canaille
Features¶
Here are the different features that Canaille provides. You can enable any of those features with the configuration to fit any use cases you may meet. Check our roadmap to see what is coming next.
Users can interact with Canaille through its web interface and administrators can also use its command line interface. Canaille can handle data stored in different database backends.
Web interface¶
Canaille web interface can be used either in production environments or locally for development purposes.
Profile management¶
Canaille provides an interface to manage user profiles.
The exact list of displayed fields, and whether they are writable or read-only depends on the user Access Control List settings (ACL).
Depending on their ACL permissions, users can either be allowed to edit their own profile, edit any user profile, or do nothing at all.
Email confirmation¶
If the email confirmation feature is enabled, any modification or addition of a profile email will send a confirmation mail to the new address. The mail will contain a link that users will need to click on to confirm their email address.
Users with user management permission can set user emails without confirmation though.
Group management¶
In a similar fashion than profile management Canaille provides an interface to manage user groups.
The group management is quite simple at the moment and consists in a group name and description, and the list of its members.
Group membership can be use as ACL Filter to define user permissions.
Todo
At the moment adding an user to a group can only be achieved by the user settings page, but we are working to improve this.
Group management can be enable with a dedicated user permission.
Important
Due to limitations in the LDAP backend, groups must have at least one member. Thus it is not possible to remove the last user of a group without removing the group.
User authentication¶
Unless their account is locked, users can authenticate with a login and a password.
Important
For security reasons, it won’t be told to users if they try to sign in with an unexisting logging, unless explicitly set in the configuration.
Todo
LDAP backend users can define which user field should be used as the login (such as user_name or emails) using a configuration parameter, but other backends can only login using user_name. We are working to improve this.
User registration¶
Users can create accounts on Canaille if the feature registration feature is enabled. They will be able to fill a registration form with the fields detailed in the default ACL settings.
If email confirmation is also enabled, users will be sent a confirmation link to their email address, on which they will need to click in order to finalize their registration.
User invitation¶
If a mail server is configured, users with user management permission can create an invitation link for one user.
The link goes to a registration form, even if regular user registration is disabled.
It can be automatically sent by email to the new user.
Account locking¶
If Canaille is plugged to a backend that supports it, user accounts can be locked by users with user management permission.
The lock date can be set instantly or at a given date in the future.
At the moment a user account is locked:
their open sessions will be closed;
they won’t be able to sign in again;
no new OIDC token will be issued;
User accounts must be manually unlocked by an administrator for the users to regain access to those actions.
Account deletion¶
Users with the account deletion permission are allowed to delete their own account.
Users that also have the user management permission are also allowed to delete other users accounts.
Password recovery¶
If a mail server is configured and the password recovery feature is enabled, then users can ask for a password reset email if they cannot remember their password.
The email will be sent to the email addresses filled in their profile, and will contain a link that will allow them to choose a new password. .
Todo
Check that password recovery is disabled on locked accounts.
Password reset¶
If a mail server is configured, user management permission can send password reset mails to users.
The mails contains a link that allow users to choose a new password without having to retrieve the old one.
Password initialization¶
User passwords are optional.
If a mail server is configured, when users with no password attempt to sign in, they are invited to click a button that will send them a password initialization mail.
The mail contains a link that leads to a form that allows users to choose a password.
Internationalization¶
Canaile will display in your preferred language if available, or your browser language if available (and if it is not you can help us with the translation).
If you prefer, you can also force a language for every users.
Lightweight¶
The web interface is lightweight, so everything should load quickly. There is a few Javascript here and there to smooth the experience, but no Javascript at all is needed to use Canaille.
Customizable¶
The default theme should be good enough for most usages.
It has a dark theme, display well on mobile, and let you choose a logo and a favicon.
If you need more you can also use a custom theme.
OpenID Connect¶
Canaille implements a subset of the OAuth2/OpenID Connect specifications . This allows to provide SSO and SLO to applications plugged to Canaille.
Consent management¶
Users can give their consent to application requesting access to their personal information, and then revoke those consent at their will.
Application management¶
Users with the right permission can manager OIDC clients through the web interface.
In some cases, it might be useful to avoid the consent page for some trusted applications, so clients can be pre-consented.
Discovery¶
Canaille implements the Discovery specifications so most of the applications plugged to Canaille can auto-configure themselves.
Dynamic Client Registration¶
Canaille implements the Dynamic Client Registration specifications, so when the feature is enabled, clients can register themselves on Canaille without an administrator intervention.
Command Line Interface¶
Canaille comes with a CLI to help administrators in hosting and management.
There are tools to check your configuration or to install missing parts.
You can use the CLI to create, read, update and delete models such as users, groups or OIDC clients.
There are also tools to fill your database with random objects, for tests purpose for instance.
Backends¶
Canaille can handle data from the most common SQL databases such as PostgreSQL, MariaDB or SQLite, as well as OpenLDAP. It also comes with a no-dependency in-memory database that can be used in unit tests suites.
Miscellaneous¶
Logging¶
Canaille writes logs for every important event happening, to help administrators understand what is going on and debug funky situations.
A tool for your development and tests¶
Thanks to its lightweight in-memory database and its curated dependency list, Canaille can be used in the unit test suite of your application, so you can check how it behaves against a real world OpenID Connect server. If you work with python you might want to check pytest-iam.
It can also being launched in your development environment, if you find that launching a Keycloak in a Docker container is too heavy for your little web application.
It also fits well in continuous integration scenarios. Thanks to its CLI, you can prepare data in Canaille, let your application interact with it, and then check the side effects.
Roadmap¶
Bêta version¶
To go out of the current Alpha version we want to achieve the following tasks:
Stable version¶
Before we push Canaille in stable version we want to achieve the following tasks: