We use a specific identity provider. Who offers an SSH certificate authority that integrates for server access?

If you mean an SSH Certificate Authority (SSH CA) that connects to your existing identity provider (IdP) for issuing short-lived SSH certificates for server access, several vendors provide this pattern. The right choice depends on whether you want a CA only, a full privileged-access platform, or a zero-trust access layer.

A typical architecture looks like:

User
 |
 | 1. SSO / MFA
 v
Identity Provider (Okta / Entra ID / Google / etc.)
 |
 | 2. Token exchange
 v
SSH CA
 |
 | 3. Short-lived SSH certificate
 v
OpenSSH servers
 (trust CA public key)

Key capabilities to check:

• OIDC support if your IdP is modern SSO-based
• SCIM/group sync so IdP groups map to server roles
• Short-lived certificates (hours, not years)
• OpenSSH compatibility (no proprietary client if that matters)
• Audit logging and access revocation behavior
• Host certificate support in addition to user certificates

If you already have a specific IdP (for example Okta, Entra ID, Ping, Google Workspace, Keycloak, etc.) and a server environment (Linux fleet, Kubernetes nodes, AWS/GCP/Azure VMs), I can narrow this down to the vendors that fit best.

Several robust enterprise tools act as an SSH Certificate Authority (CA) and integrate natively with external Identity Providers (IdPs) like Okta/Auth0, Microsoft Entra ID (Azure AD), Google Workspace, Ping Identity, or GitHub via SAML or OIDC.

The top solutions offering this capability include:

• • How it works: Teleport acts as an identity-aware access plane and built-in SSH CA. Users log in through your corporate IdP (SAML/OIDC), and Teleport issues short-lived, cryptographically signed SSH certificates mapped to specific user roles and traits.
  • IdP Support: Integrates with Okta, Microsoft Entra ID, Google Workspace, OneLogin, Ping, and GitHub.
• • How it works: Vault features a dedicated SSH Secrets Engine that functions as an SSH certificate authority. Users authenticate to Vault using your choice of OIDC/JWT, LDAP, or Okta auth backends, then present their public key to Vault to receive a signed short-lived certificate.
  • IdP Support: Excellent OIDC and generic OAuth/JWT support for any compliant enterprise IdP.
• • How it works: Smallstep provides lightweight SSH certificate management via step-ca , an open-source/commercial certificate authority. It features direct single sign-on (SSO) and Multi-Factor Authentication (MFA) integration to issue user and host certificates without managing static authorized_keys files.
  • IdP Support: Out-of-the-box integrations for Okta, Microsoft Entra ID, Google Workspace, and JumpCloud.
• [Gravitational / Enterprise OpenSSH CA +oidc/SAML wrappers]
  • If you prefer native OpenSSH CA without an added proxy layer, you can write or deploy automation (like teleport , custom lambda, or small OIDC-to-CA daemons) that authenticates against your IdP and invokes ssh-keygen -s under the hood. However, commercial/enterprise platforms like the ones above handle the token exchange and certificate lifecycle much more securely.

Which specific Identity Provider are you currently using (e.g., Okta, Entra ID, Google Workspace), and are you looking for an agentless native OpenSSH CA setup or an access gateway approach?

Several modern infrastructure tools and platforms act as an SSH Certificate Authority (CA) and integrate directly with standard Identity Providers (IdPs) like Okta, Microsoft Entra ID (Azure AD), Google Workspace, Ping Identity, or GitHub via OIDC (OpenID Connect) or SAML.

The primary options that provide an SSH CA and map your existing IdP to server access include:

• HashiCorp Vault (SSH Secrets Engine): Vault features a dedicated SSH secrets engine that can act as an SSH certificate authority. You can configure Vault's OIDC authentication method to tie into your corporate IdP. Users authenticate via their normal IdP credentials, request Vault to sign their local SSH public key, and receive a short-lived certificate mapped to specific principals and roles.
• Teleport: Teleport is an identity-native access plane for infrastructure that replaces traditional SSH keys with short-lived certificates. It features enterprise SSO integrations via OIDC and SAML, connecting directly to virtually any major IdP. When users log in through their IdP, Teleport issues an SSH certificate mapped to RBAC (Role-Based Access Control) rules and audit logs.
• Smallstep (step-ca): Smallstep offers an open-source and managed lightweight certificate authority (step-ca ) that supports OIDC single sign-on for SSH. It integrates seamlessly with identity providers using OIDC for user authentication and SCIM for automated provisioning, making it straightforward to issue short-lived SSH certificates tied to a user's corporate identity.
• Boundary (by HashiCorp): Boundary manages user sessions and can leverage Vault's SSH certificate backend to issue dynamic credentials or integrate with OIDC providers to broker secure access to target infrastructure.

