fix: disable kanidm anon account in kanidm unit

2025-07-10 11:59:56 +03:00
parent 76cc815db0
commit cf160379c0
2 changed files with 5 additions and 3 deletions
--- a/auth/kanidm.nix
+++ b/auth/kanidm.nix
@@ -234,7 +234,12 @@ let
    export KANIDM_URL="${cfg.provision.instanceUrl}"
    export KANIDM_SKIP_HOSTNAME_VERIFICATION="true"
    KANIDM_PASSWORD="$KANIDM_IDM_ADMIN_PASSWORD" ${cfg.package}/bin/kanidm login
+
+    # disable anonymous account because it allows to freely iterate over all users on kanidm instance.
+    ${cfg.package}/bin/kanidm service-account validity expire-at anonymous epoch
+
    ${createAndPopulateGroups}
+
    unset HOME
    unset KANIDM_NAME
    unset KANIDM_URL