Re: [saag] SSH Protocol Extensions

[Sam Hartman <[e-mail]>]

>>>>> "Viktor" == Viktor Dukhovni <[e-mail]> writes:

    Viktor> On Wed, Aug 12, 2015 at 05:13:02PM +0100, Phil Lello wrote:
    >> Admittedly, I'm currently put off by what appears to be a steep
    >> learning curve once GSS, RADIUS, et al. come into the mix, but
    >> with my 'lazy coder' hat on, it doesn't seem unreasonable that
    >> other potential implementers will feel the same.

    Viktor> Is this confusing implementation with deployment?

    Viktor> Once the platform's GSSAPI library supports ABFAB, it
    Viktor> becomes a question of deployment, not implementation.

    Viktor> -- Viktor.

to be clear, ABFAB is kind of heavy-weight if you really want to use a
SAML assertion to authenticate for ssh.  It does support doing that at a
theoretical level, and we do actually have running code with people
using SAML assertions to carry attribute statements for ssh in ABFAB.

However, the SAML EC folks have running code for using SAML assertions
for ssh authentication and that removes a couple of layers from the
system, so I think it's a better fit for what I understand of this use
case.