freeipa: init at 4.4.3 #22789

outergod · 2017-02-14T12:27:22Z

libverto: init at 0.2.6
pythonPackages.nss: init at 1.0.0
pythonPackages.pki: init at 10.3.5
pythonPackages.lesscpy: init at 0.12.0
pythonPackages.python-yubico: init at 1.3.2

Changed bind to optionally build with Kerberos support.
Changed krb5 to build with system libverto by default.

Motivation for this change

This changeset contains all packages and other changes to turn NixOS into a fully capable, well-behaving FreeIPA client and domain member. While only the client portion of FreeIPA is fully implemented, some of the work for building the server component has also been done to actually make the client build succeed.

FreeIPA needs several packages to be build with MIT Kerberos, which in turn needs to use a newer version of libverto than the one bundled with krb5. Because of transitive dependencies, Samba 4 also needs to be build with that same version of MIT Kerberos. The changeset takes a stance that krb5 should much rather always be built with system libverto, which will trigger a mass-rebuild but save time and space in the long run because no duplicate versions of krb5 dependents are needed.
Building with libverto is explicitly switched off for fetchurl's curl derivation to prevent a circular dependency.

The usual way to join a host to IPA is via freeipa-client-install, which normally modifies and backs up many different files in /etc, which is not possible on NixOS, for obvious reasons. Therefore, I created a nix module that does the same job idiomatically. The only manual steps for a user is to prefetch the certificate from the server and specify the resulting hash in the configuration, as seen below. After activating the configuration, they need to join the domain and obtain the keytab file manually, for which multiple different methods exist, with the most common one presented in the build output.

A typical, a valid set of FreeIPA configuration looks like this:

{
  networking.hostName = "nixos.in.foo.com";

  ipa = {
    enable = true;
    domain = "in.foo.com";
    realm  = "IN.FOO.COM";
    server = "ipa.in.foo.com";
    basedn = "dc=in,dc=foo,dc=com";
    certificate = pkgs.fetchurl {
      url = http://ipa.in.foo.com/ipa/config/ca.crt;
      sha256 = "xxx";
    };
  };
  
  services.sssd.enable = true;
  services.ntp.enable = true;
  security.pam.services.login.makeHomeDir = true;  
  security.pam.services.su.makeHomeDir = true;
}

The easiest way to test this is to create and set up a FreeIPA instance in a Fedora VM or docker container and build a NixOS version via nixos-container, bind-mounting nixpkgs like so:

sudo nixos-container create ipa-test
sudo mkdir -p /nix/var/nix/profiles/per-container/ipa-test/per-user/root/channels/nixos
sudo mount --bind /path/to/nixpkgs /nix/var/nix/profiles/per-container/ipa-test/per-user/root/channels/nixos
sudo nixos-container start ipa-test
ln -s /path/to/nixpkgs /path/to/nixpkgs/nixpkgs # Yes, this is required!
sudo nixos-container root-login ipa-test
ipa-test> nix-prefetch-url http://ipa.in.foo.com/ipa/config/ca.crt
ipa-test> cat > /etc/nixos/configuration.nix <<'EOF'
{ config, lib, pkgs, ... }:

with lib;

{ boot.isContainer = true;
  networking.hostName = "ipa-test.in.foo.com";
  networking.useDHCP = false;

  ipa = {
    enable = true;
    domain = "in.foo.com";
    realm  = "IN.FOO.COM";
    server = "ipa.in.foo.com";
    basedn = "dc=in,dc=foo,dc=com";
    certificate = pkgs.fetchurl {
      url = http://ipa.in.foo.com/ipa/config/ca.crt;
      sha256 = "xxx";
    };
  };
  
  services.sssd.enable = true;
  services.ntp.enable = true;
  security.pam.services.login.makeHomeDir = true;  
  security.pam.services.su.makeHomeDir = true;
}
EOF

ipa-test> nixos-rebuild switch

I'm well aware this is not a trivial change but I believe the benefit makes up for it and I'm grateful for reviewers who feel like they could tackle this.

Things done

Tested using sandboxing
(nix.useSandbox on NixOS,
or option build-use-sandbox in nix.conf
on non-NixOS)
Built on platform(s)
- NixOS
- macOS
- Linux
Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
Tested execution of all binary files (usually in ./result/bin/)
Fits CONTRIBUTING.md.

mention-bot · 2017-02-14T12:27:24Z

@e-user, thanks for your PR! By analyzing the history of the files in this pull request, we identified @dezgeg, @peti, @edolstra and @FRidh to be potential reviewers.

pkgs/os-specific/linux/freeipa/default.nix

pkgs/top-level/all-packages.nix

pkgs/top-level/python-packages.nix

FRidh · 2017-02-14T16:49:27Z

pkgs/top-level/python-packages.nix

+
+    preBuild = ''
+      cd base/common/python
+      unset SOURCE_DATE_EPOCH


why are you unsetting this?

