From 9f18af599164356f5a027da823f4ca67cc0e0329 Mon Sep 17 00:00:00 2001 From: jammerful Date: Mon, 1 May 2017 20:01:39 -0400 Subject: [PATCH] Add Shibboleth Service Provider Module --- nixos/modules/module-list.nix | 1 + .../services/security/shibboleth-sp.nix | 71 +++++++++++++++++++ 2 files changed, 72 insertions(+) create mode 100644 nixos/modules/services/security/shibboleth-sp.nix diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index 672521166e49..7e523ac483cd 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -534,6 +534,7 @@ ./services/security/munge.nix ./services/security/oauth2_proxy.nix ./services/security/physlock.nix + ./services/security/shibboleth-sp.nix ./services/security/sshguard.nix ./services/security/tor.nix ./services/security/torify.nix diff --git a/nixos/modules/services/security/shibboleth-sp.nix b/nixos/modules/services/security/shibboleth-sp.nix new file mode 100644 index 000000000000..9659188349eb --- /dev/null +++ b/nixos/modules/services/security/shibboleth-sp.nix @@ -0,0 +1,71 @@ +{pkgs, config, lib, ...}: + +with lib; +let + cfg = config.services.shibboleth-sp; +in { + options = { + services.shibboleth-sp = { + enable = mkOption { + type = types.bool; + default = false; + description = "Whether to enable the shibboleth service"; + }; + + configFile = mkOption { + type = types.path; + example = "${pkgs.shibboleth-sp}/etc/shibboleth/shibboleth2.xml"; + description = "Path to shibboleth config file"; + }; + + fastcgi.enable = mkOption { + type = types.bool; + default = false; + description = "Whether to include the shibauthorizer and shibresponder FastCGI processes"; + }; + + fastcgi.shibAuthorizerPort = mkOption { + type = types.int; + default = 9100; + description = "Port for shibauthorizer FastCGI proccess to bind to"; + }; + + fastcgi.shibResponderPort = mkOption { + type = types.int; + default = 9101; + description = "Port for shibauthorizer FastCGI proccess to bind to"; + }; + }; + }; + + config = mkIf cfg.enable { + systemd.services.shibboleth-sp = { + description = "Provides SSO and federation for web applications"; + after = lib.optionals cfg.fastcgi.enable [ "shibresponder.service" "shibauthorizer.service" ]; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + ExecStart = "${pkgs.shibboleth-sp}/bin/shibd -F -d ${pkgs.shibboleth-sp} -c ${cfg.configFile}"; + }; + }; + + systemd.services.shibresponder = mkIf cfg.fastcgi.enable { + description = "Provides SSO through Shibboleth via FastCGI"; + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + path = [ "${pkgs.spawn_fcgi}" ]; + serviceConfig = { + ExecStart = "${pkgs.spawn_fcgi}/bin/spawn-fcgi -n -p ${toString cfg.fastcgi.shibResponderPort} ${pkgs.shibboleth-sp}/lib/shibboleth/shibresponder"; + }; + }; + + systemd.services.shibauthorizer = mkIf cfg.fastcgi.enable { + description = "Provides SSO through Shibboleth via FastCGI"; + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + path = [ "${pkgs.spawn_fcgi}" ]; + serviceConfig = { + ExecStart = "${pkgs.spawn_fcgi}/bin/spawn-fcgi -n -p ${toString cfg.fastcgi.shibAuthorizerPort} ${pkgs.shibboleth-sp}/lib/shibboleth/shibauthorizer"; + }; + }; + }; +}