Post #1313396
2026-03-30 11:27 UTC
PAM integration looks cool, but in the past I also trialed that with SSSD and the AD and didn't end up liking it, so I have no plans to re-attempt that as of now.
Replies (2)
-
@jana@social.jsteuernagel.de 2026-03-30 11:31
Now one thing I like about kanidm is that it's very clear that they really focus on security a lot. That includes considerations on which domain to use for an SSO service, because of how cookies can propagate with CORS (allowing access to the subdomain and all domains above until the public level). Now, I run a little setup for myself, I could probably reasonably ignore that and just run it on my main domain. But I know from past experience that I am more likely to regret having done too little, rather than too much, so dedicated domain it is.
-
@arichtman@eigenmagic.net 2026-04-03 12:35
@jana let me know how you go with PAM, I haven't started that but generally I fear the dragons that PAM supposedly contains...