Gudu, Diana

Hardt, Marcus

Zachmann, Gabriel

English

KITopen

motley-cue: SSH access with OIDC tokensDiana Gudu, Marcus Hardt, Gabriel ZachmannKarlsruhe Institute of Technlogygudu@kit.edumotley  cueMotivation■ Enable federated access to shell-based services ■ Federated Identity Management  OpenID Connect (→ OIDC)■ Shell-based services  Secure Shell (→ SSH), local identities2 / 15Motivation■ Enable federated access to shell-based services ■ Federated Identity Management  OpenID Connect (→ OIDC)■ Shell-based services  Secure Shell (→ SSH), local identitiesOur solution: server & client side tools■ Works with standard SSH software■ Uses OIDC tokens for AuthN & AuthZ■ Manages local identities2 / 15How does it work?■ Client side■ mccli  wrapper for SSH client→■ oidc-agent  manage OIDC tokens→■ Server-side (this talk)■ motley-cue  authorisation & account provisioning →■ PAM1  token prompt & validate @motley-cue (→ AuthN)■ Unmodified SSHD  keyboard interactive→1 developed at PSNC 3 / 15Why would you use it?■ Single Sign-On (SSO)■ No additional service credentials■ No need for SSH key management■ No prior registration...as a user4 / 15Why would you use it?■ Benefits of federated AAI■ Offload identity management to home organisation■ Offload authorisation management to federation (VOs)...as a service provider5 / 15Why would you use it?■ Benefits of federated AAI■ Offload identity management to home organisation■ Offload authorisation management to federation (VOs)■ Bridges the gap from federated  to local identity■ Manages the mapping of federated to local accounts■ Manages the lifecycle of local accounts (create, update, suspend)■ OIDC-based authentication  no need for managing additional →credentials (passwords, ssh keys)■ Manages access control based on federated authorisation models...as a service provider5 / 15motley-cue architecture6 / 15Authorisation■ support for multiple OIDC Providers■ based on VO membership■ individual users via sub+iss7 / 15Local User Management■ Interface to site-local identity management systems■ Extensible, plug-in architecture■ Supported identity backends: UNIX accounts, LDAP, KIT RegApp8 / 15Local User Management■ Interface to site-local identity management systems■ Extensible, plug-in architecture■ Supported identity backends: UNIX accounts, LDAP, KIT RegApp■ Identity mapping: sub + iss  local username→■ Stored directly in the local IdM system ■ username generation strategies  uniqueness→■ Friendly: preferred username, first_last, ...■ Pooled: egi001, egi002, ...■ VOs mapped to local groups8 / 15New features■ Approval workflow  admins oversee all deployment requests→■ LDAP backend  for managing local accounts→■ Audience  r→ estrict access to tokens released for configured audience■ Long tokens  1kB too long for SSH, generate one-time tokens→9 / 15■ Easy deploymentTechnical details10 / 15■ Easy deployment■ Packages for most common Linux distributionsTechnical detailshttp://repo.data.kit.edu10 / 15■ Easy deployment■ Packages for most common Linux distributions■ systemd integrationTechnical details$ apt install motley-cue pam-ssh-oidc$ vim /etc/motley_cue/motley_cue.conf$ systemctl restart motley-cuehttp://repo.data.kit.edu10 / 15■ Easy deployment■ Packages for most common Linux distributions■ systemd integration■ Python, FastAPITechnical details$ apt install motley-cue pam-ssh-oidc$ vim /etc/motley_cue/motley_cue.conf$ systemctl restart motley-cuehttp://repo.data.kit.edu10 / 15Demohttps://ssh-oidc-demo.data.kit.edu/Approval workflow■ Admins can oversee all deployment requests from users■ How it works:■ User triggers deployment■ Admin (and user) is notified■ notification is backend-specific■ supported notification system: email■ Admin accepts or rejects the request manually■ Users are not notified of acceptance/rejection  pull model→■ Subsequent deployment requests■ notify the admin only when updates are necessaryLDAPLDIFrepresentation local UNIX$ groupadd …$ useradd …$ usermod …https://github.com/dianagudu/egi-2022-demo12 / 15LDAP backend■ Local accounts are managed in an LDAP■ OIDC unique ID stored in a configurable attribute■ Required LDAP  schemas: inetOrgPerson, posixAccount, posixGroup■ Modes■ read-only: local user management fully controlled by LDAP admins, including mapping■ pre-created: motley-cue adds the mapping information to pre-created accounts■ full-access: motley-cue has full control to provision users and groups in LDAPhttps://github.com/dianagudu/egi-2022-demo13 / 15Future work■ Account deprovisioning■ More flexible VO  local group→  mapping■ regex filtering and naming■ mytoken integration14 / 15Future work■ Account deprovisioning■ More flexible VO  local group→  mapping■ regex filtering and naming■ mytoken integration■ Increase adoption■ Currently being evaluated by■ Helmholtz Cloud  cloud orchestration for imaging use case→■ PUNCH4NFDI  compute resources for particle physics→14 / 15More information■ Demo instancehttps://ssh-oidc-demo.data.kit.edu/■ Contactm-contact@lists.kit.edu■ Documentationhttps://github.com/EOSC-synergy/ssh-oidchttps://motley-cue.readthedocs.io15 / 15

Motley-cue: SSH access with OIDC tokens

https://publikationen.bibliothek.kit.edu/1000152914/149846746

Motley-cue: SSH access with OIDC tokens

Abstract

Similar works

Full text

Available Versions

KITopen