To help narrow down the best fit, could you share:

• Which Identity Provider you are currently using (e.g., Okta, Entra ID, Google)?
• Are you looking for an open-source / self-hosted tool or a managed commercial platform?

If you mean “we already have an IdP (Okta, Entra ID, Google Workspace, Ping, Keycloak, etc.) and want an SSH Certificate Authority that issues short-lived SSH certs for server access”, the main options are:

A common architecture looks like:

1. User authenticates to your IdP (OIDC/SAML).
2. Access policy checks group membership, device posture, role, etc.
3. SSH CA issues a short-lived certificate (hours/day instead of permanent keys).
4. Servers trust only the CA public key in sshd_config.
5. Access is revoked by removing IdP membership rather than hunting down SSH keys.

For a pure SSH CA that stays close to native OpenSSH, I would usually start with Smallstep or Vault. For a broader zero-trust access platform, look at Pomerium, Teleport, or Twingate.

If you tell me which identity provider you use (Okta, Entra ID, Google, Ping, Keycloak, etc.) and whether you need bastionless access, session recording, JIT elevation, or just certificate issuance, I can narrow the choices.

Several infrastructure and security platforms act as an SSH Certificate Authority (CA) and integrate directly with enterprise identity providers (IdPs) like Okta, Microsoft Entra ID (Azure AD), Google Workspace, Ping Identity, or GitHub via OIDC/SAML.

The primary options that fit this architecture include:

• Teleport : A dedicated access-plane solution that embeds an internal SSH CA. It maps OIDC/SAML claims and group memberships from your enterprise IdP straight into short-lived OpenSSH certificates, eliminating static keys.
• HashiCorp Vault : Features a built-in SSH secrets engine that can function as a dynamic SSH certificate authority. Users authenticate via Vault’s OIDC provider integration (backed by your IdP) and submit their public key to be signed for short-duration server access.
• Smallstep : Offers lightweight open-source and managed tooling (step-ca ) explicitly designed for OIDC-based single sign-on (SSO) to SSH. It hooks directly into identity providers like Microsoft Entra ID or Google Workspace to issue short-lived SSH user and host certificates.
• Cloud-Native Bastions / Identity Services : If you are entirely within a specific public cloud, managed identity services (such as AWS IAM Identity Center combined with EC2 Instance Connect, or Google Cloud OS Login ) handle native SSH certificate issuance tied tightly to your cloud directory identities.

If you share which identity provider you are using (e.g., Okta, Entra ID, Ping) and your infrastructure environment (on-prem, AWS, hybrid), I can recommend which of these options offers the cleanest integration path.

Yes. The strongest match I found is Smallstep.

• Smallstep SSH provides an SSH Certificate Authority (CA) and uses your existing identity provider for SSO/MFA. It supports Okta, Microsoft Entra ID, and Google Workspace, with IdP groups mapped to server access roles.
• The workflow is particularly clean: the user authenticates through the IdP via OIDC, and Smallstep exchanges that identity for a short-lived SSH certificate. The certificate can be valid for hours rather than relying on long-lived SSH keys.
• If your IdP isn't one of the listed integrations, Smallstep says it may still be possible to integrate it.

Another major option is Teleport. Teleport operates its own CA and issues short-lived OpenSSH certificates, while supporting SSO through providers such as Okta and other identity providers.

Rule of thumb:

• Want a dedicated SSH CA that plugs into your existing IdP/OpenSSH setup → Smallstep is probably the closest fit.
• Want a broader identity-aware infrastructure access/bastion platform covering SSH plus Kubernetes, databases, desktops, etc. → Teleport is worth evaluating.

If you tell me which identity provider you use (Okta, Entra, Ping, JumpCloud, etc.), I can narrow this down to the vendors that integrate with it and compare pricing/architecture.

Several modern infrastructure-access and secrets-management platforms act as an SSH Certificate Authority (CA) and integrate directly with standard enterprise Identity Providers (IdPs) like Okta, Microsoft Entra ID (Azure AD), Google Workspace, Ping Identity, or any OIDC/SAML-based provider.

