Managing SSH keys with Kanidm

For lab members who joined before 2026-05-22. orca's logins are now managed centrally through Kanidm for new members. If you already had an orca account before that date, your existing access still works and you don't need to follow this. 
 
 This page covers SSH access to orca , whose logins are managed through the lab's identity server, Kanidm . You register your SSH public key with Kanidm once, then you can log in. (For web services and passwords, see Accounts .) Other lab machines are still being migrated — ask Adarsh for access to those. 
 1. Make sure you have an SSH key 
 On your laptop: 
 ls ~/.ssh/id_ed25519.pub
 
 If that file exists, skip to step 2. Otherwise create one: 
 ssh-keygen -t ed25519 -C "your-name@arizona.edu"
 
 Press Enter for the default location; a passphrase is recommended. This creates a private key ( ~/.ssh/id_ed25519 — never share it) and a public key ( ~/.ssh/id_ed25519.pub — safe to share). 
 2. Copy your public key 
 cat ~/.ssh/id_ed25519.pub
 
 Copy the whole line — it starts with ssh-ed25519 . 
 3. Register it with Kanidm 
 You have two options for doing this: via the web (easier) or via the command line. 
 3.1 Web (easier) 
 Sign in at idm.lab.pyarelal.xyz → Profile → Credentials -> SSH Keys → Add SSH Key , paste the public key from step 2, and give it a Title (e.g. my-macbook-pro ). 
 3.2 Command line 
 If you have the kanidm client tools : 
 kanidm login -D <your-username>
kanidm person ssh add-publickey <your-username> <label> "ssh-ed25519 AAAA... your-name@arizona.edu"
 
 (The label, e.g. my-macbook-pro , just lets you tell keys apart — use one per device.) 
 4. Log into orca 
 ssh <your-username>@orca.infosci.arizona.edu
 
 The first time, your shell may take a moment while your home directory is created. 
 Troubleshooting 
 
 
 Permission denied (publickey) — the key registered in Kanidm doesn't match the one your laptop is offering. Recheck steps 2–3, or run ssh -v <your-username>@orca.infosci.arizona.edu to see which key is being tried. 
 
 Asked for a password — your key isn't being found; confirm it's added in Kanidm and that you're connecting as the right username. 
 Still stuck? Contact Adarsh .