### Kanidm Server Configuration Example

Source: https://kanidm.github.io/kanidm/stable/server_configuration.html

This is a commented example of the `server.toml` configuration file. Ensure you set `domain`, `origin`, `tls_chain`, and `tls_key` for the server to start. The `bindaddress` and `ldapbindaddress` can be single addresses or arrays. The `db_path` specifies the database location. The `db_pagesize` option can be tuned for specific filesystems like ZFS.

```toml
# The server configuration file version.
version = "2"

#   The webserver bind address. Requires TLS certificates.
#   If the port is set to 443 you may require the
#   NET_BIND_SERVICE capability. This accepts a single address
#   or an array of addresses to listen on.
#   Defaults to "127.0.0.1:8443"
bindaddress = "0.0.0.0:8443"
#
#   The read-only ldap server bind address. Requires
#   TLS certificates. If set to 636 you may require the
#   NET_BIND_SERVICE capability. This accepts a single address
#   or an array of addresses to listen on.
#   Defaults to "" (disabled)
# ldapbindaddress = "0.0.0.0:3636"
#
#   The path to the kanidm database.
db_path = "/data/kanidm.db"
#
#   If you have a known filesystem, kanidm can tune the
#   database page size to match. Valid choices are:
#   [zfs, other]
#   If you are unsure about this leave it as the default
#   (other). After changing this
#   value you must run a vacuum task.
#   - zfs:
#     * sets database pagesize to 64k. You must set
#       recordsize=64k on the zfs filesystem.
#   - other:

```

--------------------------------

### Enable and Start Kanidm Daemon

Source: https://kanidm.github.io/kanidm/stable/integrations/pam_and_nsswitch.html

Enable the kanidm-unixd service to start on boot and start it immediately. Check its status afterwards.

```bash
systemctl enable --now kanidm-unixd
kanidm-unix status
```

--------------------------------

### Build and Run Kanidm Client Tools

Source: https://kanidm.github.io/kanidm/stable/developers/index.html

In a new terminal, build and run the Kanidm client tools. Examples include getting help, logging in anonymously, checking self-identity, and logging in as an admin.

```bash
cargo run --bin kanidm -- --help
```

```bash
cargo run --bin kanidm -- login -H https://localhost:8443 -D anonymous -C /tmp/kanidm/ca.pem
```

```bash
cargo run --bin kanidm -- self whoami -H https://localhost:8443 -D anonymous -C /tmp/kanidm/ca.pem
```

```bash
cargo run --bin kanidm -- login -H https://localhost:8443 -D admin -C /tmp/kanidm/ca.pem
```

```bash
cargo run --bin kanidm -- self whoami -H https://localhost:8443 -D admin -C /tmp/kanidm/ca.pem
```

--------------------------------

### Install and Login with opkssh

Source: https://kanidm.github.io/kanidm/stable/print.html

Install the opkssh client and log in to Kanidm using the provided provider URL.

```bash
sudo opkssh add user alice@example.com https://idm.example.com/oauth2/openid/opkssh
```

```bash
opkssh login --provider=https://idm.example.com/oauth2/openid/opkssh,opkssh
```

```bash
ssh user@your-server-hostname
```

--------------------------------

### Start Kanidm Server Container

Source: https://kanidm.github.io/kanidm/stable/evaluation_quickstart.html

Starts the previously created Kanidm Docker container. Ensure all previous setup steps are completed before running this.

```bash
docker start kanidmd
```

--------------------------------

### Install Kanidm Client with Homebrew

Source: https://kanidm.github.io/kanidm/stable/installing_client_tools.html

Tap the Kanidm Homebrew repository and install the Kanidm CLI client tools from source.

```shell
brew tap kanidm/kanidm
brew install kanidm
```

--------------------------------

### Example PAM Configuration for SUSE

Source: https://kanidm.github.io/kanidm/stable/integrations/pam_and_nsswitch/suse.html

