2014-04-14 15:26:48 +01:00
|
|
|
{ config, lib, pkgs, ... }:
|
2009-03-06 12:25:44 +00:00
|
|
|
|
2012-09-16 18:14:19 +01:00
|
|
|
with pkgs;
|
2014-05-05 19:58:51 +01:00
|
|
|
with lib;
|
2012-09-16 18:14:19 +01:00
|
|
|
|
2009-03-06 12:25:44 +00:00
|
|
|
let
|
2012-09-16 18:14:19 +01:00
|
|
|
|
|
|
|
cfg = config.users.ldap;
|
2009-03-06 12:25:44 +00:00
|
|
|
|
2012-09-16 18:14:19 +01:00
|
|
|
# Careful: OpenLDAP seems to be very picky about the indentation of
|
|
|
|
# this file. Directives HAVE to start in the first column!
|
|
|
|
ldapConfig = {
|
|
|
|
target = "ldap.conf";
|
|
|
|
source = writeText "ldap.conf" ''
|
|
|
|
uri ${config.users.ldap.server}
|
|
|
|
base ${config.users.ldap.base}
|
|
|
|
timelimit ${toString config.users.ldap.timeLimit}
|
|
|
|
bind_timelimit ${toString config.users.ldap.bind.timeLimit}
|
|
|
|
bind_policy ${config.users.ldap.bind.policy}
|
|
|
|
${optionalString config.users.ldap.useTLS ''
|
|
|
|
ssl start_tls
|
|
|
|
''}
|
|
|
|
${optionalString (config.users.ldap.bind.distinguishedName != "") ''
|
|
|
|
binddn ${config.users.ldap.bind.distinguishedName}
|
|
|
|
''}
|
|
|
|
${optionalString (cfg.extraConfig != "") cfg.extraConfig }
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
nixos/ldap: set proper User= and Group= for nslcd service
eb90d9700958aefbc7b886f2b524c6d04dc1d80d broke nslcd, as /run/nslcd was
created/chowned as root user, while nslcd wants to do parts as nslcd
user.
This commit changes the nslcd to run with the proper uid/gid from the
start (through User= and Group=), so the RuntimeDirectory has proper
permissions, too.
In some cases, secrets are baked into nslcd's config file during startup
(so we don't want to provide it from the store).
This config file is normally hard-wired to /etc/nslcd.conf, but we don't
want to use PermissionsStartOnly anymore (#56265), and activation
scripts are ugly, so redirect /etc/nslcd.conf to /run/nslcd/nslcd.conf,
which now gets provisioned inside ExecStartPre=.
This change requires the files referenced to in
users.ldap.bind.passwordFile and users.ldap.daemon.rootpwmodpwFile to be
readable by the nslcd user (in the non-nslcd case, this was already the
case for users.ldap.bind.passwordFile)
fixes #57783
2019-03-27 01:27:57 +00:00
|
|
|
nslcdConfig = writeText "nslcd.conf" ''
|
|
|
|
uri ${cfg.server}
|
|
|
|
base ${cfg.base}
|
|
|
|
timelimit ${toString cfg.timeLimit}
|
|
|
|
bind_timelimit ${toString cfg.bind.timeLimit}
|
|
|
|
${optionalString (cfg.bind.distinguishedName != "")
|
|
|
|
"binddn ${cfg.bind.distinguishedName}" }
|
|
|
|
${optionalString (cfg.daemon.rootpwmoddn != "")
|
|
|
|
"rootpwmoddn ${cfg.daemon.rootpwmoddn}" }
|
|
|
|
${optionalString (cfg.daemon.extraConfig != "") cfg.daemon.extraConfig }
|
|
|
|
'';
