11–20 of 56 posts
Can this be used together with Keycloak in some fashion?
They are talking here: https://github.com/kanidm/kanidm/pull/485 about being an IdP with support for OIDC, so once that is implemented you could probably federate to Keycloak (or any other compliant IdP).
Might be worth filing an issue, I'm sure they'd love the feedback.
Is it a replacement for freeipa? Key cloak?
Under features to avoid it says "Being like LDAP/GSSAPI/Kerberos", but aren't you just re-implementing these things?
What I’d like to see is one of these modern offerings actually expose an LDAP facade (bonus points for translating app-specific passwords into binds and for flattening nested group membership) so that it’s easy to bridge existing software which expects LDAP into this newfangled web-centric world. Things like an email MTA/MDA, a PHP app that wants a user directory or even nss_ldap for unified UIDs/GIDs across machines.
Under features to avoid it says "Being like LDAP/GSSAPI/Kerberos", but aren't you just re-implementing these things?
Especially bundling these together as equally bad/legacy is weird. LDAP itself can actually be quite easy to understand and work with if you limit yourself to a useful subset of functionality, ie. a account/group directory. Any Kerberos compatibilty/design inspiration should IMO be avoided though, as it was designed to not use public key crypto, and that translates to a lot of its weirdness. What I’d like to see is o…
Interesting that they are choosing to provide an integrated solution including user management and OAuth IdP ( https://github.com/kanidm/kanidm/pull/485 ) rather than plug into existing open source or even commercial offerings. Here's a design doc about their OAuth choices: https://github.com/kanidm/kanidm/blob/master/designs/oauth.r... It would seem simpler to go with the Ory approach of "best in breed" for, say net…
I can understand their focus of being completely open and self-contained. At work we use Azure AD and I've been looking at an IDP to use personally. I actually do have access to a personal AAD instance. But I don't want to give commercial parties access or data about my stuff.
Existing open source offerings would be ok but then you have a codebase to consider that you don't manage and it could make the product heavier. The only thing I'd 'outsource' would be algorithm stuff in libraries like crypto.
I'm looking for something lightweight that is stand-alone and this looks really interesting. I'll definitely try it out.
Just wanted to point out that there is definitely a niche for it :)
Interesting that they are choosing to provide an integrated solution including user management and OAuth IdP ( https://github.com/kanidm/kanidm/pull/485 ) rather than plug into existing open source or even commercial offerings. Here's a design doc about their OAuth choices: https://github.com/kanidm/kanidm/blob/master/designs/oauth.r... It would seem simpler to go with the Ory approach of "best in breed" for, say net…
> Interesting that they are choosing to provide an integrated solution including user management and OAuth IdP ( https://github.com/kanidm/kanidm/pull/485 ) rather than plug into existing open source or even commercial offerings. I can understand their focus of being completely open and self-contained. At work we use Azure AD and I've been looking at an IDP to use personally. I actually do have access to a personal A…
Thanks for the info! I get that controlling the whole stack can make sense (great post about this here: https://www.joelonsoftware.com/2001/10/14/in-defense-of-not-... ) but just seems like yet another user management system might not be the best use of resources. But I'm not entirely in that world (of deploying ssh keys to servers, for example) so appreciate the perspective.
Can someone tell me why is this project, or 4 softwares, not more widely known?
“Kanidm is an identity management server, acting as an authority on accounts and authorisation within a technical environment.”
Shouldn’t that be authentication, or am I misunderstanding the purpose of Kanidm?
Nobody is mentioning a big open source project like Grouper, https://incommon.org/trusted-access/ Can someone tell me why is this project, or 4 softwares, not more widely known?
I've definitely heard of Shibboleth, it's one of the big players in OSS SAML implementations.
I like these types of projects (auth) and happy to see this is a thriving area. I was a little puzzled by the very first line in their gitbook [0] documentation: “Kanidm is an identity management server, acting as an authority on accounts and authorisation within a technical environment.” Shouldn’t that be authentication, or am I misunderstanding the purpose of Kanidm? [0] https://kanidm.github.io/kanidm/intro.html