Certificate-based OpenSSH for Federated Identities

Despite being the most widely used Secure Shell Protocol (SSH) implementation, OpenSSH
only supports a very limited number of authentication mechanism including passwords,
public keys, and Kerberos. The extension of OpenSSH with support for authentication
using federated identities addresses the security risks associated with password-based
authentication, prevents cumbersome management of public keys, and streamlines user
management by enabling Single Sign-On (SSO) capabilities across diverse systems and
platforms. We present oinit, a collection of programs extending OpenSSH to support
any OpenID Connect identity provider for authentication. Our certificate-based solution
integrates seamlessly with standard OpenSSH and does not require any changes in users’
existing workflows or used programs.