#kanidm — Public Fediverse posts

I deployed #kanidm this summer, and my students will be onboarding in the morning: I just sent them all reset tokens via Canvas. I picked it because it seems to be well designed with a focus on security over convenience while not requiring a ton of resources. https://kanidm.com/ #csed

We've just released #kanidm 1.11 with a lot of under the hood changes and polish. Nothing exciting this time, but thats what we do - simple and reliable. https://github.com/kanidm/kanidm/releases/tag/v1.11.0

It's been a while since my last post and a lot has happened. Hence, a quick update.

I've fully migrated from #freeipa to #kanidm by now and while this path was definitely not without (also major) problems, a lot of back and forth also with the developers, and a steep learning curve on my side, overall I don't regret the decision at all.

While kanidm arguably falls behind in popularity/visibility compared to #authentik, #keycloak, etc and seemingly also has (much?) less developers, and development therefore feels slower, it scores with simplicity and by offering exactly what I need. And it is MUCH more light-weight than #freeipa and has WAY fewer moving parts. And developers react quickly and are helpful. POSIX users/groups I could just "inherit" from the existing system.

See here for a quick comparison:
https://kanidm.com/comparisons/

I have around 10 services connected to it using OIDC, SSH access to servers, and automatic SSH key provisioning. All is working fine (finally now).

What is a bit annoying about OIDC is that not all services offer OIDC out of the box, i.e. sometimes additional plugins are needed. The other annoying thing is that OIDC implementations differ, e.g. in how group mapping are used (if at all). But this is not kanidm's fault.

If you are looking for a one-stop solution that offers OIDC, SSH key provisioning and replication - don't look any further. I can most highly recommend it.

Hm, now how do I fudge things around so that in my #SSO (#KaniDM) I can have two separate users, that to some services (mainly #readeck and #miniflux) appear as the same user 🤔

#SelfHost

Look at this! I was finally able to configure all of these apps to allow #SingleSignOn (#SSO) using #kanidm on #NixOS.

I admit I couldn't do this without the help of an #LLM (I used antigravity-cli for this). I know there are a lot of good points against LLMs, but they sure are really useful to me.

My summer vacation starts soon. And my brain is spinning and accumulating stuff I could do. Move my hosted server to a better one finally.. I pay both for well over a year :/ Catch up with current development of #k8s, #cilium, #flux, #proxmox, move to Gateway API, #kanidm replication as it got more important. Document all that.. trying to get away from Google photos, but it's complicated with huge shared albums.. and that's just some ideas.. and only IT.

As a project #kanidm has its flaws and its limitations - but we will not allow LLM slop into an identity management system. A software service that is centered on protecting and respecting humans.

LMAO, I just sat down to add a new application to my #Authentik #SSO... And bounced right off of all the options. Indeed time to move, I guess #KaniDM looks nice.
Yeah, moving from the baroque/enterprise clickable authentik/keycloak to "it's mostly CLI and purposefully few options" can cause some whiplash 😅

Hm, stay on #authentik and try to manage it with #terraform, or switch to #KaniDM and use the ability of #NixOS to externally manage/provision users and services? 🤔

#SelfHost #HomeLab #Security #Privacy

@homelab OK, after playing around a tiny bit, it seems that the code for this exists in #KaniDM
- https://github.com/kanidm/kanidm/pull/2968
- https://github.com/kanidm/kanidm/pull/3535/
but what doesn't exist is ability to reach it and set that up for a user. Oh well.

#Privacy #Security #SelfHosting #SSO

In my #SSO / #IdM adventures, looks like if I wanted to allow people to use my hackerspace's #OIDC SSO to access my services, I can configure this in #Authentik, but not in #KaniDM 🤔

#privacy #SelfHosting #authentication

IMPORTANT: #Kanidm has released 1.9.4 and 1.10.2 that resolves a CRITICAL security issue. This issue allows any authenticated user to elevate privileges to idm_admin/admin. Details: https://github.com/kanidm/kanidm/security/advisories/GHSA-xxwr-vvr3-2g9f

On Thursday 14th of May, at 07:00 UTC (17:00 AEST, 9:00 CEST) #Kanidm will be releasing a security update containing a CRITICAL security fix. All users should be ready to upgrade!

