diff options
| author | Martin Weinelt <mweinelt@users.noreply.github.com> | 2023-06-11 20:22:00 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-06-11 20:22:00 +0200 |
| commit | fe2f291e1705383d0e04cee0fa36a52214bf3e2e (patch) | |
| tree | 0ded88f657db8eefcd7241f7351b932e0ebc178a /nixos/modules | |
| parent | 748209b9063313fd6ef84f8e7ec11ce451f36a4a (diff) | |
| parent | 7575e488de0a2610ee19dd0a0015e59224e2ae4c (diff) | |
| download | nixlib-fe2f291e1705383d0e04cee0fa36a52214bf3e2e.tar nixlib-fe2f291e1705383d0e04cee0fa36a52214bf3e2e.tar.gz nixlib-fe2f291e1705383d0e04cee0fa36a52214bf3e2e.tar.bz2 nixlib-fe2f291e1705383d0e04cee0fa36a52214bf3e2e.tar.lz nixlib-fe2f291e1705383d0e04cee0fa36a52214bf3e2e.tar.xz nixlib-fe2f291e1705383d0e04cee0fa36a52214bf3e2e.tar.zst nixlib-fe2f291e1705383d0e04cee0fa36a52214bf3e2e.zip | |
Merge pull request #236757 from max-privatevoid/pam-kanidm
nixos/pam: support Kanidm
Diffstat (limited to 'nixos/modules')
| -rw-r--r-- | nixos/modules/security/pam.nix | 16 | ||||
| -rw-r--r-- | nixos/modules/services/security/kanidm.nix | 1 |
2 files changed, 17 insertions, 0 deletions
diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index eac67cfdec5a..4172bc6fbe1e 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -484,6 +484,9 @@ let optionalString cfg.mysqlAuth '' account sufficient ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf '' + + optionalString (config.services.kanidm.enablePam) '' + account sufficient ${pkgs.kanidm}/lib/pam_kanidm.so ignore_unknown_user + '' + optionalString (config.services.sssd.enable && cfg.sssdStrictAccess==false) '' account sufficient ${pkgs.sssd}/lib/security/pam_sss.so '' + @@ -617,6 +620,9 @@ let optionalString use_ldap '' auth sufficient ${pam_ldap}/lib/security/pam_ldap.so use_first_pass '' + + optionalString config.services.kanidm.enablePam '' + auth sufficient ${pkgs.kanidm}/lib/pam_kanidm.so ignore_unknown_user use_first_pass + '' + optionalString config.services.sssd.enable '' auth sufficient ${pkgs.sssd}/lib/security/pam_sss.so use_first_pass '' + @@ -653,6 +659,9 @@ let optionalString cfg.mysqlAuth '' password sufficient ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf '' + + optionalString config.services.kanidm.enablePam '' + password sufficient ${pkgs.kanidm}/lib/pam_kanidm.so + '' + optionalString config.services.sssd.enable '' password sufficient ${pkgs.sssd}/lib/security/pam_sss.so '' + @@ -714,6 +723,9 @@ let optionalString cfg.mysqlAuth '' session optional ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf '' + + optionalString config.services.kanidm.enablePam '' + session optional ${pkgs.kanidm}/lib/pam_kanidm.so + '' + optionalString config.services.sssd.enable '' session optional ${pkgs.sssd}/lib/security/pam_sss.so '' + @@ -1298,6 +1310,7 @@ in # Include the PAM modules in the system path mostly for the manpages. [ pkgs.pam ] ++ optional config.users.ldap.enable pam_ldap + ++ optional config.services.kanidm.enablePam pkgs.kanidm ++ optional config.services.sssd.enable pkgs.sssd ++ optionals config.security.pam.krb5.enable [pam_krb5 pam_ccreds] ++ optionals config.security.pam.enableOTPW [ pkgs.otpw ] @@ -1364,6 +1377,9 @@ in optionalString use_ldap '' mr ${pam_ldap}/lib/security/pam_ldap.so, '' + + optionalString config.services.kanidm.enablePam '' + mr ${pkgs.kanidm}/lib/pam_kanidm.so, + '' + optionalString config.services.sssd.enable '' mr ${pkgs.sssd}/lib/security/pam_sss.so, '' + diff --git a/nixos/modules/services/security/kanidm.nix b/nixos/modules/services/security/kanidm.nix index 7ec7a1598735..71ccded7dce1 100644 --- a/nixos/modules/services/security/kanidm.nix +++ b/nixos/modules/services/security/kanidm.nix @@ -320,6 +320,7 @@ in ProtectHome = false; RestrictAddressFamilies = [ "AF_UNIX" ]; TemporaryFileSystem = "/:ro"; + Restart = "on-failure"; }; environment.RUST_LOG = "info"; }; |