SSH auth via Shib/ECP?

[Joel Goguen]

There's been some interest in authenticating SSH access using
Shibboleth. It isn't required that this be tied to their SSO session or
create an SSO session, just that they be able to use credentials that
Shibboleth would accept. I've tried looking for things like pam_shib and
pam_ecp but so far my search is failing to turn up anything useful.

The current requirement is that the solution be able to validate the
supplied username and password against a Shibboleth IdP and permit or
deny access based on account attributes (like eduPersonEntitlement).
It's necessary that there be sufficient flexibility to allow something
like 'user at myuniversity.edu' and 'user at theircollege.edu' to be able to
authenticate without login name collisions and the auth module knows
("somehow", maybe by requiring 'user at shibidp.myuniversity.edu' instead)
that these users need to be validated against different IdPs.

Can anyone point me at something that can do this, or should I be
looking at implementing my own PAM module?

-- 
Joel Goguen
Developer
Enterprise Solutions
Information Technology Services
University of New Brunswick
Email: joel.goguen at unb.ca
Phone: (506) 453-4872
Fax: (506) 453-3590