This example shows the content for the common PAM configuration files when integrating with Kanidm. Ensure that pam_mkhomedir or pam_oddjobd are not present.

```pam
# /etc/pam.d/common-account
# Controls authorisation to this system (who may login)
account    sufficient    pam_kanidm.so ignore_unknown_user
account    required      pam_deny.so

# /etc/pam.d/common-auth
# Controls authentication to this system (verification of credentials)
auth        required      pam_env.so
auth        sufficient    pam_kanidm.so ignore_unknown_user
auth        required      pam_deny.so

# /etc/pam.d/common-password
# Controls flow of what happens when a user invokes the passwd command. Currently does NOT
# push password changes back to kanidm
password    required    pam_unix.so nullok shadow try_first_pass

# /etc/pam.d/common-session
# Controls setup of the user session once a successful authentication and authorisation has
# occurred.
session optional    pam_systemd.so
session required    pam_limits.so
session optional    pam_umask.so
session optional    pam_kanidm.so
session optional    pam_env.so
```

--------------------------------

### Install Ubuntu Dependencies

Source: https://kanidm.github.io/kanidm/stable/developers/index.html

Installs necessary system libraries for building Kanidm on Ubuntu. Requires sudo privileges.

```bash
sudo apt-get install libudev-dev libssl-dev libsystemd-dev pkg-config libpam0g-dev clang lld
```

--------------------------------

### Install Kanidm Client on FreeBSD

Source: https://kanidm.github.io/kanidm/stable/installing_client_tools.html

Install the kanidm-client package on FreeBSD using the pkg command.

```shell
pkg install kanidm-client
```

--------------------------------

### Add Fedora/CentOS Repository and Install

Source: https://kanidm.github.io/kanidm/stable/installing_client_tools.html

Download repository metadata for Fedora or CentOS Stream and then install the kanidm-clients package using dnf.

```shell
# Fedora
wget https://download.opensuse.org/repositories/network:/idm/Fedora_$(rpm -E %fedora)/network:idm.repo
# Centos Stream
wget https://download.opensuse.org/repositories/network:/idm/CentOS_$(rpm -E %rhel)_Stream/network:idm.repo
```

```shell
dnf install kanidm-clients
```

--------------------------------

### Kanidm Server Configuration Example

Source: https://kanidm.github.io/kanidm/stable/print.html

A commented example of the server.toml configuration file for Kanidm. Ensure 'domain', 'origin', 'tls_chain', and 'tls_key' are set.

```toml
# The server configuration file version.
version = "2"

#   The webserver bind address. Requires TLS certificates.
#   If the port is set to 443 you may require the
#   NET_BIND_SERVICE capability. This accepts a single address
#   or an array of addresses to listen on.
#   Defaults to "127.0.0.1:8443"
bindaddress = "0.0.0.0:8443"
#
#   The read-only ldap server bind address. Requires
#   TLS certificates. If set to 636 you may require the
#   NET_BIND_SERVICE capability. This accepts a single address
#   or an array of addresses to listen on.
#   Defaults to "" (disabled)
# ldapbindaddress = "0.0.0.0:3636"
#
#   The path to the kanidm database.
db_path = "/data/kanidm.db"
#
#   If you have a known filesystem, kanidm can tune the
#   database page size to match. Valid choices are:
#   [zfs, other]
#   If you are unsure about this leave it as the default
#   (other). After changing this
#   value you must run a vacuum task.
#   - zfs:
#     * sets database pagesize to 64k. You must set
#       recordsize=64k on the zfs filesystem.
#   - other:
#     * sets database pagesize to 4k, matching most
#       filesystems block sizes.
# db_fs_type = "zfs"
#
#   The number of entries to store in the in-memory cache.
#   Minimum value is 256. If unset
#   an automatic heuristic is used to scale this.
#   You should only adjust this value if you experience
#   memory pressure on your system.
# db_arc_size = 2048
#
#   TLS chain and key in pem format. Both must be present.
#   If the server receives a SIGHUP, these files will be
#   re-read and reloaded if their content is valid.
tls_chain = "/data/chain.pem"
tls_key = "/data/key.pem"

#   The path where entry migrations will be read from.
#   This path should contain files that match the pattern
#   xx-name.json where xx are two number. For example:
#     00-base.json
#     10-groups.json
#   Migrations are applied in order. Migrations that fail
#   to apply, or have invalid syntax are skipped without
#   preventing server start up or reload.
# migration_path = "/data/migrations.d"

#
#   The log level of the server. May be one of info, debug, trace
#
#   NOTE: this can be overridden by the environment variable
#   `KANIDM_LOG_LEVEL` at runtime
#   Defaults to "info"
# log_level = "info"
#
#   The DNS domain name of the server. This is used in a
#   number of security-critical contexts
#   such as webauthn, so it *must* match your DNS
#   hostname. It is used to create
#   security principal names such as `william@idm.example.com`
#   so that in a (future) trust configuration it is possible
#   to have unique Security Principal Names (spns) throughout
#   the topology.
#
#   ⚠️  WARNING ⚠️
#
#   Changing this value WILL break many types of registered
#   credentials for accounts including but not limited to
#   webauthn, oauth tokens, and more.
#   If you change this value you *must* run
#   `kanidmd domain rename` immediately after.
domain = "idm.example.com"
#
#   The origin for webauthn. This is the url to the server,
#   with the port included if it is non-standard (any port

