Re: [saag] SSH Protocol Extensions

[Stefan Winter <[e-mail]>]

Hi,

> Briefly, I am seeking to add support for federated/asserted identities
> to SSH, for scenarios where the protocol is used as an application
> transport (e.g. git, svn). This involves the client sending a desired
> username for authentication, along with a authentication token from a
> trusted 3rd party.
> 
> In the initial implementation, this would be a SAML assertion

The above is pretty much exactly what the ABFAB working group has been
working on for the last couple of years. Federated SSH access is their
number one real-life case AFAICT.

Did you review their specs yet?

Greetings,

Stefan Winter

, although
> I intend to make the implementation generic enough to support other
> mechanisms. Trust relationships for valid IdPs would be handled
> according to local policy.
> 
> A related extension will be a formal websocket binding for SSH, and I
> expect the reference implementation of this to be a patch to Gerrit (a
> git-based code review tool that contains an embedded Java SSH server).
> 
> Phil Lello
> 
> 
> _______________________________________________
> saag mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/saag
> 


-- 
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et
de la Recherche
6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg

Tel: [phone]
Fax: [phone]

PGP key updated to 4096 Bit RSA - I will encrypt all mails if the
recipient's key is known to me

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66