Kanidm made some weird decision that ruled it out in one of big organisation I try to deploy it. Separate Radius password. For telco that’s half its use cases, and there is separate random password. Whole Network engineering department was like WTF ? You can’t have single password which is one of important reasons to have SSOA.
Even if git guarantees that the content is the same (if someone bothers to verify that the SHA-1 is the same and we exclude the possibility of a SHA-1 collision in git, which is yet to be demonstrated).