Please see
https://nixos.org/releases/nixpkgs/nixpkgs-17.03pre91272.7e273d9/manual/#python-setup.py-bdist_wheel-cannot-create-.whl

I'm surprised to see you actually need to unset it yourself.

pkgs/top-level/python-packages.nix

FRidh · 2017-02-18T11:15:21Z

tests of nss and pki are not run

outergod · 2017-02-18T16:23:08Z

I've addressed all of the issues you pointed out, @FRidh. pki-core doesn't have any tests for Python. All nss tests are now being run, but for one of them, an SSL server is started on port 1234, and I'm not sure what NixOS' policies are on tests like that.

outergod · 2017-03-04T09:17:30Z

Ping @FRidh

fpletz · 2017-03-06T22:03:01Z

We have a local freeipa server. I hope I can get around to test this soon. Thanks for your work on this!

FRidh

This has been open for a quite a while. My apologies for not replying any sooner.

@e-user If there's tests requiring network we disable those.

pkgs/os-specific/linux/freeipa/default.nix

pkgs/top-level/all-packages.nix

CMCDragonkai · 2017-10-22T06:18:20Z

Will this lead to allowing NixOS being a freeipa server as well?

bjornfor · 2017-10-22T13:03:35Z

I think not (from first post):

While only the client portion of FreeIPA is fully implemented, some of the work for building the server component has also been done to actually make the client build succeed.

ts468 · 2017-11-11T15:48:20Z

I'd be interested in getting FreeIPA integrated as well!
@e-user: How can I help? It would be a shame to loose all your hard work and effort!
@FRidh, @fpletz: What are your current thoughts and comment about it? Should we pick it up?

pkgs/development/python-modules/lesscpy/default.nix

pkgs/development/python-modules/nss/default.nix

pkgs/development/python-modules/yubico/default.nix

pkgs/os-specific/linux/freeipa/default.nix

FRidh · 2017-11-11T15:55:47Z

@ts468 I've only reviewed the Python expressions for which only minor changes are needed. Eventually separate commits are needed as well.

Ekleog · 2018-10-06T05:09:58Z

(triage) @e-user, are you still willing to push this forward? :)

outergod · 2018-10-08T22:11:32Z

Actually, I am interested again, @Ekleog. I'll look into this again over the next days.

srhb · 2019-04-10T10:44:50Z

I, too, am interested here. Anything I can assist with?

outergod · 2019-04-13T11:40:47Z

I'm installing NixOS into a VM right now and will pick it up again, for real.

outergod · 2019-07-25T09:07:03Z

So yeah, what's left to do? All issues had already been resolved before master moved on, again. I will happily resolve the conflicts, but I would appreciate if that could resolve in an actual merge. Alternatively, if anyone (@poelzi?) would prefer to run a real-life test against an actual server, I'll gladly provide guidance on how to do this, if so desired.

mmahut · 2019-07-25T15:12:25Z

I'm open to test this if you resolve the conflicts.

Nepetalactone · 2020-04-10T12:22:38Z

Apart from the merge conflicts, is there anything that is keeping this from being merged @infinisil ?

mmahut · 2020-05-03T15:46:25Z

ping ^^

Nepetalactone · 2020-05-06T20:01:50Z

@FRidh I hope I am not asking for too much, but since you seem to have merge rights and are already familiar with the pull request, would it be possible that you coordinate the inclusion of this package? There hasn't been any activity on this pull request since half a year and it seems as if there are no missing required changes, apart from the conflicts of course

bhipple

Have a bunch of nit-picky review comments. Happy to test this further if you rebase/polish/upgrade it. If no one else objects once that's done I'll merge it in.

bhipple · 2020-07-06T01:36:35Z

pkgs/development/libraries/libverto/default.nix

+let
+  name = "libverto-${version}";
+  version = "0.2.6";
+in


You can replace this whole thing by just using pname below.

bhipple · 2020-07-06T01:36:52Z

pkgs/development/libraries/libverto/default.nix

+      async api which allows the library to expose asynchronous interfaces and
+      offload the choice of the main loop to the application.
+    '';
+    homepage = https://github.com/latchset/libverto/;


Suggested change

homepage = https://github.com/latchset/libverto/;

homepage = "https://github.com/latchset/libverto/";

bhipple · 2020-07-06T01:38:27Z

pkgs/development/python-modules/nss/default.nix

+  inherit (stdenv.lib) concatStringsSep replaceStrings;
+in
+buildPythonPackage rec {
+  name = "nss-${version}";


