Reference labs: FreeIPA and Kanidm

Optional labs for walking the same paths — host join, HBAC or host access, sudo, SSH keys — in systems that already exist in the wild. They are orientation, not prerequisites. Linux Directory’s core server remains D + SQL; see the landscape survey.

What these labs illuminate

Check	FreeIPA	Kanidm
Host enrollment	ipa-client-install	kanidm-unixd / enroll
User login (PAM/NSS)	SSSD	kanidm PAM/NSS
Host access control	HBAC rules	groups / PAM (partial)
Central sudo	sudo rules	External or absent
SSH public keys	from IPA	from Kanidm
OIDC / passkeys	available in newer releases	native

FreeIPA (quick path)

1. A RHEL, Fedora, or CentOS Stream VM suits the server well — that is where packaging and docs concentrate.
2. Install the FreeIPA server (ipa-server-install); note the realm and admin password.
3. On an Ubuntu and a CachyOS client (where packages allow), enroll and try:
   • su / SSH as an IPA user
   • an HBAC deny and allow for one host
   • a sudo rule for a group
   • an SSH key stored in IPA used for login
4. Note packaging and client gaps on Ubuntu and CachyOS — they are often thinner than on RHEL-family hosts.

Kanidm (quick path)

1. Follow the Kanidm book — a single-binary server with a lighter footprint.
2. Create an admin, a POSIX account, and a group; enroll a Unix client (Ubuntu, Debian, CachyOS, Fedora, or openSUSE — see Distributions).
3. Try login, offline or TPM paths if available, SSH keys, OIDC app login, and RADIUS if that matters to you.
4. Observe how host access and central sudo compare with FreeIPA’s rule model.

What this means for Linux Directory

• Host join and cached login work on Ubuntu LTS and CachyOS.
• HBAC and sudo are first-class; an empty HBAC set means allow-all until rules exist.
• OIDC, passkeys, and optional Tailscale favor a lean operational story.
• Native fleet packages and energy policy are part of lindir’s own shape (Fleet).