|
|
|
|
|
|
|
|
# nslcd normally reads configuration from /etc/nslcd.conf.
|
|
|
|
# this file might contain secrets. We append those at runtime,
|
|
|
|
# so redirect its location to something more temporary.
|
|
|
|
nslcdWrapped = runCommandNoCC "nslcd-wrapped" { nativeBuildInputs = [ makeWrapper ]; } ''
|
|
|
|
mkdir -p $out/bin
|
|
|
|
makeWrapper ${nss_pam_ldapd}/sbin/nslcd $out/bin/nslcd \
|
|
|
|
--set LD_PRELOAD "${pkgs.libredirect}/lib/libredirect.so" \
|
|
|
|
--set NIX_REDIRECTS "/etc/nslcd.conf=/run/nslcd/nslcd.conf"
|
|
|
|
'';
|
2012-09-16 18:14:19 +01:00
|
|
|
|
2009-03-06 12:25:44 +00:00
|
|
|
in
|
|
|
|
|
2013-09-04 12:05:09 +01:00
|
|
|
{
|
2012-09-16 18:14:19 +01:00
|
|
|
|
2013-09-04 12:05:09 +01:00
|
|
|
###### interface
|
2011-10-02 14:24:10 +01:00
|
|
|
|
2013-09-04 12:05:09 +01:00
|
|
|
options = {
|
|
|
|
|
|
|
|
users.ldap = {
|
|
|
|
|
|
|
|
enable = mkOption {
|
2016-01-17 18:34:55 +00:00
|
|
|
type = types.bool;
|
2013-09-04 12:05:09 +01:00
|
|
|
default = false;
|
|
|
|
description = "Whether to enable authentication against an LDAP server.";
|
|
|
|
};
|
|
|
|
|
2016-07-18 14:20:21 +01:00
|
|
|
loginPam = mkOption {
|
|
|
|
type = types.bool;
|
|
|
|
default = true;
|
|
|
|
description = "Whether to include authentication against LDAP in login PAM";
|
|
|
|
};
|
|
|
|
|
2016-07-18 14:24:21 +01:00
|
|
|
nsswitch = mkOption {
|
|
|
|
type = types.bool;
|
|
|
|
default = true;
|
|
|
|
description = "Whether to include lookup against LDAP in NSS";
|
|
|
|
};
|
|
|
|
|
2013-09-04 12:05:09 +01:00
|
|
|
server = mkOption {
|
|
|
|
example = "ldap://ldap.example.org/";
|
|
|
|
description = "The URL of the LDAP server.";
|
|
|
|
};
|
|
|
|
|
|
|
|
base = mkOption {
|
|
|
|
example = "dc=example,dc=org";
|
|
|
|
description = "The distinguished name of the search base.";
|
|
|
|
};
|
|
|
|
|
|
|
|
useTLS = mkOption {
|
|
|
|
default = false;
|
|
|
|
description = ''
|
|
|
|
If enabled, use TLS (encryption) over an LDAP (port 389)
|
|
|
|
connection. The alternative is to specify an LDAPS server (port
|
|
|
|
636) in <option>users.ldap.server</option> or to forego
|
|
|
|
security.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
timeLimit = mkOption {
|
|
|
|
default = 0;
|
|
|
|
type = types.int;
|
|
|
|
description = ''
|
|
|
|
Specifies the time limit (in seconds) to use when performing
|
|
|
|
searches. A value of zero (0), which is the default, is to
|
|
|
|
wait indefinitely for searches to be completed.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
daemon = {
|
|
|
|
enable = mkOption {
|
|
|
|
default = false;
|
|
|
|
description = ''
|
|
|
|
Whether to let the nslcd daemon (nss-pam-ldapd) handle the
|
|
|
|
LDAP lookups for NSS and PAM. This can improve performance,
|
|
|
|
and if you need to bind to the LDAP server with a password,
|
|
|
|
it increases security, since only the nslcd user needs to
|
|
|
|
have access to the bindpw file, not everyone that uses NSS
|
|
|
|
and/or PAM. If this option is enabled, a local nscd user is
|
|
|
|
created automatically, and the nslcd service is started
|
|
|
|
automatically when the network get up.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
extraConfig = mkOption {
|
|
|
|
default = "";
|
2015-08-17 18:52:45 +01:00
|
|
|
type = types.lines;
|
2013-09-04 12:05:09 +01:00
|
|
|
description = ''
|
|
|
|
Extra configuration options that will be added verbatim at
|
|
|
|
the end of the nslcd configuration file (nslcd.conf).