Suggested change

name = "nss-${version}";

pname = "nss";

bhipple · 2020-07-06T01:38:59Z

pkgs/development/python-modules/nss/default.nix

+
+  meta = with stdenv.lib; {
+    description = "Python binding for NSS";
+    homepage    = https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/Python_binding_for_NSS;


Suggested change

homepage = https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/Python_binding_for_NSS;

homepage = "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/Python_binding_for_NSS";

bhipple · 2020-07-06T01:40:12Z

pkgs/development/python-modules/pki-core/default.nix

+  six }:
+
+buildPythonPackage rec {
+  name = "pki-core-${version}";


Suggested change

name = "pki-core-${version}";

pname = "pki-core";

This makes things much nicer for users pinning this to a different version in an overlay, and matches the general coding standards.

bhipple · 2020-07-06T01:42:17Z

pkgs/os-specific/linux/freeipa/default.nix

+  prefix = "/";
+
+  # Building and installing the server fails with silent Rhino errors, skipping
+  # for now. Need a newer Rhino version.


Do we have this how, or still the case?

bhipple · 2020-07-06T01:42:33Z

pkgs/os-specific/linux/freeipa/default.nix

+      features for further integration with Linux based clients (SUDO, automount)
+      and integration with Active Directory based infrastructures (Trusts).
+    '';
+    homepage = https://www.freeipa.org/;


Suggested change

homepage = https://www.freeipa.org/;

homepage = "https://www.freeipa.org/";

bhipple · 2020-07-06T01:42:56Z

pkgs/os-specific/linux/freeipa/ipa-client-install

@@ -0,0 +1,5 @@
+#!/bin/sh
+
+echo "ipa-client-install is not available on NixOS. Please see services.ipa.client, instead."


Suggested change

echo "ipa-client-install is not available on NixOS. Please see services.ipa.client, instead."

echo "ipa-client-install is not available on NixOS. Please see services.ipa.client instead."

bhipple · 2020-07-06T01:43:43Z

pkgs/servers/dns/bind/default.nix

@@ -3,10 +3,12 @@
 , libcap, libtool, libxml2, openssl
 , enablePython ? config.bind.enablePython or false, python3 ? null
 , enableSeccomp ? false, libseccomp ? null, buildPackages
+, enableGSSAPI ? true, kerberos ? null


bhipple · 2020-07-06T01:46:37Z

nixos/modules/config/ipa.nix

+         dns_lookup_realm = false
+         dns_lookup_kdc = true
+         rdns = false
+         ticket_lifetime = 24h


Might be nice to make this one configurable.

AndersonTorres · 2020-10-12T12:02:21Z

pkgs/development/compilers/lesscpy/default.nix

+
+  meta = with stdenv.lib; {
+    description = "Python LESS Compiler";
+    homepage    = https://github.com/lesscpy/lesscpy;


Suggested change

homepage = https://github.com/lesscpy/lesscpy;

homepage = "https://github.com/lesscpy/lesscpy";

AndersonTorres · 2020-10-12T12:03:53Z

pkgs/development/libraries/libverto/default.nix

+{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, glib, libev, libevent, tevent, talloc }:
+
+let
+  name = "libverto-${version}";


Suggested change

name = "libverto-${version}";

pname = "libverto";

SuperSandro2000 · 2021-01-02T17:52:51Z

Closing since author did not respond in the last months. If this is still important to you please reopen the discussion here.

bjornfor · 2021-01-02T18:56:52Z

Still important to me.

SuperSandro2000 · 2021-01-10T13:38:56Z

@bjornfor yeah to you but not to @outergod because he did not respond in 18 months to this. Feel free to pick up the work.

outergod · 2021-01-11T08:02:11Z

Yeah sorry guys. I don't even have a NixOS installation anymore, at all, so I can't really work on it. If anyone needs help finishing this, let me know.

benley · 2022-04-12T20:28:08Z

I'm vaguely considering picking this up. Before I dive in, does anyone know if there has been other related work that would significantly affect this one?

AndersonTorres · 2022-04-13T01:42:41Z

Almost two years. Just suppose that no one knows.

s1341 · 2022-12-12T08:25:32Z

I kinda need this, and it appears that @outergod did some impressive work... I may take this up and bump to the latest version of freeipa. Is there interest?

AndersonTorres · 2022-12-12T12:34:28Z

This is a package database. It will always be interesting to include a package to it.

According to NixOS#22789 (comment), the maintainer doesn't use NixOS anymore.

s1341 · 2022-12-20T13:33:55Z

I'm picking this up. I will open a new PR once I get things working...

s1341 · 2022-12-21T15:49:31Z

Please see #207115 which supersedes this.