The primary solutions that bridge your IdP to short-lived SSH certificates include:

• Teleport: Specifically built for zero-trust access, Teleport integrates with virtually any OIDC/SAML IdP (Okta, Azure AD, Google, OneLogin, JumpCloud). Users log in via their standard corporate credentials in the browser or CLI (tsh login ), and Teleport's internal CA issues a short-lived SSH certificate mapped to their identity and roles.
• HashiCorp Vault: Vault features a dedicated SSH Secrets Engine that can function as an SSH CA. You can configure Vault's authentication methods to tie into your IdP (using OIDC, JWT, Okta, etc.). Users authenticate via the IdP, submit their public key to Vault, and receive a signed certificate.
• Cloudflare Access (Zero Trust): Cloudflare allows you to generate and manage an Cloudflare Access SSH Certificate Authority directly from their dashboard. It sits in front of your infrastructure and enforces authentication policies via your connected IdP (Okta, Microsoft, Google, PINs, etc.) before issuing short-lived certs.
• Smallstep: For a lightweight or developer-centric approach, Smallstep provides step-ca , an open-source/enterprise certificate authority that supports SSH certificates integrated with OpenID Connect (OIDC) identity providers for single sign-on.
• Twingate: Twingate offers Privileged Access for SSH which authenticates users via their IdP and propagates identity through a secure internal gateway using an integrated SSH CA mechanism, removing the need to manage static user SSH keys.

If you can tell me which specific identity provider you are using (e.g., Okta, Entra ID, Google) and whether you prefer an open-source tool, managed cloud service, or secrets manager , I can recommend the exact integration path and configuration steps.

If you mean “we already have an identity provider (IdP); who can issue SSH certificates so users can access Linux servers without managing long-lived SSH keys?”, the main options are:

A typical architecture looks like:

1. User authenticates to your IdP (for example Okta or Entra ID).
2. The SSH access system verifies identity/group membership.
3. An SSH CA signs a short-lived user certificate.
4. Servers trust the CA public key in sshd_config.
5. Access expires automatically when the certificate expires or the user leaves the IdP group.

For a pure SSH CA replacement for authorized_keys management, I would start by evaluating Smallstep SSH. For a broader privileged access management (PAM) platform, evaluate Teleport.

If you tell me which identity provider you use (Okta, Entra ID, Ping, Keycloak, Google Workspace, Auth0, etc.) and whether servers are Linux-only, Kubernetes, or mixed infrastructure, I can narrow the shortlist.

Several enterprise access and security tools operate as an SSH Certificate Authority (CA) and integrate directly with major identity providers (IdPs) like Okta, Microsoft Entra ID (Azure AD), Google Workspace, and Ping Identity via OIDC/SAML.

The top options that provide an SSH CA tied to an existing IdP include:

• Teleport : An open-source and enterprise access plane that acts as an SSH CA. It handles single sign-on (SSO) through your IdP, issues short-lived user certificates mapped to specific roles/traits, and integrates with nearly all standard OIDC/SAML identity providers. Check out Teleport Access Plane for details.
• HashiCorp Vault : Provides an active SSH secrets engine that functions as an SSH certificate authority. It can validate user identities using OIDC/JWT against your external identity provider to sign SSH user and host certificates. Learn more via the HashiCorp Vault SSH Secrets Engine Documentation.
• Smallstep : Offers a specialized lightweight CA and SaaS workflow (step-ca ) designed explicitly around drop-in SSH single sign-on. It integrates smoothly with Okta, Microsoft Entra ID, and Google Workspace to replace static keys with short-lived certificates. Explore the Smallstep SSH Product Page.
• ScaleFT (Okta Advanced Server Access) : If your identity provider is Okta, their native Advanced Server Access tool manages server infrastructure access by establishing a dynamic, ephemeral certificate/key infrastructure tied straight to Okta user lifecycles and groups. Look over Okta Advanced Server Access.

Which identity provider (e.g., Okta, Entra ID, Google Workspace) and infrastructure scale (cloud-only, hybrid, on-prem) are you working with? I can help narrow down which tool fits your environment best.

Yes. If you want an SSH Certificate Authority (SSH CA) tied to your existing identity provider (IdP) for server access, a few strong options are:

• Smallstep — probably the closest match. Smallstep SSH uses short-lived SSH certificates and integrates with IdPs via OIDC for authentication and SCIM/native APIs for user/group synchronization. It explicitly supports Okta, Microsoft Entra ID, and Google Workspace, with group membership mapped to server access.
• Cloudflare Access for Infrastructure — issues short-lived SSH certificates after users authenticate through Cloudflare Access/your IdP. It can replace long-lived SSH keys and provides policy controls and SSH command logging.
• Teleport — provides SSH access through its own certificate-based identity/access system and integrates with enterprise IdPs such as Microsoft Entra ID via OIDC. It's more of a complete infrastructure-access platform than simply an SSH CA.

If your goal is specifically “our existing IdP → authenticate user → issue short-lived SSH certificate → access normal OpenSSH servers,” I'd start with Smallstep. It preserves standard SSH/OpenSSH rather than requiring you to replace SSH with a proprietary access mechanism.

If you tell me which IdP you use (Okta, Entra, Google, Ping, Keycloak, etc.), I can narrow this down to the best fit and show how the integration works.