I like kanidm too ! And I think that something that could be really powerful would be to have the local client daemon provide a token for user applications (browsers with an extension, dedicated app...).