Wise Monks:

I have a product, written in Perl, that uses ssh to do its business. I have a potential customer who has written a SAML based authentication system. The would-be customer wants me to have my product use their authentication system instead of ssh.

I'm looking for a solution that would require the least amount of work on both our parts. I am hoping to find a way to configure ssh to "just use" SAML for authentication instead-of-or-in-addition-to its other authentication mechanisms.

My first thought is that SAML is similar to Kerberos, and ssh supports Kerberos authentication via the GSSAPIAuthentication option (among others). Now I don't know much about this stuff, but I was wondering if I could have ssh use GSSAPIAuthentication to authenticate with SAML instead of Kerberos?

My research has come up with some interesting results:
Using SAML for Platform Security
SAML-AAI/Kerberos Integration
2005 Discussion on SAML using GSS-API

I ended up sending an email to Nicolas Williams about this, since he seems to be active in a lot of these discussions.

Can anybody here help me with this? Am I going down a dead-end here? Should I be trying to solve the problem in a different way?

Any thoughts, pointers, or discussion is appreciated.

Thanks

-Craig

Update:
A co-worker suggested looking into a PAM module to do this (ssh & pam work great together). I couldn't find a PAM module for SAML, but did find a java-to-pam bridge which might let me write the SAML authentication in java, and connect it up to ssh via pam.

Then I thought it would be nice to write in perl instead of java. Wouldn't you know it Authen::PAM!

Update 2:
Since perl also has Net::SAML, shouldn't it be easy to write a perl module to do this?

In reply to How to have SSH authenticate using SAML? by cmv

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.