SSH with E-Mail as Username?

Answered
Avatar
ProudOne
Created

My company uses AAD for single-sign-on, and the SSH credentials that come with that use the user's e-mail as the SSH user name. 

SSH in IDEA seems to connect like this: `user@example.org@node-02.example.org`.
This fails, probably since it gets confused about which `@` denotes the host.

On the terminal, that's not a problem since you can write the user name into the configuration. While IDEA respects the configuration, it requires that you enter an user name in the SSH profile anyway, and that leads to an authentication error.

Is anyone aware of a way to make this work?

Votes

1

Share

6 comments
Avatar
Serge Baranov
Created

It should work fine as you can specify the user name separately in IntelliJ IDEA SSH connection settings.

Check idea.log for the actual error, see https://intellij-support.jetbrains.com/hc/en-us/articles/207241085.

0
Avatar
ProudOne
Created

Here's how the Profile is set up:


Hitting the ‘test connection’ button, this is what's written to idea.log.

2023-12-04 17:10:12,009 [28714394]   INFO - net.schmizz.sshj.transport.random.JCERandom - Creating new SecureRandom.
2023-12-04 17:10:12,070 [28714455]   INFO - #c.i.s.i.s.sshj - Client identity string: SSH-2.0-IntelliJ__IDEA_IU-232.10227.8__SSHJ_0.35.0
2023-12-04 17:10:12,100 [28714485]   INFO - #c.i.s.i.s.sshj - Server identity string: SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.4
2023-12-04 17:10:12,305 [28714690]   INFO - #c.i.s.i.s.sshj - Disconnected - BY_APPLICATION
0
Avatar
Serge Baranov
Created

The Host and the user name are parsed correctly, but the connection is dropped by the server.

To get more details, check the server logs.

You can also add the following in Help | Diagnostic Tools | Debug Log Settings and check idea.log for more details:

#com.intellij.ssh:trace
#net.schmizz.sshj.transport.Decoder:trace

You will see what user name and host IDE is using in the log.

0
Avatar
ProudOne
Created

With the additional Debug Params, this is what I get in idea.log. If I'm reading it right, IDEA tries to connect using nothing but my personal id proudone@not-example.org, rather than the ID specified in my ssh config.

