Post #1313397

2026-03-30 11:31 UTC

Now one thing I like about kanidm is that it's very clear that they really focus on security a lot. That includes considerations on which domain to use for an SSO service, because of how cookies can propagate with CORS (allowing access to the subdomain and all domains above until the public level). Now, I run a little setup for myself, I could probably reasonably ignore that and just run it on my main domain. But I know from past experience that I am more likely to regret having done too little, rather than too much, so dedicated domain it is.

Replies (2)

@jana@social.jsteuernagel.de 2026-03-30 11:35

Now for the plan: I'll install it in a FreeBSD jail. Anyone surprised? Didn't think so :D I will likely setup replication, which is natively supported, to have a replica running on my home server. That's for redundancy sake, but also for "having working SSO, if the internet were to cut out", so I don't get complaints about Jellyfin not working :D I'll look into maybe putting it into my AS, so that I can use the edge routers as load balancers for the two replicas. So overall: Not too complicated (except for the AS part, as that will require me to build out more parts of the network that I have not yet looked at).

Open ##1313398
@arichtman@eigenmagic.net 2026-04-03 12:36

@jana that page on selecting a domain is considered and something I wouldn't have known to worry about before. I've sent it to a few people and followed it myself even not for kanidm

Open ##1313436