{
  "id": 2176367,
  "title": "Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH",
  "url": "https://urgent.news/2026/08/20/open-sourcing-openpubkey-ssh-opkssh-integrating-single-sign-on-with",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-20T15:24:43.000Z",
  "source": {
    "name": "Lobsters",
    "slug": "lobsters",
    "url": "https://www.ethanheilman.com/x/33/index.html"
  },
  "original_language": "en",
  "account": "OPKSSH is a tool that enables single sign-on (SSO) integration with SSH, eliminating the need for manual SSH key management. It accomplishes this without introducing a trusted third party, other than the identity provider (IdP). OPKSSH has been open-sourced under the OpenPubkey project, previously owned by Cloudflare.\n\nOpenID Connect (OIDC) is the primary protocol used for SSO. When a user authenticates with their IdP, the IdP issues an ID Token containing identity claims, like email. OIDC ID Tokens include identity information but not public keys, preventing direct usage for protocols like SSH or encrypted messaging.\n\nOpenPubkey addresses this limitation by adding public keys to ID Tokens, which can then be used as certificates. OPKSSH builds upon OpenPubkey by enabling ID Tokens to be used as SSH keys, adding SSO authentication to SSH without modifying the SSH protocol.\n\nOPKSSH enhances security by replacing long-lived SSH keys with ephemeral keys that expire after a predetermined time, typically 24 hours. This minimizes the risk of private key compromise. Additionally, OPKSSH improves usability by allowing users to SSH from any computer with OPKSSH installed, generating keys on-demand when they sign in. Visibility is also improved, as administrators can easily track authorized users via email addresses in the OPKSSH authorized users file.\n\nOPKSSH requires no changes to SSH server or client code, with only a few lines added to the SSH config file. An installation script automates this process, as demonstrated in the provided video.",
  "summary": null,
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}