Unverified Commit e93ccda8 authored by Benjamin Staffin's avatar Benjamin Staffin Committed by GitHub
Browse files

nixos/ipa: Make ipa_hostname configurable (#321588) 

Some sites put hosts in domains outside of the IPA server's default
domain, so this needs to be user-configurable.  The default is to use
the system's FQDN if it is configured, otherwise fallback to the
previous default behaviour of assuming the IPA's server's domain.
parent 7546a9d9

nixos/doc/manual/release-notes/rl-2411.section.md

+4 −0
Original line number Diff line number Diff line
@@ -40,6 +40,10 @@ 
- `openssh` and `openssh_hpn` are now compiled without Kerberos 5 / GSSAPI support in an effort to reduce the attack surface of the components for the majority of users. Users needing this support can

  use the new `opensshWithKerberos` and `openssh_hpnWithKerberos` flavors (e.g. `programs.ssh.package = pkgs.openssh_gssapi`).



- `security.ipa.ipaHostname` now defaults to the value of `networking.fqdn` if

  it is set, instead of the previous hardcoded default of

  `${networking.hostName}.${security.ipa.domain}`.



- `nvimpager` was updated to version 0.13.0, which changes the order of user and

  nvimpager settings: user commands in `-c` and `--cmd` now override the

  respective default settings because they are executed later.

nixos/modules/security/ipa.nix

+13 −1
Original line number Diff line number Diff line
@@ -85,6 +85,18 @@ in { 
        description = "Whether to cache credentials.";

      };



      ipaHostname = mkOption {

        type = types.str;

        example = "myworkstation.example.com";

        default = if config.networking.domain != null then config.networking.fqdn

                  else "${config.networking.hostName}.${cfg.domain}";

        defaultText = literalExpression ''

          if config.networking.domain != null then config.networking.fqdn

          else "''${networking.hostName}.''${security.ipa.domain}"

        '';

        description = "Fully-qualified hostname used to identify this host in the IPA domain.";

      };



      ifpAllowedUids = mkOption {

        type = types.listOf types.str;

        default = ["root"];
@@ -218,7 +230,7 @@ in { 


      ipa_domain = ${cfg.domain}

      ipa_server = _srv_, ${cfg.server}

      ipa_hostname = ${config.networking.hostName}.${cfg.domain}

      ipa_hostname = ${cfg.ipaHostname}



      cache_credentials = ${pyBool cfg.cacheCredentials}

      krb5_store_password_if_offline = ${pyBool cfg.offlinePasswords}