I like these types of projects (auth) and happy to see this is a thriving area. I was a little puzzled by the very first line in their gitbook [0] documentation:
“Kanidm is an identity management server, acting as an authority on accounts and authorisation within a technical environment.”
Shouldn’t that be authentication, or am I misunderstanding the purpose of Kanidm?
You would be the one overcomplicating the matter by clumping these distinct concepts together.
Edit: For those unfamiliar with the concepts:
Authentication: subject identity - is the user who they claim to be?
Authorization: subject permissions - is this user permitted to execute that action?
Within ABAC schemes, Authorization is a boolean function over (Request, Principle, Environment). If you zero the Principle, you can still represent a large number of unique policies considering just the Request and the Environment.
“Kanidm is an identity management server, acting as an authority on accounts and authorisation within a technical environment.”
Shouldn’t that be authentication, or am I misunderstanding the purpose of Kanidm?
[0] https://kanidm.github.io/kanidm/intro.html