Kanidm

https://kanidm.github.io/kanidm/stable
Admin
Kanidm is an identity management server that provides a central authority for authentication and...
Tokens:153,627
Snippets:1,989
Trust Score:8.3
Update:2 months ago
Show doc for...
Tokens:
Raw
### Kanidm Client Configuration

Source: https://kanidm.github.io/kanidm/stable/evaluation_quickstart.html

Example configuration file for the Kanidm client tools.

```ini
# ~/.config/kanidm

uri = "https://localhost" # The URL of the server
verify_ca = false # disables TLS certificate verification as your are using a self-signed certificate
```

--------------------------------

### Start the server

Source: https://kanidm.github.io/kanidm/stable/developers

Build and run the Kanidm server in development mode.

```bash
cd server/daemon
./run_insecure_dev_server.sh
```

--------------------------------

### Docker Alias Example

Source: https://kanidm.github.io/kanidm/stable/installing_client_tools.html

Example of creating an alias for the Docker run command to simplify access to Kanidm tools.

```shell
alias kanidm="docker run ..."
```

--------------------------------

### Low-level stateful API examples

Source: https://kanidm.github.io/kanidm/stable/developers

Examples of using the raw create, modify, search, and delete commands for advanced tasks.

```bash
# Create from json (group or account)
kanidm raw create -H https://localhost:8443 -C ../insecure/ca.pem -D admin example.create.account.json
kanidm raw create  -H https://localhost:8443 -C ../insecure/ca.pem -D idm_admin example.create.group.json

# Apply a json stateful modification to all entries matching a filter
kanidm raw modify -H https://localhost:8443 -C ../insecure/ca.pem -D admin '{"or": [ {"eq": ["name", "idm_person_account_create_priv"]}, {"eq": ["name", "idm_service_account_create_priv"]}, {"eq": ["name", "idm_account_write_priv"]}, {"eq": ["name", "idm_group_write_priv"]}, {"eq": ["name", "idm_people_write_priv"]}, {"eq": ["name", "idm_group_create_priv"]} ]}' example.modify.idm_admin.json
kanidm raw modify -H https://localhost:8443 -C ../insecure/ca.pem -D idm_admin '{"eq": ["name", "idm_admins"]}' example.modify.idm_admin.json

# Search and show the database representations
kanidm raw search -H https://localhost:8443 -C ../insecure/ca.pem -D admin '{"eq": ["name", "idm_admin"]}'

# Delete all entries matching a filter
kanidm raw delete -H https://localhost:8443 -C ../insecure/ca.pem -D idm_admin '{"eq": ["name", "test_account_delete_me"]}'
```

--------------------------------

### Serve Kanidm Book Locally

Source: https://kanidm.github.io/kanidm/stable/developers

Starts a local web server to view the Kanidm documentation book.

```bash
cd book
mdbook serve
```