2023-12-05 08:35:11,604 [1075745]   FINE - #c.i.s.c.ProductionSshConnectionConfigDelegate - Found specific settings in /etc/ssh/ssh_config for host node-02@example.org:
 authMethods: GssApi, PublicKey(privateKeys=[], agent=ALL), Password, KeyboardInteractive
 hostKeyVerifier: OpenSSH-like host key verifier (knownHostsFile=[/home/proudone/.ssh/known_hosts], strictHostKeyChecking=ASK, hashKnownHosts=true)
2023-12-05 08:35:11,605 [1075746]   FINE - #c.i.s.c.ProductionSshConnectionConfigDelegate - Found specific settings in /home/proudone/.ssh/config for host node-02@example.org:
 authMethods: GssApi, PublicKey(privateKeys=[/home/proudone/.ssh/azure-configs.d/00000000-0000-0000-0000-000000000000/id_rsa], agent=ONLY_MENTIONED), Password, KeyboardInteractive
 port: 999
 user: user@example.org
2023-12-05 08:35:11,605 [1075746]   FINE - #c.i.s.c.SshConnectionConfig - Change after applying remote credentials for host node-02@example.org:
 serverAlive: null
           -> ServerAlive(interval=PT5M, countMax=3)
2023-12-05 08:35:11,605 [1075746]   FINE - #c.i.s.c.SshConnectionConfigService - No changes after replacing %-tokens for host node-02@example.org.
2023-12-05 08:35:11,605 [1075746]   FINE - #c.i.s.i.SshConnection - Checking that can authenticate user@example.org@node-02@example.org:999
2023-12-05 08:35:11,605 [1075746]   INFO - net.schmizz.sshj.transport.random.JCERandom - Creating new SecureRandom.
2023-12-05 08:35:11,607 [1075748]   FINE - #c.i.s.i.s.sshj - Full connection config:
 authMethods: GssApi, PublicKey(privateKeys=[/home/proudone/.ssh/azure-configs.d/00000000-0000-0000-0000-000000000000/id_rsa, /home/proudone/.ssh/id_rsa, /home/proudone/.ssh/id_dsa, /home/proudone/.ssh/id_ecdsa, /home/proudone/.ssh/id_ed25519, /home/proudone/.ssh/id_xmss], agent=ONLY_MENTIONED), Password, KeyboardInteractive
 ciphers: [aes128-cbc, aes128-ctr, aes192-cbc, aes192-ctr, aes256-cbc, aes256-ctr, blowfish-cbc, blowfish-ctr, cast128-cbc, cast128-ctr, idea-cbc, idea-ctr, serpent128-cbc, serpent128-ctr, serpent192-cbc, serpent192-ctr, serpent256-cbc, serpent256-ctr, 3des-cbc, 3des-ctr, twofish128-cbc, twofish128-ctr, twofish192-cbc, twofish192-ctr, twofish256-cbc, twofish256-ctr, twofish-cbc, arcfour, arcfour128, arcfour256]
 compression: false
 connectTimeout: PT10S
 forwardAgent: false
 host: node-02@example.org
 hostKeyAlgorithms: [ecdsa-sha2-nistp256-cert-v01@openssh.com, ecdsa-sha2-nistp384-cert-v01@openssh.com, ecdsa-sha2-nistp521-cert-v01@openssh.com, sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, ssh-ed25519-cert-v01@openssh.com, sk-ssh-ed25519-cert-v01@openssh.com, rsa-sha2-512-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com, ssh-rsa-cert-v01@openssh.com, ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521, sk-ecdsa-sha2-nistp256@openssh.com, ssh-ed25519, sk-ssh-ed25519@openssh.com, rsa-sha2-512, rsa-sha2-256, ssh-rsa]
 hostKeyVerifier: OpenSSH-like host key verifier (knownHostsFile=[/home/proudone/.ssh/known_hosts], strictHostKeyChecking=ASK, hashKnownHosts=true)
 identityAgent: null
 initialLocalTcpForwardings: []
 initialRemoteTcpForwardings: []
 kexAlgorithms: [curve25519-sha256, curve25519-sha256@libssh.org, diffie-hellman-group-exchange-sha256, ecdh-sha2-nistp521, ecdh-sha2-nistp384, ecdh-sha2-nistp256, diffie-hellman-group-exchange-sha1, diffie-hellman-group1-sha1, diffie-hellman-group14-sha1, diffie-hellman-group14-sha256, diffie-hellman-group15-sha512, diffie-hellman-group16-sha512, diffie-hellman-group17-sha512, diffie-hellman-group18-sha512, diffie-hellman-group14-sha256@ssh.com, diffie-hellman-group15-sha256, diffie-hellman-group15-sha256@ssh.com, diffie-hellman-group15-sha384@ssh.com, diffie-hellman-group16-sha256, diffie-hellman-group16-sha384@ssh.com, diffie-hellman-group16-sha512@ssh.com, diffie-hellman-group18-sha512@ssh.com]
 macs: [hmac-sha1, hmac-sha1-etm@openssh.com, hmac-sha1-96, hmac-sha1-96@openssh.com, hmac-md5, hmac-md5-etm@openssh.com, hmac-md5-96, hmac-md5-96-etm@openssh.com, hmac-sha2-256, hmac-sha2-256-etm@openssh.com, hmac-sha2-512, hmac-sha2-512-etm@openssh.com, hmac-ripemd160, hmac-ripemd160-etm@openssh.com, hmac-ripemd160-96, hmac-ripemd160@openssh.com]
