Yea the RBAC part is tricky. I think you need PAM or some sort of agent on the hosts to do that if you need individual user accounts (vs "principal" accounts that map to server groups like "frontend", "backend", "database"). The latter isn't a terrible option when you use certs, fwiw, since you can still get good audit by encoding the actual user in the certificate, which gets logged to `auth.log`. Still, not ideal for everyone.

This is one of a handful of problems we're working to solve / streamline for an SSH product. We might even open source this bit, but not sure yet. If we don't, it still probably wouldn't be $hundreds/$thousands per month unless you have a huge org. If you're interested at all I'd love to talk more about this -- what your requirements are, whether you want hosted/not hosted, whether you want to pay at all / how much you'd be willing to pay, etc. Easiest thing to do to stay in the loop is send us your email at https://smallstep.com/sso-ssh/ by "requesting early access" and we'll reach out to schedule a convo & keep you updated as we make progress. Or just watch our blog! :)