket binding for SSH, and I
> > expect the reference implementation of this to be a patch to Gerrit (a
> > git-based code review tool that contains an embedded Java SSH server).
> >
> > Phil Lello
> >
> >
> > _______________________________________________
> > saag mailing list
> > saag@ietf.org
> > https://www.ietf.org/mailman/listinfo/saag
> >
>
>
> --
> Stefan WINTER
> Ingenieur de Recherche
> Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et
> de la Recherche
> 6, rue Richard Coudenhove-Kalergi
> L-1359 Luxembourg
>
> Tel: +352 424409 1
> Fax: +352 422473
>
> PGP key updated to 4096 Bit RSA - I will encrypt all mails if the
> recipient's key is known to me
>
> http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66
>