b12f/nixpkgs
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

nixos/sssd: add an option to enable KCM support

Browse source
This commit is contained in:
Dan Callaghan 2022-04-25 13:14:45 +10:00
parent bc01a2be50
commit 133ebbe46a
No known key found for this signature in database
GPG key ID: 26B5AA2FDAF2F30A
1 changed files with 31 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

31
nixos/modules/services/misc/sssd.nix
View file

@ -38,6 +38,15 @@ in {
For this to work, the <literal>ssh</literal> SSS service must be enabled in the sssd configuration.
'';
};
kcm = mkOption {
type = types.bool;
default = false;
description = ''
Whether to use SSS as a Kerberos Cache Manager (KCM).
Kerberos will be configured to cache credentials in SSS.
'';
};
};
};
config = mkMerge [
@ -79,6 +88,28 @@ in {
services.dbus.packages = [ pkgs.sssd ];
})
(mkIf cfg.kcm {
systemd.services.sssd-kcm = {
description = "SSSD Kerberos Cache Manager";
requires = [ "sssd-kcm.socket" ];
serviceConfig = {
ExecStartPre = "-${pkgs.sssd}/bin/sssd --genconf-section=kcm";
ExecStart = "${pkgs.sssd}/libexec/sssd/sssd_kcm --uid 0 --gid 0";
};
restartTriggers = [
config.environment.etc."sssd/sssd.conf".source
];
};
systemd.sockets.sssd-kcm = {
description = "SSSD Kerberos Cache Manager responder socket";
wantedBy = [ "sockets.target" ];
# Matches the default in MIT krb5 and Heimdal:
# https://github.com/krb5/krb5/blob/krb5-1.19.3-final/src/include/kcm.h#L43
listenStreams = [ "/var/run/.heim_org.h5l.kcm-socket" ];
};
krb5.libdefaults.default_ccache_name = "KCM:";
})
(mkIf cfg.sshAuthorizedKeysIntegration {
# Ugly: sshd refuses to start if a store path is given because /nix/store is group-writable.
# So indirect by a symlink.