bwIDM REST API Scripts

This repo contains scripts to communicate with the REST API of the Reg-App from version 2.7 (not tested with earlier branches). When a user tries to log in via SSH, the scripts provide the SSH server with the user's SSH keys

• which are associated with the service (e.g. NEMO2 jumphost)
• or all "active" keys of the user with a predefined prefix (e.g. RZ Uni Freiburg Juphost)

In the first case, users should refer to the corresponding wiki of the service (e.g. NEMO2). The second case is explained below.

Howto: Use the RZ Uni Freiburg Jumphost (Testinstallation)

SSH keys can be managed via the "My SSH Pubkeys" menu entry on the bwIDM registration service. Here you can add and revoke SSH keys. For the RZ Uni Freiburg jumphost to work with your SSH keys, the key name must start with the following string: UNIFR-JUMPHOST.

To add a new ssh key, please follow these steps:

1. Login to https://login.bwidm.de/ and select "My SSH Pubkeys" if you are not redirected directly.

2. Click the "Add SSH Key" or "SSH Key Hochladen" button.

3. A new window appears. Enter the name of your key. The name must start with the string UNIFR-JUMPHOST (as a prefix), and paste your SSH public key (file ~/.ssh/.pub) into the box labeled "SSH Key". DO NOT PASTE YOUR PRIVATE SSH KEY! Click on the "Add" or "Hinzufügen" button.

4. If verything worked, your new key will be displayed in the user interface.

Newly added keys are valid for three months. After that, they are revoked and placed on a "revocation list" so they cannot be used again.

As soon as your key(s) are provided, you can use the RZ uni Freiburg jumphost (test phase).

Using the Jumphost

The RZ Uni Freiburg currently jumphost is currently only available for RUF account type "employee". It is not allowed to log into the jumphost, it can only be used with the option '-J '.

Example:

ssh -J rzjump.nemo.uni-freiburg.de final.desination.uni-freiburg.de

You should configure your SSH client ro use the correct keys and users:

Host rzjump.nemo.uni-freiburg.de
    User <uni_username>
    IdentityFile ~/.ssh/keys/id_ed25519_sk_nd_nano_bwidm_jumphost1
    IdentityFile ~/.ssh/keys/id_ed25519_sk_nd_nfc_bwidm_jumphost2

To configure a server to use the jumphost, you can use the "ProxyJump" configuration option:

Host server*.subdom.uni-freiburg.de
    User admin
    ProxyJump rzjump.nemo.uni-freiburg.de
    IdentityFile ~/.ssh/keys/id_rsa-serversx

For more details, see https://github.com/nemo-cluster/jumphost#configure-your-local-ssh-client