Can this be used together with Keycloak in some fashion?
This is intended to provide oauth2 and oidc, which means you won't need keycloak.
Kanidm: A simple, secure and fast identity management platform
51–56 of 56 posts
Re: Kanidm: A simple, secure and fast identity management platform
#52Interesting that they are choosing to provide an integrated solution including user management and OAuth IdP ( https://github.com/kanidm/kanidm/pull/485 ) rather than plug into existing open source or even commercial offerings. Here's a design doc about their OAuth choices: https://github.com/kanidm/kanidm/blob/master/designs/oauth.r... It would seem simpler to go with the Ory approach of "best in breed" for, say net…
Disclosure: I work on 389-ds at SUSE, so I have a lot to say about LDAP, and why I don't want to re-implement a new LDAP server.
As mentioned, the main goal is "all in one" to avoid the FreeIPA style fragility from using lots of moving pieces. Making everything tight knit gives us a lot of ability to change and adapt to what we need, rather than being bound by what other projects want to do :)
Re: Kanidm: A simple, secure and fast identity management platform
#53I like these types of projects (auth) and happy to see this is a thriving area. I was a little puzzled by the very first line in their gitbook [0] documentation: “Kanidm is an identity management server, acting as an authority on accounts and authorisation within a technical environment.” Shouldn’t that be authentication, or am I misunderstanding the purpose of Kanidm? [0] https://kanidm.github.io/kanidm/intro.html
Just for you, I fixed up this line in the book to make it clearer. Issue reports about things like this is docs and clarity are always welcome!
Re: Kanidm: A simple, secure and fast identity management platform
#54Under features to avoid it says "Being like LDAP/GSSAPI/Kerberos", but aren't you just re-implementing these things?
Especially bundling these together as equally bad/legacy is weird. LDAP itself can actually be quite easy to understand and work with if you limit yourself to a useful subset of functionality, ie. a account/group directory. Any Kerberos compatibilty/design inspiration should IMO be avoided though, as it was designed to not use public key crypto, and that translates to a lot of its weirdness. What I’d like to see is o…
This is exactly what Kanidm does, and there is already some ideas around application password validation via the LDAP facade.
Re: Kanidm: A simple, secure and fast identity management platform
#55Re: Kanidm: A simple, secure and fast identity management platform
#56Thank you for publishing this open source project! One question I have though - there are so many projects in this area popping up (eg. Ory‘s Kratos - https://github.com/ory/kratos ) - isn’t there a way to collaborate on these larger projects instead of starting new ones? Or are there specific differences or reasons for rebuilding something like Kandim?
The main reason to do Kanidm is that it's "all in one". I've had a lot of experience with FreeIPA and have learnt that the microservice design is hard to test and hard to make reliable at scale. So a key goal was to be able to create a single bundle, that we can test end to end to ensure reliability.
> "all in one" ... create a single bundle
That's nice. (I too think it's simpler to get everything okay well tested, when it's all in one place, rather than different software, possibly from different vendors, that's supposed to integrate with each other to accomplish the same thing.)
Also nice that it's written in Rust. And that you've chosen the MPL 2.0 license.
And that Kanidm is an OIDC Identity Provider, I've been looking for that :- ) And WebAuthn
(Keycloak is nice, however it's Java and thus a bit resource intensive (RAM), and some other things.)