Hi @nodesocket, you can take a look how we solved it with Theo https://theoapp.readthedocs.io/en/latest/index.html
It supports fine hosts/users grants - i.e. I can connect as "dev" user on servers "node1" and "node2" but not on "node3" - and it leverages asymmetric key signing to validate the public SSH keys.
Theo supports mysql/mariadb/sqlite/postgresql(experimental) for storing data and redis/memecached for caching.
Happy to answer any further questions!
We started theoapp [1] in mid 2018 and we introduced it at FOSDEM 2019 [2]. We then launched AuthKeys [3], a company that offers it as SaaS.
From a technical standpoint, we chose a different approach than that described by this thread's O.P. More specifically we implemented our service as a client/server suite to integrate with the standard sshd authorizedKeysCommand feature. Rationale and more technical details can be found at the links below.
We've been in "stealth mode" until now (this is our very first public post!), while running the service with selected customers since December 2019.
Recent developments will soon allow us to widen the product’s offer with a self-hosted solution of AuthKeys.
Feedback from the HN community is more than welcome: we'd like to hear whether the website is effective and clear enough on explaining how AuthKeys works [4]. We realized the topic comes with a certain degree of complexity for some potential users while others really want to quickly spot how the internals work and how we managed to make it secure to trust and easy to use.
We’ll be happy to answer any questions on the matter, and to offer promo codes to HN readers in case you wish to give it a go.