nixpkgs/nixos/tests/openldap.nix
Dan Callaghan b30534eb02 openldap: load client config from /etc, not the nix store
We want Openldap clients to load /etc/ldap.conf at runtime, not
${pkgs.openldap}/etc/ldap.conf which is always a sample config.

Pass sysconfdir=/etc at compile time, so that /etc/krb5.conf is embedded
in the library as the path of its config file.

Pass sysconfdir=${out}/etc at install time, so that the sample configs
and schema files are correctly included in the build output.

This hack works because the Makefiles are not smart enough to notice
that the sysconfdir variable has changed across invocations -- because
nobody ever writes their Makefiles to be that smart. :-)

Fixes #181937.
2022-07-22 03:19:46 +02:00

157 lines
5.0 KiB
Nix

import ./make-test-python.nix ({ pkgs, ... }: let
dbContents = ''
dn: dc=example
objectClass: domain
dc: example
dn: ou=users,dc=example
objectClass: organizationalUnit
ou: users
'';
ldifConfig = ''
dn: cn=config
cn: config
objectClass: olcGlobal
olcLogLevel: stats
dn: cn=schema,cn=config
cn: schema
objectClass: olcSchemaConfig
include: file://${pkgs.openldap}/etc/schema/core.ldif
include: file://${pkgs.openldap}/etc/schema/cosine.ldif
include: file://${pkgs.openldap}/etc/schema/inetorgperson.ldif
dn: olcDatabase={0}config,cn=config
olcDatabase: {0}config
objectClass: olcDatabaseConfig
olcRootDN: cn=root,cn=config
olcRootPW: configpassword
dn: olcDatabase={1}mdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcMdbConfig
olcDatabase: {1}mdb
olcDbDirectory: /var/db/openldap
olcDbIndex: objectClass eq
olcSuffix: dc=example
olcRootDN: cn=root,dc=example
olcRootPW: notapassword
'';
ldapClientConfig = {
enable = true;
loginPam = false;
nsswitch = false;
server = "ldap://";
base = "dc=example";
};
in {
name = "openldap";
nodes.machine = { pkgs, ... }: {
environment.etc."openldap/root_password".text = "notapassword";
users.ldap = ldapClientConfig;
services.openldap = {
enable = true;
urlList = [ "ldapi:///" "ldap://" ];
settings = {
children = {
"cn=schema".includes = [
"${pkgs.openldap}/etc/schema/core.ldif"
"${pkgs.openldap}/etc/schema/cosine.ldif"
"${pkgs.openldap}/etc/schema/inetorgperson.ldif"
"${pkgs.openldap}/etc/schema/nis.ldif"
];
"olcDatabase={0}config" = {
attrs = {
objectClass = [ "olcDatabaseConfig" ];
olcDatabase = "{0}config";
olcRootDN = "cn=root,cn=config";
olcRootPW = "configpassword";
};
};
"olcDatabase={1}mdb" = {
# This tests string, base64 and path values, as well as lists of string values
attrs = {
objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ];
olcDatabase = "{1}mdb";
olcDbDirectory = "/var/lib/openldap/db";
olcSuffix = "dc=example";
olcRootDN = {
# cn=root,dc=example
base64 = "Y249cm9vdCxkYz1leGFtcGxl";
};
olcRootPW = {
path = "/etc/openldap/root_password";
};
};
};
};
};
};
specialisation = {
declarativeContents.configuration = { ... }: {
services.openldap.declarativeContents."dc=example" = dbContents;
};
mutableConfig.configuration = { ... }: {
services.openldap = {
declarativeContents."dc=example" = dbContents;
mutableConfig = true;
};
};
manualConfigDir = {
inheritParentConfig = false;
configuration = { ... }: {
users.ldap = ldapClientConfig;
services.openldap = {
enable = true;
configDir = "/var/db/slapd.d";
};
};
};
};
};
testScript = { nodes, ... }: let
specializations = "${nodes.machine.config.system.build.toplevel}/specialisation";
changeRootPw = ''
dn: olcDatabase={1}mdb,cn=config
changetype: modify
replace: olcRootPW
olcRootPW: foobar
'';
in ''
# Test startup with empty DB
machine.wait_for_unit("openldap.service")
with subtest("declarative contents"):
machine.succeed('${specializations}/declarativeContents/bin/switch-to-configuration test')
machine.wait_for_unit("openldap.service")
machine.succeed('ldapsearch -LLL -D "cn=root,dc=example" -w notapassword')
machine.fail('ldapmodify -D cn=root,cn=config -w configpassword -f ${pkgs.writeText "rootpw.ldif" changeRootPw}')
with subtest("mutable config"):
machine.succeed('${specializations}/mutableConfig/bin/switch-to-configuration test')
machine.succeed('ldapsearch -LLL -D "cn=root,dc=example" -w notapassword')
machine.succeed('ldapmodify -D cn=root,cn=config -w configpassword -f ${pkgs.writeText "rootpw.ldif" changeRootPw}')
machine.succeed('ldapsearch -LLL -D "cn=root,dc=example" -w foobar')
with subtest("manual config dir"):
machine.succeed(
'mkdir /var/db/slapd.d /var/db/openldap',
'slapadd -F /var/db/slapd.d -n0 -l ${pkgs.writeText "config.ldif" ldifConfig}',
'slapadd -F /var/db/slapd.d -n1 -l ${pkgs.writeText "contents.ldif" dbContents}',
'chown -R openldap:openldap /var/db/slapd.d /var/db/openldap',
'${specializations}/manualConfigDir/bin/switch-to-configuration test',
)
machine.succeed('ldapsearch -LLL -D "cn=root,dc=example" -w notapassword')
machine.succeed('ldapmodify -D cn=root,cn=config -w configpassword -f ${pkgs.writeText "rootpw.ldif" changeRootPw}')
machine.succeed('ldapsearch -LLL -D "cn=root,dc=example" -w foobar')
'';
})