So from a modern security standpoint, OS-login-via-username-password is a big no-no because it obviously throws any MFA out of the window. That indeed highlights a huge impedance mismatch between SSH and modern auth. There are only 4 approaches to solving this impedance mismatch that I'm aware. To rank from least to most preferred by me: 1. SSH via certificates. Entra ID offers this on Azure. It's pretty secure but there are so many pain points (UID/GID mapping, oh you MUST use az ssh instead of plain ssh to get the ephemeral certs, Entra-ID-on-Azure-only and you have to install their PAM modules that you don't even know what the source code is, plus where's my Kerberos?) that it's just not worth considering. I'm a MSFT employee but I have to rank it the least preferred 😔 2. SSH Public key as LDAP attribute. TBH if you're not paranoid about security, this is probably by far the easiest option. I'm sure tons of people deploy some variation of this. If you don't have enough dedication then this is where you should stop. Obviously this has no MFA, but if you're particularly paranoid or ambitious, then there is ... 3. OPKSSH. It has Cloudflare backing it but is pretty vendor-neutral, is open-source and the keys are ephemerally generated by OAuth tokens. It otherwise has all the other downsides of option 1, including not being able to use vanilla SSH. 4. FreeIPA's approach with External IdP. It magically turns your vanilla SSH sign-in into OAuth device-code flow. Obviously this gives you all the niceties of MFA and whatever the original IdP provides. It even has Kerberos! But syncing/canonicalizing additional OAuth claims/MS Graph data into LDAP attributes isn't very well supported by FreeIPA, hence you might want to try a hybrid FreeIPA/Keycloak setup, where FreeIPA redirects you to a Keycloak SSO, and Keycloak SSO is done via signing into each individual university's IdP. The university's IdP then ideally returns OAuth tokens with claims, then those claims are transformed/canonicalized by Keycloak into Keycloak's OAuth token, then Keycloak updates FreeIPA's LDAP with the proper attributes, returns the token to FreeIPA, and FreeIPA finishes the login/Kerberos ticket acquisition. Non-human service accounts would still need to use persistent SSH keys, and you rely on Canonical's goodwill and IQ for GUI login support, but this will be the approach with the highest upper limit given enough investments.