--------------------------------

### Kanidm Server Configuration

Source: https://kanidm.github.io/kanidm/stable/evaluation_quickstart.html

Example `server.toml` configuration file for Kanidm. Key parameters like `domain` and `origin` should be reviewed and adjusted.

```toml
__
# The server configuration file version.
version = "2"

#   The webserver bind address. Requires TLS certificates.
#   If the port is set to 443 you may require the
#   NET_BIND_SERVICE capability. This accepts a single address
#   or an array of addresses to listen on.
#   Defaults to "127.0.0.1:8443"
bindaddress = "0.0.0.0:8443"
#
#   The read-only ldap server bind address. Requires
#   TLS certificates. If set to 636 you may require the
#   NET_BIND_SERVICE capability. This accepts a single address
#   or an array of addresses to listen on.
#   Defaults to "" (disabled)
# ldapbindaddress = "0.0.0.0:3636"
#
#   The path to the kanidm database.
db_path = "/data/kanidm.db"
#
#   If you have a known filesystem, kanidm can tune the
#   database page size to match. Valid choices are:
#   [zfs, other]
#   If you are unsure about this leave it as the default
#   (other). After changing this
#   value you must run a vacuum task.
#   - zfs:
#     * sets database pagesize to 64k. You must set
#       recordsize=64k on the zfs filesystem.
#   - other:
#     * sets database pagesize to 4k, matching most
#       filesystems block sizes.
# db_fs_type = "zfs"
#
#   The number of entries to store in the in-memory cache.
#   Minimum value is 256. If unset
#   an automatic heuristic is used to scale this.
#   You should only adjust this value if you experience
#   memory pressure on your system.
# db_arc_size = 2048
#
#   TLS chain and key in pem format. Both must be present.
#   If the server receives a SIGHUP, these files will be
#   re-read and reloaded if their content is valid.
tls_chain = "/data/chain.pem"
tls_key = "/data/key.pem"

#   The path where entry migrations will be read from.
#   This path should contain files that match the pattern
#   xx-name.json where xx are two number. For example:
#     00-base.json
#     10-groups.json
#   Migrations are applied in order. Migrations that fail
#   to apply, or have invalid syntax are skipped without
#   preventing server start up or reload.
# migration_path = "/data/migrations.d"

#
#   The log level of the server. May be one of info, debug, trace
#
#   NOTE: this can be overridden by the environment variable
#   `KANIDM_LOG_LEVEL` at runtime
#   Defaults to "info"
# log_level = "info"
#
#   The DNS domain name of the server. This is used in a
#   number of security-critical contexts
#   such as webauthn, so it *must* match your DNS
#   hostname. It is used to create
#   security principal names such as `william@idm.example.com`
#   so that in a (future) trust configuration it is possible
#   to have unique Security Principal Names (spns) throughout
#   the topology.
#
#   ⚠️  WARNING ⚠️
#
#   Changing this value WILL break many types of registered
#   credentials for accounts including but not limited to
#   webauthn, oauth tokens, and more.
#   If you change this value you *must* run
#   `kanidmd domain rename` immediately after.
domain = "idm.example.com"
#
#   The origin for webauthn. This is the url to the server,
#   with the port included if it is non-standard (any port
#   except 443). This must match or be a descendent of the
#   domain name you configure above. If these two items are
#   not consistent, the server WILL refuse to start!
#   origin = "https://idm.example.com"
#   # OR
#   origin = "https://idm.example.com:8443"
origin = "https://idm.example.com"

#   HTTPS requests can be reverse proxied by a loadbalancer.
#   To preserve the original IP of the caller, these systems
#   will often add a header such as "Forwarded" or
#   "X-Forwarded-For". Some other proxies can use the PROXY
#   protocol v2 header. While we support the PROXY protocol
#   v1 header, we STRONGLY discourage it's use as it has
#   significantly greater overheads compared to v2 during
#   processing.
#   This setting allows configuration of the list of trusted
#   IPs or IP ranges which can supply this header information,
#   and which format the information is provided in.

```

--------------------------------

### Start Kanidm Container

Source: https://kanidm.github.io/kanidm/stable/evaluation_quickstart.html

Starts the previously created Kanidm Docker container.

```bash
docker start kanidmd
```

--------------------------------

### Querying LDAP with Default Install

Source: https://kanidm.github.io/kanidm/stable/print.html

Example of querying the LDAP server with a default install configuration.

```bash
# from server.toml
ldapbindaddress = "[::]:3636"

LDAPTLS_CACERT=ca.pem ldapsearch \
    -H ldaps://127.0.0.1:3636 \
    -b 'dc=idm,dc=example,dc=com' \
    -x '(name=test1)'

# test1@example.com, idm.example.com
dn: spn=test1@idm.example.com,dc=idm,dc=example,dc=com
objectclass: account
objectclass: memberof
objectclass: object
objectclass: person
objectclass: posixaccount
displayname: Test User
gidnumber: 12345
memberof: spn=group240@idm.example.com,dc=idm,dc=example,dc=com
name: test1
spn: test1@idm.example.com
entryuuid: 22a65b6c-80c8-4e1a-9b76-3f3afdff8400
```

--------------------------------

### Build a kanidm container using podman

Source: https://kanidm.github.io/kanidm/stable/developers

Example of building a kanidm container specifically with podman.

```bash
CONTAINER_TOOL=podman make build/kanidmd
```

--------------------------------

### OPKSSH Setup - Create and Add to Group

Source: https://kanidm.github.io/kanidm/stable/integrations/oauth2/examples.html

Commands to create a new Kanidm group for OPKSSH users and add a user to it.

```bash
kanidm group create opkssh_users
kanidm group add-members opkssh_users alice
```

--------------------------------

### Install mdbook and Extensions

Source: https://kanidm.github.io/kanidm/stable/developers

Installs mdbook and the mdbook-mermaid extension using cargo.

```bash
cargo install mdbook mdbook-mermaid
```

--------------------------------

### Install System Dependencies (Ubuntu)

Source: https://kanidm.github.io/kanidm/stable/developers

Installs necessary system libraries for building Kanidm on Ubuntu.

```bash
sudo apt-get install libudev-dev libssl-dev libsystemd-dev pkg-config libpam0g-dev clang lld
```