 port: 999
 proxyConfig: null
 serverAlive: ServerAlive(interval=PT5M, countMax=3)
 user: user@example.org
 x11Forwarding: null
2023-12-05 08:35:11,614 [1075755]   FINE - #c.i.s.i.s.sshj - Got error in reading a public key of /home/proudone/.ssh/id_rsa: java.io.FileNotFoundException: /home/proudone/.ssh/id_rsa (No such file or directory)
2023-12-05 08:35:11,614 [1075755]   FINE - #c.i.s.i.s.sshj - Got error in reading a public key of /home/proudone/.ssh/id_dsa: java.io.FileNotFoundException: /home/proudone/.ssh/id_dsa (No such file or directory)
2023-12-05 08:35:11,615 [1075756]   FINE - #c.i.s.i.s.sshj - Got error in reading a public key of /home/proudone/.ssh/id_ed25519: java.io.FileNotFoundException: /home/proudone/.ssh/id_ed25519 (No such file or directory)
2023-12-05 08:35:11,615 [1075756]   FINE - #c.i.s.i.s.sshj - Got error in reading a public key of /home/proudone/.ssh/id_xmss: java.io.FileNotFoundException: /home/proudone/.ssh/id_xmss (No such file or directory)
2023-12-05 08:35:11,615 [1075756]   FINE - #c.i.s.i.s.sshj - Failed to initialize key /home/proudone/.ssh/id_rsa: java.io.FileNotFoundException: /home/proudone/.ssh/id_rsa (No such file or directory)
2023-12-05 08:35:11,615 [1075756]   FINE - #c.i.s.i.s.sshj - Failed to initialize key /home/proudone/.ssh/id_dsa: java.io.FileNotFoundException: /home/proudone/.ssh/id_dsa (No such file or directory)
2023-12-05 08:35:11,615 [1075756]   FINE - #c.i.s.i.s.sshj - Failed to initialize key /home/proudone/.ssh/id_ed25519: java.io.FileNotFoundException: /home/proudone/.ssh/id_ed25519 (No such file or directory)
2023-12-05 08:35:11,615 [1075756]   FINE - #c.i.s.i.s.sshj - Failed to initialize key /home/proudone/.ssh/id_xmss: java.io.FileNotFoundException: /home/proudone/.ssh/id_xmss (No such file or directory)
2023-12-05 08:35:11,640 [1075781]   INFO - #c.i.s.i.s.sshj - Client identity string: SSH-2.0-IntelliJ__IDEA_IU-232.10227.8__SSHJ_0.35.0
2023-12-05 08:35:11,674 [1075815]   INFO - #c.i.s.i.s.sshj - Server identity string: SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.4
2023-12-05 08:35:11,835 [1075976]   FINE - c.i.s.i.s.PlatformAuthAgent - Attempting authentication using agent identity ProudOne proudone@not-example.org
2023-12-05 08:35:11,871 [1076012]   INFO - com.hierynomus.sshj.userauth.keyprovider.OpenSSHKeyV1KeyFile - Read key type: ssh-rsa
2023-12-05 08:35:11,873 [1076014]   FINE - c.i.s.i.s.PlatformAuthPublickey - Attempting authentication using com.hierynomus.sshj.userauth.keyprovider.OpenSSHKeyV1KeyFile@2a6bf3aa
2023-12-05 08:35:11,905 [1076046]   FINE - c.i.s.i.s.PlatformAuthPublickey - Attempting authentication using com.hierynomus.sshj.userauth.keyprovider.OpenSSHKeyV1KeyFile@2a6bf3aa
2023-12-05 08:35:11,939 [1076080]   FINE - c.i.s.i.s.PlatformAuthPublickey - Attempting authentication using com.hierynomus.sshj.userauth.keyprovider.OpenSSHKeyV1KeyFile@2a6bf3aa
2023-12-05 08:35:11,965 [1076106]   INFO - #c.i.s.i.s.sshj - Disconnected - BY_APPLICATION

.ssh/config:

Host node-*.example.org
 User user@example.org
 CertificateFile "/home/proudone/.ssh/azure-configs.d/00000000-0000-0000-0000-000000000000/id_rsa.pub-aadcert.pub"
 IdentityFile "/home/proudone/.ssh/azure-configs.d/00000000-0000-0000-0000-000000000000/id_rsa"
 IdentitiesOnly yes
 Port 999


The server log contains no related lines, not even a connection hint.

0
Avatar
Serge Baranov
Created

Are you sure the log provided corresponds to the screenshot with your settings? We tried exactly the same setup and the log looks different.

You have this in the log:

host: node-02@example.org

But with the configuration from your screenshot, we get this:

host: node-02.example.org

What IDE version do you use?

If it's just the result of the incorrect log edit and it still doesn't work, this is likely the root cause: https://youtrack.jetbrains.com/issue/IDEA-271669/Support-CertificateFile-directive-in-ssh-config-file.

It has nothing to do with the email used as the user name.

0
Avatar
ProudOne
Created

Yes, I incorrectly redacted the log. The bug you linked looks extremely relevant. Thank you!

0

Please sign in to leave a comment.