```

--------------------------------

### Start Kanidm Instance

Source: https://kanidm.github.io/kanidm/stable/domain_rename.html

After the domain rename process is complete, start the Kanidm instance again. Replace `<container name>` with your actual container name.

```bash
docker start <container name>
```

--------------------------------

### Install Kanidm Clients on OpenSUSE

Source: https://kanidm.github.io/kanidm/stable/installing_client_tools.html

Use zypper to refresh repositories and install the kanidm-clients package on OpenSUSE systems.

```shell
zypper ref
zypper in kanidm-clients
```

--------------------------------

### Kanidm Client Configuration Example

Source: https://kanidm.github.io/kanidm/stable/print.html

Example configuration for the Kanidm client, specifying the server URI and CA certificate path.

```ini
uri = "https://idm.example.com"
ca_path = "/path/to/ca.pem"
```

--------------------------------

### Start Kanidm Development Server

Source: https://kanidm.github.io/kanidm/stable/developers/index.html

Navigate to the server daemon directory and run the insecure development server script. This command starts the server with a database located at /tmp/kanidm/kanidm.db.

```bash
cd server/daemon
./run_insecure_dev_server.sh
```

--------------------------------

### Kanidm Sync Tool Configuration Example

Source: https://kanidm.github.io/kanidm/stable/print.html

An example configuration file for the Kanidm sync tool, demonstrating settings for sync token, schedule, status listener, LDAP connection details, filters, and attribute mappings.

```ini
# The sync account token as generated by "system sync generate-token".
sync_token = "eyJhb..."

# A cron-like expression of when to run when in scheduled mode. The format is:
#   sec  min   hour   day of month   month   day of week   year
#
# The default of this value is "0 */5 * * * * *" which means "run every 5 minutes".
# schedule = ""

# If you want to monitor the status of the scheduled sync tool (you should)
# then you can set a bind address here.
# Example: If set to e.g. "[::1]:12345", status can be retrieved with netcat "nc ::1 12345".
# Returns "Ok" or "Err".
#
# If not set, defaults to no status listener.
# status_bind = ""

# The LDAP URI to the server. This MUST be LDAPS. You should connect to a unique single
# server in the LDAP topology rather than via a load balancer or dns srv records. This
# is to prevent replication conflicts and issues due to how 389-ds and openldap sync works.
ldap_uri = "ldaps://specific-server.ldap.kanidm.com"
# Path to the LDAP CA certificate in PEM format.
ldap_ca = "/path/to/kanidm-ldap-ca.pem"

# In some cases you may need to disable TLS certificate validation. This is not secure
# and you should always opt to have certificate validation if possible.
# ldap_verify_ca = true

# The DN of an account with content sync rights. On 389-ds, by default cn=Directory Manager has
# this access. On OpenLDAP you must grant this access.
ldap_sync_dn = "cn=Directory Manager"
ldap_sync_pw = "directory manager password"

# The basedn to search
ldap_sync_base_dn = "dc=ldap,dc=dev,dc=kanidm,dc=com"
# Filter the entries that are synchronised with this filter
# NOTE: attribute-value-assertions with spaces require quoting!
ldap_filter = "(|" (objectclass=person)(objectclass=posixgroup))"
# ldap_filter = "(cn=\"my value\")"

# By default Kanidm separates the primary account password and credentials from
# the unix credential. This allows the unix password to be isolated from the
# account password so that compromise of one doesn't compromise the other. However
# this can be surprising for new users during a migration. This boolean allows the
# user password to be set as the unix password during the migration for consistency
# and then after the migration they are "unlinked".
#
# sync_password_as_unix_password = false

# The objectclass used to identify persons to import to Kanidm.
#
# If not set, defaults to "person"
# person_objectclass = ""

# Attribute mappings. These allow you to bind values from your directory server
# to the values that Kanidm will import.
#
# person_attr_user_name = "uid"
# person_attr_display_name = "cn"
# person_attr_gidnumber = "uidnumber"
# person_attr_login_shell = "loginshell"
# person_attr_password = "userpassword"

# If the password value requires a prefix for Kanidm to import it, this can be optionally
# provided here.
#
# person_password_prefix = ""

# The objectclass used to identify groups to import to Kanidm.
#
# If not set, defaults to "groupofnames"