--------------------------------

### Grafana Claim Map Setup

Source: https://kanidm.github.io/kanidm/stable/integrations/oauth2/examples.html

Commands to set up claim maps for Grafana roles.

```bash
kanidm system oauth2 update-claim-map-join 'grafana' 'grafana_role' array
kanidm system oauth2 update-claim-map 'grafana' 'grafana_role' 'grafana_superadmins' 'GrafanaAdmin'
kanidm system oauth2 update-claim-map 'grafana' 'grafana_role' 'grafana_admins' 'Admin'
kanidm system oauth2 update-claim-map 'grafana' 'grafana_role' 'grafana_editors' 'Editor'
```

--------------------------------

### OPKSSH Setup - Create OAuth2 Application in Kanidm

Source: https://kanidm.github.io/kanidm/stable/integrations/oauth2/examples.html

Commands to create a public OAuth2 application in Kanidm for OPKSSH, including redirect URLs and scope mapping.

```bash
# The redirect origin is set to localhost for local callbacks
kanidm system oauth2 create-public opkssh opkssh http://localhost:3000

# Add the specific redirect URIs used by OPKSSH
kanidm system oauth2 add-redirect-url opkssh http://localhost:3000/login-callback
kanidm system oauth2 add-redirect-url opkssh http://localhost:10001/login-callback
kanidm system oauth2 add-redirect-url opkssh http://localhost:11110/login-callback

# Explicitly allow localhost redirects for this client
kanidm system oauth2 enable-localhost-redirects opkssh

# Map the group created earlier to the required OIDC scopes
kanidm system oauth2 update-scope-map opkssh opkssh_users email openid profile groups
```

--------------------------------

### Kanidm OAuth2 Proxy Setup - WebApp Client

Source: https://kanidm.github.io/kanidm/stable/integrations/oauth2/examples.html

Commands to create and configure a basic OAuth2 client for OAuth2 Proxy in Kanidm.

```bash
kanidm system oauth2 create webapp 'webapp.example.com' 'https://webapp.example.com'
kanidm system oauth2 add-redirect-url webapp 'https://webapp.example.com/oauth2/callback'
kanidm system oauth2 update-scope-map webapp webapp_admin email openid
kanidm system oauth2 get webapp
kanidm system oauth2 show-basic-secret webapp
<SECRET>
```

--------------------------------

### Example private key format

Source: https://kanidm.github.io/kanidm/stable/preparing_for_your_deployment.html

Example format for the key.pem file, which should be a single PEM private key without encryption.

```text
-----BEGIN PRIVATE KEY-----
MII...<base64>
-----END PRIVATE KEY-----
```

--------------------------------

### Example certificate chain format

Source: https://kanidm.github.io/kanidm/stable/preparing_for_your_deployment.html

Example format for the chain.pem file, containing the leaf certificate, intermediates, and the CA root.

```text
-----BEGIN CERTIFICATE-----
<leaf certificate>
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
<intermediate certificate>
-----END CERTIFICATE-----
[ more intermediates if needed ]
-----BEGIN CERTIFICATE-----
<ca/croot certificate>
-----END CERTIFICATE-----
```

--------------------------------

### Build Dependencies for Kanidm on openSUSE

Source: https://kanidm.github.io/kanidm/stable/developers

Commands to install build dependencies for Kanidm on openSUSE using zypper.

```bash
zypper in rustup git libudev-devel sqlite3-devel libopenssl-3-devel libselinux-devel \
    pam-devel systemd-devel tpm2-0-tss-devel clang lld make sccache
```

--------------------------------

### Build a kanidm container with redis build cache

Source: https://kanidm.github.io/kanidm/stable/developers

Example of building a kanidm container and utilizing a redis build cache.

```bash
CONTAINER_BUILD_ARGS='--build-arg "SCCACHE_REDIS=redis://redis.dev.blackhats.net.au:6379"' make build/kanidmd
```

--------------------------------

### NSSwitch Configuration Example

Source: https://kanidm.github.io/kanidm/stable/integrations/pam_and_nsswitch/fedora.html

An example of an nsswitch.conf file for the custom Kanidm profile.

```config
passwd: kanidm compat systemd
group:  kanidm compat systemd
shadow:     files
hosts:      files dns myhostname
services:   files
netgroup:   files
automount:  files

alias:    files
ether:     files
gshadow:    files
networks:   files dns
protocols:  files
publickey:  files
rpc:        files

