Key authentication in SSH from AD. What are the options (I want not to distribute the keys, but online)?

Question

SSH

I want to authenticate in bulk (more than a hundred) users through ssh keys, but store them in AD\Scheme. The solution suggests itself AD<>FreeIPA<>Linux Host (SSSD+OpenSSH)
Question: did anyone take off? What is better to do - a trust or a domain member on FreeIPA? were there any workflows?

Answer 1

Freeipa has everything out of the box, the key can be loaded both through the face and through the rest api or ldapmodify

Answer 2

So it is possible to pass authentication through kerberos. There, linux is entered into the domain, then ssh (/etc/ssh/sshd_config) config is edited like this:

KerberosAuthentication yes
KerberosTicketCleanup yes
GSSAPIAuthentication yes
GSSAPICleanupCredentials yes