Making use of ssh keys for authentication in other applications?

If you just have a list of users that can use your application and you have no need to see who did what.

You can setup your server so that it listens only on localhost (127.1) rather than 0.0.0.0, and provide a restricted sshd, forwarding the port required to connect to the application

~/.ssh/authorized_keys will provide a list of the authorized keys that can be used.

 ssh -I private_key_file <hostname> -L 3000:localhost:3000

For a basic setup and help with configuring your sshd, check out this answer:https://askubuntu.com/questions/48129/how-to-create-a-restricted-ssh-user-for-port-forwarding

Note: Be warned that if you don't lock it down, any user will have full shell access on your box where the machine is hosted.

A dirty hack from top of my head: could you wrap the application so that it would create an actual SSH tunnel from localhost to your server, and use that for ?

Assuming you are talking about a web based application. What you are really looking for is X.509 Client certificates (1.3.6.1.5.5.7.3.2). This will allow you to identify a user individually to your application.

These face the same issues that are usually faced when looking at key distribution. Which is generally considered a hard problem.

If you wanted to head down this road here is what you would need to do.

• Generate a root certificate (once)
• Setup web server with appropriate modules to parse the certificate (nginx/apache)
• Generate a certificate for each user (openssl)
• Download cerificiate from centralized server. (maybe use their ssh pub key here)
• Install the x509 cert locally (OS Dependent)

On the server side, you would need to process the cert as part of the web-server (nginx or apache should have modules to do this) and then pass the name onto your application as a header field which you can then process internally.

This is a much better security solution than usernames and passwords, however is complex because of the key distribution issue. Most people wouldn't bother since in most applications it is easy enough to integrate logins with LDAP or radius.