Home

SSH Proxy → Workspace Flow

This document describes the flow between SSH CLI, SSH Proxy, Identity, Provisioner, and k8shelld.
The flow is divided into three phases:

1. User Mapping & Onboarding
2. Workspace Provisioning
3. User Interaction (SSH Session)

1. User Mapping & Onboarding

sequenceDiagram
    autonumber
    participant C as SSH CLI
    participant P as SSH Proxy
    participant I as Identity Service
    participant G as GitHub (Identity Provider)

    C->>P: Open SSH connection (handshake)
    note right of P: Parse login (user~bp@addr)

    %% Key verification with GitHub
    P->>G: Retrieve user public keys (GitHub API)
    G-->>P: Return authorized_keys list
    P->>P: Verify SSH key / cert against GitHub keys

    %% Identity mapping
    P->>I: Resolve user mapping
    alt User mapped
        I-->>P: Mapping OK
    else User not mapped
        P->>I: Start onboarding (e.g. GitHub Device Flow)
        alt Onboarding successful
            I-->>P: Mapping created
        else Onboarding failed
            I-->>P: No mapping
            P-->>C: Access denied
        end
    end

Loading