Kanidm with Dex and IncusOS

IncusOS
1

Kanidm is an Identity Management platform which I’ve seen mentioned several times in these forums - and I think thats a good thing.

However. Kanidm doesn’t support every function in every bit of OAuth 2, Device Authorisation Grants (DAG) have been requested for a while but haven’t bubbled up to the top of the project todo.

Because of missing DAG support some use cases like IncusOS are impossible to fully use with Kanidm - in the case of IncusOS the CLI tools can’t authenticate.

I did a writeup about adding Dex to an existing Kanidm setup but because @tibeer had already shared their configuration in Criticize my setup - #7 by tibeer it felt like sharing it here was duplicating his work. Instead I posted mine for the Kanidm community, but wanted to share a couple of additional comments about the Dex configuration here in case they help simplify someone elses setup:

  • changing enablePasswordDB to false disables the step where i need to select email vs oidc during authentication flow
  • with enablePasswordDB false, using ‘memory’ as the storage backend is possible so no on disk db is required

I can update this post with how IncusOS OIDC settings relate to Dex/Kanidm settings, if it would be generally helpful.

I hope that helps someone else :slight_smile:

2 Likes
2

Thanks!

It’s been good to see more IdPs supporting the device code authentication.

Back when we added OIDC to LXD (pre-Incus), there were really few that handled it correctly, leading to us mostly relying on Keycloak for our deployments. These days, it looks like a majority of hosted and self-hosted options do handle it correctly, though as you’ve noticed, it’s not quite all of them yet :slight_smile:

Dex is a great hack for that given it’s very lightweight and can act as an OIDC proxy of sorts, introducing the missing methods.

2 Likes