SSH с авторизацией в Keycloak? Легко
Привет, уважаемый %username%! Уважаю твое личное время, поэтому без лишних слов - сразу к делу. В этой статье я кратко опишу, как настроить доступ к удаленному серверу по SSH с использованием Keycloak. Разберем, в чем преимущества этого решения, и что именно происходит в процессе такой авторизации.
### #Cloudflare open sources #OPKSSH to bring Single Sign-On #SSO to #SSH
This week, it was officially open-sourced under the umbrella of the #OpenPubkey project, itself became a #Linux Foundation open-source initiative in 2023, OPKSSH remained closed-source until now. Making it easy to #authenticate to #servers over SSH using #OpenID Connect (#OIDC), allowing developers to ditch manually configured SSH keys in favor of identity provider-based access.
OPKSSH (OpenPubkey SSH) is now open-sourced as part of the OpenPubkey project. This enables users and organizations to configure SSH to work with single sign-on technologies like OpenID Connect, removing the need to manually manage & configure SSH keys without adding a trusted party other than your IdP.
New highly nerdy and awesome blog on #openpubkey and #cryptography
https://www.bastionzero.com/blog/generalizing-openpubkey-to-any-identity-provider
Excited to share a new IETF internet draft that @bifurcation and I just submitted to the OAuth working group.
We introduce PIKA: Proof of Issue Key Authority, to solve a problem relevant to #openpubkey, #oidc and JWTs in general.
What's a PIKA and why do I care?
OpenPubkey uses PK Tokens to allow an OpenID Provider (OP) to bind user identities to user-held public keys. This essentially allows the OP to act like a certificate authority, without any changes to today's OIDC.
PK Tokens are signed by the OP's signing keys. But, OP's rotate their signing keys over time. What happens if we need to use a PK Token *after* the OP rotates signing key?
This is where the PIKA comes in.
In this draft, we introduce the PIKA and show how it can be combined with a timestamping authority to allow PK Tokens to be used even after the OP rotates it signing key. The PIKA is a secure object that allows you to cache the OP's key, and verify using the OP's key even if the OP is offline.
And that's why I got interested in this work.
But our solution is much more generic and widely applicable than to just OpenPubkey. PIKAs allow the verification of JWTs, ID Tokens and other OIDC Tokens without querying the OP directly. You can use them to reduce the load on a OP, or to build applications that require caching or historical information about OP keys. Historical information about signing key is a particularly important in #softwaresupplychain usecases.
We're still digesting all the different ways that PIKAs can be used. Feel free to get in touch if you have any feedback!
https://www.ietf.org/archive/id/draft-barnes-oauth-pika-00.html
A relying party verifying a JSON Web Token (JWT) needs to verify that the public key used to verify the signature legitimately represents the issuer represented in the "iss" claim of the JWT. Today, relying parties commonly use the "iss" claim to fetch a set of authorized signing keys over HTTPS, relying on the security of HTTPS to establish the authority of the downloaded keys for that issuer. The ephemerality of this proof of authority makes it unsuitable for use cases where a JWT might need to be verified for some time. In this document, we define a format for Proofs of Issuer Key Authority, which establish the authority of a key using a signed object instead of an HTTPS connection.
How to Use OpenPubkey to Solve Key Management via SSO
#Products #Docker #OpenPubkey #Security
https://www.docker.com/blog/how-to-use-openpubkey-to-solve-key-management-via-sso/
How to Use OpenPubkey to SSH Without SSH Keys
#Docker #Products #Containers #Dockersecurity #OpenPubkey
https://www.docker.com/blog/how-to-use-openpubkey-to-ssh-without-ssh-keys/
How to Use OpenPubkey with GitHub Actions Workloads
#Products #Docker #Githubaction #Opensource #OpenPubkey #SecureSoftwareSupplyChain #Security
https://www.docker.com/blog/how-to-use-openpubkey-with-github-actions-workloads/
Learn how to use OpenPubkey to bind public keys to workload identities using GitHub Actions and Docker. And find out how Docker is using OpenPubkey with GitHub Actions to sign Docker Official Images and improve supply chain security.
Excellent program at @BSidesCambridgeMA today.
Excited to present #OpenPubkey and demo how to ssh using your OpenID identity without having to trust your identity provider.
HMU if you are at bsides today
Habr
AzureCerulean
st1nger 
🏴☠️ 
Sharon Goldberg
Docker Blog
Ethan Heilman