kanidm: don't log provisioned passwords via instrumentation

This also make sure to test this in the related nixos test.

Fixes: CVE-2025-30205
Reported-By: Katherina Walshe-Grey <qenya@qenya.tel>

oddlama df0193b3 dbe55c59

Changed files
+10 -3
nixos
pkgs
by-name
+4
nixos/tests/kanidm-provisioning.nix
···
provision.succeed('${specialisations}/credentialProvision/bin/switch-to-configuration test')
provision_login("${provisionIdmAdminPassword}")
# Test provisioned admin pw
out = provision.succeed("KANIDM_PASSWORD=${provisionAdminPassword} kanidm login -D admin")
assert_contains(out, "Login Success for admin")
···
provision.succeed('${specialisations}/credentialProvision/bin/switch-to-configuration test')
provision_login("${provisionIdmAdminPassword}")
+
# Make sure neither password is logged
+
provision.fail("journalctl --since -10m --unit kanidm.service --grep '${provisionAdminPassword}'")
+
provision.fail("journalctl --since -10m --unit kanidm.service --grep '${provisionIdmAdminPassword}'")
+
# Test provisioned admin pw
out = provision.succeed("KANIDM_PASSWORD=${provisionAdminPassword} kanidm login -D admin")
assert_contains(out, "Login Success for admin")
+2 -1
pkgs/by-name/ka/kanidm/patches/1_3/recover-account.patch
···
#[instrument(
level = "info",
-
skip(self, eventid),
fields(uuid = ?eventid)
)]
pub(crate) async fn handle_admin_recover_account(
···
#[instrument(
level = "info",
+
- skip(self, eventid),
+
+ skip(self, password, eventid),
fields(uuid = ?eventid)
)]
pub(crate) async fn handle_admin_recover_account(
+2 -1
pkgs/by-name/ka/kanidm/patches/1_4/recover-account.patch
···
#[instrument(
level = "info",
-
skip(self, eventid),
fields(uuid = ?eventid)
)]
pub(crate) async fn handle_admin_recover_account(
···
#[instrument(
level = "info",
+
- skip(self, eventid),
+
+ skip(self, password, eventid),
fields(uuid = ?eventid)
)]
pub(crate) async fn handle_admin_recover_account(
+2 -1
pkgs/by-name/ka/kanidm/patches/1_5/recover-account.patch
···
#[instrument(
level = "info",
-
skip(self, eventid),
fields(uuid = ?eventid)
)]
pub(crate) async fn handle_admin_recover_account(
···
#[instrument(
level = "info",
+
- skip(self, eventid),
+
+ skip(self, password, eventid),
fields(uuid = ?eventid)
)]
pub(crate) async fn handle_admin_recover_account(