[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
01/01: services: Add nslcd-service-type.
|
From: |
guix-commits |
|
Subject: |
01/01: services: Add nslcd-service-type. |
|
Date: |
Wed, 20 Mar 2019 15:32:18 -0400 (EDT) |
rekado pushed a commit to branch master
in repository guix.
commit c16423f143919916a5273761d7ed29bd49f14519
Author: Ricardo Wurmus <address@hidden>
Date: Wed Mar 20 19:43:07 2019 +0100
services: Add nslcd-service-type.
* gnu/services/authentication.scm (nslcd-service-type, nslcd-configuration,
%nslcd-accounts): New variables.
(uglify-field-name, value->string, serialize-field, serialize-list,
ssl-option?, tls-reqcert-option?, deref-option?,
comma-separated-list-of-strings?, serialize-ignore-users-option,
log-option?,
serialize-log-option, valid-map?, scope-option?, serialize-scope-option,
map-entry?, list-of-map-entries?, filter-entry?, list-of-filter-entries?,
serialize-filter-entry, serialize-list-of-filter-entries,
serialize-map-entry,
serialize-list-of-map-entries, nslcd-config-file, nslcd-etc-service,
nslcd-shepherd-service, pam-ldap-pam-services, pam-ldap-pam-service,
generate-nslcd-documentation): New procedures.
* gnu/tests/ldap.scm: New file.
* gnu/local.mk (GNU_SYSTEM_MODULES): Add it.
* doc/guix.texi (LDAP Services): Document it.
---
doc/guix.texi | 479 +++++++++++++++++++++++++++++++++++++
gnu/local.mk | 1 +
gnu/services/authentication.scm | 511 +++++++++++++++++++++++++++++++++++++++-
gnu/tests/ldap.scm | 160 +++++++++++++
4 files changed, 1150 insertions(+), 1 deletion(-)
diff --git a/doc/guix.texi b/doc/guix.texi
index bb344e1..94d7a29 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -11139,6 +11139,7 @@ declaration.
* Telephony Services:: Telephony services.
* Monitoring Services:: Monitoring services.
* Kerberos Services:: Kerberos services.
+* LDAP Services:: LDAP services.
* Web Services:: Web servers.
* Certificate Services:: TLS certificates via Let's Encrypt.
* DNS Services:: DNS daemons.
@@ -17685,6 +17686,484 @@ Local accounts with lower values will silently fail
to authenticate.
@end deftp
address@hidden LDAP Services
address@hidden LDAP Services
address@hidden LDAP
address@hidden nslcd, LDAP service
+
+The @code{(gnu services authentication)} module provides the
address@hidden, which can be used to authenticate against an LDAP
+server. In addition to configuring the service itself, you may want to add
address@hidden as a name service to the Name Service Switch. @xref{Name Service
+Switch} for detailed information.
+
+Here is a simple operating system declaration with a default configuration of
+the @code{nslcd-service-type} and a Name Service Switch configuration that
+consults the @code{ldap} name service last:
+
address@hidden
+(use-service-modules authentication)
+(use-modules (gnu system nss))
+...
+(operating-system
+ ...
+ (services
+ (cons*
+ (service nslcd-service-type)
+ (service dhcp-client-service-type)
+ %base-services))
+ (name-service-switch
+ (let ((services (list (name-service (name "db"))
+ (name-service (name "files"))
+ (name-service (name "ldap")))))
+ (name-service-switch
+ (inherit %mdns-host-lookup-nss)
+ (password services)
+ (shadow services)
+ (group services)
+ (netgroup services)
+ (gshadow services)))))
address@hidden example
+
address@hidden %start of generated documentation for nslcd-configuration
+
+Available @code{nslcd-configuration} fields are:
+
address@hidden address@hidden parameter} package nss-pam-ldapd
+The @code{nss-pam-ldapd} package to use.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-number threads
+The number of threads to start that can handle requests and perform LDAP
+queries. Each thread opens a separate connection to the LDAP server.
+The default is to start 5 threads.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} string uid
+This specifies the user id with which the daemon should be run.
+
+Defaults to @samp{"nslcd"}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} string gid
+This specifies the group id with which the daemon should be run.
+
+Defaults to @samp{"nslcd"}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} log-option log
+This option controls the way logging is done via a list containing
+SCHEME and LEVEL. The SCHEME argument may either be the symbols "none"
+or "syslog", or an absolute file name. The LEVEL argument is optional
+and specifies the log level. The log level may be one of the following
+symbols: "crit", "error", "warning", "notice", "info" or "debug". All
+messages with the specified log level or higher are logged.
+
+Defaults to @samp{("/var/log/nslcd" info)}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} list uri
+The list of LDAP server URIs. Normally, only the first server will be
+used with the following servers as fall-back.
