SSO for ssh
Posted by Accurate-Sundae1744@reddit | ExperiencedDevs | View on Reddit | 6 comments
Just noticed news about OPKSSH https://www.helpnetsecurity.com/2025/03/28/opkssh-sso-ssh/ and wonder what are folks opinion... My thoughts were like "oh great, yet again someone brings some corporate feature to bind you to their services"...
But though I definitely don't plan to access my homelab via Google SSO I can see how it can be useful...
xor_rotate@reddit
opkssh maintainer here, happy to answer any questions or feedback/criticism
Wronnay@reddit
As an experienced dev you should know that this is not limited to Google, Microsoft and other big corporations but can be used with any OIDC provider.
I run my own OIDC provider and will probably try this out in the future.
Same with my employer - we have our own OIDC provider and could use this to simplify SSH access…
samgranieri@reddit
Keycloak with step?
rabbitix98@reddit
https://github.com/openpubkey/opkssh?tab=readme-ov-file#custom-openid-providers-authentik-authelia-keycloak-zitadel
readme explained setup with customer OIDC
originalchronoguy@reddit
It is useful for zero-trust environment.
I can better explaining it with an example. Say you have a server cluster. All access is audited.
I don't remember the exact term but you sign in via SSO. It knows your user/role ACL group.
Then it gives you a 45 minute .pem (key file) which expires. That key file allows you to SSH and do your thing and get out. After 45 minutes, your key file is useless. No hacker, no rogue internal nefarious actor.
All that access is highly audited. Like why do you need to SSH into that server? Give us a reason. Need to review a log file? Great, log into this portal, you got 45 minutes to do your thing on that single server.
Ok_Bathroom_4810@reddit
SSO allows for shorter ttl keys and depending on your SSO provider it can be easier to reuse your SSO 2fa than have a separate setup for ssh.