To SSH into servers at $work, I need to run a command to 2FA-authenticate against our SSO and obtain a short-lived SSH cert for my local SSH key. We have around

To SSH into servers at $work, I need to run a command to 2FA-authenticate against our SSO and obtain a short-lived SSH cert for my local SSH key. We have around 10 tech employees and around 40 servers and it's really nice when onboarding new servers or new employees that we don't have to juggle authorized_keys around, and when offboarding employees we no longer have stale authorized_keys files to worry about, since access will expire automatically after 20 hours once the employee is removed in SSO. There's no hardware backing the CA, and it's all homebrew (NIH style) 2FA-SSO with openssh CA invocations, but it works and is quite convenient. We also use the same CA for host keys (again, certs issued by our NIH-style homebrew fleet management), which allows us to avoid TOFU prompts when onboarding new servers.