+
+Defaults to @samp{("ldap://localhost:389/";)}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-string ldap-version
+The version of the LDAP protocol to use. The default is to use the
+maximum version supported by the LDAP library.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-string binddn
+Specifies the distinguished name with which to bind to the directory
+server for lookups. The default is to bind anonymously.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-string bindpw
+Specifies the credentials with which to bind. This option is only
+applicable when used with binddn.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-string rootpwmoddn
+Specifies the distinguished name to use when the root user tries to
+modify a user's password using the PAM module.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-string rootpwmodpw
+Specifies the credentials with which to bind if the root user tries to
+change a user's password. This option is only applicable when used with
+rootpwmoddn
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-string sasl-mech
+Specifies the SASL mechanism to be used when performing SASL
+authentication.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-string sasl-realm
+Specifies the SASL realm to be used when performing SASL authentication.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-string sasl-authcid
+Specifies the authentication identity to be used when performing SASL
+authentication.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-string sasl-authzid
+Specifies the authorization identity to be used when performing SASL
+authentication.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-boolean sasl-canonicalize?
+Determines whether the LDAP server host name should be canonicalised. If
+this is enabled the LDAP library will do a reverse host name lookup. By
+default, it is left up to the LDAP library whether this check is
+performed or not.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-string krb5-ccname
+Set the name for the GSS-API Kerberos credentials cache.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} string base
+The directory search base.
+
+Defaults to @samp{"dc=example,dc=com"}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} scope-option scope
+Specifies the search scope (subtree, onelevel, base or children). The
+default scope is subtree; base scope is almost never useful for name
+service lookups; children scope is not supported on all servers.
+
+Defaults to @samp{(subtree)}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-deref-option deref
+Specifies the policy for dereferencing aliases. The default policy is
+to never dereference aliases.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-boolean referrals
+Specifies whether automatic referral chasing should be enabled. The
+default behaviour is to chase referrals.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} list-of-map-entries maps
+This option allows for custom attributes to be looked up instead of the
+default RFC 2307 attributes. It is a list of maps, each consisting of
+the name of a map, the RFC 2307 attribute to match and the query
+expression for the attribute as it is available in the directory.
+
+Defaults to @samp{()}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} list-of-filter-entries filters
+A list of filters consisting of the name of a map to which the filter
+applies and an LDAP search filter expression.
+
+Defaults to @samp{()}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-number bind-timelimit
+Specifies the time limit in seconds to use when connecting to the
+directory server. The default value is 10 seconds.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-number timelimit
+Specifies the time limit (in seconds) to wait for a response from the
+LDAP server. A value of zero, which is the default, is to wait
+indefinitely for searches to be completed.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-number idle-timelimit
+Specifies the period if inactivity (in seconds) after which the con‐
+nection to the LDAP server will be closed. The default is not to time
+out connections.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-number reconnect-sleeptime
+Specifies the number of seconds to sleep when connecting to all LDAP
+servers fails. By default one second is waited between the first
+failure and the first retry.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-number reconnect-retrytime
+Specifies the time after which the LDAP server is considered to be
+permanently unavailable. Once this time is reached retries will be done
+only once per this time period. The default value is 10 seconds.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-ssl-option ssl
+Specifies whether to use SSL/TLS or not (the default is not to). If
+'start-tls is specified then StartTLS is used rather than raw LDAP over
+SSL.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-tls-reqcert-option tls-reqcert
+Specifies what checks to perform on a server-supplied certificate. The
+meaning of the values is described in the ldap.conf(5) manual page.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-string tls-cacertdir
+Specifies the directory containing X.509 certificates for peer authen‐
+tication. This parameter is ignored when using GnuTLS.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-string tls-cacertfile
+Specifies the path to the X.509 certificate for peer authentication.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-string tls-randfile
+Specifies the path to an entropy source. This parameter is ignored when
+using GnuTLS.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-string tls-ciphers
+Specifies the ciphers to use for TLS as a string.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-string tls-cert
+Specifies the path to the file containing the local certificate for
+client TLS authentication.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-string tls-key
+Specifies the path to the file containing the private key for client TLS
