$ show openpubkey/opkssh
opkssh is a production-grade CLI tool that bridges OpenID Connect (OIDC) authentication with SSH access. It allows users to authenticate via any OIDC provider (Google, Azure, GitLab, Keycloak, etc.) and obtain short-lived SSH certificates embedding OpenPubkey PK tokens. The server-side component, invoked as sshd's AuthorizedKeysCommand, verifies these certificates against policy files and grants access based on email, subject, or group membership. The architecture is a single Go binary with client and server modes, using Cobra for CLI commands. Key entry points include `opkssh login` (interactive OIDC flow, SSH key generation, agent integration), `opkssh verify` (server-side certificate validation and policy enforcement), `opkssh add` (policy management), and `opkssh audit` (configuration validation). External dependencies include the openpubkey library for PK token operations, afero for filesystem abstraction, and testcontainers for integration tests. The tool supports Linux, macOS, and Windows, with platform-specific file permission checks and ACL handling. It also features a policy plugin system for custom access control logic via external scripts.
The LLM identified 4 files worth highlighting for reuse:
Defines a FileSystem interface that combines I/O operations (read/write/open), file permission checks, and ACL verification. It wraps afero.Fs and provides platform-specific implementations for Unix and Windows. This abstraction allows the entire policy enforcement layer to be tested without real filesystem side effects, and can be reused in any Go project needing mockable filesystem operations with security-sensitive permission checks.
A generic parser for whitespace-delimited configuration files (like /etc/opk/auth_id). It handles comments, BOM, empty lines, and returns rows of fields. The parser is self-contained, has no external dependencies beyond standard library, and can be extracted for any project that needs to parse simple tabular config files with robust comment and whitespace handling.
Implements SshCertSmuggler, which embeds an OpenPubkey PK token into an SSH certificate's critical extension (openpubkey-pkt). It handles certificate creation, signing, and parsing. This module encapsulates the non-trivial logic of encoding/decoding PK tokens within SSH certificates, and could be reused in other projects that need to attach arbitrary authenticated data to SSH keys.
Implements a policy plugin enforcer that runs external commands (scripts) with token claims passed as environment variables. It sanitizes the environment, sets a timeout, and interprets exit codes as allow/deny. This pattern is reusable for any system that needs Turing-complete policy evaluation via external executables, with careful security considerations (no shell injection, limited environment).