Kanidm
Kanidm is a modern, simple and secure identity management platform written in Rust. It provides OAuth2/OIDC, LDAP, RADIUS and Unix (PAM/nsswitch) authentication, WebAuthn/passkey support and a self-service web portal for managing people, groups and service accounts.
Kanidm
In Development
This script is currently in active development and may be unstable or incomplete. Use in production environments is not recommended.
This script is currently in active development and may be unstable or incomplete. Use in production environments is not recommended.
Installation
Default install:
1
bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVED/main/ct/kanidm.sh)"
Notes
Kanidm cannot run on a bare IP (WebAuthn/passkeys require a real domain name, and its domain must start with a letter). The script defaults the domain/origin to kanidm..nip.io, a public wildcard DNS that resolves to the container automatically — just open https://kanidm..nip.io:8443, no hosts file or DNS setup needed, and accept the self-signed certificate warning.</div> </div>
If your router/DNS has rebinding protection (blocks public names that resolve to private IPs), nip.io may not resolve. Fallback: add ' kanidm.local' to your client's hosts file and set the matching domain/origin in /etc/kanidm/server.toml. To use your own real domain, change 'domain' and 'origin' in server.toml BEFORE creating accounts — changing it later requires a Kanidm domain rename.</div> </div> ## Web Interface## Links - [Official Website](https://kanidm.com/) - [Documentation](https://kanidm.github.io/kanidm/stable/) ---
Generate the break-glass admin passwords after install, inside the container: 'kanidmd recover-account idm_admin' (manages people and groups — use this account to sign in to the web portal) and 'kanidmd recover-account admin' (manages server configuration).