122 lines
3.7 KiB
Nix
122 lines
3.7 KiB
Nix
{ config, pkgs, lib, ... }:
|
|
{
|
|
services.openldap = let
|
|
dn = "dc=pvv,dc=ntnu,dc=no";
|
|
cfg = config.services.openldap;
|
|
|
|
heimdal = config.security.krb5.package;
|
|
in {
|
|
enable = true;
|
|
|
|
# NOTE: this is a custom build of openldap with support for
|
|
# perl and kerberos.
|
|
package = pkgs.openldap.overrideAttrs (prev: {
|
|
# https://github.com/openldap/openldap/blob/master/configure
|
|
configureFlags = prev.configureFlags ++ [
|
|
# Connect to slapd via UNIX socket
|
|
"--enable-local"
|
|
# Cyrus SASL
|
|
"--enable-spasswd"
|
|
# Reverse hostname lookups
|
|
"--enable-rlookups"
|
|
# perl
|
|
"--enable-perl"
|
|
];
|
|
|
|
buildInputs = prev.buildInputs ++ [
|
|
pkgs.perl
|
|
# NOTE: do not upstream this, it might not work with
|
|
# MIT in the same way
|
|
heimdal
|
|
];
|
|
|
|
extraContribModules = prev.extraContribModules ++ [
|
|
# https://git.openldap.org/openldap/openldap/-/tree/master/contrib/slapd-modules
|
|
"smbk5pwd"
|
|
];
|
|
});
|
|
|
|
settings = {
|
|
attrs = {
|
|
olcLogLevel = [ "stats" "config" "args" ];
|
|
|
|
# olcAuthzRegexp = ''
|
|
# gidNumber=.*\\\+uidNumber=0,cn=peercred,cn=external,cn=auth
|
|
# "uid=heimdal,${dn2}"
|
|
# '';
|
|
|
|
# olcSaslSecProps = "minssf=0";
|
|
};
|
|
|
|
children = {
|
|
"cn=schema".includes = let
|
|
# NOTE: needed for smbk5pwd.so module
|
|
schemaToLdif = name: path: pkgs.runCommandNoCC name {
|
|
buildInputs = with pkgs; [ schema2ldif ];
|
|
} ''
|
|
schema2ldif "${path}" > $out
|
|
'';
|
|
|
|
hdb-ldif = schemaToLdif "hdb.ldif" "${heimdal.src}/lib/hdb/hdb.schema";
|
|
samba-ldif = schemaToLdif "samba.ldif" "${heimdal.src}/tests/ldap/samba.schema";
|
|
in [
|
|
"${cfg.package}/etc/schema/core.ldif"
|
|
"${cfg.package}/etc/schema/cosine.ldif"
|
|
"${cfg.package}/etc/schema/nis.ldif"
|
|
"${cfg.package}/etc/schema/inetorgperson.ldif"
|
|
"${hdb-ldif}"
|
|
"${samba-ldif}"
|
|
];
|
|
|
|
# NOTE: installation of smbk5pwd.so module
|
|
# https://git.openldap.org/openldap/openldap/-/tree/master/contrib/slapd-modules/smbk5pwd
|
|
"cn=module{0}".attrs = {
|
|
objectClass = [ "olcModuleList" ];
|
|
olcModuleLoad = [ "${cfg.package}/lib/modules/smbk5pwd.so" ];
|
|
};
|
|
|
|
# NOTE: activation of smbk5pwd.so module for {1}mdb
|
|
"olcOverlay={0}smbk5pwd,olcDatabase={1}mdb".attrs = {
|
|
objectClass = [ "olcOverlayConfig" "olcSmbK5PwdConfig" ];
|
|
olcOverlay = "{0}smbk5pwd";
|
|
olcSmbK5PwdEnable = [ "krb5" "samba" ];
|
|
olcSmbK5PwdMustChange = toString (60 * 60 * 24 * 10000);
|
|
};
|
|
|
|
"olcDatabase={1}mdb".attrs = {
|
|
objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ];
|
|
|
|
olcDatabase = "{1}mdb";
|
|
|
|
olcSuffix = dn;
|
|
|
|
# TODO: PW is supposed to be a secret, but it's probably fine for testing
|
|
olcRootDN = "cn=users,${dn}";
|
|
|
|
# TODO: replace with proper secret
|
|
olcRootPW.path = pkgs.writeText "olcRootPW" "pass";
|
|
|
|
olcDbDirectory = "/var/lib/openldap/test-smbk5pwd-db";
|
|
olcDbIndex = "objectClass eq";
|
|
|
|
olcAccess = [
|
|
''{0}to attrs=userPassword,shadowLastChange
|
|
by dn.exact=cn=users,${dn} write
|
|
by self write
|
|
by anonymous auth
|
|
by * none''
|
|
|
|
''{1}to dn.base=""
|
|
by * read''
|
|
|
|
/* allow read on anything else */
|
|
# ''{2}to *
|
|
# by cn=users,${dn} write by dn.exact=gidNumber=0+uidNumber=0+cn=peercred,cn=external write
|
|
# by * read''
|
|
];
|
|
};
|
|
};
|
|
};
|
|
};
|
|
}
|