Post #1313394

2026-03-30 11:23 UTC

The plan is to finally deploy an SSO system, so I can have unified credentials and central access management for all of my services. I've been playing with the idea for a long time already. At one point I had already started integrating some services with my Active Directory via LDAP, but I fully reverted that after some time. There are multiple reasons for that: 1. I don't want to rely on the AD for anything beyond Windows enrollment anymore. It's way too unpredictable for anything else. 2. I didn't trust myself to run a service that central to everything else I do, for a long time. By now I have run other services that are even more critical (my mailserver) without problems for years, so SSO seems reasonable to do now. 3. When I previously looked at existing solutions, I never came up with one that I liked and trusted enough. Switching out an SSO provider would be a pain, so I wanted to be confident about my choice.

Replies (2)

@jana@social.jsteuernagel.de 2026-03-30 11:27

So why now? Well, I'm bored :D And I've found kanidm, which sparks a lot of confidence in me. I already tried it a few months ago and it seemed solid. Rauthy also seems like a reasonable candidate, which apparently also uses kanidm libraries behind the scenes, with a slightly more limited scope than kanidm. But I want to keep as many options as possible open for myself, so I'll go ahead with kanidm. Then I can integrate services with OAuth2 and I'm also eying the RADIUS integration to potentially finally resurrect my WiFi with enterprise auth (The old setup with the AD of that died because UniFi...)

Open ##1313395
@zako@fosstodon.org 2026-04-05 19:40

@jana the SSO is for internal o external services? I feel even with OIDC/OAuth2 and secure SSO systems applications can have zero day bugs. So for my personal services accesible via Internet I try to add mTLS or forward_auth apart from the OIDC/OAuth2 configuration

Open ##1313439