Disclaimer: I code-review OpenSSH yearly.

Just by looking at the diagram, the mere presence of a third-party IdP is enough for most of enterprise and homelab to be deterred and look elsewhere for a more self-contained self-host identity provider server.

But then again, I could be wrong.

Still, using certificate in OpenSSH (instead of public key) is easier for me once it starts to scale beyond 5 or more hosts. Even do dual-cert, by host and by user combo, while using brittle OpenLDAP-OpenSSH for other class of users.

And smashed all my notes on certificates and OpenSSH on my ad-free, revenue-free, JS-free Pelican blog. It's personal on both note-wise and server.

Oh, certain browser will not work with this blog if it cannot negotiate ONLY for Cha-Cha/Poly. It's by design as a showcase of why that particular web browser refuses to do that.

https://egbert.net/blog/articles/ssh-openssh-certificates.ht...