```

--------------------------------

### Install Kanidm Client Packages

Source: https://kanidm.github.io/kanidm/stable/integrations/pam_and_nsswitch.html

Install the Kanidm client daemon packages using your system's package manager. These packages provide the necessary components for PAM and nsswitch integration.

```bash
# OpenSUSE
zypper in kanidm-unixd-clients
# Fedora
dnf install kanidm-unixd-clients
# FreeBSD
pkg install kanidm-client
```

--------------------------------

### FreeBSD PAM Configuration Example

Source: https://kanidm.github.io/kanidm/stable/print.html

Example PAM configuration for FreeBSD, including common modules for authentication, account, session, and password management. Note that password changes via pam_kanidm.so are not yet supported.

```pam
# /etc/pam.d/common
# auth
auth            required        /usr/local/lib/libpam_kanidm.so try_first_pass

# account
account         required        pam_login_access.so
account         required        /usr/local/lib/libpam_kanidm.so

# session
session         required        /usr/local/lib/libpam_kanidm.so

# password
password        required        pam_unix.so             no_warn try_first_pass
# Password changes via pam_kanidm.so are not yet supported.
# password        required        /usr/local/lib/libpam_kanidm.so             no_warn try_first_pass
```

```pam
# /etc/pam.d/system

# auth
auth            include         common

# account
account         include         common

# session
session         required        pam_lastlog.so          no_fail
session         required        pam_xdg.so
session         include         common

# password
password          include         common
```

```pam
# /etc/pam.d/sshd

# auth
auth            include         common

# account
account         required        pam_nologin.so
account         include         common

# session
session         include         common

# password
password          include         common
```

```pam
# /etc/pam.d/atrun

# Note well: enabling pam_nologin for atrun will currently result
# in jobs discarded, not just delayed, during a no-login period.

# account         required        pam_nologin.so
account         include         common
```

```pam
# /etc/pam.d/cron

account         required        pam_nologin.so
account         include         common
```

--------------------------------

### Install Kanidm Clients with DNF

Source: https://kanidm.github.io/kanidm/stable/print.html

Install the Kanidm client packages on Fedora or CentOS systems after adding the appropriate repository.

```bash
dnf install kanidm-clients
```

--------------------------------

### Install Kanidm Clients on Alpine Linux

Source: https://kanidm.github.io/kanidm/stable/installing_client_tools.html

Install the kanidm-clients package from the Alpine Linux testing repository using apk.

```shell
apk add kanidm-clients
```

--------------------------------

### Configure Load Balancer for WebFinger Redirect

Source: https://kanidm.github.io/kanidm/stable/integrations/oauth2.html

Example Caddy configuration to redirect /.well-known/webfinger requests to the appropriate Kanidm WebFinger endpoint, preserving query parameters. This example supports only one client.

```caddy
example.com {
  redir /.well-known/webfinger https://idm.example.com/oauth2/openid/:client_id:{uri} 307
}
```

