c798322ad8
Implements #60 authsession garbage collection. If we assume that an authsession is around 1024 bytes (this assumes a 16 char name + groups + claims) then this means that in 1Gb of ram we can store about 1 million in progress auth attempts. Obviously, we don't want infinite memory growth, but we can't use an LRU cache due to the future desire to use concurrent trees. So instead we prune the tree based on a timeout when we start and auth operation. Auth session id's are generated from a timestamp similar to how we'll generate replication csn's. We can then apply a diff that will split all items lower than the csn/sid and remove them from future consideration. We set the default timeout to 5 minutes. This means that assuming 10,000 auths per second, we would require 3GB of ram to process these sessions before they are expired. We expect any deployment with such large loadings can affort 3Gb of ram :) |
||
|---|---|---|
| artwork | ||
| designs | ||
| rsidm_client | ||
| rsidm_proto | ||
| rsidm_tools | ||
| rsidmd | ||
| .dockerignore | ||
| .gitignore | ||
| Cargo.toml | ||
| CHECKLIST.md | ||
| CODE_OF_CONDUCT.md | ||
| CONTRIBUTORS.md | ||
| Dockerfile | ||
| LICENSE.md | ||
| pull_request_template.md | ||
| README.md | ||
Kanidm
Kanidm is an identity management platform written in rust. Our goals are:
- Modern identity management platform
- Simple to deploy and integrate with
- Extensible for various needs
- Correct and secure behaviour by default
Today the project is still under heavy development to achieve these goals - we don't expect a fully functional release before early 2020. It is important to note that not all needed security features of the system have been completed yet!
Code of Conduct
Some key ideas
- All people should be respected and able to be respresented securely.
- Devices represent users and their identities - they are part of the authentication.
- Human error occurs - we should be designed to minimise human mistakes and empower people.
- The system should be easy to understand and reason about for users and admins.
Quick start
Details to come ...
Implemented/Planned features
- RBAC design
- SSH key distribution for servers
- Pam/nsswitch clients (with limited offline auth)
- Sudo rule distribution via nsswitch
- CLI and WebUI for administration
- OIDC/Oauth
- Claims (limited by time and credential scope)
- MFA (Webauthn, TOTP)
- Highly concurrent desgin (MVCC, COW)
- Replication (async multiple active write servers, read only servers)
- Account impersonation
- RADIUS integration
- Self service UI with wifi enrollment, claim management and more.
- Synchronisation to other IDM services
Features we want to avoid
- Auditing: This is better solved by SIEM software, so we should generate data they can consume.
- Fully synchronous behaviour: This is slow.
- Generic database: We don't want to be another NoSQL database, we want to be an IDM solution.
- Being LDAP/GSSAPI/Kerberos: These are all legacy protocols that are hard to use and confine our thinking - we should avoid "being like them".
Designs
See the designs folder
Get involved
To get started, you'll need to fork or branch, and we'll merge based on PR's.
If you are a contributor to the project, simply clone:
git clone git@github.com:Firstyear/kanidm.git
If you are forking, then Fork in github and clone with:
git clone https://github.com/Firstyear/kanidm.git
cd kanidm
git remote add myfork git@github.com:<YOUR USERNAME>/kanidm.git
Select and issue (and always feel free to reach out to us for advice!), and create a branch to start working:
git branch <feature-branch-name>
git checkout <feature-branche-name>
When you are ready for review (even if the feature isn't complete and you just want some advice)
git commit -m 'Commit message' change_file.rs ...
git push <myfork/origin> <feature-branch-name>
If you get advice or make changes, just keep commiting to the branch, and pushing to your branch. When we are happy with the code, we'll merge in github, meaning you can now cleanup your branch.
git checkout master
git pull
git branch -D <feature-branch-name>
Rebasing:
If you are asked to rebase your change, follow these steps:
git checkout master
git pull
git checkout <feature-branche-name>
git rebase master
Then be sure to fix any merge issues or other comments as they arise. If you have issues, you can always stop and reset with:
git rebase --abort
Why do I see rsidm references?
The original project name was rsidm while it was a thought experiment. Now that it's growing and developing, we gave it a better project name. Kani is Japanese for "crab". Rust's mascot is a crab. It all works out in the end.