SSH auth via Shib/ECP?

[Chris Phillips]

Hi Joel,

Check out the SAML EC work which I think may be what you are looking for:

https://github.com/jbasney/mech_saml_ec


An implementation of:
http://tools.ietf.org/html/draft-ietf-kitten-sasl-saml-ec-11


Chris.


On 14-02-12 9:28 AM, "Joel Goguen" <joel.goguen at unb.ca> wrote:

>There's been some interest in authenticating SSH access using
>Shibboleth. It isn't required that this be tied to their SSO session or
>create an SSO session, just that they be able to use credentials that
>Shibboleth would accept. I've tried looking for things like pam_shib and
>pam_ecp but so far my search is failing to turn up anything useful.
>
>The current requirement is that the solution be able to validate the
>supplied username and password against a Shibboleth IdP and permit or
>deny access based on account attributes (like eduPersonEntitlement).
>It's necessary that there be sufficient flexibility to allow something
>like 'user at myuniversity.edu' and 'user at theircollege.edu' to be able to
>authenticate without login name collisions and the auth module knows
>("somehow", maybe by requiring 'user at shibidp.myuniversity.edu' instead)
>that these users need to be validated against different IdPs.
>
>Can anyone point me at something that can do this, or should I be
>looking at implementing my own PAM module?
>
>-- 
>Joel Goguen
>Developer
>Enterprise Solutions
>Information Technology Services
>University of New Brunswick
>Email: joel.goguen at unb.ca
>Phone: (506) 453-4872
>Fax: (506) 453-3590
>--
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net