--------------------------------

### Kanidm Server Configuration Example

Source: https://kanidm.github.io/kanidm/stable/print.html

Example `server.toml` configuration file for Kanidm. Key parameters like `domain` and `origin` must be reviewed and adjusted to match your environment. The `bindaddress` specifies the network interface and port for the webserver.

```toml
# The server configuration file version.
version = "2"

#   The webserver bind address. Requires TLS certificates.
#   If the port is set to 443 you may require the
#   NET_BIND_SERVICE capability. This accepts a single address
#   or an array of addresses to listen on.
#   Defaults to "127.0.0.1:8443"
bindaddress = "0.0.0.0:8443"
#
#   The read-only ldap server bind address. Requires
#   TLS certificates. If set to 636 you may require the
#   NET_BIND_SERVICE capability. This accepts a single address
#   or an array of addresses to listen on.
#   Defaults to "" (disabled)
# ldapbindaddress = "0.0.0.0:3636"
#
#   The path to the kanidm database.
db_path = "/data/kanidm.db"
#
#   If you have a known filesystem, kanidm can tune the
#   database page size to match. Valid choices are:
#   [zfs, other]
#   If you are unsure about this leave it as the default
#   (other). After changing this
#   value you must run a vacuum task.
#   - zfs:
#     * sets database pagesize to 64k. You must set
#       recordsize=64k on the zfs filesystem.
#   - other:
#     * sets database pagesize to 4k, matching most
#       filesystems block sizes.
# db_fs_type = "zfs"
#
#   The number of entries to store in the in-memory cache.
#   Minimum value is 256. If unset
#   an automatic heuristic is used to scale this.
#   You should only adjust this value if you experience
#   memory pressure on your system.

```

--------------------------------

### Kanidm NSSwitch Configuration Example

Source: https://kanidm.github.io/kanidm/stable/integrations/pam_and_nsswitch/fedora.html

This is an example of a custom nsswitch.conf file for the Kanidm authselect profile. Modify the 'passwd', 'group', and 'shadow' lines according to your specific needs.

```config
passwd: kanidm compat systemd
group:  kanidm compat systemd
shadow:     files
hosts:      files dns myhostname
services:   files
netgroup:   files

alias:    files
ether:     files
gshadow:    files
networks:   files dns
protocols:  files
publickey:  files
rpc:        files
```

--------------------------------

### Install Kanidm Build Dependencies on openSUSE

Source: https://kanidm.github.io/kanidm/stable/developers

Install necessary system libraries and tools for building Kanidm on openSUSE. This includes Rust toolchain, development libraries for udev, SQLite, OpenSSL, SELinux, PAM, systemd, TPM2, and build accelerators like clang, lld, and sccache.

```bash
zypper in rustup git libudev-devel sqlite3-devel libopenssl-3-devel libselinux-devel \
    pam-devel systemd-devel tpm2-0-tss-devel clang lld make sccache
```

--------------------------------

### Install Kanidm Build Dependencies on openSUSE

Source: https://kanidm.github.io/kanidm/stable/developers/index.html

Install necessary build tools and libraries for Kanidm on openSUSE using zypper. This includes Rust toolchain, development libraries, and compilers.

```bash
__
zypper in rustup git libudev-devel sqlite3-devel libopenssl-3-devel libselinux-devel \
    pam-devel systemd-devel tpm2-0-tss-devel clang lld make sccache

```

--------------------------------

### Install Kanidm Build Dependencies on Fedora/RHEL

Source: https://kanidm.github.io/kanidm/stable/developers/index.html

Install required system libraries for building Kanidm on Fedora or RHEL-based systems. This includes development headers for systemd, SQLite, OpenSSL, and PAM.

```bash
__
systemd-devel sqlite-devel openssl-devel pam-devel clang lld

```

--------------------------------

### Basic Replication Configuration

Source: https://kanidm.github.io/kanidm/stable/developers/designs/replication_coordinator.html

Example of a basic replication configuration for a server.

```toml
[replication]
origin = "repl://kanidmd_b:8444"
bindaddress = "[::]:8444"
```

--------------------------------

### Install Kanidm Build Dependencies on Fedora/CentOS/RHEL

Source: https://kanidm.github.io/kanidm/stable/developers

Install required system libraries for building Kanidm, including Rust toolchain, development libraries for systemd, SQLite, OpenSSL, PAM, and compilers clang and lld. Building the Web UI requires additional Perl modules.

```bash
systemd-devel sqlite-devel openssl-devel pam-devel clang lld
```

```bash
perl-FindBin perl-File-Compare
```

--------------------------------

### Entry Change State Example

Source: https://kanidm.github.io/kanidm/stable/print.html

Shows the change state of a live entry, including creation time and attribute update times.

```plaintext
__
Live {
  at: { server_uuid: A, cid: 1 },
  attrs: {
    attr_a: cid = 1
    attr_b: cid = 1
    attr_c: cid = 2
  }
}

```

--------------------------------

### Object Level Resolution Example

Source: https://kanidm.github.io/kanidm/stable/print.html

Demonstrates how an entry resolves using the 'last write wins' strategy in object level resolution.

```text
# OL Resolution
attr_b: 1
attr_c: 2
attr_d: 3

