I'm trying to implement dynamic git auth backend using aclchecker and keyhelper. The problem I'm running into is that my instance is running on an OpenShift instance, hence making the sshd IP address unpredictable. That causes a problem with /ssh/lookupkey/ and /ssh/checkaccess/, since they're wrapped with localonly wrapper, which only lets through one of configured addresses.

I think it'd make sense to also allow using some sort of token for this usecase, that the sshd service would have and would add to requests to authenticate to these two endpoints.

Does that make sense? If so, would it make sense to use admin token for this? I think it might, but I'd like to hear some opinions first.