Kanidm
| License | FOSS problems | Maintenance | SSO | Users | Tested |
|---|---|---|---|---|---|
| MPL-2.0Copyleft license. Only the covered files must stay open — surrounding proprietary code in separate files is permitted. | — | Active | ✅ | Unlimited | ❌ |
Description
Kanidm is a Rust-based identity management platform aimed at replacing the "Keycloak plus a separate LDAP server" combination with one cohesive system — security and correctness as first design principles, the same philosophy Rauthy shares, just scoped to cover more ground (LDAP and RADIUS too, not just OIDC).
Features
- OIDC, LDAP, and RADIUS in one system — where Rauthy is OIDC-only, Kanidm also acts as a directory and can authenticate network/VPN access via RADIUS.
- SSH key management and Linux/Unix integration — can distribute SSH keys and act as an identity source for system-level Unix logins, not just web apps.
- Passkey-first — built around modern authentication from the start rather than added later.
- Rust memory safety — the same class of vulnerability (buffer overflows, use-after-free) that's historically hit identity servers written in memory-unsafe languages is structurally ruled out.
Usage patterns
Same central-SSO role as the rest of this catalog, with a wider scope if the LDAP/RADIUS/SSH pieces are ever actually needed — e.g. authenticating VPN access or managing SSH keys across servers, not just web app SSO. For this project's current actual need (OIDC SSO for self-hosted web apps), those extra capabilities are unused surface area, not a benefit.
License and governance
MPL-2.0, fully open source — no CLA, no dual-licensing, no commercial tier gating anything. Cleaner licensing story than Zitadel or Logto in this same catalog.
Conclusion
Why you would — the licensing is the cleanest of any option evaluated here, and the Rust/security-first philosophy plus LDAP+RADIUS+SSH scope make it a genuinely different tool than an OIDC-only provider, worth it specifically if those extra capabilities would actually get used.
Why you wouldn't — younger and less feature-complete than Keycloak or even Authentik; the extra scope (LDAP/RADIUS/SSH) is dead weight for a setup that's purely OIDC SSO for web apps, and a newer project carries more operational risk than something with Authentik's track record.
Sources: Kanidm, Kanidm GitHub