Just by looking at the diagram, the mere presence of a third-party IdP is enough for most of enterprise and homelab to be deterred and look elsewhere for a more self-contained self-host identity provider server.
But then again, I could be wrong.
Still, using certificate in OpenSSH (instead of public key) is easier for me once it starts to scale beyond 5 or more hosts. Even do dual-cert, by host and by user combo, while using brittle OpenLDAP-OpenSSH for other class of users.
And smashed all my notes on certificates and OpenSSH on my ad-free, revenue-free, JS-free Pelican blog. It's personal on both note-wise and server.
Oh, certain browser will not work with this blog if it cannot negotiate ONLY for Cha-Cha/Poly. It's by design as a showcase of why that particular web browser refuses to do that.
Disclaimer: I code-review OpenSSH yearly.
Just by looking at the diagram, the mere presence of a third-party IdP is enough for most of enterprise and homelab to be deterred and look elsewhere for a more self-contained self-host identity provider server.
But then again, I could be wrong.
Still, using certificate in OpenSSH (instead of public key) is easier for me once it starts to scale beyond 5 or more hosts. Even do dual-cert, by host and by user combo, while using brittle OpenLDAP-OpenSSH for other class of users.
And smashed all my notes on certificates and OpenSSH on my ad-free, revenue-free, JS-free Pelican blog. It's personal on both note-wise and server.
Oh, certain browser will not work with this blog if it cannot negotiate ONLY for Cha-Cha/Poly. It's by design as a showcase of why that particular web browser refuses to do that.
https://egbert.net/blog/articles/ssh-openssh-certificates.ht...