Kanidm is a simple and secure identity management platform, allowing other applications and services to offload the challenge of authenticating and storing identities to Kanidm.
The goal of this project is to be a complete identity provider, covering the broadest possible set of requirements and integrations. You should not need any other components (like Keycloak) when you use Kanidm - we already have everything you need!
To achieve this we rely heavily on strict defaults, simple configuration, and self-healing components. This allows Kanidm to run from small home labs, for families, small business, and all the way to the largest enterprise needs.
If you want to host your own authentication service, then Kanidm is for you!
Features
- Webauthn (passkeys) for secure cryptographic authentication
- OAuth2/OIDC Authentication provider for web SSO
- OAuth Application Portal/Gateway allowing easy access to linked applications
- Linux/UNIX integration with offline authentication
- SSH key distribution to Linux/UNIX systems
- RADIUS for network and VPN authentication
- Read only LDAPS gateway for Legacy Systems
- Complete CLI tooling for Administration
- User Self Service via the WebUI
External References
- Evaluation Quickstart - Kanidm Administration
- Introduction to Kanidm - Kanidm Administration
- GitHub - kanidm/kanidm: Kanidm: A simple, secure, and fast identity management platform
A Federated OpenID Connect Provider
Integrate any identity provider into your application using OpenID Connect.
Federate across upstream identity providers with ease.
OAuth allows websites and services to share assets among users. It is widely accepted, but be aware of its vulnerabilities.
Since the beginning of distributed personal computer networks, one of the toughest computer security nuts to crack has been to provide a seamless, single sign-on (SSO) access experience among multiple computers, each of which require unrelated logon accounts to access their services and content. Although still not fully realized across the entire internet, myriad, completely unrelated websites can now be accessed using a single physical sign-on. You can use your password, phone, digital certificate, biometric identity, two-factor authentication (2FA) or multi-factor authentication (MFA) SSO solution to log onto one place, and not have to put in another access credential all day to access a bunch of others. We have OAuth to thank for much of it.
OpenID Connect is a simple identity layer built on top of the OAuth 2.0 protocol, which allows clients to verify the identity of an end user based on the authentication performed by an authorization server or identity provider (IdP), as well as to obtain basic profile information about the end user in an interoperable and REST-like manner. OpenID Connect specifies a RESTful HTTP API, using JSON as a data format.
OpenID Connect is an increasingly common authentication protocol: when an app prompts you to authenticate using your Facebook or Google+ credentials, the app is probably using OpenID Connect.
OpenID Connect allows a range of clients, including web-based, mobile, and JavaScript clients, to request and receive information about authenticated sessions and end-users.
OneLogin provides a custom connector option that makes it easy to configure your OpenID Connect-enabled app to use OneLogin as the Identity Provider (IdP) in an OpenID Connect flow.
For more information about API authorization, see How to setup an API Authorization PoC.
The Gluu Server is a container distribution of free open source software (FOSS) for identity and access management (IAM). SaaS, custom, open source and commercial web and mobile applications can leverage a Gluu Server for user authentication, identity information, and policy decisions.
Common use cases include:
- Single sign-on (SSO)
- Mobile authentication
- API access management
- Two-factor authentication (2FA)
- Customer identity and access management (CIAM)
- Identity federation
Open Web Standards
The Gluu Server can be deployed to support the following open standards for authentication, authorization, federated identity, and identity management:
- OAuth 2.0
- OpenID Connect
- User Managed Access 2.0 (UMA)
- SAML 2.0
- System for Cross-domain Identity Management (SCIM)
- FIDO Universal 2nd Factor (U2F)
- FIDO 2.0 / WebAuthn
- Lightweight Directory Access Protocol (LDAP)
- Remote Authentication Dial-In User Service (RADIUS)
Microsofts bekannten Verzeichnisdienst Active Directory gibt es inzwischen auch in der Cloud des Herstellers. Golem.de zeigt, wie er dort funktioniert.
Unternehmen haben viele Gründe, auf zentrale Verzeichnisdienste für die Verwaltung ihrer Dienste und Benutzer zu setzen. Besonders die Verwaltung von Benutzerzugängen spielt dabei eine herausragende Rolle: Es ist im Jahr 2021 nicht mehr zeitgemäß oder sinnvoll, jedes System als Insel mit eigenen Benutzerzugängen zu betrachten.
Hydra is an OAuth 2.0 and OpenID Connect Provider. In other words, an implementation of the OAuth 2.0 Authorization Framework as well as the OpenID Connect Core 1.0 framework. As such, it issues OAuth 2.0 Access, Refresh, and ID Tokens that enable third-parties to access your APIs in the name of your users.
Oauth 2 Server providing JSON Web Tokens for identification.
Lightweight, fast and easy to install on small systems. Requires a MySql or SQLite3 database. Handles LDAP or database for users backend.
The API backend is fully written in language C, it’s based on Ulfius HTTP framework, Hoel database framework and Libjwt JSON Web Tokens library.