Hackeriet members can begin onboarding by visiting the Hacker-ID section in Hula:

https://hackeriet.no/hula/idp/

All services enrolled into Hacker-ID are documented using tags in Netbox:

• Hacker-ID: LDAP – Not currently implemented
• Hacker-ID: RADIUS – Not currently implemented
• Hacker-ID: SSH – SSH daemon reads authorized keys from Hacker-ID
• Hacker-ID: SSO – OpenID/OAuth2 authentication flow
• Hacker-ID: Unix – Integrated into the user database for the host (UIDs/GIDs, sudo, passwd, VTY consoles…)

All members with an active Hackerhula account can initiate onboarding into Hacker-ID by visiting the Hacker-ID page. Following instructions in Hula for more details, or ask an IDP admin for help.

https://hackeriet.no/hula/idp/

Implementation of Hacker-ID onboarding is discussed in this Github ticket: https://github.com/hackeriet/hackerhula/pull/43

All users are able to change their personal information.

This includes the login name used for both the web portal, and any Unix accounts used on servers. This can be done from the profile section of the self-service portal: https://idp.hackeriet.no/ui/profile

Unless noted otherwise here, all services consuming Hacker-ID supports account renames/email changes.

You can also rename and update your account profile using the CLI:

• Account name:

  kanidm person update d404d --newname testlmao

• Display name:

  kanidm person update d404d --displayname "Epic New Hacker Name"

• Email:

  kanidm person update d404d --email "<somehandle>@hackeriet.no"

During the draft phase, the following groups have been configured:

IDP admins may always step in to assist, shall any of the groups be orphaned (no active/reachable members).

Kanidm can be used as a resolve-through locally caching authentication handler, resilient to network failures and transparently allowing existing local credentials to be used as-is.

There's relatively few steps compared to some other authentication provider solutions:

1. Install the client tools repo
2. Configure ''kanidm-unixd''
   1. Edit config file /etc/kanidm/config: Set uri to https://idp.hackeriet.no
   2. Edit config file /etc/kanidm/unixd: Set pam_allowed_login_groups to hackeriet-members or other relevant groups
      1. Optional: Add group mappings, like sudo or docker rights:

         [[kanidm.map_group]]
         local = "sudo"
         with = "hackeriet-members"
         
         [[kanidm.map_group]]
         local = "docker"
         with = "hackeriet-members"

3. Tell Linux to proxy user and group lookups through ''kanidm-unixd''
4. Register the Kanidm PAM modules
   1. Debian/Ubuntu/Raspbian: This step can be skipped, although the bundled unix-chkpwd AppArmor profile on Ubuntu must be disabled/fixed
   2. Fedora/CentOS/Rocky
      1. Note: SELinux profiles are NOT included
   3. Others
5. Set kanidm as a global authorized keys command and apply additional SSH hardening

Restart kanidm-unixd service, review the unit logs, and attempt login using kanidm-unix:

# kanidm-unix status
system: online
Kanidm: online

# kanidm-unix auth-test --name d404d
Enter Unix password: [hidden]
auth success!
account success!

If for some reason a user needs to be onboarded through the CLI, use the following sequence of commands:

kanidm person create "<username>" "<display name>"
kanidm person update "<username>" --mail "<mail>"
kanidm person posix set
kanidm group add-members hackeriet-members "<username>"
kanidm person credential create-reset-token "<username>" "<expiry in seconds>"

• Some information is publicly accessible, as required by unix/posix integrations: https://kanidm.github.io/kanidm/stable/accounts/anonymous_account.html#access
  • Anonymous access will be removed once this draft is finalized: https://kanidm.github.io/kanidm/master/developers/designs/domain_join_machine_accounts.html
• Users are allowed to change all details about their profile! NEVER consider anything but the user UUID to be user identifiable (see the sub claim or uuid claims re. OpenIDC)
  • THIS INCLUDES THE USERNAME AND EMAIL

Rough notes for the moment:

• Hosted on idp1.hackeriet.no
• Authentication realm is idp.hackeriet.no
• Public portal and API on https://idp.hackeriet.no
• Internal services (SSH, LDAP, RADIUS etc.) will be exposed on int-idp.hackeriet.no
  • We won't be able to get LDAP certs for the right hostname on the internal interface… If this turns out to be a dealbreaker it might be better to solve this using NAT rather than moving the host entirely onto VLAN 130.
• Located in /srv/kanidm
  • One docker compose stack with Traefik (for certificate issuance as LE needs this in-line) and Kanidm
  • Dedicated v6 subnet defined in compose and in /etc/docker/daemon.json in order for XFF mapping to work properly
  • Communication between the two are encrypted using a self-signed certificate (Kanidm requires last-hop encryption)
  • Created user and group “kanidm” in the host, which will represent the kanidm container's resources. Rights configured according to https://kanidm.github.io/kanidm/stable/security_hardening.html#security-hardening
• Kanidm includes built-in backup solution and replication
  • No mirroring of the backups has been configured yet
• Set up kanidm-unixd for idp1.hackeriet.no
  • Installed daemon
  • Added to SSH config
  • Added to nsswitch
  • For Debian flavours incl. Ubuntu and Raspbian, installing kanidm-unixd and configuring the two config files in /etc/kanidm should be enough wrt. PAM
  • AppArmor default profiles blocks access to the service socket used, need to amend the profile with the correct paths then reload & restart