[saag] SSH Protocol Extensions

[Phil Lello <[e-mail]>]

Hi,

I'm currently working on extensions to the SSH protocol; as I believe the
SecSH WG is effectively dormant, is this list the best place to discuss the
proposals?

Briefly, I am seeking to add support for federated/asserted identities to
SSH, for scenarios where the protocol is used as an application transport
(e.g. git, svn). This involves the client sending a desired username for
authentication, along with a authentication token from a trusted 3rd party.

In the initial implementation, this would be a SAML assertion, although I
intend to make the implementation generic enough to support other
mechanisms. Trust relationships for valid IdPs would be handled according
to local policy.

A related extension will be a formal websocket binding for SSH, and I
expect the reference implementation of this to be a patch to Gerrit (a
git-based code review tool that contains an embedded Java SSH server).

Phil Lello