b12f/nixpkgs
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

openldap: load client config from /etc, not the nix store

Browse source 
We want Openldap clients to load /etc/ldap.conf at runtime, not
${pkgs.openldap}/etc/ldap.conf which is always a sample config.

Pass sysconfdir=/etc at compile time, so that /etc/krb5.conf is embedded
in the library as the path of its config file.

Pass sysconfdir=${out}/etc at install time, so that the sample configs
and schema files are correctly included in the build output.

This hack works because the Makefiles are not smart enough to notice
that the sysconfdir variable has changed across invocations -- because
nobody ever writes their Makefiles to be that smart. :-)

Fixes #181937.
This commit is contained in:
Dan Callaghan 2022-07-19 22:31:11 +10:00 committed by Martin Weinelt
parent df9f22a8b8
commit b30534eb02
2 changed files with 20 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
nixos/tests/openldap.nix
View file

@ -39,11 +39,23 @@ import ./make-test-python.nix ({ pkgs, ... }: let
olcRootDN: cn=root,dc=example
olcRootPW: notapassword
'';
ldapClientConfig = {
enable = true;
loginPam = false;
nsswitch = false;
server = "ldap://";
base = "dc=example";
};
in {
name = "openldap";
nodes.machine = { pkgs, ... }: {
environment.etc."openldap/root_password".text = "notapassword";
users.ldap = ldapClientConfig;
services.openldap = {
enable = true;
urlList = [ "ldapi:///" "ldap://" ];
@ -96,6 +108,7 @@ in {
manualConfigDir = {
inheritParentConfig = false;
configuration = { ... }: {
users.ldap = ldapClientConfig;
services.openldap = {
enable = true;
configDir = "/var/db/slapd.d";
@ -119,14 +132,14 @@ in {
with subtest("declarative contents"):
machine.succeed('${specializations}/declarativeContents/bin/switch-to-configuration test')
machine.wait_for_unit("openldap.service")
machine.succeed('ldapsearch -LLL -D "cn=root,dc=example" -w notapassword -b "dc=example"')
machine.succeed('ldapsearch -LLL -D "cn=root,dc=example" -w notapassword')
machine.fail('ldapmodify -D cn=root,cn=config -w configpassword -f ${pkgs.writeText "rootpw.ldif" changeRootPw}')
with subtest("mutable config"):
machine.succeed('${specializations}/mutableConfig/bin/switch-to-configuration test')
machine.succeed('ldapsearch -LLL -D "cn=root,dc=example" -w notapassword -b "dc=example"')
machine.succeed('ldapsearch -LLL -D "cn=root,dc=example" -w notapassword')
machine.succeed('ldapmodify -D cn=root,cn=config -w configpassword -f ${pkgs.writeText "rootpw.ldif" changeRootPw}')
machine.succeed('ldapsearch -LLL -D "cn=root,dc=example" -w foobar -b "dc=example"')
machine.succeed('ldapsearch -LLL -D "cn=root,dc=example" -w foobar')
with subtest("manual config dir"):
machine.succeed(
@ -136,8 +149,8 @@ in {
'chown -R openldap:openldap /var/db/slapd.d /var/db/openldap',
'${specializations}/manualConfigDir/bin/switch-to-configuration test',
)
machine.succeed('ldapsearch -LLL -D "cn=root,dc=example" -w notapassword -b "dc=example"')
machine.succeed('ldapsearch -LLL -D "cn=root,dc=example" -w notapassword')
machine.succeed('ldapmodify -D cn=root,cn=config -w configpassword -f ${pkgs.writeText "rootpw.ldif" changeRootPw}')
machine.succeed('ldapsearch -LLL -D "cn=root,dc=example" -w foobar -b "dc=example"')
machine.succeed('ldapsearch -LLL -D "cn=root,dc=example" -w foobar')
'';
})

3
pkgs/development/libraries/openldap/default.nix
View file

@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
"STRIP=" # Disable install stripping as it breaks cross-compiling. We strip binaries anyway in fixupPhase.
"STRIP_OPTS="
"prefix=${placeholder "out"}"
"sysconfdir=${placeholder "out"}/etc"
"sysconfdir=/etc"
"systemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
# contrib modules require these
"moduledir=${placeholder "out"}/lib/modules"
@ -101,6 +101,7 @@ stdenv.mkDerivation rec {
installFlags = [
"prefix=${placeholder "out"}"
"sysconfdir=${placeholder "out"}/etc"
"moduledir=${placeholder "out"}/lib/modules"
"INSTALL=install"
];