+authentication.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-number pagesize
+Set this to a number greater than 0 to request paged results from the
+LDAP server in accordance with RFC2696. The default (0) is to not
+request paged results.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-ignore-users-option
nss-initgroups-ignoreusers
+This option prevents group membership lookups through LDAP for the
+specified users. Alternatively, the value 'all-local may be used. With
+that value nslcd builds a full list of non-LDAP users on startup.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-number nss-min-uid
+This option ensures that LDAP users with a numeric user id lower than
+the specified value are ignored.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-number nss-uid-offset
+This option specifies an offset that is added to all LDAP numeric user
+ids. This can be used to avoid user id collisions with local users.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-number nss-gid-offset
+This option specifies an offset that is added to all LDAP numeric group
+ids. This can be used to avoid user id collisions with local groups.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-boolean nss-nested-groups
+If this option is set, the member attribute of a group may point to
+another group. Members of nested groups are also returned in the higher
+level group and parent groups are returned when finding groups for a
+specific user. The default is not to perform extra searches for nested
+groups.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-boolean nss-getgrent-skipmembers
+If this option is set, the group member list is not retrieved when
+looking up groups. Lookups for finding which groups a user belongs to
+will remain functional so the user will likely still get the correct
+groups assigned on login.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-boolean nss-disable-enumeration
+If this option is set, functions which cause all user/group entries to
+be loaded from the directory will not succeed in doing so. This can
+dramatically reduce LDAP server load in situations where there are a
+great number of users and/or groups. This option is not recommended for
+most configurations.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-string validnames
+This option can be used to specify how user and group names are verified
+within the system. This pattern is used to check all user and group
+names that are requested and returned from LDAP.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-boolean ignorecase
+This specifies whether or not to perform searches using case-insensitive
+matching. Enabling this could open up the system to authorization
+bypass vulnerabilities and introduce nscd cache poisoning
+vulnerabilities which allow denial of service.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-boolean pam-authc-ppolicy
+This option specifies whether password policy controls are requested and
+handled from the LDAP server when performing user authentication.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-string pam-authc-search
+By default nslcd performs an LDAP search with the user's credentials
+after BIND (authentication) to ensure that the BIND operation was
+successful. The default search is a simple check to see if the user's
+DN exists. A search filter can be specified that will be used instead.
+It should return at least one entry.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-string pam-authz-search
+This option allows flexible fine tuning of the authorisation check that
+should be performed. The search filter specified is executed and if any
+entries match, access is granted, otherwise access is denied.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} maybe-string
pam-password-prohibit-message
+If this option is set password modification using pam_ldap will be
+denied and the specified message will be presented to the user instead.
+The message can be used to direct the user to an alternative means of
+changing their password.
+
+Defaults to @samp{disabled}.
+
address@hidden deftypevr
+
address@hidden address@hidden parameter} list pam-services
+List of pam service names for which LDAP authentication should suffice.
+
+Defaults to @samp{()}.
+
address@hidden deftypevr
+
address@hidden %end of generated documentation for nslcd-configuration
+
+
@node Web Services
@subsection Web Services
diff --git a/gnu/local.mk b/gnu/local.mk
index c32876c..a5a2f11 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -569,6 +569,7 @@ GNU_SYSTEM_MODULES = \
%D%/tests/monitoring.scm \
%D%/tests/nfs.scm \
%D%/tests/install.scm \
+ %D%/tests/ldap.scm \
%D%/tests/mail.scm \
%D%/tests/messaging.scm \
%D%/tests/networking.scm \
diff --git a/gnu/services/authentication.scm b/gnu/services/authentication.scm
index 1a2629d..ab54aaf 100644
--- a/gnu/services/authentication.scm
+++ b/gnu/services/authentication.scm
@@ -1,5 +1,6 @@
;;; GNU Guix --- Functional package management for GNU
;;; Copyright © 2018 Danny Milosavljevic <address@hidden>
+;;; Copyright © 2018, 2019 Ricardo Wurmus <address@hidden>
;;;
;;; This file is part of GNU Guix.
;;;
@@ -18,13 +19,28 @@
(define-module (gnu services authentication)
#:use-module (gnu services)
+ #:use-module (gnu services base)
+ #:use-module (gnu services configuration)
#:use-module (gnu services dbus)
+ #:use-module (gnu services shepherd)
+ #:use-module (gnu system pam)
+ #:use-module (gnu system shadow)
+ #:use-module (gnu packages admin)
#:use-module (gnu packages freedesktop)
+ #:use-module (gnu packages openldap)
#:use-module (guix gexp)
#:use-module (guix records)
+ #:use-module (guix packages)
+ #:use-module (ice-9 match)
+ #:use-module (srfi srfi-1)
+ #:use-module (srfi srfi-26)
#:export (fprintd-configuration
fprintd-configuration?
- fprintd-service-type))
+ fprintd-service-type
+
+ nslcd-configuration
+ nslcd-configuration?
+ nslcd-service-type))
(define-record-type* <fprintd-configuration>
fprintd-configuration make-fprintd-configuration
@@ -39,3 +55,496 @@
list)))
(description
"Run fprintd, a fingerprint management daemon.")))
+
+
+;;;
+;;; NSS Pam LDAP service (nslcd)
+;;;
+
+(define (uglify-field-name name)
+ (match name
+ ('filters "filter")
+ ('maps "map")
+ (_ (string-map (match-lambda
+ (#\- #\_)
+ (chr chr))
+ (symbol->string name)))))
+
+(define (value->string val)
+ (cond
+ ((boolean? val)
+ (if val "on" "off"))
+ ((number? val)
+ (number->string val))
+ ((symbol? val)
+ (string-map (match-lambda
+ (#\- #\_)
+ (chr chr))
+ (symbol->string val)))
+ (else val)))
+
+(define (serialize-field field-name val)
+ (if (eq? field-name 'pam-services)
+ #t
+ (format #t "~a ~a\n"
+ (uglify-field-name field-name)
+ (value->string val))))
+
+(define serialize-string serialize-field)
+(define serialize-boolean serialize-field)
+(define serialize-number serialize-field)
+(define (serialize-list field-name val)
+ (map (cut serialize-field field-name <>) val))
+(define-maybe string)
+(define-maybe boolean)
+(define-maybe number)
+
+(define (ssl-option? val)
+ (or (boolean? val)
+ (eq? val 'start-tls)))
+(define serialize-ssl-option serialize-field)
+(define-maybe ssl-option)
+
+(define (tls-reqcert-option? val)
+ (member val '(never allow try demand hard)))
+(define serialize-tls-reqcert-option serialize-field)
+(define-maybe tls-reqcert-option)
+
+(define (deref-option? val)
+ (member val '(never searching finding always)))
+(define serialize-deref-option serialize-field)
+(define-maybe deref-option)
+
+(define (comma-separated-list-of-strings? val)
+ (and (list? val)
+ (every string? val)))
+(define (ignore-users-option? val)
+ (or (comma-separated-list-of-strings? val)
+ (eq? 'all-local val)))
+(define (serialize-ignore-users-option field-name val)
+ (serialize-field field-name (if (eq? 'all-local val)
+ val
+ (string-join val ","))))
+(define-maybe ignore-users-option)
+
+(define (log-option? val)
+ (let ((valid-scheme? (lambda (scheme)
+ (or (string? scheme)
+ (member scheme '(none syslog))))))
+ (match val
+ ((scheme level)
+ (and (valid-scheme? scheme)
+ (member level '(crit error warning notice info debug))))
+ ((scheme)
+ (valid-scheme? scheme)))))
+(define (serialize-log-option field-name val)
+ (serialize-field field-name
+ (string-join (map (cut format #f "~a" <>) val))))
+
+(define (valid-map? val)
+ "Is VAL a supported map name?"
+ (member val
+ '(alias aliases ether ethers group host hosts netgroup network
networks
+ passwd protocol protocols rpc service services shadow)))
+
+(define (scope-option? val)
+ (let ((valid-scopes '(subtree onelevel base children)))
+ (match val
+ ((map-name scope)
+ (and (valid-map? map-name)
+ (member scope valid-scopes)))
+ ((scope)
+ (member scope valid-scopes)))))
+(define (serialize-scope-option field-name val)
+ (serialize-field field-name
+ (string-join (map (cut format #f "~a" <>) val))))
+
+(define (map-entry? val)
+ (match val
+ (((? valid-map? map-name)
+ (? string? attribute)
+ (? string? new-attribute)) #t)
+ (_ #f)))
+
+(define (list-of-map-entries? val)
+ (and (list? val)
+ (every map-entry? val)))
+
+(define (filter-entry? val)
+ (match val
+ (((? valid-map? map-name)
+ (? string? filter-expression)) #t)
+ (_ #f)))
+
+(define (list-of-filter-entries? val)
+ (and (list? val)
+ (every filter-entry? val)))
+
+(define (serialize-filter-entry field-name val)
+ (serialize-field 'filter
+ (match val
+ (((? valid-map? map-name)
+ (? string? filter-expression))
+ (string-append (symbol->string map-name)
+ " " filter-expression)))))
+
+(define (serialize-list-of-filter-entries field-name val)
+ (for-each (cut serialize-filter-entry field-name <>) val))
+
+(define (serialize-map-entry field-name val)
+ (serialize-field 'map
+ (match val
+ (((? valid-map? map-name)
+ (? string? attribute)
+ (? string? new-attribute))
+ (string-append (symbol->string map-name)
+ " " attribute
+ " " new-attribute)))))
+
+(define (serialize-list-of-map-entries field-name val)
+ (for-each (cut serialize-map-entry field-name <>) val))
+
+
+(define-configuration nslcd-configuration
+ (nss-pam-ldapd
+ (package nss-pam-ldapd)
+ "The NSS-PAM-LDAPD package to use.")
+
+ ;; Runtime options
+ (threads
+ (maybe-number 'disabled)
+ "The number of threads to start that can handle requests and perform LDAP
+queries. Each thread opens a separate connection to the LDAP server. The
+default is to start 5 threads.")
+ (uid
+ (string "nslcd")
+ "This specifies the user id with which the daemon should be run.")
+ (gid
+ (string "nslcd")
+ "This specifies the group id with which the daemon should be run.")
+ (log
+ (log-option '("/var/log/nslcd" info))
+ "This option controls the way logging is done via a list containing SCHEME
+and LEVEL. The SCHEME argument may either be the symbols \"none\" or
+\"syslog\", or an absolute file name. The LEVEL argument is optional and
+specifies the log level. The log level may be one of the following symbols:
+\"crit\", \"error\", \"warning\", \"notice\", \"info\" or \"debug\". All
+messages with the specified log level or higher are logged.")
+
+ ;; LDAP connection settings
+ (uri
+ (list '("ldap://localhost:389/";))
+ "The list of LDAP server URIs. Normally, only the first server will be
+used with the following servers as fall-back.")
+ (ldap-version
+ (maybe-string 'disabled)
+ "The version of the LDAP protocol to use. The default is to use the
+maximum version supported by the LDAP library.")
+ (binddn
+ (maybe-string 'disabled)
+ "Specifies the distinguished name with which to bind to the directory
+server for lookups. The default is to bind anonymously.")
+ (bindpw
+ (maybe-string 'disabled)
+ "Specifies the credentials with which to bind. This option is only
+applicable when used with binddn.")
+ (rootpwmoddn
+ (maybe-string 'disabled)
+ "Specifies the distinguished name to use when the root user tries to modify
+a user's password using the PAM module.")
+ (rootpwmodpw
+ (maybe-string 'disabled)
+ "Specifies the credentials with which to bind if the root user tries to
+change a user's password. This option is only applicable when used with
+rootpwmoddn")
+
+ ;; SASL authentication options
+ (sasl-mech
+ (maybe-string 'disabled)
+ "Specifies the SASL mechanism to be used when performing SASL
+authentication.")
+ (sasl-realm
+ (maybe-string 'disabled)
+ "Specifies the SASL realm to be used when performing SASL authentication.")
+ (sasl-authcid
+ (maybe-string 'disabled)
+ "Specifies the authentication identity to be used when performing SASL
+authentication.")
+ (sasl-authzid
+ (maybe-string 'disabled)
+ "Specifies the authorization identity to be used when performing SASL
+authentication.")
+ (sasl-canonicalize?
+ (maybe-boolean 'disabled)
+ "Determines whether the LDAP server host name should be canonicalised. If
+this is enabled the LDAP library will do a reverse host name lookup. By
+default, it is left up to the LDAP library whether this check is performed or
+not.")
+
+ ;; Kerberos authentication options
+ (krb5-ccname
+ (maybe-string 'disabled)
+ "Set the name for the GSS-API Kerberos credentials cache.")
+
+ ;; Search / mapping options
+ (base
+ (string "dc=example,dc=com")
+ "The directory search base.")
+ (scope
+ (scope-option '(subtree))
+ "Specifies the search scope (subtree, onelevel, base or children). The
+default scope is subtree; base scope is almost never useful for name service
+lookups; children scope is not supported on all servers.")
+ (deref
+ (maybe-deref-option 'disabled)
+ "Specifies the policy for dereferencing aliases. The default policy is to
+never dereference aliases.")
+ (referrals
+ (maybe-boolean 'disabled)
+ "Specifies whether automatic referral chasing should be enabled. The
+default behaviour is to chase referrals.")
+ (maps
+ (list-of-map-entries '())
+ "This option allows for custom attributes to be looked up instead of the
+default RFC 2307 attributes. It is a list of maps, each consisting of the
+name of a map, the RFC 2307 attribute to match and the query expression for
+the attribute as it is available in the directory.")
+ (filters
+ (list-of-filter-entries '())
+ "A list of filters consisting of the name of a map to which the filter
+applies and an LDAP search filter expression.")
+
+ ;; Timing / reconnect options
+ (bind-timelimit
+ (maybe-number 'disabled)
+ "Specifies the time limit in seconds to use when connecting to the
+directory server. The default value is 10 seconds.")
+ (timelimit
+ (maybe-number 'disabled)
+ "Specifies the time limit (in seconds) to wait for a response from the LDAP
+server. A value of zero, which is the default, is to wait indefinitely for
+searches to be completed.")
+ (idle-timelimit
+ (maybe-number 'disabled)
+ "Specifies the period if inactivity (in seconds) after which the con‐
+nection to the LDAP server will be closed. The default is not to time out
+connections.")
+ (reconnect-sleeptime
+ (maybe-number 'disabled)
+ "Specifies the number of seconds to sleep when connecting to all LDAP
+servers fails. By default one second is waited between the first failure and
+the first retry.")
+ (reconnect-retrytime
+ (maybe-number 'disabled)
+ "Specifies the time after which the LDAP server is considered to be
+permanently unavailable. Once this time is reached retries will be done only
+once per this time period. The default value is 10 seconds.")
+
+ ;; TLS options
+ (ssl
+ (maybe-ssl-option 'disabled)
+ "Specifies whether to use SSL/TLS or not (the default is not to). If
+'start-tls is specified then StartTLS is used rather than raw LDAP over SSL.")
+ (tls-reqcert
+ (maybe-tls-reqcert-option 'disabled)
+ "Specifies what checks to perform on a server-supplied certificate.
+The meaning of the values is described in the ldap.conf(5) manual page.")
+ (tls-cacertdir
+ (maybe-string 'disabled)
+ "Specifies the directory containing X.509 certificates for peer authen‐
+tication. This parameter is ignored when using GnuTLS.")
+ (tls-cacertfile
+ (maybe-string 'disabled)
+ "Specifies the path to the X.509 certificate for peer authentication.")
+ (tls-randfile
+ (maybe-string 'disabled)
+ "Specifies the path to an entropy source. This parameter is ignored when
+using GnuTLS.")
+ (tls-ciphers
+ (maybe-string 'disabled)
+ "Specifies the ciphers to use for TLS as a string.")
+ (tls-cert
+ (maybe-string 'disabled)
+ "Specifies the path to the file containing the local certificate for client
+TLS authentication.")
+ (tls-key
+ (maybe-string 'disabled)
+ "Specifies the path to the file containing the private key for client TLS
+authentication.")
+
+ ;; Other options
+ (pagesize
+ (maybe-number 'disabled)
+ "Set this to a number greater than 0 to request paged results from the LDAP
+server in accordance with RFC2696. The default (0) is to not request paged
+results.")
+ (nss-initgroups-ignoreusers
+ (maybe-ignore-users-option 'disabled)
+ "This option prevents group membership lookups through LDAP for the
+specified users. Alternatively, the value 'all-local may be used. With that
+value nslcd builds a full list of non-LDAP users on startup.")
+ (nss-min-uid
+ (maybe-number 'disabled)
+ "This option ensures that LDAP users with a numeric user id lower than the
+specified value are ignored.")
+ (nss-uid-offset
+ (maybe-number 'disabled)
+ "This option specifies an offset that is added to all LDAP numeric user
+ids. This can be used to avoid user id collisions with local users.")
+ (nss-gid-offset
+ (maybe-number 'disabled)
+ "This option specifies an offset that is added to all LDAP numeric group
+ids. This can be used to avoid user id collisions with local groups.")
+ (nss-nested-groups
+ (maybe-boolean 'disabled)
+ "If this option is set, the member attribute of a group may point to
+another group. Members of nested groups are also returned in the higher level
+group and parent groups are returned when finding groups for a specific user.
+The default is not to perform extra searches for nested groups.")
+ (nss-getgrent-skipmembers
+ (maybe-boolean 'disabled)
+ "If this option is set, the group member list is not retrieved when looking
+up groups. Lookups for finding which groups a user belongs to will remain
+functional so the user will likely still get the correct groups assigned on
+login.")
+ (nss-disable-enumeration
+ (maybe-boolean 'disabled)
+ "If this option is set, functions which cause all user/group entries to be
+loaded from the directory will not succeed in doing so. This can dramatically
+reduce LDAP server load in situations where there are a great number of users
+and/or groups. This option is not recommended for most configurations.")
+ (validnames
+ (maybe-string 'disabled)
+ "This option can be used to specify how user and group names are verified
+within the system. This pattern is used to check all user and group names
+that are requested and returned from LDAP.")
+ (ignorecase
+ (maybe-boolean 'disabled)
+ "This specifies whether or not to perform searches using case-insensitive
+matching. Enabling this could open up the system to authorization bypass
+vulnerabilities and introduce nscd cache poisoning vulnerabilities which allow
+denial of service.")
+ (pam-authc-ppolicy
+ (maybe-boolean 'disabled)
+ "This option specifies whether password policy controls are requested and
+handled from the LDAP server when performing user authentication.")
+ (pam-authc-search
+ (maybe-string 'disabled)
+ "By default nslcd performs an LDAP search with the user's credentials after
+BIND (authentication) to ensure that the BIND operation was successful. The
+default search is a simple check to see if the user's DN exists. A search
+filter can be specified that will be used instead. It should return at least
+one entry.")
+ (pam-authz-search
+ (maybe-string 'disabled)
+ "This option allows flexible fine tuning of the authorisation check that
+should be performed. The search filter specified is executed and if any
+entries match, access is granted, otherwise access is denied.")
+ (pam-password-prohibit-message
+ (maybe-string 'disabled)
+ "If this option is set password modification using pam_ldap will be denied
+and the specified message will be presented to the user instead. The message
+can be used to direct the user to an alternative means of changing their
+password.")
+
+ ;; Options for extension of pam-root-service-type.
+ (pam-services
+ (list '())
+ "List of pam service names for which LDAP authentication should suffice."))
+
+(define %nslcd-accounts
+ (list (user-group
+ (name "nslcd")
+ (system? #t))
+ (user-account
+ (name "nslcd")
+ (group "nslcd")
+ (comment "NSLCD service account")
+ (home-directory "/var/empty")
+ (shell (file-append shadow "/sbin/nologin"))
+ (system? #t))))
+
+(define (nslcd-config-file config)
+ "Return an NSLCD configuration file."
+ (plain-file "nslcd.conf"
+ (with-output-to-string
+ (lambda ()
+ (serialize-configuration config nslcd-configuration-fields)
+ ;; The file must end with a newline character.
+ (format #t "\n")))))
+
+;; XXX: The file should only be readable by root if it contains a "bindpw"
+;; declaration. Unfortunately, this etc-service-type extension does not
+;; support setting file modes, so we do this in the activation service.
+(define (nslcd-etc-service config)
+ `(("nslcd.conf" ,(nslcd-config-file config))))
+
+(define (nslcd-shepherd-service config)
+ (list (shepherd-service
+ (documentation "Run the nslcd service for resolving names from LDAP.")
+ (provision '(nslcd))
+ (requirement '(networking user-processes))
+ (start #~(make-forkexec-constructor
+ (list (string-append #$(nslcd-configuration-nss-pam-ldapd
config)
+ "/sbin/nslcd")
+ "--nofork")
+ #:pid-file "/var/run/nslcd/nslcd.pid"
+ #:environment-variables
+ (list (string-append "LD_LIBRARY_PATH="
+ #$(nslcd-configuration-nss-pam-ldapd
config)
+ "/lib"))))
+ (stop #~(make-kill-destructor)))))
+
+(define (pam-ldap-pam-service config)
+ "Return a PAM service for LDAP authentication."
+ (define pam-ldap-module
+ #~(string-append #$(nslcd-configuration-nss-pam-ldapd config)
+ "/lib/security/pam_ldap.so"))
+ (lambda (pam)
+ (if (member (pam-service-name pam)
+ (nslcd-configuration-pam-services config))
+ (let ((sufficient
+ (pam-entry
+ (control "sufficient")
+ (module pam-ldap-module))))
+ (pam-service
+ (inherit pam)
+ (auth (cons sufficient (pam-service-auth pam)))
+ (session (cons sufficient (pam-service-session pam)))
+ (account (cons sufficient (pam-service-account pam)))))
+ pam)))
+
+(define (pam-ldap-pam-services config)
+ (list (pam-ldap-pam-service config)))
+
+(define nslcd-service-type
+ (service-type
+ (name 'nslcd)
+ (description "Run the NSLCD service for looking up names from LDAP.")
+ (extensions
+ (list (service-extension account-service-type
+ (const %nslcd-accounts))
+ (service-extension etc-service-type
+ nslcd-etc-service)
+ (service-extension activation-service-type
+ (const #~(begin
+ (use-modules (guix build utils))
+ (let ((rundir "/var/run/nslcd")
+ (user (getpwnam "nslcd")))
+ (mkdir-p rundir)
+ (chown rundir (passwd:uid user)
(passwd:gid user))
+ (chmod rundir #o755)
+ (when (file-exists?
