How do I auto-enable on an ssh public key login on an ASA?

Question

I am trying to allow an ssh session to auto-enable on my ASA. I am enable to ssh to the asa with the public key and get directly to a non-enabled prompt, but I want that prompt to enter in enabled mode so that I can use the account for automation without storing passwords in a script.

Per the cisco docs, if you specify auto-enable on the aaa authorization exec LOCAL line, it should automatically put an inbound localdb user in enable mode.

Thinking that I might also need to set service-type, I set service-type admin on the user in question.

Relevant config:

aaa authentication ssh console tacacsgroup LOCAL
aaa authentication enable console tacacsgroup LOCAL
aaa authentication http console tacacsgroup LOCAL
aaa authorization command LOCAL
aaa accounting command tacacsgroup
aaa accounting enable console tacacsgroup
aaa accounting ssh console tacacsgroup
aaa authorization exec LOCAL auto-enable

And the user entry:

username redacted password redacted encrypted privilege 15
username redacted attributes
 service-type admin
 ssh authentication publickey re:da:ct:ed:re:da:ct:ed:re:da:ct:ed:re:da:ct:ed:re:da:ct:ed:re:da:ct:ed:re:da:ct:ed:re:da:ct:ed hashed

Answer 1

I just tested with ASA 9.1.7 and found that telnet and ssh with password authentication works fine with "auto-enable", but ssh with publickey does not. A workaround is to push the enable sequence to each ssh session:

notroot@ubuntu:/www$ ssh 10.89.168.49 $'en\n\n'
Type help or '?' for a list of available commands.
LABNET-CORE-ASA5510-1> en
Password: 
LABNET-CORE-ASA5510-1# <you are left here>

If you're industrious, open up a TAC case and ask Cisco to fix the bug.