It's a set of tools that allows (you guessed it) ssh with OIDC. What you might not have guessed: We go for the difficult-to-implement but simplest-to-use approach.
The final usage is as simple as:
mccli ssh <hostname>
For testing the client, we provide a demonstration server at ssh-oidc-demo server
On the client you will need two basic tools:
mccli
) for
Please follow installation instructions at https://indigo-dc.gitbook.io/oidc-agent/installation
Useful commandlines for generating an oidc-agent configuration are listed
here. (You may add --flow device
if you run oidc-agent on a remote
host.)
oidc-gen --pub --iss https://aai.egi.eu/auth/realms/egi \
--scope "openid profile email offline_access \
eduperson_entitlement eduperson_scoped_affiliation eduperson_unique_id" egi
oidc-gen --pub --issuer https://wlcg.cloud.cnaf.infn.it/ \
--scope "openid profile offline_access wlcg.groups wlcg \
eduperson_entitlement eduperson_scoped_affiliation " wlcg
oidc-gen --pub --iss https://login.helmholtz.de/oauth2/ \
--scope "openid profile email offline_access \
eduperson_entitlement eduperson_scoped_affiliation eduperson_unique_id" helmholtz
oidc-gen --pub --iss https://accounts.google.com/ --flow device --scope max google
Install with
pip install mccli
Use either of:
mccli ssh ssh-oidc-demo.data.kit.edu --iss https://aai.egi.eu/oidc
mccli ssh ssh-oidc-demo.data.kit.edu --oidc egi
ACCESS_TOKEN=<access_token> mccli ssh ssh-oidc-demo.data.kit.edu
It is as simple as this!
Installation is mostly a matter of installing the packages:
motley-cue
and pam-ssh-oidc
(or pam-ssh-oidc-autoconfig
)Packages are available at https://repo.data.kit.edu
Follow the instructions there to support the correct repository for apt or yum.
The currently supported Linuxes are:
Details are described in the linked chapters pam-ssh-oidc and motley-cue
Are collected in our FAQ.
The public demo instance runs at ssh-oidc-demo.data.kit.edu. Further documentation is available there (https://ssh-oidc-demo.data.kit.edu)
We have two presentations:
This page documents a set of tools that have been developed in a joint effort of: