92a541c0ed
This replaces the krb5 module's options with RFC 42-style krb5.settings option, while greatly simplifying the code and fixing a few bugs, namely: - #243068 krb5: Configuration silently gets ignored when set by multiple modules - not being able to use mkIf etc. inside subattributes of krb5.libdefaults, e.g. krb5.libdefaults.default_realm = mkIf ... See #144575. Closes #243068. Co-authored-by: h7x4 <h7x4@nani.wtf>
44 lines
1.1 KiB
Nix
44 lines
1.1 KiB
Nix
import ../make-test-python.nix ({pkgs, ...}: {
|
|
name = "kerberos_server-mit";
|
|
nodes.machine = { config, libs, pkgs, ...}:
|
|
{ services.kerberos_server =
|
|
{ enable = true;
|
|
realms = {
|
|
"FOO.BAR".acl = [{principal = "admin"; access = ["add" "cpw"];}];
|
|
};
|
|
};
|
|
krb5 = {
|
|
enable = true;
|
|
package = pkgs.krb5;
|
|
settings = {
|
|
libdefaults = {
|
|
default_realm = "FOO.BAR";
|
|
};
|
|
realms = {
|
|
"FOO.BAR" = {
|
|
admin_server = "machine";
|
|
kdc = "machine";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
users.extraUsers.alice = { isNormalUser = true; };
|
|
};
|
|
|
|
testScript = ''
|
|
machine.succeed(
|
|
"kdb5_util create -s -r FOO.BAR -P master_key",
|
|
"systemctl restart kadmind.service kdc.service",
|
|
)
|
|
|
|
for unit in ["kadmind", "kdc"]:
|
|
machine.wait_for_unit(f"{unit}.service")
|
|
|
|
machine.succeed(
|
|
"kadmin.local add_principal -pw admin_pw admin",
|
|
"kadmin -p admin -w admin_pw addprinc -pw alice_pw alice",
|
|
"echo alice_pw | sudo -u alice kinit",
|
|
)
|
|
'';
|
|
})
|