fix(kanidm): force shortname for uid/gid attr map on unixd v2 #495

Closed

lytedev wants to merge 1 commit from fix-kanidm-uid-attr-map into main

lytedev commented

2026-04-18 00:16:02 -05:00

Owner

Summary

Kanidm 1.10's unixd config v2 changed the default uid_attr_map / gid_attr_map from name to spn, so users started resolving as daniel@idm.h.lyte.dev instead of daniel. This broke local tooling assuming the bare shortname.

Pin both to "name" at the top level of unixSettings (they're top-level fields in v2; only pam_allowed_login_groups sits under [kanidm]). Verified against the kanidm source at the pinned commit c070a411 (v1.10.0-dev).

Test plan

Deploy to thinker
id daniel and getent passwd daniel resolve the kanidm user as bare daniel
SSH login as daniel still works

## Summary Kanidm 1.10's `unixd` config v2 changed the default `uid_attr_map` / `gid_attr_map` from `name` to `spn`, so users started resolving as `daniel@idm.h.lyte.dev` instead of `daniel`. This broke local tooling assuming the bare shortname. Pin both to `"name"` at the top level of `unixSettings` (they're top-level fields in v2; only `pam_allowed_login_groups` sits under `[kanidm]`). Verified against the kanidm source at the pinned commit `c070a411` (v1.10.0-dev). ## Test plan - [ ] Deploy to thinker - [ ] `id daniel` and `getent passwd daniel` resolve the kanidm user as bare `daniel` - [ ] SSH login as `daniel` still works

lytedev added 1 commit

2026-04-18 00:16:02 -05:00

fix(kanidm): force shortname for uid/gid attr map on kanidm 1.10 unixd v2

/ build (push) Waiting to run

Details

/ check-format (push) Has been cancelled

Details

6bc26dd084

Kanidm 1.10's unixd config v2 changed the default uid_attr_map/gid_attr_map
to "spn", causing users to resolve as "name@idm.h.lyte.dev" instead of
"name". Pin both to "name" to restore pre-upgrade behavior.