Key-based access (SSH / age)
Not all access is a password or a browser login. SSH and age keys are access credentials in their own right, and the platform manages them as such – so reaching a host over SSH, or decrypting a payload with age, is a governed access path alongside the identity-based methods.
Keys are tracked separately from a user’s identities. A person’s login accounts and their keys are related but distinct: a key can be added, rotated, or revoked without touching the accounts, and vice versa.
How ResorsIT integrates it
- A user’s SSH and age public keys are recorded by the platform and can be managed by the user through self-service
- Keys are provisioned to the hosts and tools that should trust them, and removed when access ends
- Because keys are held centrally, revoking a compromised key is one action, not a hunt across every host
When a tool uses this
Key-based access fits anything reached over SSH – servers, network devices, and CLIs – and anything that uses age for encryption. It is the access method for tools that are operated from a shell rather than signed in to through a browser.
For browser and application logins, see the identity-based methods: single sign-on, LDAP, and non-SSO identities.
