Commit Graph

26 Commits

Author SHA1 Message Date
Linus Heckemann
f448ec3365
Merge pull request #98731 from mayflower/ldap-nss-optional
config.users.ldap: do not include nss module if turned off
2020-12-12 10:53:39 +01:00
Aaron Andersen
ae02e1fe53 nixos/ldap: minor cosmetic fixes 2020-10-20 19:50:18 -04:00
Aaron Andersen
a1acbfbfcb nixos/ldap: add missing types 2020-10-20 19:50:18 -04:00
Aaron Andersen
d89aff670a nixos/ldap: restart nslcd when configuration changes 2020-10-20 19:50:17 -04:00
Robin Gloster
a485504740 config.users.ldap: do not include nss module if turned off 2020-09-25 12:03:42 +02:00
Florian Klink
4f9c8ef791 nixos/ldap: move nss database configuration into ldap module
now that passwdArray and shadowArray aren't used anymore, these can be
folded.
2020-05-11 16:14:50 +02:00
Dominik Xaver Hörl
c10d82358f treewide: add types to boolean / enable options or make use of mkEnableOption 2020-04-27 09:32:01 +02:00
Aaron Andersen
28bedc5f11 nixos/ldap: add CAP_SYS_RESOURCE capability to nslcd service 2020-01-31 10:12:41 -05:00
Aaron Andersen
90c96ec31d nixos/ldap: remove redundant configuration options 2020-01-31 09:55:33 -05:00
rnhmjoj
1d61efb7f1 treewide: use attrs instead of list for types.loaOf options 2020-01-06 10:39:18 -05:00
Florian Klink
8817bbefdb nixos/ldap: set proper User= and Group= for nslcd service
eb90d97009 broke nslcd, as /run/nslcd was
created/chowned as root user, while nslcd wants to do parts as nslcd
user.

This commit changes the nslcd to run with the proper uid/gid from the
start (through User= and Group=), so the RuntimeDirectory has proper
permissions, too.

In some cases, secrets are baked into nslcd's config file during startup
(so we don't want to provide it from the store).

This config file is normally hard-wired to /etc/nslcd.conf, but we don't
want to use PermissionsStartOnly anymore (#56265), and activation
scripts are ugly, so redirect /etc/nslcd.conf to /run/nslcd/nslcd.conf,
which now gets provisioned inside ExecStartPre=.

This change requires the files referenced to in
users.ldap.bind.passwordFile and users.ldap.daemon.rootpwmodpwFile to be
readable by the nslcd user (in the non-nslcd case, this was already the
case for users.ldap.bind.passwordFile)

fixes #57783
2019-03-28 13:08:47 +01:00
Florian Klink
0a1451afe3 nixos/ldap: rename password file options properly
users.ldap.daemon.rootpwmodpw -> users.ldap.daemon.rootpwmodpwFile
users.ldap.bind.password -> users.ldap.bind.passwordFile

as users.ldap.daemon.rootpwmodpw never was part of a release, no
mkRenamedOptionModule is introduced.
2019-03-27 02:53:56 +01:00
Julien Moutinho
65cfba23af nixos/tests: test LDAP password changing through nslcd
NOTE: slapd.conf is deprecated, hence use cn=config.
2019-01-18 05:13:42 +01:00
Julien Moutinho
eb90d97009 nixos/nslcd: use systemd's RuntimeDirectory 2019-01-09 17:45:19 +01:00
Julien Moutinho
4af7db9c73 nixos/nslcd: restart when nslcd.conf changes 2019-01-09 17:45:15 +01:00
Florian Klink
fff5923686 nixos/modules: users.(extraUsers|extraGroup->users|group) 2018-06-30 03:02:58 +02:00
Graham Christensen
2b2a6f2070
nixos/ldap: remove tls_checkpeer no when using TLS 2017-07-19 19:23:40 -04:00
Markus Mueller
07c44b81c3 ldap: Add option for NSS integration 2016-08-23 21:12:51 +02:00
Markus Mueller
e04c3506eb ldap: Add option for login PAM integration 2016-08-23 21:12:51 +02:00
Markus Mueller
19ee3baa32 ldap module: fix activationScripts declaration 2016-05-23 22:54:15 +02:00
Thomas Strobel
a04a7272aa Add missing 'type', 'defaultText' and 'literalExample' in module definitions
- add missing types in module definitions
- add missing 'defaultText' in module definitions
- wrap example with 'literalExample' where necessary in module definitions
2016-01-17 19:41:23 +01:00
Jan Malakhovski
6eadb16022 nixos: fix some types 2015-09-18 18:48:50 +00:00
Rickard Nilsson
a01862a4b6 nslcd nixos service: Should be wantedBy multi-user, otherwise not started if activated on running server (only starts on bootup) 2014-08-08 17:40:14 +02:00
Shea Levy
b3cfb9084b Get all lib functions from lib, not pkgs.lib, in modules 2014-07-02 12:28:18 -04:00
Eelco Dolstra
29027fd1e1 Rewrite ‘with pkgs.lib’ -> ‘with lib’
Using pkgs.lib on the spine of module evaluation is problematic
because the pkgs argument depends on the result of module
evaluation. To prevent an infinite recursion, pkgs and some of the
modules are evaluated twice, which is inefficient. Using ‘with lib’
prevents this problem.
2014-04-14 16:26:48 +02:00
Eelco Dolstra
5c1f8cbc70 Move all of NixOS to nixos/ in preparation of the repository merge 2013-10-10 13:28:20 +02:00