Kanidm on Ubuntu 24.04 LTS
by cloudimg
A directory and identity provider that ships with no default password to change.
One server for identity, not two
Kanidm is a complete identity management platform: the directory that holds your people, groups and service accounts, and the identity provider those accounts authenticate against. Most self hosted identity products are one or the other, so a working deployment means running a directory and a federation front end and keeping them in step. Kanidm is both, in a single statically linked Rust binary, with a web interface for administration and self service, a REST API, a read only LDAP endpoint for applications that only speak LDAP, an OAuth2 and OpenID Connect provider for applications that speak modern federation, RADIUS secrets for network authentication, and POSIX attributes for Unix login.
No default password, and none generated for you
This is the defining property of the image and it is stronger than the usual arrangement. Kanidm ships two break glass accounts, admin and idm_admin, and neither holds any credential at all: they cannot authenticate over HTTPS, LDAPS, OAuth2 or RADIUS. There is no vendor default to change and no password written to a file at first boot for you to find, so there is no window between a machine booting and being secured in which anyone could sign in. The first credential on the server is one you mint yourself, from a root shell, with a single documented command that prints a freshly generated password once. Before release this was proven on a fresh machine in both directions: both accounts were refused, the documented recovery was run, the printed password then worked, and the account that had not been recovered was still refused.
What is on it
Kanidm 1.11.2, released 11 September 2026, built from the upstream git tag with the tag verified against its commit before anything is compiled, plus the matching command line client. Ubuntu 24.04 LTS, fully patched at build time with unattended security upgrades armed. Kanidm is written in Rust and upstream publishes no binary for this release, so the image is compiled from source; the compiler, linker and build tree live on a scratch volume destroyed before capture, and the absence of any toolchain is then asserted against both the filesystem and the package database.
Exposed surface
Off the VM, this image answers on ports 22, 443 and 636 only, and that set is asserted by equality against every socket the machine opens rather than against a list of the services we expected. Port 636 is the LDAP endpoint, and it is safe to expose by design rather than by configuration: Kanidm serves LDAP over TLS only, it does not implement StartTLS at all, it rejects every write, and a bind with a POSIX password is granted only anonymous level read. TLS is mandatory and there is no reverse proxy: the server terminates TLS itself, so no client supplied forwarding header is trusted by anything. The certificate and its authority are minted on each machine at first boot, and two machines from this image were compared before release with no key material, host identity or certificate in common.
Licence and attribution
Kanidm is published under the Mozilla Public License 2.0, and the licence text ships in the image. Kanidm is an independent open source project; cloudimg is not affiliated with, endorsed by, or sponsored by it, and the name is used only to identify the software this image runs.
Support
24/7 support from cloudimg, and a step by step deployment guide covering the first administrator credential, choosing a domain name, creating people and groups, connecting applications over LDAP and OpenID Connect, replacing the TLS certificate and backups.