lytedev/nix
1
0
Fork 2
Code Pull requests 7 Activity Actions

wip: docs(issues): design for unifying local auth (kanidm, FIDO2 PAM, Vaultwarden) #831

Draft
lytedev wants to merge 1 commit from local-auth-unification into main
pull from: local-auth-unification
merge into: lytedev:main
Conversation 0 Commits 1 Files changed 1 +109
lytedev commented 2026-07-29 12:33:22 -05:00
Owner
Copy link

Captures the design discussion as an issue in issues/open/. Docs-only — no config changes.

Position: unify the unlock (one hardware authenticator feeding kanidm, PAM/sudo and LUKS), not the storage. Machine secrets stay on sops-nix.

Records four concrete findings from surveying the repo and upstream:

  • kanidm PAM is mkForce false fleet-wide over a uid-2001-vs-1000 collision — that's the real blocker.
  • kanidm passkeys can't back PAM login; that's pam_u2f + systemd-cryptenroll.
  • Goldwarden (Vaultwarden→Secret Service) is removed from nixpkgs and abandoned.
  • Passkey login to Vaultwarden (WebAuthn PRF) hasn't landed server-side.

Follow-up work is sequenced as three independent PRs in the issue.

Captures the design discussion as an issue in `issues/open/`. Docs-only — no config changes. Position: unify the **unlock** (one hardware authenticator feeding kanidm, PAM/sudo and LUKS), not the **storage**. Machine secrets stay on sops-nix. Records four concrete findings from surveying the repo and upstream: - kanidm PAM is `mkForce false` fleet-wide over a uid-2001-vs-1000 collision — that's the real blocker. - kanidm passkeys can't back PAM login; that's `pam_u2f` + `systemd-cryptenroll`. - Goldwarden (Vaultwarden→Secret Service) is removed from nixpkgs and abandoned. - Passkey login to Vaultwarden (WebAuthn PRF) hasn't landed server-side. Follow-up work is sequenced as three independent PRs in the issue.
docs(issues): design for unifying local auth (kanidm identity, FIDO2 PAM, Vaultwarden)
All checks were successful
/ check-format (push) Successful in 9s
Details
/ build (push) Successful in 5m54s
Details
f4d8208c4c 
Captures the three-plane split (human secrets / machine secrets / identity)
and the position that the unification belongs at the unlock — one hardware
authenticator, three consumers — not at the storage layer.

Records the concrete blockers found while surveying the repo:

- kanidm PAM is mkForce-disabled fleet-wide (default-module.nix plus dragon,
  foxtrot and fennec) because kanidm's posix daniel is uid 2001 while the
  nix-provisioned daniel is uid 1000, so pam_kanidm starts sessions as the
  wrong user.
- kanidm passkeys cannot back PAM login at all (kanidm_unixd caches password
  hashes, not offline WebAuthn), so local passkey login is pam_u2f and
  systemd-cryptenroll, a separate mechanism sharing the same key.
- Goldwarden, the only Vaultwarden-to-Secret-Service bridge, is removed from
  nixpkgs and abandoned upstream.
- Passkey login to Vaultwarden (WebAuthn PRF) has not landed server-side.

Also states as a standing constraint that machine secrets stay on sops-nix and
must not be wired to Vaultwarden, since an unlock-gated network-dependent store
cannot serve secrets to services at boot.
lytedev changed title from docs(issues): design for unifying local auth (kanidm, FIDO2 PAM, Vaultwarden) to wip: docs(issues): design for unifying local auth (kanidm, FIDO2 PAM, Vaultwarden) 2026-07-30 10:20:08 -05:00
All checks were successful
/ check-format (push) Successful in 9s
Required
Details
/ build (push) Successful in 5m54s
Required
Details
This pull request is marked as a work in progress.
This branch is out-of-date with the base branch
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin local-auth-unification:local-auth-unification
git switch local-auth-unification
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug
Something is wrong

  
enhancement
New feature

  
question
Awaiting information

  
scary
Potentially problematic change

  
upstream
Awaiting upstream changes

No labels
bug
enhancement
question
scary
upstream
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
lytedev/nix!831
No description provided.