fix: disable kanidm anon account in kanidm unit

2025-07-10 11:59:56 +03:00
parent 76cc815db0
commit cf160379c0
2 changed files with 5 additions and 3 deletions
--- a/auth/auth-module.nix
+++ b/auth/auth-module.nix
@@ -81,9 +81,6 @@ let
            fi
        fi

-        # disable anonymous account because it allows to freely iterate over all users on kanidm instance.
-        $KANIDM service-account validity expire-at anonymous epoch
-
        # create a new token for kanidm
        if ! KANIDM_SERVICE_ACCOUNT_TOKEN_JSON="$($KANIDM service-account api-token generate --name idm_admin "${kanidmServiceAccountName}" "${kanidmServiceAccountTokenName}" ${lib.strings.optionalString isRW "--rw"} --output json)"
        then