```

--------------------------------

### Example server.toml configuration

Source: https://kanidm.github.io/kanidm/stable/server_configuration.html

A commented example of the server.toml configuration file, illustrating various settings for the Kanidm server.

```toml
# The server configuration file version.
version = "2"

#   The webserver bind address. Requires TLS certificates.
#   If the port is set to 443 you may require the
#   NET_BIND_SERVICE capability. This accepts a single address
#   or an array of addresses to listen on.
#   Defaults to "127.0.0.1:8443"
bindaddress = "0.0.0.0:8443"
#
#   The read-only ldap server bind address. Requires
#   TLS certificates. If set to 636 you may require the
#   NET_BIND_SERVICE capability. This accepts a single address
#   or an array of addresses to listen on.
#   Defaults to "" (disabled)
# ldapbindaddress = "0.0.0.0:3636"
#
#   The path to the kanidm database.
db_path = "/data/kanidm.db"
#
#   If you have a known filesystem, kanidm can tune the
#   database page size to match. Valid choices are:
#   [zfs, other]
#   If you are unsure about this leave it as the default
#   (other). After changing this
#   value you must run a vacuum task.
#   - zfs:
#     * sets database pagesize to 64k. You must set
#       recordsize=64k on the zfs filesystem.
#   - other:

```

--------------------------------

### Docker commands for Kanidm setup

Source: https://kanidm.github.io/kanidm/stable/print.html

Commands to create a Docker volume, create a Kanidm server container, copy configuration, generate certificates, and start the container.

```bash
docker volume create kanidmd
docker create --name kanidmd \
  -p '443:8443' \
  -p '636:3636' \
  -v kanidmd:/data \
  docker.io/kanidm/server:latest
```

```bash
docker cp server.toml kanidmd:/data/server.toml
```

```bash
docker run --rm -i -t -v kanidmd:/data \
  docker.io/kanidm/server:latest \
  kanidmd cert-generate
```

```bash
docker start kanidmd
```

--------------------------------

### NSSwitch Configuration Example

Source: https://kanidm.github.io/kanidm/stable/integrations/pam_and_nsswitch.html

Example of how to add Kanidm to the nsswitch.conf file for user and group resolution.

```shell
passwd: kanidm compat # ... other modules
group:  kanidm compat
```

--------------------------------

### FreeIPA Configuration Example

Source: https://kanidm.github.io/kanidm/stable/print.html

Example of how to modify the retro changelog plugin configuration to include the full scope of the database suffix.

```bash
# Run on the FreeIPA server
dsctl --list
> slapd-DEV-KANIDM-COM
```

```bash
# Run on the FreeIPA server
dsconf <instance name> plugin retro-changelog show
dsconf slapd-DEV-KANIDM-COM plugin retro-changelog show
```

```bash
ldapsearch -H ldaps://<IPA SERVER HOSTNAME/IP> -x -b '' -s base namingContexts
# namingContexts: dc=ipa,dc=dev,dc=kanidm,dc=com
```

```ldif
dn: cn=Retro Changelog Plugin,cn=plugins,cn=config
changetype: modify
replace: nsslapd-include-suffix
nsslapd-include-suffix: dc=ipa,dc=dev,dc=kanidm,dc=com
```

```bash
ldapmodify -f change.ldif -H ldaps://<IPA SERVER HOSTNAME/IP> -x -D 'cn=Directory Manager' -W
# Enter LDAP Password:
```

--------------------------------

### Enable and Start Kanidm Daemon

Source: https://kanidm.github.io/kanidm/stable/integrations/pam_and_nsswitch.html

Commands to enable and start the kanidm-unixd service.

```bash
systemctl enable --now kanidm-unixd
kanidm-unix status
```

--------------------------------

### NSSwitch Configuration Example

Source: https://kanidm.github.io/kanidm/stable/print.html

Example of how to add Kanidm to the nsswitch.conf file for user and group resolution.

```shell
__
passwd: kanidm compat # ... other modules
group:  kanidm compat

