I am currently have multiple users accessing multiple customer servers with ssh access (which all only allow access from our public office IP). This kind of gets annoying if a new employee enters the company or just the team or leaves the team or the organisation. Another problem is that servers change ownership depending on their stage (development, operations).
So best case would be if I update the authorized keys every time something changes in a scripted way thought Ansible for example.
The thing is that I want to rely on the internal Active Directory users and group memberships, so when a user changes teams (and groups) or leaves the company (gets deactivated) those changes happen automatically. But those servers would need access to the AD server, which is internal only, then. So that's not really an option as I do not want the AD port in the internet.
Therefore I wanted to have something like a reverse bastion/jump host (or ssh gateway), which sits in our office networks DMZ and from which the users can connect to the customers ssh server. The jump host would have access to the AD to authenticate and authorize the users if they are in the correct group which is needed for a customer server he wants to connect to.
I found something similar (SSH access gateway for many servers) to this, but it does not solve two problems: - no AD integration - no separation between teams