version = "2"

# Bind cached credentials to the local TPM when one is available.
hsm_type = "tpm_if_possible"

default_shell = "/bin/bash"
home_prefix = "/home/"
home_attr = "uuid"
home_alias = "name"
use_etc_skel = true
selinux = true

[kanidm]
# Members of this Kanidm POSIX group are allowed to log in via PAM.
pam_allowed_login_groups = ["unix_users"]

# Token for the Kanidm service account used to resolve identities. Provision it
# at /etc/kanidm/unixd_token (a single line) after install, or remove this line
# if the server permits anonymous reads.
service_account_token_path = "/etc/kanidm/unixd_token"