"/etc/nslcd.conf")
+ (chmod "/etc/nslcd.conf"
#o400))))))
+ (service-extension pam-root-service-type
+ pam-ldap-pam-services)
+ (service-extension nscd-service-type
+ (const (list nss-pam-ldapd)))
+ (service-extension shepherd-root-service-type
+ nslcd-shepherd-service)))
+ (default-value (nslcd-configuration))))
+
+(define (generate-nslcd-documentation)
+ (generate-documentation
+ `((nslcd-configuration ,nslcd-configuration-fields))
+ 'nslcd-configuration))
diff --git a/gnu/tests/ldap.scm b/gnu/tests/ldap.scm
new file mode 100644
index 0000000..2d4f15f
--- /dev/null
+++ b/gnu/tests/ldap.scm
@@ -0,0 +1,160 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2019 Ricardo Wurmus <address@hidden>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu tests ldap)
+ #:use-module (gnu tests)
+ #:use-module (gnu system)
+ #:use-module (gnu system nss)
+ #:use-module (gnu system vm)
+ #:use-module (gnu services)
+ #:use-module (gnu services authentication)
+ #:use-module (gnu services networking)
+ #:use-module (gnu packages base)
+ #:use-module (gnu packages openldap)
+ #:use-module (guix gexp)
+ #:use-module (guix store)
+ #:export (%test-ldap))
+
+(define %ldap-os
+ (let ((simple
+ (simple-operating-system
+ (service dhcp-client-service-type)
+ (service nslcd-service-type))))
+ (operating-system
+ (inherit simple)
+ (name-service-switch
+ (let ((services (list (name-service (name "db"))
+ (name-service (name "files"))
+ (name-service (name "ldap")))))
+ (name-service-switch
+ (inherit %mdns-host-lookup-nss)
+ (password services)
+ (shadow services)
+ (group services)
+ (netgroup services)
+ (gshadow services)))))))
+
+(define (run-ldap-test)
+ "Run tests in %LDAP-OS."
+ (define os
+ (marionette-operating-system
+ %ldap-os
+ #:imported-modules '((gnu services herd)
+ (guix combinators))))
+
+ (define vm
+ (virtual-machine os))
+
+ (define test
+ (with-imported-modules '((gnu build marionette))
+ #~(begin
+ (use-modules (srfi srfi-11) (srfi srfi-64)
+ (gnu build marionette))
+
+ (define marionette
+ (make-marionette (list #$vm)))
+
+ (mkdir #$output)
+ (chdir #$output)
+
+ (test-begin "ldap")
+
+ ;; Set up LDAP directory server
+ (test-assert "LDAP server instance running"
+ (marionette-eval
+ '(begin
+ (with-output-to-file "instance.inf"
+ (lambda ()
+ (display "[general]
+config_version = 2
+
+\n[slapd]
+root_password = SECRET
+user = root
+group = root
+
+\n[backend-userroot]
+sample_entries = yes
+suffix = dc=example,dc=com")))
+ (and
+ ;; Create instance
+ (zero? (system* #$(file-append 389-ds-base "/sbin/dscreate")
+ "-v" "from-file" "instance.inf"))
+ ;; Start instance
+ (zero? (system* #$(file-append 389-ds-base "/sbin/dsctl")
+ "localhost" "start"))
+ ;; Create user account
+ (zero? (system* #$(file-append 389-ds-base "/sbin/dsidm")
+ "-b" "dc=example,dc=com"
+ "localhost" "user" "create"
+ "--uid" "eva" "--cn" "Eva Lu Ator"
+ "--displayName" "Eva Lu Ator"
+ "--uidNumber" "1234" "--gidNumber" "2345"
+ "--homeDirectory" "/home/eva"))))
+ marionette))
+
+ (test-assert "Manager can bind to LDAP server instance"
+ (marionette-eval
+ '(zero? (system* #$(file-append openldap "/bin/ldapwhoami")
+ "-H" "ldap://localhost"; "-D"
+ "cn=Directory Manager" "-w" "SECRET"))
+ marionette))
+
+ ;; Wait for nslcd to be up and running.
+ (test-assert "nslcd service running"
+ (marionette-eval
+ '(begin
+ (use-modules (gnu services herd))
+ (match (start-service 'nslcd)
+ (#f #f)
+ (('service response-parts ...)
+ (match (assq-ref response-parts 'running)
+ ((pid) (number? pid))))))
+ marionette))
+
+ (test-assert "nslcd produces a log file"
+ (marionette-eval
+ '(file-exists? "/var/log/nslcd")
+ marionette))
+
+ (test-assert "Can query LDAP user accounts"
+ (marionette-eval
+ '(begin
+ ;; TODO: This shouldn't be necessary, but unfortunately it
+ ;; really is needed to discover LDAP accounts with "id".
+ (setenv "LD_LIBRARY_PATH"
+ #$(file-append nss-pam-ldapd "/lib"))
+ (zero? (system* #$(file-append coreutils "/bin/id") "eva")))
+ marionette))
+
+ (test-assert "Can become LDAP user"
+ (marionette-eval
+ '(zero? (system* "/run/setuid-programs/su" "eva" "-c"
+ #$(file-append coreutils "/bin/true")))
+ marionette))
+
+ (test-end)
+ (exit (= (test-runner-fail-count (test-runner-current)) 0)))))
+
+ (gexp->derivation "ldap-test" test))
+
+(define %test-ldap
+ (system-test
+ (name "ldap")
+ (description "Run an LDAP directory server and authenticate against it.")
+ (value (run-ldap-test))))