diff options
| author | Max <max@privatevoid.net> | 2023-06-08 22:35:30 +0200 |
|---|---|---|
| committer | Max <max@privatevoid.net> | 2023-06-11 17:17:42 +0200 |
| commit | 34a4165674bf4879ef0f1aade197637d8aa5dc4b (patch) | |
| tree | b0fb51c0d265eaf89098cd1478db25de39c1c035 /nixos | |
| parent | cc4e1f69ed9c4cce1abc6a9ef0a91b71c4a52004 (diff) | |
| download | nixlib-34a4165674bf4879ef0f1aade197637d8aa5dc4b.tar nixlib-34a4165674bf4879ef0f1aade197637d8aa5dc4b.tar.gz nixlib-34a4165674bf4879ef0f1aade197637d8aa5dc4b.tar.bz2 nixlib-34a4165674bf4879ef0f1aade197637d8aa5dc4b.tar.lz nixlib-34a4165674bf4879ef0f1aade197637d8aa5dc4b.tar.xz nixlib-34a4165674bf4879ef0f1aade197637d8aa5dc4b.tar.zst nixlib-34a4165674bf4879ef0f1aade197637d8aa5dc4b.zip | |
nixos/pam: support Kanidm
Diffstat (limited to 'nixos')
| -rw-r--r-- | nixos/modules/security/pam.nix | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index eac67cfdec5a..4172bc6fbe1e 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -484,6 +484,9 @@ let optionalString cfg.mysqlAuth '' account sufficient ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf '' + + optionalString (config.services.kanidm.enablePam) '' + account sufficient ${pkgs.kanidm}/lib/pam_kanidm.so ignore_unknown_user + '' + optionalString (config.services.sssd.enable && cfg.sssdStrictAccess==false) '' account sufficient ${pkgs.sssd}/lib/security/pam_sss.so '' + @@ -617,6 +620,9 @@ let optionalString use_ldap '' auth sufficient ${pam_ldap}/lib/security/pam_ldap.so use_first_pass '' + + optionalString config.services.kanidm.enablePam '' + auth sufficient ${pkgs.kanidm}/lib/pam_kanidm.so ignore_unknown_user use_first_pass + '' + optionalString config.services.sssd.enable '' auth sufficient ${pkgs.sssd}/lib/security/pam_sss.so use_first_pass '' + @@ -653,6 +659,9 @@ let optionalString cfg.mysqlAuth '' password sufficient ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf '' + + optionalString config.services.kanidm.enablePam '' + password sufficient ${pkgs.kanidm}/lib/pam_kanidm.so + '' + optionalString config.services.sssd.enable '' password sufficient ${pkgs.sssd}/lib/security/pam_sss.so '' + @@ -714,6 +723,9 @@ let optionalString cfg.mysqlAuth '' session optional ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf '' + + optionalString config.services.kanidm.enablePam '' + session optional ${pkgs.kanidm}/lib/pam_kanidm.so + '' + optionalString config.services.sssd.enable '' session optional ${pkgs.sssd}/lib/security/pam_sss.so '' + @@ -1298,6 +1310,7 @@ in # Include the PAM modules in the system path mostly for the manpages. [ pkgs.pam ] ++ optional config.users.ldap.enable pam_ldap + ++ optional config.services.kanidm.enablePam pkgs.kanidm ++ optional config.services.sssd.enable pkgs.sssd ++ optionals config.security.pam.krb5.enable [pam_krb5 pam_ccreds] ++ optionals config.security.pam.enableOTPW [ pkgs.otpw ] @@ -1364,6 +1377,9 @@ in optionalString use_ldap '' mr ${pam_ldap}/lib/security/pam_ldap.so, '' + + optionalString config.services.kanidm.enablePam '' + mr ${pkgs.kanidm}/lib/pam_kanidm.so, + '' + optionalString config.services.sssd.enable '' mr ${pkgs.sssd}/lib/security/pam_sss.so, '' + |