Thanks Dmitri,
I'm sshing from linux boxes.
SSH does not support cert authentication but in RHEL there have been some patches to support X509 certs though I am not sure how exactly it would work.
I had this input also from someone else : if I find something interesting I will report about it here.
My point is that there may have been some kind of mecanism for the server on which to log in to ask for the client to bind the ldap server ( when pam knows that ldap is to be used ) rather than presenting the usual "login/passwd" message.
This binding operation may have involved sssd transactions between the client and the server ( so that sssd could bind directly the ldap server using information passed by the client, and being therefore able to certify about the requester identity ).
May be a wrong idea.
I'm afraid this is outside of scope of SSSD. Even when using Kerberos auth, I believe that SSH does the authentication by itself and contacts SSSD only for identification and subsequent authorization. X.509 authentication would be probably the same.
If you use Kerberos and/or IPA for your Lunix/UNIX environment you can provision a user keytab
At this stage my goal is to properly deploy a rightly operated ldap service for user authentication and authorization.
sso with kerberos or IPA are things that I consider but... as a next step really ( and with no targetted deadline ! :-)
I think that your life might be easier is you deployed IPA right away. After all, that's what IPA is for :-) Also SSH with IPA (Kerberos) might be the right solution you are looking for.
Thanks Jan