Is it a replacement for freeipa? Key cloak?
Yes, it's a replacement for both - still in (a rapidly developing) Alpha stage currently.
So far LDAP and PAM/NSS modules are fully operational, and OAuth's being tested.
Kanidm: A simple, secure and fast identity management platform
41–50 of 56 posts
Re: Kanidm: A simple, secure and fast identity management platform
#42Earlier quoted context omitted.
Is it a widely held concept that Rust is less prone to bugs compared to Python? I've only heard it being compared to C, and only wrt. memory safety bugs.
Rust is statically typed and doesn't have null returns, so it's got advantages for correctness, but the big win with Rust vs. Python would be performance, not security.
There's a lot more checks and balances built into rust as a language, so the foot-gun opportunities are less likely - which makes it rather suitable for reliable systems programming.
And getting back to this particular case... kanidm is fast AND reliable. There's a lot of testing going on comparing it to 389 DS.
Re: Kanidm: A simple, secure and fast identity management platform
#43Earlier quoted context omitted.
Rust is statically typed and doesn't have null returns, so it's got advantages for correctness, but the big win with Rust vs. Python would be performance, not security.
There's a lot more checks and balances built into rust as a language, so the foot-gun opportunities are less likely - which makes it rather suitable for reliable systems programming. And getting back to this particular case... kanidm is fast AND reliable. There's a lot of testing going on comparing it to 389 DS.
Yes, I write a fair bit of Rust. I'm just saying: between Python and Rust, there isn't that much of a security difference (you could nitpick things like deserialization in Python, but really the significant security win of Rust is not having memory corruption flaws, which Python has never really had.)
Re: Kanidm: A simple, secure and fast identity management platform
#44Earlier quoted context omitted.
Authentication and Authorization are distinct concepts whose English terms both start with the same prefix.
The set of possible Authorization policies without having some form of Authentication is quite limited ;)
Within ABAC schemes, Authorization is a boolean function over (Request, Principle, Environment). If you zero the Principle, you can still represent a large number of unique policies considering just the Request and the Environment.
Re: Kanidm: A simple, secure and fast identity management platform
#45Making this a Solid Server or starting as a Solid IDP would be pretty valuable: https://solidproject.org/
OIDC support's been merged, which would likely help with that?
Re: Kanidm: A simple, secure and fast identity management platform
#46Re: Kanidm: A simple, secure and fast identity management platform
#47Trying to read the docs and look through the code, and it all seems very jumbled, like someone had ADHD and went around implementing a dozen different things that relate to identity and authZ. It would seem like the efforts might be best applied as independent components that combine with other open source solutions, to prevent reinventing the wheel, and create more independent composeable solutions that do one thing…
Seems like the code just grow organically without a super coherent structure. I'm sure there are folks with ADHD who might be able to get through it though.
There actually is a plan and set of designs that worked towards these parts. There was a lot of foundational work, and currently the goal is the integrations on top.
Re: Kanidm: A simple, secure and fast identity management platform
#48Thank you for publishing this open source project! One question I have though - there are so many projects in this area popping up (eg. Ory‘s Kratos - https://github.com/ory/kratos ) - isn’t there a way to collaborate on these larger projects instead of starting new ones? Or are there specific differences or reasons for rebuilding something like Kandim?
The main reason to do Kanidm is that it's "all in one". I've had a lot of experience with FreeIPA and have learnt that the microservice design is hard to test and hard to make reliable at scale. So a key goal was to be able to create a single bundle, that we can test end to end to ensure reliability.
Re: Kanidm: A simple, secure and fast identity management platform
#49Isn't the name also working in Turkish? https://translate.google.com/?sl=tr&tl=en&text=kan%C4%B1tlam... The kanıdım conjugation is basically like "I did [verb]".
It's Japanese - Kani == Crab. Crab-Identity-Management :)
Re: Kanidm: A simple, secure and fast identity management platform
#50Under features to avoid it says "Being like LDAP/GSSAPI/Kerberos", but aren't you just re-implementing these things?
It depends how you look at it - as a professional LDAP developer, I know the ins and outs pretty well, and the issue is that both LDAP and Kerberos "limit" our thoughts on a design. If we come at a problem and say "lets use LDAP, now lets solve the problem" we will be limited by LDAP's ability. But if we say "Here's our problem, how could we solve it?" we can take a completely different approach. So there are many parts inspired by the GOOD bits of LDAP and there are many parts that are completely different.