Skip to main content

RAC SSH Public Key Authentication

About RAC SSH public key authentication​

The RAC provider supports SSH public key authentication. This allows for secure connections to SSH devices without the use of passwords.

SSH private keys can be configured via several methods:

Apply a private key to an RAC provider​

  1. Log in to authentik as an administrator and open the authentik Admin interface.
  2. Navigate to Applications > Providers.
  3. Click the Edit icon on the RAC provider that requires public key authentication.
  4. In the Settings codebox enter the private key of the device, for example: 
    private-key: |
        -----BEGIN SSH PRIVATE KEY-----
        SAMPLEgIBAAJBAKj34GkxFhD90vcNLYLInFEX6Ppy1tPf9Cnzj4p4WGeKLs1Pt8Qu
        KUpRKfFLfRYC9AIKjbJTWit+CqvjWYzvQwECAwEAAQJAIJLixBy2qpFoS4DSmoEm
        o3qGy0t6z09AIJtH+5OeRV1be+N4cDYJKffGzDa88vQENZiRm0GRq6a+HPGQMd2k
        TQIhAKMSvzIBnni7ot/OSie2TmJLY4SwTQAevXysE2RbFDYdAiEBCUEaRQnMnbp7
        9mxDXDf6AU0cN/RPBjb9qSHDcWZHGzUCIG2Es59z8ugGrDY+pxLQnwfotadxd+Uy
        v/Ow5T0q5gIJAiEAyS4RaI9YG8EWx/2w0T67ZUVAw8eOMB6BIUg0Xcu+3okCIBOs
        /5OiPgoTdSy7bcF9IGpSE8ZgGKzgYQVZeN97YE00
        -----END SSH PRIVATE KEY-----
  5. Click Update.
info

The pipe character (|) is required to preserve linebreaks in the YAML text. See the YAML spec for more information.

Apply a private key to a single device​

Connection settings for a single device are set with a RAC property mapping, which receives the device it is evaluated for:

if device.name == "my-server":
    return {
        "private-key": """-----BEGIN SSH PRIVATE KEY-----
...
-----END SSH PRIVATE KEY-----""",
    }
return {}

The equivalent of the provider-wide key above, for one device: yaml private-key: | -----BEGIN SSH PRIVATE KEY----- SAMPLEgIBAAJBAKj34GkxFhD90vcNLYLInFEX6Ppy1tPf9Cnzj4p4WGeKLs1Pt8Qu KUpRKfFLfRYC9AIKjbJTWit+CqvjWYzvQwECAwEAAQJAIJLixBy2qpFoS4DSmoEm o3qGy0t6z09AIJtH+5OeRV1be+N4cDYJKffGzDa88vQENZiRm0GRq6a+HPGQMd2k TQIhAKMSvzIBnni7ot/OSie2TmJLY4SwTQAevXysE2RbFDYdAiEBCUEaRQnMnbp7 9mxDXDf6AU0cN/RPBjb9qSHDcWZHGzUCIG2Es59z8ugGrDY+pxLQnwfotadxd+Uy v/Ow5T0q5gIJAiEAyS4RaI9YG8EWx/2w0T67ZUVAw8eOMB6BIUg0Xcu+3okCIBOs /5OiPgoTdSy7bcF9IGpSE8ZgGKzgYQVZeN97YE00 -----END SSH PRIVATE KEY----- 6. Click Update.

info

The pipe character (|) is required to preserve linebreaks in the YAML text. See the YAML spec for more information.

Apply a private key to an RAC property mapping​

  1. Log in to authentik as an administrator and open the authentik Admin interface.

  2. Navigate to Customization > Property Mappings and click New Property Mapping, then create a RAC Provider Property Mapping with the following settings:

    • Name: Choose a descriptive name
    • Under Advanced Settings:
      • Expression:
    import textwrap

    private_key = textwrap.dedent("""
    -----BEGIN SSH PRIVATE KEY-----
    SAMPLEgIBAAJBAKj34GkxFhD90vcNLYLInFEX6Ppy1tPf9Cnzj4p4WGeKLs1Pt8Qu
    KUpRKfFLfRYC9AIKjbJTWit+CqvjWYzvQwECAwEAAQJAIJLixBy2qpFoS4DSmoEm
    o3qGy0t6z09AIJtH+5OeRV1be+N4cDYJKffGzDa88vQENZiRm0GRq6a+HPGQMd2k
    TQIhAKMSvzIBnni7ot/OSie2TmJLY4SwTQAevXysE2RbFDYdAiEBCUEaRQnMnbp7
    9mxDXDf6AU0cN/RPBjb9qSHDcWZHGzUCIG2Es59z8ugGrDY+pxLQnwfotadxd+Uy
    v/Ow5T0q5gIJAiEAyS4RaI9YG8EWx/2w0T67ZUVAw8eOMB6BIUg0Xcu+3okCIBOs
    /5OiPgoTdSy7bcF9IGpSE8ZgGKzgYQVZeN97YE00
    -----END SSH PRIVATE KEY-----
    """)

    return {
        "username": "<your_username>",
        "private-key": private_key
    }

  3. Click Finish.

  4. Navigate to Applications > Providers.

  5. Click the Edit icon on the RAC provider that requires public key authentication.

  6. Under Protocol Settings add the newly created property mapping to Selected Property Mappings.

  7. Click Update.

Retrieve a private key from a user's attributes and apply it to an RAC property mapping​

  1. Log in to authentik as an administrator and open the authentik Admin interface.

  2. Navigate to Customization > Property Mappings and click New Property Mapping. Create a RAC Provider Property Mapping with the following settings:

    • Name: Choose a descriptive name
    • Under Advanced Settings:
      • Expression:
      return {
      "private-key": request.user.attributes.get("<private-key-attribute-name>", "default"),
      }

  3. Click Finish.

  4. Navigate to Applications > Providers.

  5. Click the Edit icon on the RAC provider that requires public key authentication.

  6. Under Protocol Settings, add the newly created property mapping to Selected Property Mappings.

  7. Click Update.

info

For group attributes, the following expression can be used request.user.group_attributes(request.http_request).