```

--------------------------------

### Kanidm Server Configuration Example

Source: https://kanidm.github.io/kanidm/stable/print.html

A commented example of the server.toml configuration file.

```toml
# The server configuration file version.
version = "2"

#   The webserver bind address. Requires TLS certificates.
#   If the port is set to 443 you may require the
#   NET_BIND_SERVICE capability. This accepts a single address
#   or an array of addresses to listen on.
#   Defaults to "127.0.0.1:8443"
bindaddress = "0.0.0.0:8443"
#
#   The read-only ldap server bind address. Requires
#   TLS certificates. If set to 636 you may require the
#   NET_BIND_SERVICE capability. This accepts a single address
#   or an array of addresses to listen on.
#   Defaults to "" (disabled)
# ldapbindaddress = "0.0.0.0:3636"
#
#   The path to the kanidm database.
db_path = "/data/kanidm.db"
#
#   If you have a known filesystem, kanidm can tune the
#   database page size to match. Valid choices are:
#   [zfs, other]
#   If you are unsure about this leave it as the default
#   (other). After changing this
#   value you must run a vacuum task.
#   - zfs:
#     * sets database pagesize to 64k. You must set
#       recordsize=64k on the zfs filesystem.
#   - other:
#     * sets database pagesize to 4k, matching most
#       filesystems block sizes.
# db_fs_type = "zfs"
#
#   The number of entries to store in the in-memory cache.
#   Minimum value is 256. If unset
#   an automatic heuristic is used to scale this.
#   You should only adjust this value if you experience
#   memory pressure on your system.
# db_arc_size = 2048
#
#   TLS chain and key in pem format. Both must be present.
#   If the server receives a SIGHUP, these files will be
#   re-read and reloaded if their content is valid.
tls_chain = "/data/chain.pem"
tls_key = "/data/key.pem"

#   The path where entry migrations will be read from.
#   This path should contain files that match the pattern
#   xx-name.json where xx are two number. For example:
#     00-base.json
#     10-groups.json
#   Migrations are applied in order. Migrations that fail
#   to apply, or have invalid syntax are skipped without
#   preventing server start up or reload.
# migration_path = "/data/migrations.d"

#
#   The log level of the server. May be one of info, debug, trace
#
#   NOTE: this can be overridden by the environment variable
#   `KANIDM_LOG_LEVEL` at runtime
#   Defaults to "info"
# log_level = "info"
#
#   The DNS domain name of the server. This is used in a
#   number of security-critical contexts
#   such as webauthn, so it *must* match your DNS
#   hostname. It is used to create
#   security principal names such as `william@idm.example.com`
#   so that in a (future) trust configuration it is possible
#   to have unique Security Principal Names (spns) throughout
#   the topology.
#
#   ⚠️  WARNING ⚠️
#
#   Changing this value WILL break many types of registered
#   credentials for accounts including but not limited to
#   webauthn, oauth tokens, and more.
#   If you change this value you *must* run
#   `kanidmd domain rename` immediately after.
domain = "idm.example.com"
#
#   The origin for webauthn. This is the url to the server,
#   with the port included if it is non-standard (any port

```

--------------------------------

### Kanidm nsswitch.conf Example

Source: https://kanidm.github.io/kanidm/stable/print.html

An example configuration for the nsswitch.conf file within a custom Kanidm authselect profile.

```config
passwd: kanidm compat systemd
group:  kanidm compat systemd
shadow:     files
hosts:      files dns myhostname
services:   files
netgroup:   files
automount:  files

alias:    files
ether:     files
gshadow:    files
networks:   files dns
protocols:  files
publickey:  files
rpc:        files
```

--------------------------------

### Migration Assertions Example 2

Source: https://kanidm.github.io/kanidm/stable/entry_management.html

Example illustrating potential failure due to ordering of group and user creation.

```markdown
- group with member X which does exist
- user X that does not exist
```

--------------------------------

### Install OpenSSL with vcpkg

Source: https://kanidm.github.io/kanidm/stable/developers

Installs the OpenSSL dependency using vcpkg, compiling it from source.

```bash
vcpkg install openssl:x64-windows-static-md
```

--------------------------------

### Example Kanidm PAM Configuration

Source: https://kanidm.github.io/kanidm/stable/integrations/pam_and_nsswitch/suse.html

Provides example content for the four common PAM configuration files after integrating Kanidm, demonstrating the necessary module calls.

```text
# /etc/pam.d/common-account
# Controls authorisation to this system (who may login)
account    sufficient    pam_kanidm.so ignore_unknown_user
account    required      pam_deny.so

# /etc/pam.d/common-auth
# Controls authentication to this system (verification of credentials)
auth        required      pam_env.so
auth        sufficient    pam_kanidm.so ignore_unknown_user
auth        required      pam_deny.so

# /etc/pam.d/common-password
# Controls flow of what happens when a user invokes the passwd command. Currently does NOT
# push password changes back to kanidm
password    required    pam_unix.so nullok shadow try_first_pass

# /etc/pam.d/common-session
# Controls setup of the user session once a successful authentication and authorisation has
# occurred.
session optional    pam_systemd.so
session required    pam_limits.so
session optional    pam_umask.so
session optional    pam_kanidm.so
session optional    pam_env.so
```

--------------------------------

### Copy Configuration File

Source: https://kanidm.github.io/kanidm/stable/evaluation_quickstart.html

Copies the server configuration file into the running container's data directory.

```bash
docker cp server.toml kanidmd:/data/server.toml
```

--------------------------------

### Fedora and CentOS Stream Repository Setup

Source: https://kanidm.github.io/kanidm/stable/installing_client_tools.html

Add repository metadata for Fedora and CentOS Stream to install Kanidm clients.

```shell
# Fedora
wget https://download.opensuse.org/repositories/network:/idm/Fedora_$(rpm -E %fedora)/network:idm.repo
# Centos Stream
wget https://download.opensuse.org/repositories/network:/idm/CentOS_$(rpm -E %rhel)_Stream/network:idm.repo
```