|
|
|
|
'' ;
|
|
|
|
} ;
|
2019-01-08 16:01:01 +00:00
|
|
|
|
|
|
|
rootpwmoddn = mkOption {
|
|
|
|
default = "";
|
|
|
|
example = "cn=admin,dc=example,dc=com";
|
|
|
|
type = types.str;
|
|
|
|
description = ''
|
|
|
|
The distinguished name to use to bind to the LDAP server
|
|
|
|
when the root user tries to modify a user's password.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
2019-03-27 00:46:19 +00:00
|
|
|
rootpwmodpwFile = mkOption {
|
2019-01-08 16:01:01 +00:00
|
|
|
default = "";
|
|
|
|
example = "/run/keys/nslcd.rootpwmodpw";
|
|
|
|
type = types.str;
|
|
|
|
description = ''
|
2019-03-27 00:46:19 +00:00
|
|
|
The path to a file containing the credentials with which to bind to
|
|
|
|
the LDAP server if the root user tries to change a user's password.
|
2019-01-08 16:01:01 +00:00
|
|
|
'';
|
|
|
|
};
|
2013-09-04 12:05:09 +01:00
|
|
|
};
|
|
|
|
|
|
|
|
bind = {
|
|
|
|
distinguishedName = mkOption {
|
|
|
|
default = "";
|
|
|
|
example = "cn=admin,dc=example,dc=com";
|
2015-08-17 18:52:45 +01:00
|
|
|
type = types.str;
|
2013-09-04 12:05:09 +01:00
|
|
|
description = ''
|
|
|
|
The distinguished name to bind to the LDAP server with. If this
|
|
|
|
is not specified, an anonymous bind will be done.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
2019-03-27 00:46:19 +00:00
|
|
|
passwordFile = mkOption {
|
2013-09-04 12:05:09 +01:00
|
|
|
default = "/etc/ldap/bind.password";
|
2015-08-17 18:52:45 +01:00
|
|
|
type = types.str;
|
2013-09-04 12:05:09 +01:00
|
|
|
description = ''
|
|
|
|
The path to a file containing the credentials to use when binding
|
|
|
|
to the LDAP server (if not binding anonymously).
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
timeLimit = mkOption {
|
|
|
|
default = 30;
|
|
|
|
type = types.int;
|
|
|
|
description = ''
|
|
|
|
Specifies the time limit (in seconds) to use when connecting
|
|
|
|
to the directory server. This is distinct from the time limit
|
|
|
|
specified in <literal>users.ldap.timeLimit</literal> and affects
|
|
|
|
the initial server connection only.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
policy = mkOption {
|
|
|
|
default = "hard_open";
|
2015-08-17 18:52:45 +01:00
|
|
|
type = types.enum [ "hard_open" "hard_init" "soft" ];
|
2013-09-04 12:05:09 +01:00
|
|
|
description = ''
|
|
|
|
Specifies the policy to use for reconnecting to an unavailable
|
|
|
|
LDAP server. The default is <literal>hard_open</literal>, which
|
|
|
|
reconnects if opening the connection to the directory server
|
|
|
|
failed. By contrast, <literal>hard_init</literal> reconnects if
|
|
|
|
initializing the connection failed. Initializing may not
|
|
|
|
actually contact the directory server, and it is possible that
|
|
|
|
a malformed configuration file will trigger reconnection. If
|
|
|
|
<literal>soft</literal> is specified, then
|
|
|
|
<literal>nss_ldap</literal> will return immediately on server
|
|
|
|
failure. All hard reconnect policies block with exponential
|
|
|
|
backoff before retrying.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
extraConfig = mkOption {
|
|
|
|
default = "";
|
2015-08-17 18:52:45 +01:00
|
|
|
type = types.lines;
|
2013-09-04 12:05:09 +01:00
|
|
|
description = ''
|
|
|
|
Extra configuration options that will be added verbatim at
|
|
|
|
the end of the ldap configuration file (ldap.conf).
|
|
|
|
If <literal>users.ldap.daemon</literal> is enabled, this
|
|
|
|
configuration will not be used. In that case, use
|
|
|
|
<literal>users.ldap.daemon.extraConfig</literal> instead.
|
|
|
|
'' ;
|
|
|
|
};
|
2012-09-16 18:14:19 +01:00
|
|
|
|
|
|
|
};
|
2013-09-04 12:05:09 +01:00
|
|
|
|
2012-09-16 18:14:19 +01:00
|
|
|
};
|
|
|
|
|
2013-09-04 12:05:09 +01:00
|
|
|
###### implementation
|
|
|
|
|
|
|
|
config = mkIf cfg.enable {
|
|
|
|
|
2019-09-14 18:51:29 +01:00
|
|
|
environment.etc = optionalAttrs (!cfg.daemon.enable) {
|
|
|
|
"ldap.conf" = ldapConfig;
|
|
|
|
};
|
2013-09-04 12:05:09 +01:00
|
|
|
|
nixos/ldap: set proper User= and Group= for nslcd service
eb90d9700958aefbc7b886f2b524c6d04dc1d80d broke nslcd, as /run/nslcd was
created/chowned as root user, while nslcd wants to do parts as nslcd
user.
