nixos/openldap: add option for configuring OpenLDAP package to use #91963
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ciil
suggested changes
Jul 1, 2020
There was a problem hiding this comment.
Seems reasonable overall, but I'd really like the documentation to be very clear here what this option does, because it's not like there are multiple openldap packages (like specific versions or open/closed source alternatives) in standard nixpkgs so this might confuse some people.
| default = pkgs.openldap; | ||
| description = '' | ||
| Package to use for OpenLDAP. This can be overridden if | ||
| custom modules or other similar features are necessary. |
There was a problem hiding this comment.
Could you clarify the description some more to make it clear that we always mean an openldap package, just that it can be a custom OpenLDAP package with an override to enable specific features or modules.
There was a problem hiding this comment.
Cool, I've updated the description - what do you think?
In certain cases, for example when custom OpenLDAP modules are compiled into the binary, users may want to override the package used for OpenLDAP. This is especially common in setups where LDAP is the primary authentication source, as good password hashing mechanisms need to be enabled as extra modules.
tazjin
force-pushed
the
feat/openldap-package
branch
from
d2c9175
to
c0122d3
Compare
|
@ofborg test openldap |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Motivation for this change
In certain cases, for example when custom OpenLDAP modules are
compiled into the binary, users may want to override the package used
for OpenLDAP.
This is especially common in setups where LDAP is the primary
authentication source, as good password hashing mechanisms need to be
enabled as extra modules.
Concretely this came up because we have enabled the Argos2 module in a deployment and the only way to update the OpenLDAP package was via an override in the package set, which causes extremely widespread rebuilds (as packages such as Python or GPG depend on OpenLDAP).
Things done
sandboxinnix.confon non-NixOS linux)nix-shell -p nixpkgs-review --run "nixpkgs-review wip"./result/bin/)nix path-info -Sbefore and after)