- uid_attr_map/gid_attr_map = name so NSS/PAM see 'misthios', not the SPN - allow_local_account_override = [misthios] so Kanidm takes over an existing local account of the same name (Kanidm otherwise ignores its own entry, leaving logins to fall back to the local account and fail)