This commit changes the nslcd to run with the proper uid/gid from the
start (through User= and Group=), so the RuntimeDirectory has proper
permissions, too.
In some cases, secrets are baked into nslcd's config file during startup
(so we don't want to provide it from the store).
This config file is normally hard-wired to /etc/nslcd.conf, but we don't
want to use PermissionsStartOnly anymore (#56265), and activation
scripts are ugly, so redirect /etc/nslcd.conf to /run/nslcd/nslcd.conf,
which now gets provisioned inside ExecStartPre=.
This change requires the files referenced to in
users.ldap.bind.passwordFile and users.ldap.daemon.rootpwmodpwFile to be
readable by the nslcd user (in the non-nslcd case, this was already the
case for users.ldap.bind.passwordFile)
fixes #57783
2019-03-27 01:27:57 +00:00
|
|
|
system.activationScripts = mkIf (!cfg.daemon.enable) {
|
2013-09-04 12:05:09 +01:00
|
|
|
ldap = stringAfter [ "etc" "groups" "users" ] ''
|
2019-03-27 00:46:19 +00:00
|
|
|
if test -f "${cfg.bind.passwordFile}" ; then
|
2019-01-08 16:01:01 +00:00
|
|
|
umask 0077
|
|
|
|
conf="$(mktemp)"
|
2019-03-27 00:46:19 +00:00
|
|
|
printf 'bindpw %s\n' "$(cat ${cfg.bind.passwordFile})" |
|
2019-01-08 16:01:01 +00:00
|
|
|
cat ${ldapConfig.source} - >"$conf"
|
|
|
|
mv -fT "$conf" /etc/ldap.conf
|
2013-09-04 12:05:09 +01:00
|
|
|
fi
|
2012-09-16 18:14:19 +01:00
|
|
|
'';
|
2013-09-04 12:05:09 +01:00
|
|
|
};
|
|
|
|
|
|
|
|
system.nssModules = singleton (
|
|
|
|
if cfg.daemon.enable then nss_pam_ldapd else nss_ldap
|
|
|
|
);
|
|
|
|
|
|
|
|
users = mkIf cfg.daemon.enable {
|
2018-06-30 00:58:35 +01:00
|
|
|
groups.nslcd = {
|
2013-09-04 12:05:09 +01:00
|
|
|
gid = config.ids.gids.nslcd;
|
|
|
|
};
|
|
|
|
|
2018-06-30 00:58:35 +01:00
|
|
|
users.nslcd = {
|
2013-09-04 12:05:09 +01:00
|
|
|
uid = config.ids.uids.nslcd;
|
|
|
|
description = "nslcd user.";
|
|
|
|
group = "nslcd";
|
|
|
|
};
|
|
|
|
};
|
2013-01-27 19:07:37 +00:00
|
|
|
|
2013-09-04 12:05:09 +01:00
|
|
|
systemd.services = mkIf cfg.daemon.enable {
|
|
|
|
nslcd = {
|
2014-08-08 16:40:03 +01:00
|
|
|
wantedBy = [ "multi-user.target" ];
|
2013-09-04 12:05:09 +01:00
|
|
|
|
|
|
|
preStart = ''
|
2019-01-08 16:01:01 +00:00
|
|
|
umask 0077
|
|
|
|
conf="$(mktemp)"
|
|
|
|
{
|
nixos/ldap: set proper User= and Group= for nslcd service
eb90d9700958aefbc7b886f2b524c6d04dc1d80d broke nslcd, as /run/nslcd was
created/chowned as root user, while nslcd wants to do parts as nslcd
user.
This commit changes the nslcd to run with the proper uid/gid from the
start (through User= and Group=), so the RuntimeDirectory has proper
permissions, too.
In some cases, secrets are baked into nslcd's config file during startup
(so we don't want to provide it from the store).
This config file is normally hard-wired to /etc/nslcd.conf, but we don't
want to use PermissionsStartOnly anymore (#56265), and activation
scripts are ugly, so redirect /etc/nslcd.conf to /run/nslcd/nslcd.conf,
which now gets provisioned inside ExecStartPre=.
This change requires the files referenced to in
users.ldap.bind.passwordFile and users.ldap.daemon.rootpwmodpwFile to be
readable by the nslcd user (in the non-nslcd case, this was already the
case for users.ldap.bind.passwordFile)
fixes #57783
2019-03-27 01:27:57 +00:00
|
|
|
cat ${nslcdConfig}
|
2019-03-27 00:46:19 +00:00
|
|
|
test -z '${cfg.bind.distinguishedName}' -o ! -f '${cfg.bind.passwordFile}' ||
|
|
|
|
printf 'bindpw %s\n' "$(cat '${cfg.bind.passwordFile}')"
|
|
|
|
test -z '${cfg.daemon.rootpwmoddn}' -o ! -f '${cfg.daemon.rootpwmodpwFile}' ||
|
|
|
|
printf 'rootpwmodpw %s\n' "$(cat '${cfg.daemon.rootpwmodpwFile}')"
|
2019-01-08 16:01:01 +00:00
|
|
|
} >"$conf"
|
nixos/ldap: set proper User= and Group= for nslcd service
eb90d9700958aefbc7b886f2b524c6d04dc1d80d broke nslcd, as /run/nslcd was
created/chowned as root user, while nslcd wants to do parts as nslcd
user.
This commit changes the nslcd to run with the proper uid/gid from the
start (through User= and Group=), so the RuntimeDirectory has proper
permissions, too.
In some cases, secrets are baked into nslcd's config file during startup
(so we don't want to provide it from the store).
This config file is normally hard-wired to /etc/nslcd.conf, but we don't
want to use PermissionsStartOnly anymore (#56265), and activation
scripts are ugly, so redirect /etc/nslcd.conf to /run/nslcd/nslcd.conf,
which now gets provisioned inside ExecStartPre=.
This change requires the files referenced to in
users.ldap.bind.passwordFile and users.ldap.daemon.rootpwmodpwFile to be
readable by the nslcd user (in the non-nslcd case, this was already the
case for users.ldap.bind.passwordFile)
fixes #57783
2019-03-27 01:27:57 +00:00
|
|
|
mv -fT "$conf" /run/nslcd/nslcd.conf
|
2013-09-04 12:05:09 +01:00
|
|
|
'';
|
nixos/ldap: set proper User= and Group= for nslcd service
eb90d9700958aefbc7b886f2b524c6d04dc1d80d broke nslcd, as /run/nslcd was
created/chowned as root user, while nslcd wants to do parts as nslcd
user.
This commit changes the nslcd to run with the proper uid/gid from the
start (through User= and Group=), so the RuntimeDirectory has proper
permissions, too.
In some cases, secrets are baked into nslcd's config file during startup
(so we don't want to provide it from the store).
This config file is normally hard-wired to /etc/nslcd.conf, but we don't
want to use PermissionsStartOnly anymore (#56265), and activation
scripts are ugly, so redirect /etc/nslcd.conf to /run/nslcd/nslcd.conf,
which now gets provisioned inside ExecStartPre=.
This change requires the files referenced to in
users.ldap.bind.passwordFile and users.ldap.daemon.rootpwmodpwFile to be
readable by the nslcd user (in the non-nslcd case, this was already the
case for users.ldap.bind.passwordFile)
fixes #57783
2019-03-27 01:27:57 +00:00
|
|
|
restartTriggers = [ "/run/nslcd/nslcd.conf" ];
|
2018-09-17 02:23:32 +01:00
|
|
|
|
2013-09-04 12:05:09 +01:00
|
|
|
serviceConfig = {
|
nixos/ldap: set proper User= and Group= for nslcd service
eb90d9700958aefbc7b886f2b524c6d04dc1d80d broke nslcd, as /run/nslcd was
created/chowned as root user, while nslcd wants to do parts as nslcd
user.
This commit changes the nslcd to run with the proper uid/gid from the
start (through User= and Group=), so the RuntimeDirectory has proper
permissions, too.
