105 lines
3.8 KiB
Scheme
105 lines
3.8 KiB
Scheme
(define-module (services sssd)
|
||
#:use-module (gnu)
|
||
#:use-module (gnu packages sssd)
|
||
#:use-module (gnu services dbus)
|
||
#:use-module (gnu services shepherd)
|
||
#:use-module (guix modules)
|
||
#:use-module (guix packages)
|
||
#:use-module (guix records)
|
||
#:use-module (srfi srfi-1)
|
||
#:export (pam-sss-service-type sssd-service-type sssd-configuration))
|
||
|
||
;;;
|
||
;;; System Security Services Daemon.
|
||
;;;
|
||
|
||
(define-record-type* <sssd-configuration>
|
||
sssd-configuration make-sssd-configuration
|
||
sssd-configuration?
|
||
(package sssd-configuration-package (default sssd))
|
||
(config-file sssd-configuration-config-file (default "/etc/sssd/sssd.conf")))
|
||
|
||
(define (sssd-shepherd-service config)
|
||
"Return a <shepherd-service> for SSSD with CONFIG."
|
||
(let ((sssd (sssd-configuration-package config)))
|
||
(list
|
||
(shepherd-service
|
||
(requirement '(dbus-system))
|
||
(provision '(sssd))
|
||
(documentation "Start sssd")
|
||
(start #~(make-forkexec-constructor
|
||
(list (string-append #$sssd "/sbin/sssd")
|
||
"-c" #$(sssd-configuration-config-file config)
|
||
"--logger=files")
|
||
#:pid-file "/var/run/sssd.pid"
|
||
#:log-file "/var/log/sssd/daemon.log"))
|
||
(stop #~(make-kill-destructor))))))
|
||
|
||
(define sssd-activation
|
||
;; Create data directories for sssd.
|
||
#~(begin
|
||
(use-modules (guix build utils))
|
||
(mkdir-p "/var/log/sssd")
|
||
(for-each (lambda (dir) (mkdir-p (string-append "/var/lib/sss/" dir)))
|
||
'("db" "gpo_cache" "mc" "pipes/private" "pubconf"))))
|
||
|
||
(define sssd-service-type
|
||
(service-type
|
||
(name 'sssd)
|
||
(extensions
|
||
(list (service-extension activation-service-type
|
||
(const sssd-activation))
|
||
(service-extension dbus-root-service-type
|
||
(compose list sssd-configuration-package))
|
||
(service-extension nscd-service-type
|
||
(compose list sssd-configuration-package))
|
||
(service-extension profile-service-type
|
||
(compose list sssd-configuration-package))
|
||
(service-extension shepherd-root-service-type
|
||
sssd-shepherd-service)))
|
||
(default-value (sssd-configuration))
|
||
(description "Run @command{sssd}.")))
|
||
|
||
(define-record-type* <pam-sss-configuration>
|
||
pam-sss-configuration make-pam-sss-configuration
|
||
pam-sss-configuration?
|
||
(sssd pam-sss-configuration-sssd (default sssd)))
|
||
|
||
|
||
;;;
|
||
;;; SSSD PAM service.
|
||
;;;
|
||
|
||
(define (pam-sss-pam-service config)
|
||
(let ((module #~(string-append #$(pam-sss-configuration-sssd config)
|
||
"/lib/security/pam_sss.so")))
|
||
(list
|
||
(lambda (pam)
|
||
(pam-service
|
||
(inherit pam)
|
||
(auth (cons* (pam-entry
|
||
(control "sufficient")
|
||
(module module))
|
||
;(arguments (list "use_first_pass")))
|
||
(pam-service-auth pam)))
|
||
(account (cons* (pam-entry
|
||
(control "[default=bad success=ok user_unknown=ignore]")
|
||
(module module))
|
||
(pam-service-account pam)))
|
||
(password (cons* (pam-entry
|
||
(control "sufficient")
|
||
(module module))
|
||
;(arguments (list "use_authtok")))
|
||
(pam-service-password pam)))
|
||
(session (cons* (pam-entry
|
||
(control "optional")
|
||
(module module))
|
||
(pam-service-session pam))))))))
|
||
|
||
(define pam-sss-service-type
|
||
(service-type
|
||
(name 'pam-sss)
|
||
(extensions
|
||
(list (service-extension pam-root-service-type pam-sss-pam-service)))
|
||
(default-value (pam-sss-configuration))
|
||
(description "Activate PAM SSSD support.")))
|