5.4k stars · MPL-2.0 · v1.11.2 (2026-09-11), read from /releases/latest; the date showed no year and falls in the past, so 2026. That release fixes a moderate LDAP bind issue described on its own page · Track this in Scout
One identity server with its own embedded storage, speaking OAuth2, OpenID Connect and LDAP, with passkeys as the normal way in.
▶Repo detailsthe review · specs · pros & cons · install
What it is
An identity management server written in Rust. It speaks OAuth2 and OpenID Connect for modern applications and LDAP for older ones, and it ships as a single service with its own embedded database rather than a stack of parts. It supports passkeys, one-time codes, groups, and rules about which group may enter which application.
What it is good for. A solo builder whose server has quietly grown five private screens: a container manager, a log viewer, a monitoring page, a database tool, an invoice app. The problem it removes is five sets of credentials and no way to revoke them at once. When somebody stops helping you, you switch off one account instead of remembering five. This ledger already holds two answers to the same question, and you should pick one: Logto (Edition 11 #4) is aimed at signing in the customers of a product, and Pocket ID (Edition 18 #4) is the small passkey-only option. Kanidm sits between them and is stricter than either about security defaults.
- One program, with its own storage. There is no separate database, cache or queue to run and back up.
- Passkeys are treated as the normal way in rather than an extra, and the project takes a hard line on weak settings.
- MPL-2.0, which only asks you to publish changes you make to the project's own files. Building a paid product around it is fine.
- It refuses to run without HTTPS and a valid certificate, so there is no five-minute version to try.
- The strict defaults mean some older applications simply will not connect, and the answer is usually to change the application.
- It is smaller than Authentik or Authelia, so there are fewer step-by-step guides when you get stuck.
- goauthentik/authentik
Does the same job with a much larger feature list and a friendlier admin screen, at the cost of running several containers instead of one.
Track this in Scout 
authelia/autheliaSits in front of your web server and asks for a second factor before letting anyone through, which is simpler but gives applications less to work with.
Track this in Scout
pocket-id/pocket-idPasskeys only, and deliberately small; the right choice if you want sign-in and nothing else.
Track this in Scout
sudo mkdir -p /opt/kanidm/data # Write /opt/kanidm/server.toml with your domain, your origin URL, # and the paths to your certificate and key. The exact fields are listed at # https://kanidm.github.io/kanidm/stable/server_configuration.html sudo docker run -d --name kanidm \ -p 443:8443 \ -v /opt/kanidm:/data \ docker.io/kanidm/server:latest # Recover the first administrator account: sudo docker exec -i -t kanidm kanidmd recover-account admin
