Kanidm: A simple, secure and fast identity management platform

Thank you for publishing this open source project! One question I have though - there are so many projects in this area popping up (eg. Ory‘s Kratos - https://github.com/ory/kratos) - isn’t there a way to collaborate on these larger projects instead of starting new ones? Or are there specific differences or reasons for rebuilding something like Kandim?

Re: Kanidm: A simple, secure and fast identity management platform

#5

Post by SahAssar » Sat, Oct 16, 2021, 11:27 AM UTC

JamesBenson wrote: post #4

Thank you for publishing this open source project! One question I have though - there are so many projects in this area popping up (eg. Ory‘s Kratos - https://github.com/ory/kratos ) - isn’t there a way to collaborate on these larger projects instead of starting new ones? Or are there specific differences or reasons for rebuilding something like Kandim?

Looks to me like the main difference (besides the language) is that this is planning to offer more in the way of OS and network level auth (SSH/PAM/RADIUS) while kratos focuses on app/website level auth. I'm not sure how hard it'd be to extend kratos with those sort of features.

Re: Kanidm: A simple, secure and fast identity management platform

#6

Post by RedShift1 » Sat, Oct 16, 2021, 11:31 AM UTC

Under features to avoid it says "Being like LDAP/GSSAPI/Kerberos", but aren't you just re-implementing these things?

Re: Kanidm: A simple, secure and fast identity management platform

#7

Post by mindwok » Sat, Oct 16, 2021, 12:07 PM UTC

unixhero wrote: post #3

Can this be used together with Keycloak in some fashion?

Seems like it's intending to replace key cloak, or at least some of it.

Re: Kanidm: A simple, secure and fast identity management platform

#8

Post by [deleted] » Sat, Oct 16, 2021, 12:12 PM UTC

JamesBenson wrote: post #4

Thank you for publishing this open source project! One question I have though - there are so many projects in this area popping up (eg. Ory‘s Kratos - https://github.com/ory/kratos ) - isn’t there a way to collaborate on these larger projects instead of starting new ones? Or are there specific differences or reasons for rebuilding something like Kandim?

[deleted]

Re: Kanidm: A simple, secure and fast identity management platform

#9

Post by mooreds » Sat, Oct 16, 2021, 12:24 PM UTC

Interesting that they are choosing to provide an integrated solution including user management and OAuth IdP ( https://github.com/kanidm/kanidm/pull/485 ) rather than plug into existing open source or even commercial offerings.

Here's a design doc about their OAuth choices: https://github.com/kanidm/kanidm/blob/master/designs/oauth.r...

It would seem simpler to go with the Ory approach of "best in breed" for, say network management tooling (most of which they already have implemented), and then integrate with Keycloak, Okta, FusionAuth, the Ory suite, etc for user management. Maybe they didn't want to do that because there are synergies with integrated user management? I dunno, seems like there are a lot of user management tools out there.

I also find it interesting that they explicitly disallow a goal of building a better LDAP server. I think there's a lot of room to run in that. My employer has had users show a fair bit of interest in a modern experience with LDAP layered on top ( https://github.com/FusionAuth/fusionauth-issues/issues/954 ) and I talked to someone at a conference that had built a whole business out of virtual LDAP: https://www.radiantlogic.com . They were working with companies with multiple LDAP based auth systems, and providing a way to have apps see one view of the user.

Maybe kanidm isn't that project, but it seems like a modern OSS LDAP implementation would be welcomed by the software community.

Disclosure: I work at FusionAuth.

Re: Kanidm: A simple, secure and fast identity management platform

#10

Post by _Anima_ » Sat, Oct 16, 2021, 12:26 PM UTC

Is it a replacement for freeipa? Key cloak?