- OPKSSH integrates single sign-on (SSO) with SSH using OpenID Connect, eliminating the need to manually manage SSH keys.
- It uses OpenPubkey to add public keys to ID tokens, creating PK Tokens that serve as certificates without modifying existing SSO protocols.
- OPKSSH has been open-sourced under Apache 2.0, donated by Cloudflare to the OpenPubkey project, moving from closed source to community-driven development.
- Security is improved with ephemeral keys (default 24-hour expiration), reducing risk of compromise; usability increases as users only need to sign in to their identity provider.
- Visibility is enhanced by authorizing based on identity (email) rather than public keys, simplifying access management.
- No changes to the SSH protocol are required; it works by embedding PK Tokens in SSH certificate extensions and using the AuthorizedKeysCommand on the server.
- The open-source release invites contributions and community involvement via GitHub, monthly meetings, and the OpenSSF Slack.