I'd like to see an MFA-version of Kerberos/kinit, and a PAM module that checks for ticket revocation on login.
That's not so different from BeyondCorp and Uber's model.
Alternatively, some kind of OpenID Connect init (oidcinit) to get a JWT and then a PAM module like the kerberos one (which also checks the JWT's Key Id for revocation on authentication)
That's not so different from BeyondCorp and Uber's model.
Alternatively, some kind of OpenID Connect init (oidcinit) to get a JWT and then a PAM module like the kerberos one (which also checks the JWT's Key Id for revocation on authentication)