Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH

What this post added

This post introduces the open-sourcing of OPKSSH (OpenPubkey SSH), a system that integrates single sign-on (SSO) technologies like OpenID Connect with SSH. OPKSSH allows users to authenticate to SSH servers using their identity provider (IdP) credentials, eliminating the need for manual SSH key management. It achieves this by packaging an OpenPubkey PK Token (which includes an identity and a public key) into an SSH certificate extension. The SSH server uses an AuthorizedKeysCommand to invoke an OpenPubkey verifier, which validates the PK Token and checks if the user's email address is authorized. This enhances security by using ephemeral keys and improves usability by simplifying the authentication process.