NixiN/nixin-krops
2
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions
Page: Home
Pages
Home
22 Home
Douze Bé edited this page 2026-01-07 13:09:26 +00:00

Indentity and Profile Managers criterias

  • Free libre open source
  • Mature, stable, security oriented actively developed and well supported by a good community
  • Lightweight
  • All-in-one app, simple to use and to administer
  • MFA auth (password + OTP code for exemple)
  • Passkey auth (fido2/WebAuthn compatible)
  • Login web page
  • User self registration web interface
    • can be enabled/disabled by admin
    • bot protection
  • User profile self modification web interface
    • can change display name
    • can change email (with email verification)
    • can change auth credentials (password, secondary factors, passkeys)
    • immutable user id
  • User portal
  • Secure password recovery
  • Admin web interface
    • Manage users and groups/roles
    • Manage client applications
    • Manage who can access to what
    • Manage oidc providers
  • Packaged for NixOS with full declarative configuration
    • Declarative configuration of admin user
    • Declarative configuration of email server
    • Declarative configuration of user self registration enable/disable
    • Declarative provision of OIDC clients
    • Declarative provision of users and groups/roles
    • Declarative configuration of user self modification
  • OIDC provider
  • OIDC client (to accept users from other OIDC providers)
  • Compatible with legacy apps that only support LDAP and not OIDC
  • Supported by traefik plugin for
    • securing a web site that does not have any auth/privilege mechanism
    • securing a web app that is not compatible with OIDC or LDAP but that can use headers to get user/auth info

Indentity and Profile Managers tests

  • pocket-id
    • ✅ packaged in nixpkgs
    • ✅ tested support by traefik plugin to secure apps that do not have any authentication mecanism.
      • ⚠️ but need to test again with better plugin config
    • ✅ tested support by traefik plugin to secure apps that can authenticate using X-Oidc-* headers.
      • ⚠️ but need to test again with better plugin config)
    • ✅ Self registration of users (has to be enabled by admin), or creation of users by admin through web app
    • ✅ account/profile page for users to configure their password/otp/passkey/email?
      • ⚠️ if enabling self-eccount editing (which is desirable), user can also change their username, which could be a problem for applications if there is no other user claim that is unique and immutable. There is only an all of nothing admin setting for this.
    • ✅ lightweight, does the job, very simple,
      • ⚠️ but maybe too simple as only passkey auth is supported (auth by password + OTP is not possible)
    • ⚠️ Legacy apps that only support ldap auth (ex jellyfin) can be integrated though an external LDAP. But in that case users can only be managed from the external LDAP. Meaning admins will have to interact with 2 systems One for the users and one for OIDC.
  • keycloak
    • ✅ packaged in nixpkgs
      • ⚠️ But not everything can be declaratively configured.
        • ⚠️ Actually needs quite a lot of manual configuration by an admin for most uses cases (Oidc client, roles, passey enabling, including roles in id token, ...)
    • ✅ tested support by traefik plugin to secure apps that do not have any authentication mecanism.
    • ✅ tested support by traefik plugin to secure apps that can authenticate users using X-Oidc-* headers. (need to test again)
    • ⚠️ kind of bloatware (java) but does the job
    • ✅ Self registration of users (has to be enabled by admin), or creation of users by admin through web app
    • ✅ account/profile page for users to configure their password/otp/passkey/email
      • ✅ username seems to be immutable, which is good.
    • ❓ can legacy apps that only support ldap auth (ex jellyfin) be integrated?
      • ❓ Mays need to manage users externally with an ldap system for that
  • Kanidm
  • ✅ packaged in nixpkgs
  • ✅ Read only LDAPS gateway for Legacy Systems
  • ⚠️ Adding passkeys disables password sign-in : Mentioned on https://thinglab.org/2025/02/keycloak_to_kanidm/#kanidm-praise
  • ❓User creation by admin only from command line? (but could be declaratively provisioned also, so maybe not a blocker)
  • ❓Need to test "User Self Service via the WebUI" feature to check if it fullfils :
    • ❓ user registration form ?
    • ❓ account/profile page for users to configure their password/otp/passkey/email?
  • Zitadel
  • Rauthy?
  • LemonLDAP?
  • Authelia?
  • Casdoor?
  • Ory
  • Authentik?