FRidh self-assigned this Feb 14, 2017

FRidh added the 6.topic: python label Feb 14, 2017

fpletz added the 6.topic: nixos label Feb 14, 2017

FRidh requested changes Feb 14, 2017

View reviewed changes

FRidh removed their assignment Feb 14, 2017

FRidh reviewed Feb 18, 2017

View reviewed changes

pkgs/top-level/python-packages.nix Outdated Show resolved Hide resolved

outergod force-pushed the pkgs/freeipa-4.4.3 branch from c2da7f3 to 74e66a4 Compare February 18, 2017 16:20

outergod force-pushed the pkgs/freeipa-4.4.3 branch from 74e66a4 to 421f6a5 Compare February 19, 2017 11:12

fpletz self-requested a review March 6, 2017 22:03

fpletz self-assigned this Mar 6, 2017

FRidh requested changes May 16, 2017

View reviewed changes

pkgs/os-specific/linux/freeipa/default.nix Show resolved Hide resolved

pkgs/top-level/all-packages.nix Outdated Show resolved Hide resolved

FRidh added 2.status: merge conflict 2.status: work-in-progress labels May 16, 2017

FRidh reviewed Nov 11, 2017

View reviewed changes

bjornfor mentioned this pull request Nov 23, 2017

Update sssd integration with pam as documented by RedHat #31969

Merged

8 tasks

outergod force-pushed the pkgs/freeipa-4.4.3 branch from 421f6a5 to 3e9abf2 Compare April 13, 2019 23:56

outergod requested a review from infinisil as a code owner April 13, 2019 23:56

fpletz removed their assignment Nov 17, 2019

bhipple requested changes Jul 6, 2020

View reviewed changes

ryantm added 2.status: merge conflict and removed 2.status: merge conflict labels Oct 3, 2020

AndersonTorres reviewed Oct 12, 2020

View reviewed changes

SuperSandro2000 marked this pull request as draft November 27, 2020 22:00

SuperSandro2000 closed this Jan 2, 2021

bjornfor reopened this Jan 2, 2021

SuperSandro2000 closed this Jan 10, 2021

AndersonTorres added a commit to atorres1985-contrib/nixpkgs that referenced this pull request Dec 12, 2022

treewide: remove e-user from maintainers

28a5476

According to NixOS#22789 (comment), the maintainer doesn't use NixOS anymore.

This was referenced Dec 12, 2022

treewide: remove e-user from maintainers #205772

Merged

libverto: init at 0.3.2 #205778

Merged

s1341 mentioned this pull request Dec 21, 2022

freeipa: init at 4.10.1 #207115

Merged

16 tasks

	homepage = https://github.com/latchset/libverto/;
	homepage = "https://github.com/latchset/libverto/";

	homepage = https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/Python_binding_for_NSS;
	homepage = "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/Python_binding_for_NSS";

	homepage = https://www.freeipa.org/;
	homepage = "https://www.freeipa.org/";

		@@ -0,0 +1,5 @@
		#!/bin/sh

		echo "ipa-client-install is not available on NixOS. Please see services.ipa.client, instead."

	homepage = https://github.com/lesscpy/lesscpy;
	homepage = "https://github.com/lesscpy/lesscpy";

freeipa: init at 4.4.3 #22789

freeipa: init at 4.4.3 #22789

Conversation

outergod commented Feb 14, 2017 • edited

Motivation for this change

Things done

mention-bot commented Feb 14, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

FRidh commented Feb 18, 2017

outergod commented Feb 18, 2017

outergod commented Mar 4, 2017

fpletz commented Mar 6, 2017

FRidh left a comment

Choose a reason for hiding this comment

CMCDragonkai commented Oct 22, 2017

bjornfor commented Oct 22, 2017

ts468 commented Nov 11, 2017

FRidh commented Nov 11, 2017

Ekleog commented Oct 6, 2018

outergod commented Oct 8, 2018

srhb commented Apr 10, 2019

outergod commented Apr 13, 2019

outergod commented Jul 25, 2019

mmahut commented Jul 25, 2019

Nepetalactone commented Apr 10, 2020 • edited

mmahut commented May 3, 2020

Nepetalactone commented May 6, 2020

bhipple left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

SuperSandro2000 commented Jan 2, 2021

bjornfor commented Jan 2, 2021

SuperSandro2000 commented Jan 10, 2021 • edited by AndersonTorres

outergod commented Jan 11, 2021

benley commented Apr 12, 2022

AndersonTorres commented Apr 13, 2022

s1341 commented Dec 12, 2022

AndersonTorres commented Dec 12, 2022

s1341 commented Dec 20, 2022

s1341 commented Dec 21, 2022

outergod commented Feb 14, 2017 •

edited

Nepetalactone commented Apr 10, 2020 •

edited

SuperSandro2000 commented Jan 10, 2021 •

edited by AndersonTorres