--------------------------------

### Integrate vcpkg

Source: https://kanidm.github.io/kanidm/stable/developers

Enables the use of installed packages for the user system-wide with vcpkg.

```bash
vcpkg integrate install
```

--------------------------------

### Docker Volume and Container Creation

Source: https://kanidm.github.io/kanidm/stable/evaluation_quickstart.html

Creates a Docker volume for data storage and then creates the Kanidm server container.

```bash
docker volume create kanidmd
docker create --name kanidmd \
  -p '443:8443' \
  -p '636:3636' \
  -v kanidmd:/data \
  docker.io/kanidm/server:latest
```

--------------------------------

### Create Person

Source: https://kanidm.github.io/kanidm/stable/evaluation_quickstart.html

Creates a new person account in Kanidm.

```bash
kanidm person create <your username> <Your Displayname>
```

--------------------------------

### Get YouTrack Client Secret

Source: https://kanidm.github.io/kanidm/stable/integrations/oauth2/examples.html

Retrieves the client secret for the YouTrack OAuth2 application from Kanidm.

```bash
kanidm system oauth2 show-basic-secret youtrack
```

--------------------------------

### Build Kanidm Book

Source: https://kanidm.github.io/kanidm/stable/developers

Builds the Kanidm documentation book using make.

```bash
make book
```

--------------------------------

### Get Outline OAuth2 Client Secret

Source: https://kanidm.github.io/kanidm/stable/integrations/oauth2/examples.html

Command to retrieve the client secret for the Outline OAuth2 application from Kanidm.

```bash
kanidm system oauth2 show-basic-secret outline
```

--------------------------------

### Install Kanidm Client Daemon

Source: https://kanidm.github.io/kanidm/stable/integrations/pam_and_nsswitch.html

Recommended installation commands for the Kanidm client daemon on various Linux distributions and FreeBSD.

```bash
# OpenSUSE
zypper in kanidm-unixd-clients
# Fedora
dnf install kanidm-unixd-clients
# FreeBSD
pkg install kanidm-client
```

--------------------------------

### Pull and run the radius container

Source: https://kanidm.github.io/kanidm/stable/developers

Example command for pulling and running the radius container from GitHub container registry.

```bash
docker pull ghcr.io/kanidm/radius:devel
docker run --rm -it \
    -v $(pwd)/kanidm:/data/kanidm \
    ghcr.io/kanidm/radius:devel
```

--------------------------------

### Example PAM Configuration Files for Kanidm

Source: https://kanidm.github.io/kanidm/stable/print.html

These are example configurations for various PAM services, demonstrating how to integrate `pam_kanidm.so` for authentication and authorization.

```pam
# /etc/pam.d/common-account
# Controls authorisation to this system (who may login)
account    sufficient    pam_kanidm.so ignore_unknown_user
account    required      pam_deny.so

# /etc/pam.d/common-auth
# Controls authentication to this system (verification of credentials)
auth        required      pam_env.so
auth        sufficient    pam_kanidm.so ignore_unknown_user
auth        required      pam_deny.so

# /etc/pam.d/common-password
# Controls flow of what happens when a user invokes the passwd command. Currently does NOT
# push password changes back to kanidm
password    required    pam_unix.so nullok shadow try_first_pass

# /etc/pam.d/common-session
# Controls setup of the user session once a successful authentication and authorisation has
# occurred.
session optional    pam_systemd.so
session required    pam_limits.so
session optional    pam_umask.so
session optional    pam_kanidm.so
session optional    pam_env.so
```

```pam
# /etc/pam.d/system-auth
auth        required                                     pam_env.so
auth        required                                     pam_faildelay.so delay=2000000
auth        sufficient                                   pam_fprintd.so
auth        sufficient                                   pam_kanidm.so ignore_unknown_user
auth        sufficient                                   pam_unix.so nullok
auth        required                                     pam_deny.so

account     sufficient                                   pam_kanidm.so ignore_unknown_user
account     required                                     pam_unix.so

password    requisite                                    pam_pwquality.so
password    sufficient                                   pam_unix.so yescrypt shadow nullok use_authtok
password    required                                     pam_deny.so

session     optional                                     pam_keyinit.so revoke
session     required                                     pam_limits.so
-session    optional                                     pam_systemd.so
session     [success=1 default=ignore]                   pam_succeed_if.so service in crond quiet use_uid
session     optional                                     pam_kanidm.so
session     required                                     pam_unix.so

# /etc/pam.d/password-auth
auth        required                                     pam_env.so
auth        required                                     pam_faildelay.so delay=2000000
auth        sufficient                                   pam_kanidm.so ignore_unknown_user
auth        sufficient                                   pam_unix.so nullok
auth        required                                     pam_deny.so

account     sufficient                                   pam_kanidm.so
account     required                                     pam_unix.so

password    requisite                                    pam_pwquality.so
password    sufficient                                   pam_unix.so yescrypt shadow nullok use_authtok
password    required                                     pam_deny.so

session     optional                                     pam_keyinit.so revoke
session     required                                     pam_limits.so
-session    optional                                     pam_systemd.so
session     [success=1 default=ignore]                   pam_succeed_if.so service in crond quiet use_uid
session     optional                                     pam_kanidm.so
session     required                                     pam_unix.so
```

