kanidm · danielblignaut · May 7, 2025 · May 7, 2025 · May 7, 2025 · May 7, 2025
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -145,10 +145,10 @@ sketching = { path = "./libs/sketching", version = "=1.7.0-dev" }
 
 anyhow = { version = "1.0.98" }
 argon2 = { version = "0.5.3", features = ["alloc"] }
-askama = { version = "0.12.1", features = ["serde", "with-axum"] }
-askama_axum = { version = "0.4.0" }
+askama = { version = "0.14.0", features = ["serde_json"] }
+askama_web = { version = "0.14.0", features = ["axum-0.8"] }
 async-trait = "^0.1.85"
-axum = { version = "0.7.9", features = [
+axum = { version = "^0.8.0", features = [
     "form",
     "json",
     "macros",
@@ -158,9 +158,9 @@ axum = { version = "0.7.9", features = [
     "tokio",
     "tracing",
 ] }
-axum-extra = { version = "0.9.6", features = ["cookie"] }
+axum-extra = { version = "0.10.1", features = ["cookie"] }
 axum-macros = "0.4.2"
-axum-htmx = { version = "0.5.0", features = ["serde", "guards"] }
+axum-htmx = { version = "0.7.0", features = ["serde", "guards"] }
 base32 = "^0.5.1"
 base64 = "^0.22.1"
 base64urlsafedata = "0.5.1"
@@ -222,18 +222,18 @@ oauth2_ext = { version = "^4.4.2", package = "oauth2", default-features = false
 openssl-sys = "^0.9"
 openssl = "^0.10.72"
 
-opentelemetry = { version = "0.27.0" }
-opentelemetry_api = { version = "0.27.0", features = ["logs", "metrics"] }
-opentelemetry-otlp = { version = "0.27.0", default-features = false, features = [
+opentelemetry = { version = "0.29.0" }
+opentelemetry_api = { version = "0.29.0", features = ["logs", "metrics"] }
+opentelemetry-otlp = { version = "0.29.0", default-features = false, features = [
     "serde",
     "logs",
     "metrics",
     "http-proto",
     "grpc-tonic",
 ] }
-opentelemetry_sdk = { version = "0.27.0", features = ["rt-tokio"] }
-opentelemetry-semantic-conventions = "0.27.0"
-tracing-opentelemetry = "0.28.0"
+opentelemetry_sdk = { version = "0.29.0", features = ["rt-tokio"] }
+opentelemetry-semantic-conventions = "0.29.0"
+tracing-opentelemetry = "0.30.0"
 tracing-core = "0.1.33"
 
 peg = "0.8"
@@ -292,8 +292,8 @@ tracing-forest = "^0.1.6"
 
 url = "^2.5.2"
 urlencoding = "2.1.3"
-utoipa = { version = "4.2.0", features = ["url", "uuid"] }
-utoipa-swagger-ui = "6.0.0"
+utoipa = { version = "5.3.1", features = ["url", "uuid"] }
+utoipa-swagger-ui = "9.0.1"
 uuid = "^1.12.1"
 
 webauthn-authenticator-rs = { version = "0.5.1", features = [

diff --git a/book/src/integrations/oauth2.md b/book/src/integrations/oauth2.md
@@ -44,7 +44,7 @@ introspection.
 ## Kanidm's OAuth2 URLs
 
 Kanidm will expose its OAuth2 APIs at the following URLs, substituting
-`:client_id:` with an OAuth2 client ID.
+`{client_id}:` with an OAuth2 client ID.
 <!-- markdownlint-disable MD033 -->
 
 <dl>
@@ -57,7 +57,7 @@ URL **(recommended)**
 </dt>
 <dd>
 
-`https://idm.example.com/oauth2/openid/:client_id:/.well-known/openid-configuration`
+`https://idm.example.com/oauth2/openid/{client_id}:/.well-known/openid-configuration`
 
 This document includes all the URLs and attributes an app needs to be able to
 authenticate using OIDC with Kanidm, _except_ for the `client_id` and
@@ -79,7 +79,7 @@ URL **(recommended)**
 
 <dd>
 
-`https://idm.example.com/oauth2/openid/:client_id:/.well-known/oauth-authorization-server`
+`https://idm.example.com/oauth2/openid/{client_id}:/.well-known/oauth-authorization-server`
 
 </dd>
 
@@ -91,7 +91,7 @@ URL **(recommended)**
 
 <dd>
 
-`https://idm.example.com/oauth2/openid/:client_id:/.well-known/webfinger`
+`https://idm.example.com/oauth2/openid/{client_id}:/.well-known/webfinger`
 
 See [the WebFinger section](#webfinger) for more details, as there a number of
 caveats for WebFinger clients.
@@ -168,7 +168,7 @@ OpenID Connect Issuer URL
 
 <dd>
 
-`https://idm.example.com/oauth2/openid/:client_id:`
+`https://idm.example.com/oauth2/openid/{client_id}:`
 
 </dd>
 
@@ -180,7 +180,7 @@ OpenID Connect user info
 
 <dd>
 
-`https://idm.example.com/oauth2/openid/:client_id:/userinfo`
+`https://idm.example.com/oauth2/openid/{client_id}:/userinfo`
 
 </dd>
 
@@ -192,7 +192,7 @@ Token signing public key
 
 <dd>
 
-`https://idm.example.com/oauth2/openid/:client_id:/public_key.jwk`
+`https://idm.example.com/oauth2/openid/{client_id}:/public_key.jwk`
 
 </dd>
 
@@ -497,14 +497,14 @@ difficult to use with Kanidm:
 
   You will need a load balancer in front of Kanidm's HTTPS server to send a HTTP
   307 redirect to the appropriate
-  `/oauth2/openid/:client_id:/.well-known/webfinger` URL, *while preserving all
+  `/oauth2/openid/{client_id}:/.well-known/webfinger` URL, *while preserving all
   query parameters*. For example, with Caddy:
 
   ```caddy
   # Match on a prefix, and use {uri} to preserve all query parameters.
   # This only supports *one* client.
   example.com {
-    redir /.well-known/webfinger https://idm.example.com/oauth2/openid/:client_id:{uri} 307
+    redir /.well-known/webfinger https://idm.example.com/oauth2/openid/{client_id}:{uri} 307
   }
   ```
 

