Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH

This post introduces OpenPubkey SSH (OPKSSH), an open-source project that integrates single sign-on (SSO) with SSH. OPKSSH allows users to authenticate to SSH servers using OpenID Connect (OIDC) tokens, eliminating the need for manual SSH key management. It achieves this by generating ephemeral SSH keys on-demand, obtaining a PK Token from an OIDC provider that commits to the ephemeral key and user identity, and then packaging this PK Token into an SSH certificate extension. The SSH server uses an AuthorizedKeysCommand to invoke the OpenPubkey verifier, which validates the PK Token and checks user authorization based on the identity claims within the token. This approach enhances security through ephemeral keys and improves usability by simplifying the SSH login process.