--------------------------------

### Serve Live Docs

Source: https://kanidm.github.io/kanidm/stable/developers/python_module.html

Command to run a local live server for the documentation.

```bash
make docs/pykanidm/serve
```

--------------------------------

### Grafana Environment Preparation

Source: https://kanidm.github.io/kanidm/stable/integrations/oauth2/examples.html

Commands to prepare the environment for Grafana integration.

```bash
kanidm system oauth2 create grafana "grafana.domain.name" https://grafana.domain.name
kanidm system oauth2 set-landing-url grafana 'https://grafana.domain.name/login/generic_oauth'
kanidm system oauth2 update-scope-map grafana grafana_users email openid profile groups
kanidm system oauth2 enable-pkce grafana
kanidm system oauth2 get grafana
kanidm system oauth2 show-basic-secret grafana
<SECRET>
```

--------------------------------

### OPKSSH Setup - Add Email to Kanidm Account

Source: https://kanidm.github.io/kanidm/stable/integrations/oauth2/examples.html

Command to add an email address to a Kanidm user account for OPKSSH integration.

```bash
kanidm person update alice -m alice@example.com
```

--------------------------------

### Kanidm Unixd Service Configuration Example

Source: https://kanidm.github.io/kanidm/stable/integrations/pam_and_nsswitch.html

Example configuration file for the Kanidm UNIX daemon, illustrating various settings for HSM, default shell, home directory, and more.

```toml
# The configuration file version.
version = '2'

# ⚠️  Ensure that you have the [kanidm] or other provider sections below
# configured else accounts from remote sources will not be available.

# Kanidm unix will bind all cached credentials to a local Hardware Security
# Module (HSM) to prevent exfiltration and attacks against these. In addition,
# any internal private keys will also be stored in this HSM.
#
# * soft: A software hsm that encrypts all local key material
# * tpm: Use a tpm for all key storage and binding
# * tpm_if_possible: If a hardware tpm exists it is used, otherwise fall back to the software tpm.
#                    If the hardware tpm has previously been used, software tpm will not be used.
#
# Default: tpm_if_possible

# hsm_type = "tpm"


# If using `hsm_type = "tpm"`, this allows configuration of the TCTI name of
# the tpm to use. For more, see: https://tpm2-tools.readthedocs.io/en/latest/man/common/tcti/
#
# You should leave this value as the default kernel resource manager.
#
# Default: device:/dev/tpmrm0

# tpm_tcti_name = "device:/dev/tpmrm0"


# Default shell for users if no value is set.
#
# Default: /bin/sh

# default_shell = "/bin/sh"


# The prefix prepended to where home directories are stored. Must end with a trailing `/`.
#
# Default: /home/

# home_prefix = "/home/"


# The attribute to use for the stable home directory path. Valid choices are
# `uuid`, `name`, `spn`.

# > **NOTICE:** All users in Kanidm can change their name (and their spn) at any time. If you change
# > `home_attr` from `uuid` you _must_ have a plan on how to manage these directory renames in your
# > system. We recommend that you have a stable ID (like the UUID), and symlinks from the name to the
# > UUID folder. Automatic support is provided for this via the unixd tasks daemon, as documented
# > here.

# Default: uuid

# home_attr = "uuid"

# Controls the prefix that will be prepended to the home name when using mounted home directories from
# a location that is outside of them `home_prefix`. Must end with a trailing `/`. If unset then home
# directories will be created in `home_prefix`.
#
# This is option is useful when implementing a networked home directory layout. A common implementation
# is to configure a networked filesystem that contains user directories mounted at `/u/` (eg /u/$user_uuid)
# and then symlink the mounted directory into /home/$user_name when the user logs in. This can be accomplished
# with a configuration that includes the following:
#
# > home_attr = "uuid"
# > home_alias = "name"
# > home_prefix = "/home/"
# > home_mount_prefix = "/u/"
#
# ⚠️  If you expect directories to be created by kanidm unixd tasks in an alternate mount prefix, then
# you need to run `systemctl edit kanidm-unixd-tasks` to allow the daemon to write to these locations.
#
# > [Service]