@viq interesting... #KaniDM is new for me. I was thinking to deploy #authelia in my #Selfhosting environment. I'll read more about it. Thanks

@homelab

Out of the #IdM / #SSO solutions I can #SelfHost that I remembered about, apparently only #KaniDM has ability to create app passwords / bearer tokens that actually allow to access only a single application 🤔

#Linux #SysAdmin #Privacy #Security #SelfHosting #homelab
@homelab

Be me.
Make a typo `pcke` instead of `pkce` in your NixOS config for headscale.
Config does not get spellchecked, just converted to yml.
Kandidm does not reciece pkce challenge.
Fight for hours over 4 weeks to finally decide to open the generated yml.

GG.

#NixOS #HeadScale #KanIDM

I proposed something for #kanidm which a reviewer described as "what if CSRF tokens but they hurt to touch"

ClaimMaps in Kanidm on NixOS fixed.
Now paperless-ngx and wiki-js can read user groups/roles over OIDC.

The trick wad to `_` instead of `-` in thr naming scheme.

#KanIDM #NixOS #OIDC #OpenIdConnect

commands for kanidm + bookstack

kanidm create group bookstack_admin

kanidm system oauth2 create-claim-map bookstack bookstack_roles bookstack_admin admin

kanidm system oauth2 update-scope-map bookstack bookstack_users email groups openid profile bookstack_roles

kanidm group add-members bookstack_admin stelb

Environment for bookstack:
OIDC_USER_TO_GROUPS=true
OIDC_GROUPS_CLAIM=bookstack_roles
OIDC_REMOVE_FROM_GROUPS=true

#iam #idm #oauth2 #roles #claim-map #kanidm

I did this for bookstack with kanidm
Given the oauth2 app is 'bookstack':
map claims (roles in bookstack, say admin)
to scopes and groups in IAM, e.g. bookstack_roles and bookstack_admin

add the scope to the oauth2 application

assign users to these groups as needed.

configure app which scope to use for roles

#iam #idm #oauth2 #roles #claim-map #kanidm

Ok, first time I tried to use a custom scope to map oauth2 users to application specific roles.
Followed some sample and I just replaced names.
Working with one role.. adding another. Both roles not working anymore.
Reading more theory about scopes and claims did help to understand (oh well 🙈)
It's actually not that complicated 🤓
Both roles working now. Writing up some docs and adding another 2 roles is planned for tomorrow.
#oauth2 #idm #kanidm

Ah, you got to love that sometimes SSO callback URIs have a trailing slash and sometimes they don't. And no, i did absolutely not search for the error 45 minutes straight.

By the way, did anybody set up claimMaps for kanidm in NixOS yet? I am too sleepy right now and i think i am reading it wrong.

https://search.nixos.org/options?channel=25.11&query=services.kanidm&show=services.kanidm.provision.systems.oauth2.<name>.claimMaps.<name>.valuesByGroup

#NixOS #KanIDM #PaperlessNGX

Kanidm PAM authorizations are so nice.
I cannot decide if i want to maintain users on my servers etc. via Nix as i used to or extend it by kanidm.

Rotating keys and granting/revoking authorizations is just so nice with kanidm.

I also found out that - with a client installed on my main machine - i can just login to the remote instance by `kanidm login` and use my yubikey locally and then do admin stuff without sshing to the server. Awesome.

#kanidm

About half a year ago I installed https://github.com/Tricked-dev/kanidm-oauth2-manager
Just to replace my shell script to setup oauth2 for my services with kanidm.
Now I pulled the image again and.. it's
"Kanidm Management Console" 😃
With UI added for users and groups too.
I do prefer automation so I do like full cli management. But sometimes a UI is nice too :)
#kanidm #idm #ui

Only on some rare occasions i log into Shithub, because some projects are either too big for codeberg (looking at you, NixOS) or too corporate? (kanidm).

I hope this will be the last time this year.

#QuitGithubNow #NixOS #KanIDM

Turned on SSO for vaultwarden.
I forgot, that the passkey for SSO was in vaultwarden only. Shot myself in the foot. Fixable, but I simply fogot that 😅
I have added hw keys too now ;)
#vaultwarden #sso #kanidm #fail

@Larvitz Thats great to hear! Thanks for sharing this with us. I have still to evaluate #Kanidm. It seems like a lightweight and fresh approach compared to freeIPA to me.

@firstyear thank youuuu :3

Yea I wanna look into #kanidm soon;
Currently have #Zitadel deployed.

Once I find time for that, ig :neocat_laptop:

@tanja Proud to see #kanidm so high here in the poll - it's certainly got its flaws but if you give it a go and have any issues, we'd be happy to help!