In some cases, secrets are baked into nslcd's config file during startup
(so we don't want to provide it from the store).
This config file is normally hard-wired to /etc/nslcd.conf, but we don't
want to use PermissionsStartOnly anymore (#56265), and activation
scripts are ugly, so redirect /etc/nslcd.conf to /run/nslcd/nslcd.conf,
which now gets provisioned inside ExecStartPre=.
This change requires the files referenced to in
users.ldap.bind.passwordFile and users.ldap.daemon.rootpwmodpwFile to be
readable by the nslcd user (in the non-nslcd case, this was already the
case for users.ldap.bind.passwordFile)
fixes #57783
2019-03-27 01:27:57 +00:00
|
|
|
ExecStart = "${nslcdWrapped}/bin/nslcd";
|
2013-09-04 12:05:09 +01:00
|
|
|
Type = "forking";
|
|
|
|
Restart = "always";
|
nixos/ldap: set proper User= and Group= for nslcd service
eb90d9700958aefbc7b886f2b524c6d04dc1d80d broke nslcd, as /run/nslcd was
created/chowned as root user, while nslcd wants to do parts as nslcd
user.
This commit changes the nslcd to run with the proper uid/gid from the
start (through User= and Group=), so the RuntimeDirectory has proper
permissions, too.
In some cases, secrets are baked into nslcd's config file during startup
(so we don't want to provide it from the store).
This config file is normally hard-wired to /etc/nslcd.conf, but we don't
want to use PermissionsStartOnly anymore (#56265), and activation
scripts are ugly, so redirect /etc/nslcd.conf to /run/nslcd/nslcd.conf,
which now gets provisioned inside ExecStartPre=.
This change requires the files referenced to in
users.ldap.bind.passwordFile and users.ldap.daemon.rootpwmodpwFile to be
readable by the nslcd user (in the non-nslcd case, this was already the
case for users.ldap.bind.passwordFile)
fixes #57783
2019-03-27 01:27:57 +00:00
|
|
|
User = "nslcd";
|
|
|
|
Group = "nslcd";
|
2018-12-30 10:36:46 +00:00
|
|
|
RuntimeDirectory = [ "nslcd" ];
|
nixos/ldap: set proper User= and Group= for nslcd service
eb90d9700958aefbc7b886f2b524c6d04dc1d80d broke nslcd, as /run/nslcd was
created/chowned as root user, while nslcd wants to do parts as nslcd
user.
This commit changes the nslcd to run with the proper uid/gid from the
start (through User= and Group=), so the RuntimeDirectory has proper
permissions, too.
In some cases, secrets are baked into nslcd's config file during startup
(so we don't want to provide it from the store).
This config file is normally hard-wired to /etc/nslcd.conf, but we don't
want to use PermissionsStartOnly anymore (#56265), and activation
scripts are ugly, so redirect /etc/nslcd.conf to /run/nslcd/nslcd.conf,
which now gets provisioned inside ExecStartPre=.
This change requires the files referenced to in
users.ldap.bind.passwordFile and users.ldap.daemon.rootpwmodpwFile to be
readable by the nslcd user (in the non-nslcd case, this was already the
case for users.ldap.bind.passwordFile)
fixes #57783
2019-03-27 01:27:57 +00:00
|
|
|
PIDFile = "/run/nslcd/nslcd.pid";
|
2020-01-31 15:12:41 +00:00
|
|
|
AmbientCapabilities = "CAP_SYS_RESOURCE";
|
2013-09-04 12:05:09 +01:00
|
|
|
};
|
2013-01-27 19:07:37 +00:00
|
|
|
};
|
2013-09-04 12:05:09 +01:00
|
|
|
|
2012-09-16 18:14:19 +01:00
|
|
|
};
|
2013-09-04 12:05:09 +01:00
|
|
|
|
2012-09-16 18:14:19 +01:00
|
|
|
};
|
2019-03-27 00:46:19 +00:00
|
|
|
|
|
|
|
imports =
|
|
|
|
[ (mkRenamedOptionModule [ "users" "ldap" "bind" "password"] [ "users" "ldap" "bind" "passwordFile"])
|
|
|
|
];
|
2009-03-06 12:25:44 +00:00
|
|
|
}
|