The landscape of Linux identity systems
A quiet survey of how communities have gathered users, hosts, and policy under one roof — and where Linux Directory (lindir) sits among them: a greenfield IdM with a D server backend, PostgreSQL or MySQL storage, first-class CachyOS and Ubuntu support, and optional pluggable Tailscale/VPN.
Scope
Linux Directory centers on identity and host enrollment/policy (users, groups, hosts, auth, sudo/HBAC, SSH keys) and optional mesh VPN management, with native fleet care: apt/pacman/dnf/zypper packages, energy policies, vulnerability findings, inventory, and remote queries/scripts. Groupware and mail live in companions such as Nextcloud via OIDC.
Capability mapping
| Desired capability | Familiar directory analogue | Linux-native approach |
|---|---|---|
| Central users/groups | Directory + domain accounts | IDM directory + POSIX attrs (SQL in lindir) |
| Machine identity / join | Computer accounts | Host enrollment |
| Auth / SSO | Kerberos | Kerberos and/or OIDC + PAM/NSS |
| Who may log into which host | Directory ACLs / host policy | HBAC, PAM groups, RBAC |
| Privileged commands | Restricted groups / host policy | Central sudo rules |
| Secrets for services | Keytabs / certs | Keytabs, CA, or passkeys |
| Name resolution | Integrated DNS | Integrated or external DNS |
| Site / remote connectivity | Site VPN | Optional mesh VPN (Tailscale) via plugin |
| Distro support | Domain-joined client SKUs | First-class CachyOS and Ubuntu |
| Config / packages / device management | Central policy + update services | lindir native fleet (apt/pacman + energy); optional Ansible/Landscape |
| Power / sleep policy | Central power settings | lindir energy policies (logind / DPMS / dconf) |
| Mail / calendar / contacts | Groupware suite | Companion Nextcloud via OIDC (Handbook §8.6) |
Systems worth knowing
FreeIPA
An integrated stack: 389 Directory Server, MIT Kerberos, Dogtag CA, optional DNS, and SSSD on clients. Host-based access control, sudo, host enrollment, and multi-master replication are mature. Operational weight is substantial; packaging and documentation lean toward RHEL-family servers, with Ubuntu and Arch as secondary citizens.
Kanidm
A modern Rust identity service: OIDC, passkeys, Unix PAM/NSS, SSH keys, RADIUS, and read-only LDAP. Footprint and day-to-day ops tend to be lighter. Host-based access control and central sudo are thinner than in FreeIPA; much of the operator surface is CLI-oriented.
DIY LDAP + Kerberos
Maximum flexibility. The ongoing cost is integration: enrollment, HBAC, sudo, certificates, and client tooling become a project of their own.
LLDAP + Authentik/Keycloak
A natural fit for application logins and web SSO. Computer-domain concerns — host enrollment, HBAC, central sudo — are largely outside this pairing’s center of gravity.
Adjacent paths
Samba as a domain controller, Keycloak or Authentik alone for application SSO, and cloud identity providers guiding Linux fleets: each occupies its own orbit; Linux Directory’s center of gravity remains a Linux-native directory with host policy and fleet care.
Feature orientation
Legend: Y = well supported, P = partial or emerging, N = not a primary focus of that system.
| Desired feature | FreeIPA | Kanidm | LDAP+Krb DIY | LLDAP+OIDC | lindir |
|---|---|---|---|---|---|
| Central users/groups | Y | Y | Y | Y | Y |
| Host / machine enrollment | Y | Y | P | N | Y |
| Offline / cached login | Y | Y | P | N | Y |
| Kerberos SSO | Y | N/P | Y | N | P |
| OIDC / app SSO | P | Y | N | Y | Y |
| Passkeys / WebAuthn | P | Y | N | P | Y |
| HBAC | Y | P | P | N | Y |
| Central sudo rules | Y | N/P | P | N | Y |
| SSH key distribution | Y | Y | P | N | Y |
| Integrated CA | Y | P | P | N | P |
| Integrated DNS | Y | N | P | N | P (external OK) |
| RADIUS | P | Y | P | N | P |
| Tailscale / mesh VPN mgmt | N | N | N | N | Y (plugin) |
| Pluggable VPN architecture | N | N | N | N | Y |
| Multi-master / HA | Y | Y | P | P | P (SQL HA) |
| Admin Web UI | Y | P | N | Y | Y |
| Low ops complexity | N | Y | N | Y | Y |
| First-class Ubuntu | P | P | P | P | Y |
| First-class CachyOS / Arch | N | P | P | P | Y |
| SQL store (Postgres/MySQL) | N | N | N | N | Y |
| Native fleet packages (apt/pacman) | N | N | N | N | Y |
| Energy / power policies | P | N | N | N | Y |
| D language server | N | N | N | N | Y |
| Linux-native directory (no Windows DC required) | Y | Y | Y | Y | Y |
Companion fleet and collaboration
lindir ships a native fleet layer with first-class apt/pacman package management and energy policies (Fleet). Ansible, Landscape, and Foreman remain welcome companions when an estate already orbits them.
For files, calendar, and contacts, use Nextcloud as an OIDC relying party (Handbook §8.6). Optional IMAP backends (Mailcow, Stalwart) remain separate mailbox stacks.