```

--------------------------------

### Kanidm Replication Configuration - Server A

Source: https://kanidm.github.io/kanidm/stable/developers/designs/replication_coordinator.html

Example of configuring replication origin and bind address for a Kanidm server node.

```ini
[replication]
origin = "repl://kanidmd_a:8444"
bindaddress = "[::]:8444"
```

--------------------------------

### Install Kanidm Tools with Cargo

Source: https://kanidm.github.io/kanidm/stable/installing_client_tools.html

Install the kanidm_tools using Cargo, assuming a Rust toolchain is available. This installs the tools into your home directory. Ensure additional development libraries are installed as specified in the Developer Guide.

```shell
cargo install kanidm_tools --locked
```

--------------------------------

### Serve Live Docs with Make

Source: https://kanidm.github.io/kanidm/stable/developers/python_module.html

Run this command to start a local live server for viewing the pykanidm documentation. The server will be accessible at http://localhost:8000.

```bash
make docs/pykanidm/serve
```

--------------------------------

### Serve Kanidm Book Locally

Source: https://kanidm.github.io/kanidm/stable/developers/index.html

Starts a local web server to preview the Kanidm documentation book. Navigate to http://localhost:3000 (or similar) in your browser.

```bash
cd book
mdbook serve
```

--------------------------------

### Node A Example Data

Source: https://kanidm.github.io/kanidm/stable/print.html

Example data structure for Node A before potential conflict resolution.

```text
# Node A
attr_a: 1
attr_b: 2
attr_c: 3

```

--------------------------------

### Install Release Tools

Source: https://kanidm.github.io/kanidm/stable/developers/release_checklist.html

Installs essential Cargo tools for release management, including audit, outdated dependency checks, and unused dependency analysis. Use --force to ensure the latest versions are installed.

```bash
cargo install  --force \
      cargo-audit \
      cargo-outdated \
      cargo-udeps \
      cargo-machete
```

--------------------------------

### Create a Service Account for Synchronization

Source: https://kanidm.github.io/kanidm/stable/sync/ldap.html

Create a service account that will be used for content synchronization. Replace `dc=ldap,dc=dev,dc=kanidm,dc=com` with your actual base DN.

```bash
dsidm -b dc=ldap,dc=dev,dc=kanidm,dc=com localhost service create --cn kanidm-sync --description sync
```

--------------------------------

### Install fido-mds-tool

Source: https://kanidm.github.io/kanidm/stable/accounts/account_policy.html

Install the fido-mds-tool using cargo. This tool is used to manage WebAuthn authenticator allowlists.

```bash
cargo install fido-mds-tool
```

--------------------------------

### Node B Example Data

Source: https://kanidm.github.io/kanidm/stable/print.html

Example data structure for Node B before potential conflict resolution.

```text
# Node B
attr_b: 1
attr_c: 2
attr_d: 3

```

--------------------------------

### Install Web UI Build Dependencies

Source: https://kanidm.github.io/kanidm/stable/print.html

Installs Perl modules required for building the Kanidm Web UI.

```shell
perl-FindBin perl-File-Compare
```

--------------------------------

### Run Kanidm Client Tools

Source: https://kanidm.github.io/kanidm/stable/print.html

Builds and runs the Kanidm client tools, demonstrating help, anonymous login, and self-querying, followed by admin login and self-querying.

```bash
cargo run --bin kanidm -- --help
cargo run --bin kanidm -- login -H https://localhost:8443 -D anonymous -C /tmp/kanidm/ca.pem
cargo run --bin kanidm -- self whoami -H https://localhost:8443 -D anonymous -C /tmp/kanidm/ca.pem

cargo run --bin kanidm -- login -H https://localhost:8443 -D admin -C /tmp/kanidm/ca.pem
cargo run --bin kanidm -- self whoami -H https://localhost:8443 -D admin -C /tmp/kanidm/ca.pem
```

--------------------------------

### Install mdbook and Extensions

Source: https://kanidm.github.io/kanidm/stable/developers/index.html

Installs mdbook and the mdbook-mermaid extension using cargo. These are required to build the project's documentation.

```bash
cargo install mdbook mdbook-mermaid
```