```

--------------------------------

### FreeBSD Installation

Source: https://kanidm.github.io/kanidm/stable/installing_client_tools.html

Install the Kanidm client on FreeBSD using ports or packages.

```shell
pkg install kanidm-client
```

--------------------------------

### Login to Kanidm

Source: https://kanidm.github.io/kanidm/stable/evaluation_quickstart.html

Logs into the Kanidm server using the 'idm_admin' account.

```bash
kanidm login --name idm_admin
```

--------------------------------

### Place certificates using a shell container

Source: https://kanidm.github.io/kanidm/stable/preparing_for_your_deployment.html

This command demonstrates how to place certificates using a Docker container that mounts the Kanidm volume and a host path.

```bash
docker run --rm -i -t -v kanidmd:/data -v /my/host/path/work:/work opensuse/leap:latest \
    /bin/sh -c "cp /work/* /data/"
```

--------------------------------

### Cargo Installation

Source: https://kanidm.github.io/kanidm/stable/installing_client_tools.html

Install Kanidm tools using Cargo if a Rust toolchain is available.

```shell
cargo install kanidm_tools --locked
```

--------------------------------

### Pull Kanidm Server Image

Source: https://kanidm.github.io/kanidm/stable/evaluation_quickstart.html

Pulls the latest Kanidm server Docker image.

```bash
__
docker pull docker.io/kanidm/server:latest

```

--------------------------------

### Alpine Linux Installation

Source: https://kanidm.github.io/kanidm/stable/installing_client_tools.html

Install the Kanidm client on Alpine Linux from the testing repository.

```shell
apk add kanidm-clients
```

--------------------------------

### macOS Installation with Homebrew

Source: https://kanidm.github.io/kanidm/stable/installing_client_tools.html

Install Kanidm CLI client tools from source using Homebrew.

```shell
brew tap kanidm/kanidm
brew install kanidm
```

--------------------------------

### PAM Configuration - atrun

Source: https://kanidm.github.io/kanidm/stable/integrations/pam_and_nsswitch/freebsd.html

Example PAM configuration for /etc/pam.d/atrun.

```pam
__
# /etc/pam.d/atrun

# Note well: enabling pam_nologin for atrun will currently result
# in jobs discarded, not just delayed, during a no-login period.

# account         required        pam_nologin.so
account         include         common

```

--------------------------------

### OpenSUSE Installation

Source: https://kanidm.github.io/kanidm/stable/installing_client_tools.html

Install Kanidm clients on OpenSUSE Tumbleweed, Leap, and SUSE Linux Enterprise.

```shell
zypper ref
zypper in kanidm-clients
```

--------------------------------

### Select and Use a Specific Instance

Source: https://kanidm.github.io/kanidm/stable/client_tools.html

Example of setting an environment variable to select a specific Kanidm instance and logging in.

```bash
__
export KANIDM_INSTANCE=development
kanidm login -D username@idm.dev.example.com


```

--------------------------------

### Fedora and CentOS Stream Installation

Source: https://kanidm.github.io/kanidm/stable/installing_client_tools.html

Install Kanidm clients on Fedora and CentOS Stream after setting up the repository.

```shell
dnf install kanidm-clients
```

--------------------------------

### Nextcloud Error Log Example

Source: https://kanidm.github.io/kanidm/stable/integrations/oauth2/examples.html

Example error message seen in Nextcloud logs when local access rules are violated.

```text
Host 172.24.11.129 was not connected to because it violates local access rules
```

--------------------------------

### GitLab Configuration for OpenID Connect

Source: https://kanidm.github.io/kanidm/stable/integrations/oauth2/examples.html

Example configuration snippet for GitLab's gitlab.rb file to enable OpenID Connect authentication with Kanidm.

```ruby
# /etc/gitlab/gitlab.rb
gitlab_rails['gitlab_openid_connect_enabled'] = true
gitlab_rails['gitlab_openid_connect_allow_rejection'] = false
gitlab_rails['gitlab_openid_connect_sign_in_button_enabled'] = true

gitlab_rails['gitlab_openid_connect_providers'] = [ {
  'name' => 'kanidm',
  'label' => 'Sign in with Kanidm',
  'args' => {
    'client_id' => 'gitlab',
    'client_secret' => '[from show-basic-secret above]',
    'discovery' => 'https://idm.example.com/oauth2/openid/gitlab/.well-known/openid-configuration',
    'scope' => 'openid email profile groups',
    'uid_field' => 'sub'
  }
} ]
```
Tokens:
Raw