Automated key management for remote devices using single sign-on techniques
Techniques are provided for automated key management for accessing remote devices using single sign-on techniques. One method comprises maintaining a data record identifying target user devices that a given source user device is authorized to access; and initiating storage of a public key of the given source user device in a file of at least one target user device, wherein the given source user device accesses the at least one target user device using a secure remote connection protocol based on the public key of the given source user device stored in the file of the at least one target user device. The data record may further comprise a fingerprint of a key of the at least one target user device, and the method may further comprise comparing a fingerprint of the key returned by the at least one target user device to the fingerprint of the key obtained from the data record.
1. A method, comprising:
maintaining, by at least one server device, a data record identifying one or more target user devices that a given source user device is authorized to access, wherein the at least one server device is distinct from the one or more target user devices and the given source user device;
authenticating the given source user device using a single sign-on service; and
in response to one or more of: (i) a user of the given source user device requesting to access at least a given one of the one or more target user devices, and (ii) one or more of the target user devices being identified in the data record:
automatically distributing, by the at least one server device, a public key of the given source user device for storage in a file of at least one of the one or more target user devices, wherein the given source user device accesses the at least one target user device using a secure remote connection protocol based at least in part on the public key of the given source user device stored in the file of the at least one target user device;
wherein the method is performed by at least one processing device comprising a processor coupled to a memory.
2. The method of claim 1 , wherein the initiating the storage of the public key of the given source user device is performed using the secure remote connection protocol.
3. The method of claim 1 , wherein a private key of the given source user device is stored as an Identity File in a configuration file of the secure remote connection protocol on the given source user device.
4. The method of claim 3 , wherein the configuration file of the secure remote connection protocol on the given source user device further comprises a network address and a user identifier for the one or more target user devices that the given source user device is authorized to access.
5. The method of claim 1 , wherein the data record further comprises a fingerprint of at least one key of the at least one target user device, and further comprising comparing a fingerprint of the at least one key returned by the at least one target user device upon the given source user device accessing the at least one target user device to the fingerprint of the at least one key of the at least one target user device obtained from the data record.
6. The method of claim 1 , further comprising removing the authorization of the given source user device to access a given target user device by initiating a deletion of the public key of the given source user device in the data record for the given target user device and in the file of the given target user device.
7. The method of claim 1 , wherein the data record maps a user of the given source user device to the one or more target user devices.
8. An apparatus comprising:
at least one processing device comprising a processor coupled to a memory;
the at least one processing device being configured to implement the following steps:
maintaining, by at least one server device, a data record identifying one or more target user devices that a given source user device is authorized to access, wherein the at least one server device is distinct from the one or more target user devices and the given source user device; and
authenticating the given source user device using a single sign-on service; and
in response to one or more of: (i) a user of the given source user device requesting to access at least a given one of the one or more target user devices, and (ii) one or more of the target user devices being identified in the data record:
automatically distributing, by the at least one server device, a public key of the given source user device for storage in a file of at least one of the one or more target user devices, wherein the given source user device accesses the at least one target user device using a secure remote connection protocol based at least in part on the public key of the given source user device stored in the file of the at least one target user device.
9. The apparatus of claim 8 , wherein a private key of the given source user device is stored as an Identity File in a configuration file of the secure remote connection protocol on the given source user device, wherein the configuration file of the secure remote connection protocol on the given source user device further comprises a network address and a user identifier for the one or more target user devices that the given source user device is authorized to access.
10. The apparatus of claim 8 , wherein the data record further comprises a fingerprint of at least one key of the at least one target user device, and further comprising comparing a fingerprint of the at least one key returned by the at least one target user device upon the given source user device accessing the at least one target user device to the fingerprint of the at least one key of the at least one target user device obtained from the data record.
11. The apparatus of claim 8 , further comprising removing the authorization of the given source user device to access a given target user device by initiating a deletion of the public key of the given source user device in the data record for the given target user device and in the file of the given target user device.
12. The apparatus of claim 8 , wherein the data record maps a user of the given source user device to the one or more target user devices.
13. The apparatus of claim 8 , wherein the storage of the public key of the given source user device is performed using the secure remote connection protocol.
14. A non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device to perform the following steps:
maintaining, by at least one server device, a data record identifying one or more target user devices that a given source user device is authorized to access, wherein the at least one server device is distinct from the one or more target user devices and the given source user device; and
authenticating the given source user device using a single sign-on service; and
in response to one or more of: (i) a user of the given source user device requesting to access at least a given one of the one or more target user devices, and (ii) one or more of the target user devices being identified in the data record:
automatically distributing, by the at least one server device, a public key of the given source user device for storage in a file of at least one of the one or more target user devices, wherein the given source user device accesses the at least one target user device using a secure remote connection protocol based at least in part on the public key of the given source user device stored in the file of the at least one target user device.
15. The non-transitory processor-readable storage medium of claim 14 , wherein a private key of the given source user device is stored as an Identity File in a configuration file of the secure remote connection protocol on the given source user device, wherein the configuration file of the secure remote connection protocol on the given source user device further comprises a network address and a user identifier for the one or more target user devices that the given source user device is authorized to access.
16. The non-transitory processor-readable storage medium of claim 14 , wherein the data record further comprises a fingerprint of at least one key of the at least one target user device.
17. The non-transitory processor-readable storage medium of claim 14 , further comprising removing the authorization of the given source user device to access a given target user device by initiating a deletion of the public key of the given source user device in the data record for the given target user device and in the file of the given target user device.
18. The non-transitory processor-readable storage medium of claim 14 , wherein the data record maps a user of the given source user device to the one or more target user devices.
19. The non-transitory processor-readable storage medium of claim 14 , wherein the storage of the public key of the given source user device is performed using the secure remote connection protocol.
20. The non-transitory processor-readable storage medium of claim 19 , further comprising comparing a fingerprint of the at least one key returned by the at least one target user device upon the given source user device accessing the at least one target user device to the fingerprint of the at least one key of the at least one target user device obtained from the data record.