version = "2"

# Presentation options are TOP-LEVEL in the v2 config (see ConfigV2 in
# kanidm unix_integration/common/src/unix_config.rs). Short names (bl)
# instead of SPNs (bl@id.uhhm.no) so home paths come out as /home/<name>
# matching the NFS export from ergo. UID/GID numbers must match the
# server side (`kanidm person posix set --gidnumber 1000 bl`).
default_shell = "/usr/bin/fish"
home_prefix = "/home/"
home_attr = "name"
# NSS displays the home_alias path (default: spn) — align it with home_attr.
home_alias = "name"
uid_attr_map = "name"
gid_attr_map = "name"
use_etc_skel = false

# The [kanidm] section must exist or the kanidm provider never starts
# and every lookup is silently negative-cached; provider options
# (timeouts, pam groups, group maps, service token) live here.
[kanidm]
pam_allowed_login_groups = ["corp"]
