Introduction

A common requirement for research organizations is to provide access via SSH to command line tools hosted on Unix-based systems. Provisioning and deprovisioning the accounts required for access, and leveraging the researcher's existing credentials to authenticate the access, are common challenges in providing this access.

Goals

Leverage COmanage to enroll a researcher to a collaboration, collect the researcher's SSH public key, and create a Unix account for the researcher.

1. Configure an Enrollment Flow to allow a researcher to join a collaboration.
2. Configure an LDAP provisioner to write Unix account information to LDAP.
3. Enroll the researcher.
4. Upload the researcher's SSH keys.
5. Login to the unix server as the researcher.

Architecture and Components

The major components involved in this pilot are

• COmanage Registry, used to manage participant registration in the collaboration
  • SQL database backend, used by COmanage
• UNIX Server, on which the command line tools run and to which the researcher desires access
• Home IdP, used by the researcher to authenticate to the collaboration
• SP Proxy and OpenConext, used to manage connectivity to federated identity and other authentication services
• LDAP Server, provisioned by COmanage and used by the UNIX Server as a source of account information

Configuration

This section assumes that each component is already installed and configured for basic connectivity.

xxx set up enrollment flow, provisioner, set up unix server (ssh mod/config to read from ldap)

Usage

xxx enroll, upload ssh keys, login to VM

Resources

• Screencast demonstrating this pilot
• COmanage documentation