We do something similar with HashiCorp Vault. People authenticate to Vault (backed by Active Directory) and if they have the proper permissions (based on AD gro

We do something similar with HashiCorp Vault. People authenticate to Vault (backed by Active Directory) and if they have the proper permissions (based on AD group) they can ask Vault to issue an SSH certificate for a particular account on a specific server. This is working well; we no longer have accounts for everyone who needs access on every box and giving or removing access is as easy as changing group membership in AD. https://www.vaultproject.io/docs/secrets/ssh/signed-ssh-certificates.html https://www.vaultproject.io/docs/secrets/ssh/signed-ssh-cert...