Reference labs
Two kinds of lab work sit beside the product docs: orientation against other IdM systems, and regression of Linux Directory itself across real guest images.
Linux Directory isolated e2e lab
The in-tree stack under scripts/integration/e2e-lab/ brings up IdP + Postgres, Headscale, Nextcloud, and six fleet guests (Ubuntu, Debian, Arch-as-CachyOS-stand-in, Fedora, openSUSE Leap, Rocky). It is the place that encoded day-one IdM, enroll/sync, Headscale mesh, Nextcloud SSO, console, and retire — see README.md and CHECKLIST.md there.
Operator-facing lessons from that work live in the topic guides (Client, OIDC, VPN, MDM & Compliance, Distributions, Fleet). Hypervisor plumbing (QEMU session, hostfwd ports, guest proxies) stays in the script README — not in day-to-day ops docs.
Podman suites for auth and package managers: Distributions, scripts/integration/auth/.
FreeIPA and Kanidm (orientation)
Optional labs for walking the same paths — host join, HBAC or host access, sudo, SSH keys — in systems that already exist in the wild. They are orientation, not prerequisites. Linux Directory’s core server remains D + SQL; see the landscape survey.
What these labs illuminate
| Check | FreeIPA | Kanidm |
|---|---|---|
| Host enrollment | ipa-client-install |
kanidm-unixd / enroll |
| User login (PAM/NSS) | SSSD | kanidm PAM/NSS |
| Host access control | HBAC rules | groups / PAM (partial) |
| Central sudo | sudo rules | External or absent |
| SSH public keys | from IPA | from Kanidm |
| OIDC / passkeys | available in newer releases | native |
FreeIPA (quick path)
- A RHEL, Fedora, or CentOS Stream VM suits the server well — that is where packaging and docs concentrate.
- Install the FreeIPA server (
ipa-server-install); note the realm and admin password. - On an Ubuntu and a CachyOS client (where packages allow), enroll and try:
su/ SSH as an IPA user- an HBAC deny and allow for one host
- a sudo rule for a group
- an SSH key stored in IPA used for login
- Note packaging and client gaps on Ubuntu and CachyOS — they are often thinner than on RHEL-family hosts.
Kanidm (quick path)
- Follow the Kanidm book — a single-binary server with a lighter footprint.
- Create an admin, a POSIX account, and a group; enroll a Unix client (Ubuntu, Debian, CachyOS, Fedora, or openSUSE — see Distributions).
- Try login, offline or TPM paths if available, SSH keys, OIDC app login, and RADIUS if that matters to you.
- Observe how host access and central sudo compare with FreeIPA’s rule model.
What this means for Linux Directory
- Host join and cached login work on Ubuntu LTS and CachyOS (and the wider client matrix in Distributions).
- HBAC and sudo are first-class; an empty HBAC set means allow-all until rules exist.
- OIDC, passkeys, and optional Tailscale/Headscale favor a lean operational story.
- Native fleet packages and energy policy are part of lindir’s own shape (Fleet).