diff --git a/book/src/integrations/oauth2/examples.md b/book/src/integrations/oauth2/examples.md
@@ -981,7 +981,7 @@ server.config.yaml:
 GUI:
   authenticator:
     type: OIDC
-    oidc_issuer: https://idm.example.com/oauth2/openid/:client_id:/
+    oidc_issuer: https://idm.example.com/oauth2/openid/{client_id}:/
     oauth_client_id: <client name/>
     oauth_client_secret: <client secret>
 ```

diff --git a/libs/scim_proto/src/lib.rs b/libs/scim_proto/src/lib.rs
@@ -29,6 +29,7 @@ pub mod prelude {
     pub use crate::{ScimAttr, ScimComplexAttr, ScimEntry, ScimEntryHeader, ScimMeta, ScimValue};
 }
 
+
 #[derive(Deserialize, Serialize, Debug, Clone, ToSchema)]
 #[serde(untagged)]
 pub enum ScimAttr {
@@ -41,7 +42,7 @@ pub enum ScimAttr {
     // this point.
     #[serde(with = "time::serde::rfc3339")]
     DateTime(OffsetDateTime),
-
+    #[schema(value_type = Object)]
     Binary(Base64UrlSafeData),
     Reference(Url),
 }

diff --git a/libs/sketching/src/otel.rs b/libs/sketching/src/otel.rs
@@ -5,7 +5,7 @@ use opentelemetry_otlp::{Protocol, WithExportConfig};
 use opentelemetry::{global, trace::TracerProvider as _, KeyValue};
 
 use opentelemetry_sdk::{
-    trace::{Sampler, TracerProvider},
+    trace::{Sampler, TracerProviderBuilder},
     Resource,
 };
 use tracing::Subscriber;
@@ -86,19 +86,27 @@ pub fn start_logging_pipeline(
             // let hostname = hostname.to_string_lossy();
             // let hostname = hostname.to_lowercase();
 
-            let resource = Resource::from_schema_url(
-                [
+            let resource = Resource::builder()
+                .with_schema_url(vec![
                     // TODO: it'd be really nice to be able to set the instance ID here, from the server UUID so we know *which* instance on this host is logging
                     KeyValue::new(SERVICE_NAME, service_name),
                     KeyValue::new(SERVICE_VERSION, version),
                     // TODO: currently marked as an experimental flag, leaving it out for now
                     // KeyValue::new(DEPLOYMENT_ENVIRONMENT_NAME, hostname),
-                ],
-                SCHEMA_URL,
-            );
-
-            let provider = TracerProvider::builder()
-                .with_batch_exporter(otlp_exporter, opentelemetry_sdk::runtime::Tokio)
+                ], SCHEMA_URL)
+                .build();
+            //     .with_attributes(vec![
+            //         // TODO: it'd be really nice to be able to set the instance ID here, from the server UUID so we know *which* instance on this host is logging
+            //         KeyValue::new(SERVICE_NAME, service_name),
+            //         KeyValue::new(SERVICE_VERSION, version),
+            //         // TODO: currently marked as an experimental flag, leaving it out for now
+            //         // KeyValue::new(DEPLOYMENT_ENVIRONMENT_NAME, hostname),
+            //     ],
+            //     SCHEMA_URL,
+            // );
+
+            let provider = TracerProviderBuilder::default()
+                .with_batch_exporter(otlp_exporter)
                 // we want *everything!*
                 .with_sampler(Sampler::AlwaysOn)
                 .with_max_events_per_span(MAX_EVENTS_PER_SPAN)
@@ -137,7 +145,8 @@ pub struct TracingPipelineGuard {}
 
 impl Drop for TracingPipelineGuard {
     fn drop(&mut self) {
-        opentelemetry::global::shutdown_tracer_provider();
+        // TODO: https://github.com/open-telemetry/opentelemetry-rust/blob/main/opentelemetry-sdk/CHANGELOG.md how to remove tihs?
+        // opentelemetry::global::shutdown_tracer_provider();
         eprintln!("Logging pipeline completed shutdown");
     }
 }
diff --git a/proto/src/internal/credupdate.rs b/proto/src/internal/credupdate.rs
@@ -133,7 +133,9 @@ pub enum CURegState {
     TotpNameTryAgain(String),
     TotpInvalidSha1,
     BackupCodes(Vec<String>),
+    #[schema(value_type = Object)]
     Passkey(CreationChallengeResponse),
+    #[schema(value_type = Object)]
     AttestedPasskey(CreationChallengeResponse),
 }
 
@@ -185,7 +187,7 @@ pub struct CUStatus {
 
     pub unixcred: Option<CredentialDetail>,
     pub unixcred_state: CUCredState,
-
+    #[schema(value_type = Object)]
     pub sshkeys: BTreeMap<String, SshPublicKey>,
     pub sshkeys_state: CUCredState,
 }

diff --git a/proto/src/scim_v1/mod.rs b/proto/src/scim_v1/mod.rs
@@ -83,6 +83,7 @@ pub struct ScimMail {
 #[serde(rename_all = "camelCase")]
 pub struct ScimSshPublicKey {
     pub label: String,
+    #[schema(value_type = Object)]
     pub value: SshPublicKey,
 }
 

diff --git a/proto/src/v1/auth.rs b/proto/src/v1/auth.rs
@@ -60,9 +60,11 @@ pub enum AuthCredential {
     Anonymous,
     Password(String),
     Totp(u32),
+    #[schema(value_type = Object)]
     SecurityKey(Box<PublicKeyCredential>),
