Passwordless Cluster Shell Access with OIDC/Okta Authentication

Get Help
1

Environment

We are using Open OnDemand (OOD) as our web portal and are currently authenticating users through Okta using OIDC.The OOD portal authentication is working correctly. Users log in to the OOD portal through Okta and are then able to access the various OOD applications.

We also use the Cluster Shell Access / Shell App in OOD, which provides users with a terminal in their browser.Our current SSH authentication policy is password-based SSH authentication. Users are not permitted to use personal SSH public/private key pairs.

When the user launches the Cluster Shell Access application, OOD establishes an SSH connection to the configured host. Since the SSH server uses password authentication, the user is prompted to enter their Linux/LDAP password.

In other words, once the user has authenticated to OOD through Okta, we would like the Cluster Shell Access application to provide an interactive shell without asking the user for their password again.

Could you please help on this?

2

We also don’t allow SSH keys for authentication to our login nodes so we have setup Host-Based Authentication from our OOD server. This allows any user logged into that server to access the login nodes. I believe that we have this setup on our compute nodes as well.