kanidm VS GeoRust

Kanidm is a identity management platform with a ldap compatible interface, sso and more. It's still young, but the author works on the 389 ldap server at suse, so knows how to build a secure ldap alternative :)

Kanidm: A simple, secure and fast identity management platform\ (22 comments)

Here is the OAuth/OIDC issue: https://github.com/kanidm/kanidm/issues/278

They are talking here: https://github.com/kanidm/kanidm/pull/485 about being an IdP with support for OIDC, so once that is implemented you could probably federate to Keycloak (or any other compliant IdP).

Might be worth filing an issue, I'm sure they'd love the feedback.

Interesting that they are choosing to provide an integrated solution including user management and OAuth IdP ( https://github.com/kanidm/kanidm/pull/485 ) rather than plug into existing open source or even commercial offerings.

Here's a design doc about their OAuth choices: https://github.com/kanidm/kanidm/blob/master/designs/oauth.r...

It would seem simpler to go with the Ory approach of "best in breed" for, say network management tooling (most of which they already have implemented), and then integrate with Keycloak, Okta, FusionAuth, the Ory suite, etc for user management. Maybe they didn't want to do that because there are synergies with integrated user management? I dunno, seems like there are a lot of user management tools out there.

I also find it interesting that they explicitly disallow a goal of building a better LDAP server. I think there's a lot of room to run in that. My employer has had users show a fair bit of interest in a modern experience with LDAP layered on top ( https://github.com/FusionAuth/fusionauth-issues/issues/954 ) and I talked to someone at a conference that had built a whole business out of virtual LDAP: https://www.radiantlogic.com . They were working with companies with multiple LDAP based auth systems, and providing a way to have apps see one view of the user.

Maybe kanidm isn't that project, but it seems like a modern OSS LDAP implementation would be welcomed by the software community.

Disclosure: I work at FusionAuth.

Kanidm, it might not sound as fun or exciting but this sound engineering driven by exceptional people. Similarly, concread.

saml-rs, creating a SAML IdP in rust, kind of spun out of trying to do it for Kanidm.

And now they employ one of the lead 389 Directory Server developers (now the default in SUSE instead of OpenLDAP which is is still available but is going to be depreciated). The same person is also the lead developer of Kandim, a new beta IDM that looks really promising (but is likely quite some time from being ready for enterprise production).

And, uhh, I searched and, https://www.nature.com/articles/d41586-020-03382-2 this article cites.. geosciences as well? https://github.com/georust/geo