--------------------------------

### Selecting Kanidm Instance and Logging In

Source: https://kanidm.github.io/kanidm/stable/print.html

Set the KANIDM_INSTANCE environment variable to select a specific Kanidm instance and then log in. This allows managing multiple Kanidm environments.

```bash
export KANIDM_INSTANCE=development
kanidm login -D username@idm.dev.example.com
```

--------------------------------

### Install Kanidm Build Dependencies on Fedora/RHEL

Source: https://kanidm.github.io/kanidm/stable/print.html

Installs Rust and system libraries required for building Kanidm on Fedora or RHEL-based systems.

```shell
systemd-devel sqlite-devel openssl-devel pam-devel clang lld
```

--------------------------------

### Build Static Docs with Make

Source: https://kanidm.github.io/kanidm/stable/developers/python_module.html

Use this command to build a static copy of the documentation for the pykanidm module.

```bash
make docs/pykanidm/build
```

--------------------------------

### Basic Kanidm Server Configuration

Source: https://kanidm.github.io/kanidm/stable/print.html

Sets TLS certificate paths, server domain, and WebAuthn origin. Ensure domain and origin are consistent to prevent startup failures.

```toml
tls_chain = "/data/chain.pem"
tls_key = "/data/key.pem"

domain = "idm.example.com"
origin = "https://idm.example.com"
```

--------------------------------

### Install uv package manager

Source: https://kanidm.github.io/kanidm/stable/print.html

Installs the uv package manager, which is used for managing Python packages and virtual environments within the Kanidm project.

```bash
python -m pip install uv
```

--------------------------------

### Set Account Validity Start Time

Source: https://kanidm.github.io/kanidm/stable/accounts/people_accounts.html

Define the earliest time a person account can start authenticating. The datetime must be in ISO8601 format with a timezone offset.

```bash
kanidm person validity begin-from demo_user '2020-09-25T11:22:04+00:00' --name idm_admin
```

--------------------------------

### Switch Kanidm Instance and Log In

Source: https://kanidm.github.io/kanidm/stable/client_tools.html

Select a specific Kanidm instance using an environment variable and then log in. This is useful when managing multiple Kanidm deployments.

```bash
export KANIDM_INSTANCE=development
kanidm login -D username@idm.dev.example.com

```

--------------------------------

### Install Debian Build Dependencies

Source: https://kanidm.github.io/kanidm/stable/packaging/debian_ubuntu_packaging.html

Installs necessary build dependencies within the Docker container for creating Debian packages. This script should be run inside the container.

```bash
platform/debian/kanidm_ppa_automation/scripts/install_ci_build_dependencies.sh
```

--------------------------------

### Create, Add Members, and List Group Members

Source: https://kanidm.github.io/kanidm/stable/accounts/groups.html

Use these commands to create a new group, add users as members, and then list all members of that group. Requires 'idm_admin' privileges.

```bash
kanidm group create demo_group --name idm_admin
```

```bash
kanidm group add-members demo_group demo_user --name idm_admin
```

```bash
kanidm group list-members demo_group --name idm_admin
```

--------------------------------

### Install OpenSSL Dependency with vcpkg

Source: https://kanidm.github.io/kanidm/stable/developers/index.html

Installs the OpenSSL library for Windows using vcpkg. This command compiles OpenSSL from source and may download additional dependencies.

```bash
vcpkg install openssl:x64-windows-static-md
```

--------------------------------

### FreeIPA Sync Tool Configuration Example

Source: https://kanidm.github.io/kanidm/stable/print.html

Configuration settings for the FreeIPA sync tool, including the sync token and scheduling. The schedule uses a cron-like expression.

```toml
# The sync account token as generated by "system sync generate-token".
sync_token = "eyJhb..."

# A cron-like expression of when to run when in scheduled mode. The format is:
#   sec  min   hour   day of month   month   day of week   year
#
# The default of this value is "0 */5 * * * * *" which means "run every 5 minutes".
# schedule = ""

# If you want to monitor the status of the scheduled sync tool (you should)
# then you can set a bind address here.
#

