A simple, secure, and fast identity management platform for self-hosted authentication, supporting OAuth2, LDAP, RADIUS, and Unix integration.
Kanidm is an open-source identity management platform that provides authentication and identity storage for applications and services. It solves the problem of managing user identities securely and efficiently, supporting features like OAuth2, LDAP, and RADIUS. The platform is designed to be a complete identity provider, eliminating the need for additional components like Keycloak.
System administrators, DevOps engineers, and organizations needing a self-hosted identity management solution for environments ranging from home labs to large enterprises. It's ideal for those who want to offload authentication from their applications.
Developers choose Kanidm for its simplicity, security, and broad feature set out of the box, including native OAuth2/OIDC support and Unix integration. Its high-performance database and replication system, built on enterprise LDAP experience, offer better speed and reliability compared to alternatives relying on external SQL databases.
Kanidm: A simple, secure, and fast identity management platform
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Integrates OAuth2/OIDC, LDAPs, RADIUS, and Unix auth natively, covering a wide range of authentication needs without extra components like Keycloak.
Uses a custom database system that outperforms alternatives like FreeIPA in benchmarks, with faster search and modification operations for scalability.
Features passkeys with WebAuthn attestation and TPM-protected offline authentication, emphasizing secure defaults for high-risk environments.
Relies on self-healing components and strict defaults, reducing configuration complexity and maintenance overhead from home labs to enterprises.
Administrative functionality is primarily through CLI, as the Web UI is designed more for user self-service, which may be less intuitive for some admins.
The comprehensive feature set and unique architecture can require more initial learning and setup effort compared to simpler tools like LLDAP or Rauthy.
As a newer project, it may have fewer community-contributed plugins or integrations compared to established platforms like Keycloak, potentially slowing adoption in complex ecosystems.
Kanidm is an open-source alternative to the following products:
FreeIPA is an integrated security information management solution for Linux/Unix environments, combining LDAP, Kerberos, DNS, and certificate services for centralized identity and authentication.
An open-source LDAP (Lightweight Directory Access Protocol) server implementation for Linux, developed by Red Hat.
OpenLDAP is an open-source implementation of the Lightweight Directory Access Protocol (LDAP) for directory services and authentication.
Authentik is an open-source identity provider that focuses on flexibility and integration with modern infrastructure. It provides authentication, authorization, and user management for applications and APIs.
Authelia is an open-source authentication and authorization server that provides single sign-on and two-factor authentication for web applications. It can be deployed as a reverse proxy to protect internal services.
Keycloak is an open-source identity and access management solution that provides single sign-on, user federation, and social login capabilities for web applications and services.
Zitadel is an open-source identity and access management platform that provides authentication, authorization, and user management with a focus on developer experience.