3 ms·
I suppose you could do something based on IDP-signed tokens, e.g. "valid for authentication to service x until <timestamp>"?
by lxgr 2y ago
I suppose you could do something based on IDP-signed tokens, e.g. "valid for authentication to service x until <timestamp>"?
- megous 2y agoThis is basically a ssh certificate then.
- pluto_modadic 2y agothe difference is in /key management/. Key management is the hard part. Especially keyless SSH management. (things like sigstore's rekor/fulcio remove some complexity here). It is not "just a (manually generated) ssh certificate"
- XorNot 2y agoKerberos tickets have timeouts on them already, it's a matter of configuration how long you wait. The thing is most enterprises want "user disabled" to be instant. Which of course leads to SSH keys all over the place anyway.