```

--------------------------------

### Configure Docker Volume and Permissions for Kanidm

Source: https://kanidm.github.io/kanidm/stable/print.html

These commands demonstrate how to set up a Docker volume for Kanidm data, create a database directory, set ownership and permissions, and configure the server.toml file to use the new database path. This is crucial for allowing the Kanidm process to manage its files within the container.

```shell
docker run --rm -i -t -v kanidmd:/data opensuse/leap:latest /bin/sh
mkdir /data/db/
chown 1000:1000 /data/db/
chmod 750 /data/db/
sed -i -e "s/db_path.*/db_path = \"\/data\/db\/kanidm.db\"/g" /server.toml
chown root:root /server.toml
chmod 644 /server.toml
```

--------------------------------

### Value Level Resolution Example

Source: https://kanidm.github.io/kanidm/stable/developers/designs/replication_design_and_notes.html

Presents value-level resolution, the most complex strategy, which allows merging of individual values within attributes. This example shows how values from both nodes are combined.

```yaml
# VL Resolution
attr_a: 1
attr_b: 1, 2
attr_c: 2, 3
attr_d: 3
```

--------------------------------

### Build Kanidm Container with Make

Source: https://kanidm.github.io/kanidm/stable/developers/index.html

Use the 'make' command to build a container with the current branch. Check 'make help' for a list of valid targets. Environment variables like IMAGE_BASE, IMAGE_VERSION, and IMAGE_ARCH can control the build process.

```bash
make <TARGET>
```

--------------------------------

### Build Kanidm Book

Source: https://kanidm.github.io/kanidm/stable/developers/index.html

Builds the Kanidm documentation book using the Makefile. This command generates the static site for the book.

```bash
make book
```

--------------------------------

### Attribute Level Resolution Example

Source: https://kanidm.github.io/kanidm/stable/developers/designs/replication_design_and_notes.html

Demonstrates attribute-level resolution where the most recently updated attribute wins. This example shows a merged entry based on individual attribute update times.

```yaml
# AL Resolution
attr_a: 1  <-
attr_b: 1  <-
attr_c: 3  <-
attr_d: 3  <-
```

--------------------------------

### Enable Retro Changelog and Content Sync Plugins

Source: https://kanidm.github.io/kanidm/stable/sync/ldap.html

Enable both the content sync and retro-changelog plugins for your 389 Directory Server instance. Replace `<instance name>` with your actual instance name.

```bash
dsconf <instance name> plugin retro-changelog enable
dsconf <instance name> plugin contentsync enable
```

--------------------------------

### Install Web UI Build Dependencies

Source: https://kanidm.github.io/kanidm/stable/developers/index.html

Install Perl modules required for building the Kanidm Web UI. These are typically used for file comparison and path finding during the build process.

```bash
__
perl-FindBin perl-File-Compare

```

--------------------------------

### Verify Client Configuration File Permissions

Source: https://kanidm.github.io/kanidm/stable/print.html

This command shows the permissions for a client configuration file. It should be readable by everyone.

```shell
[william@amethyst 12:26] /etc/kanidm > ls -al config
-r--r--r--    1 root  root    38 10 Jul 10:10 config
```

--------------------------------

### Kanidm Raw API - Create Entries

Source: https://kanidm.github.io/kanidm/stable/developers

Use the low-level stateful API to create new entries in Kanidm. Requires a running server and appropriate credentials.

```bash
kanidm raw create -H https://localhost:8443 -C ../insecure/ca.pem -D admin example.create.account.json
```

```bash
kanidm raw create  -H https://localhost:8443 -C ../insecure/ca.pem -D idm_admin example.create.group.json
```

--------------------------------

### Extended Search Access Profile Example

Source: https://kanidm.github.io/kanidm/stable/developers/designs/access_profiles_original.html

An extended example of search access profiles that includes specific conditions for individual users, demonstrating how to grant attribute access to a particular user ('william').

```kanidm
__
search {
    action: allow
    targetscope: Eq("class", "group")
    targetattr: name
    targetattr: description
}

search {
    action: allow
    targetscope: Eq("class", "user")
    targetattr: name
}

search {
    action: allow
    targetscope: And(Eq("class", "user"), Eq("name", "william"))
    targetattr: description
}


```

--------------------------------

### Run New Kanidm Docker Instance

Source: https://kanidm.github.io/kanidm/stable/server_updates.html

Start a new Kanidm Docker container with the updated image, ensuring to mount your existing data volume and include any necessary custom options.

```bash
__
docker run [Your Arguments Here] -v kanidmd:/data \
    OTHER_CUSTOM_OPTIONS \
    kanidm/server:latest
```