     BackupCode(String),
     // Should this just be discoverable?
+    #[schema(value_type = Object)]
     Passkey(Box<PublicKeyCredential>),
 }
 
@@ -151,7 +153,9 @@ pub enum AuthAllowed {
     BackupCode,
     Password,
     Totp,
+    #[schema(value_type = Object)]
     SecurityKey(RequestChallengeResponse),
+    #[schema(value_type = Object)]
     Passkey(RequestChallengeResponse),
 }
 

diff --git a/proto/src/v1/unix.rs b/proto/src/v1/unix.rs
@@ -12,6 +12,7 @@ use crate::constants::{ATTR_GROUP, ATTR_LDAP_SSHPUBLICKEY};
 #[allow(dead_code)]
 #[derive(ToSchema)]
 #[schema(as = KeyTypeKind)]
+#[schema(value_type = Object)]
 pub struct KeyTypeKindSchema(KeyTypeKind);
 
 #[derive(ToSchema)]
@@ -21,19 +22,23 @@ pub struct KeyTypeSchema {
     pub short_name: &'static str,
     pub is_cert: bool,
     pub is_sk: bool,
+    #[schema(value_type = Object)]
     pub kind: KeyTypeKind,
     pub plain: &'static str,
 }
 
 #[allow(dead_code)]
 #[derive(ToSchema)]
 #[schema(as = PublicKeyKind)]
+#[schema(value_type = Object)]
 pub struct PublicKeyKindSchema(PublicKeyKind);
 
 #[derive(ToSchema)]
 #[schema(as = SshPublicKey)]
 pub struct SshPublicKeySchema {
+    #[schema(value_type = Object)]
     pub key_type: KeyType,
+    #[schema(value_type = Object)]
     pub kind: PublicKeyKind,
     pub comment: Option<String>,
 }
@@ -74,6 +79,7 @@ pub struct UnixUserToken {
     pub uuid: Uuid,
     pub shell: Option<String>,
     pub groups: Vec<UnixGroupToken>,
+    #[schema(value_type = Object)]
     pub sshkeys: Vec<SshPublicKey>,
     // The default value of bool is false.
     #[serde(default)]

diff --git a/server/core/Cargo.toml b/server/core/Cargo.toml
@@ -20,8 +20,8 @@ default = []
 dev-oauth2-device-flow = []
 
 [dependencies]
-askama = { workspace = true, features = ["with-axum"] }
-askama_axum = { workspace = true }
+askama = { workspace = true }
+askama_web = { workspace = true }
 axum = { workspace = true }
 axum-htmx = { workspace = true }
 axum-extra = { workspace = true }

diff --git a/server/core/src/https/apidocs/mod.rs b/server/core/src/https/apidocs/mod.rs
@@ -55,8 +55,8 @@ impl Modify for SecurityAddon {
         super::v1::raw_modify,
         super::v1::raw_search,
 
-        super::v1_oauth2::oauth2_id_image_delete,
-        super::v1_oauth2::oauth2_id_image_post,
+        // super::v1_oauth2::oauth2_id_image_delete,
+        // super::v1_oauth2::oauth2_id_image_post,
         super::v1_oauth2::oauth2_get,
         super::v1_oauth2::oauth2_basic_post,
         super::v1_oauth2::oauth2_public_post,
@@ -89,10 +89,10 @@ impl Modify for SecurityAddon {
         super::v1::schema_classtype_get_id,
         super::v1::person_get,
         super::v1::person_post,
-        super::v1::service_account_credential_generate,
-        super::v1::service_account_api_token_delete,
-        super::v1::service_account_api_token_get,
-        super::v1::service_account_api_token_post,
+        // super::v1::service_account_credential_generate,
+        // super::v1::service_account_api_token_delete,
+        // super::v1::service_account_api_token_get,
+        // super::v1::service_account_api_token_post,
         super::v1::person_search_id,
         super::v1::person_id_get,
         super::v1::person_id_patch,
@@ -121,16 +121,16 @@ impl Modify for SecurityAddon {
         super::v1::person_id_radius_delete,
         super::v1::person_id_radius_token_get,
 
-        super::v1::account_id_ssh_pubkeys_get,
+        // super::v1::account_id_ssh_pubkeys_get,
         super::v1::account_id_radius_token_post,
         super::v1::person_id_unix_post,
         super::v1::person_id_unix_credential_put,
         super::v1::person_id_unix_credential_delete,
         super::v1::person_identify_user_post,
         super::v1::service_account_get,
         super::v1::service_account_post,
-        super::v1::service_account_get,
-        super::v1::service_account_post,
+        // super::v1::service_account_get,
+        // super::v1::service_account_post,
         super::v1::service_account_id_get,
         super::v1::service_account_id_delete,
         super::v1::service_account_id_patch,
@@ -150,9 +150,9 @@ impl Modify for SecurityAddon {
         super::v1::account_id_unix_post,
         super::v1::account_id_unix_auth_post,
         super::v1::account_id_unix_token,
-        super::v1::account_id_unix_token,
-        super::v1::account_id_radius_token_post,
-        super::v1::account_id_radius_token_get,
+        // super::v1::account_id_unix_token,
+        // super::v1::account_id_radius_token_post,
+        // super::v1::account_id_radius_token_get,
         super::v1::account_id_ssh_pubkeys_get,
         super::v1::account_id_ssh_pubkeys_tag_get,
         super::v1::account_id_user_auth_token_get,