kanidim-provision is a helper utility that uses kanidms API to provision users, groups and oauth2 systems. Prior to version 1.2.0, a faulty function intrumentation in the (optional) kanidm patches provided by kandim-provision will cause the provisioned admin credentials to be leaked to the system log. This only impacts users which both use the provided patches and provision their admin or idm_admin account credentials this way. No other credentials are affected. Users should recompile kanidm with the newest patchset from tag v1.2.0 or higher. As a workaround, the user can set the log level KANIDM_LOG_LEVEL to any level higher than info, for example warn.
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
While logging all information may be helpful during development stages, it is important that logging levels be set appropriately before a product ships so that sensitive user data and system information are not accidentally exposed to potential attackers. Different log files may be produced and stored for: