SSH auth via Shib/ECP?

[Cantor, Scott]

On 2/12/14, 9:45 AM, "Chris Phillips" <Chris.Phillips at canarie.ca> wrote:

>Hi Joel,
>
>Check out the SAML EC work which I think may be what you are looking for:
>
>https://github.com/jbasney/mech_saml_ec
>
>
>An implementation of:
>http://tools.ietf.org/html/draft-ietf-kitten-sasl-saml-ec-11
>

Yes, that's the "official" Shibboleth answer, but we have no project
resources to productionize the prototype work that NCSA kindly built for
us. I did finish the spec draft, it's waiting to go through last call.

Minus some important features like channel binding, which doesn't matter
for SSH, a GSS client following the draft works against an unmodified
Shibboleth IdP.

Much of the larger picture of making GSS work practically is the same set
of work Moonshot has to build, but lacking the resources, we don't have
the ability to directly collaborate on the work.

You may find this summary of interest also:

https://carmenwiki.osu.edu/display/CICIDM/Federating+SSH

-- Scott