[client] Refuse SSH JWT auth when the client changes the user name between auth requests on one connection (#8389)

* Refuse SSH JWT auth when the client changes the user name between auth requests on one connection

* Run SSH sessions and SFTP as the OS user that was authorized, taken from the connection context

client/ssh/server/session_handlers.go

@@ -12,10 +12,17 @@ import (
 	log "github.com/sirupsen/logrus"
 )
 
+// sessionUser returns the OS user name the session was authenticated for. The context keeps the
+// name from the first auth request of the connection, which is the one passwordHandler checked,
+// while sess.User() is the name from the last request the client sent and may differ from it.
+func sessionUser(sess ssh.Session) string {
+	return sess.Context().User()
+}
+
 // associateJWTUsername extracts pending JWT username for the session and associates it with the session state.
 // Returns the JWT username (empty if none) for logging purposes.
 func (s *Server) associateJWTUsername(sess ssh.Session, sessionKey sessionKey) string {
-	key := newAuthKey(sess.User(), sess.RemoteAddr())
+	key := newAuthKey(sessionUser(sess), sess.RemoteAddr())
 
 	s.mu.Lock()
 	defer s.mu.Unlock()
@@ -61,7 +68,7 @@ func (s *Server) sessionHandler(session ssh.Session) {
 		defer drainWindowChanges(winCh)
 	}
 
-	privilegeResult, err := s.userPrivilegeCheck(session.User())
+	privilegeResult, err := s.userPrivilegeCheck(sessionUser(session))
 	if err != nil {
 		s.handlePrivError(logger, session, err)
 		return
@@ -90,7 +97,7 @@ func (s *Server) registerSession(session ssh.Session, sessionType string) sessio
 	shortID := hex.EncodeToString(hash[:4])
 
 	remoteAddr := session.RemoteAddr().String()
-	username := session.User()
+	username := sessionUser(session)
 	sessionKey := sessionKey(fmt.Sprintf("%s@%s-%s", username, remoteAddr, shortID))
 
 	s.mu.Lock()