Kanidm

Self-hosted lightweight identity management service. https://kanidm.github.io

Two groups are created by default:

1. admins: this will contain all admin groups for enabled applications (e.g. forgejo_admins)
2. users: this will contain all user groups for enabled applications (e.g. forgejo_users)

Usage

momo-cloud.authentication = {
  enable = true;
  adminPasswordFile = config.age.secrets."kanidm-admin-password".path;
  idmAdminPasswordFile = config.age.secrets."kanidm-idm-admin-password".path;
  mailPasswordFile = config.age.secrets."kanidm-mail-password".path;
};

Secrets

adminPasswordFile

Generate the password:

openssl rand -hex 24

idmAdminPasswordFile

Generate the password:

openssl rand -hex 24

mailPasswordFile

Should be the password for the SMTP mail account.

User management with kanidm

Example ~/.config/kanidm:

["staging"]
uri = "https://account.staging.example.com"

["prod"]
uri = "https://account.example.com"

Initial login:

KANIDM_INSTANCE=staging kanidm login -D idm_admin

Creating users:

KANIDM_INSTANCE=staging kanidm person create $username $displayName

Updating a users email address:

KANIDM_INSTANCE=staging kanidm person update $username --mail "initial@email.address"

Adding users to groups:

KANIDM_INSTANCE=staging kanidm group add-members paperless_users $username

Generating a link to be sent to user for credentials creation:

KANIDM_INSTANCE=staging kanidm person credential create-reset-token $username

Change login timeout, for example to 3 months:

KANIDM_INSTANCE=staging kanidm group account-policy auth-expiry idm_all_accounts 7776000

Update

Pre-update check:

Example:

sudo -u kanidm /nix/store/wwlis495qq380mvwkccw23ixgg92dz61-kanidm-1.6.4/bin/kanidmd domain upgrade-check -c /nix/store/w5bipks8vzzs83xcx0sj8wi5n791lskc-server.toml

📜 Using config file: "/nix/store/w5bipks8vzzs83xcx0sj8wi5n791lskc-server.toml"
00000000-0000-0000-0000-000000000000 INFO     ｉ [info]: Starting Kanidmd | version: 1.6.4
00000000-0000-0000-0000-000000000000 WARN     🚧 [warn]: WARNING: /nix/store/w5bipks8vzzs83xcx0sj8wi5n791lskc-server.toml has 'everyone' permission bits in the mode. This could be a security risk ...
00000000-0000-0000-0000-000000000000 INFO     ｉ [info]: Running domain upgrade check ...
00000000-0000-0000-0000-000000000000 INFO     ｉ [info]: domain_name            : account.staging.momo.koeln
00000000-0000-0000-0000-000000000000 INFO     ｉ [info]: domain_uuid            : f7496e7b-a183-4cc7-bd14-6eb02ca1d288
00000000-0000-0000-0000-000000000000 INFO     ｉ [info]: domain_current_level   : 9
00000000-0000-0000-0000-000000000000 INFO     ｉ [info]: domain_upgrade_level   : 10
Logging pipeline completed shutdown