My one fear with this is offline authentication. I enjoy oauth/oidc a lot, but it doesn’t have mechanisms for machines to continue to be able to authenticate while offline, like the way ldap/kerberos can do.

Is this just for machines that will always be online? I can understand that usecase but :/

EDIT: Okay, one comment, mentions himmelblau an alternative to authd, which seems to be more mature. Himmelblau has docs about offline usage. It looks like it has an emergency config that can use a cached password from the oidc provider,

Single-factor authentication (SFA-only) users and Hello-PIN users already have offline sign-in capability

Hmmm. Okay. Upon doing further reseach, it looks like offline authentication is exclusive to Microsoft Entra ID. :/

Have you used ovirt? It’s currently being maintained by Oracle after Red Hat gave it up.

I’ve been meaning to try it, but the documentation is dense and hard to get through, and I unironically find the openstack install instructions more approachable in some ways…

My recommendation is to use an abstraction layer that runs qemu-kvm under the hood and automate that. Some people have mentioned libvirt, but Incus is another good option.