skills.rest
Probably-Group
Probably-GroupOFFICIAL
Explore all skills by this author →
Website𝕏@problynotingGitHub

kanidm-expert

Design secure Kanidm deployments for OAuth2/OIDC, LDAP, and WebAuthn.

3|1|Updated Dec 3, 2025
Search Tags:#mfa#oidc#oauth2#webauthn#security hardening#ldap#kanidm
One-click install
npx skills add https://github.com/Probably-Group/Dev-AID --skill kanidm-expert-probably-group
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: kanidm-expert
Source: https://github.com/Probably-Group/Dev-AID/tree/main/.dev-aid/skills/expert/kanidm-expert
Command: npx skills add https://github.com/Probably-Group/Dev-AID --skill kanidm-expert-probably-group

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps you deploy and integrate Kanidm identity management securely, preventing common OAuth2/OIDC, LDAP, and WebAuthn configuration mistakes that can lead to account takeover, token theft, or weak authentication.

Core Features & Use Cases

  • Secure Kanidm server configuration: Produce hardened production settings for TLS, network binding, backups, and operational expectations.
  • OAuth2/OIDC client and provider integration: Guide the creation of Kanidm OAuth2/OIDC clients with strict redirect URI validation, PKCE, scope mapping, and safe session/token assumptions.
  • LDAP gateway and WebAuthn (passkey) readiness: Implement LDAPS-only LDAP integration patterns and configure WebAuthn/MFA expectations for privileged access.
  • Use Case: You are standing up Kanidm to serve as an IdP for an internal app, legacy LDAP consumers, and admin passkeys; use this Skill to generate configuration and integration steps that are aligned with the included security guardrails.

Quick Start

Use the kanidm-expert skill to design a production-ready Kanidm setup for OAuth2/OIDC (with PKCE and exact redirect URIs), LDAPS gateway integration, and enforced WebAuthn for admin accounts.

Frequently Asked Questions about kanidm-expert

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure Kanidm OAuth2 clients with PKCE and strict redirect URIs?▼

To configure Kanidm OAuth2 securely, you must enforce PKCE for all clients and use exact redirect URI validation to prevent token theft. This approach also involves configuring strict scope mapping and safe session handling.

What is the best way to set up an LDAPS gateway with Kanidm?▼

The best way to set up an LDAPS gateway in Kanidm is to enforce LDAPS-only integration patterns. This ensures encrypted traffic for legacy LDAP consumers and prevents credential exposure during transit.

How do I enforce WebAuthn passkeys for Kanidm admin accounts?▼

You can enforce WebAuthn for Kanidm admins by configuring MFA and passkey enrollment specifically for privileged access. This reduces high-risk misconfiguration and blocks account takeover attempts.

Does Kanidm support OIDC integration with group-based authorization?▼

Yes, Kanidm supports OIDC integration with group-based authorization. You can map scopes to specific groups, ensuring clients only receive permissions aligned with validated user sessions and credential handling.

What Kanidm server settings are needed for a hardened production deployment?▼

Hardened Kanidm production deployments require proper TLS configuration, secure network binding, and automated backups. These settings establish operational expectations and protect identity management data.

Related Skills

Explore More Software Engineering Skills→
cornmanwtfcornmanwtf

certificate-manager

Automate TLS certificate rotation and mTLS configuration for secure communication.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

adcs-template-abuse

Exploit misconfigured AD CS templates to impersonate domain users via SAN manipulation.

Official
Advanced
jonnymuirjonnymuir
1

generic-oidc-logout-id-token-hint

Implement RP-initiated logout for generic OIDC providers using stored ID tokens.

Community
Intermediate
BlackBeltTechnologyBlackBeltTechnology

judo-runtime:custom-auth

Implement custom authentication and authorization providers in the JUDO runtime framework.

Official
Advanced