kanidm

Kanidm is a modern, secure, and comparatively lightweight identity management solution developed in Rust, focusing on clear standards, self‑healing mechanisms, and simple administration. The platform is suitable for home labs, small businesses, and even enterprise environments.

Compared to many other IAM systems (e.g., Keycloak), Kanidm comes with built‑in features such as OAuth2/OIDC, Unix integration, passkey authentication (WebAuthn), and an application portal.

Kanidm supports modern security features:

  • Passkeys / WebAuthn
  • OIDC & OAuth2
  • Application Portal
  • Unix integration
  • Two‑node replication

Configuration is done via CLI and configuration files – you can find the complete references in the Kanidm Book: https://kanidm.github.io/kanidm/master/

Requirements

Kanidm is officially provided as a container. You can find the official images on Docker Hub:

  • kanidm/server
  • kanidm/radius
  • kanidm/tools

Basic requirements:

  • Modern CPU feature set: x86_64_v2 or ARM NEON
  • Docker + Docker Compose
  • TLS certificates (chain.pem & key.pem)
  • Storage space (approx. 8 KB per entry) & RAM (approx. 64 KB per entry)

Installation with Docker Compose

In the following example, Kanidm is set up with a bind mount for certificates and a persistent volume for data.

/etc/kanidm/
├── chain.pem
├── key.pem
└── server.toml

Example server.toml

version = "2"

bindaddress = "0.0.0.0:8443"

db_path = "/data/kanidm.db"

tls_chain = "/data/chain.pem"
tls_key   = "/data/key.pem"

domain = "idm.example.com"
origin = "https://idm.example.com"
log_level = "info"

Note: Domain, origin, tls_chain & tls_key must be set, or Kanidm will not start.

Docker Compose file

services:
  kanidmd:
    container_name: kanidmd
    image: kanidm/server:latest
    restart: always

    volumes:
      - type: bind
        source: /etc/kanidm/
        target: /data/
      - kanidm_data:/var/lib/kanidm/

    ports:
      - "443:8443"

volumes:
  kanidm_data:

Starting the container

docker compose up -d

docker logs -f kanidmd

If TLS and configuration are correct, the server should start successfully.

Initial setup via CLI

docker run --rm -it   --network host   kanidm/tools:latest   kanidm login --user admin --password

You can then manage users, groups, and applications.

WebAuthn & Features

  • Passkeys / WebAuthn
  • OIDC & OAuth2
  • Application Portal
  • Unix integration
  • Two‑node replication

Configuration is done via CLI and configuration files – full references in the Kanidm Book.

Reloading certificates

docker kill -s HUP kanidmd

Conclusion

Kanidm is a modern, secure, and lightweight identity management solution that is easy to deploy via containers. Its strict but simple configuration makes it ideal for home labs and larger environments.

Last modified: August 28, 2026
RCS-Networks