Commit 00a8c125 authored by Nessdoor's avatar Nessdoor
Browse files

nixos/kerberos_server: add the "get-keys" ACL permission

parent cd16b1db

nixos/modules/security/krb5/krb5-conf-format.nix

+10 −1
Original line number Diff line number Diff line
@@ -62,15 +62,24 @@ rec { 
          };

          access = mkOption {

            type = either (listOf (enum [

              "all"

              "add"

              "cpw"

              "delete"

              "get-keys"

              "get"

              "list"

              "modify"

            ])) (enum [ "all" ]);

            default = "all";

            description = "The changes the principal is allowed to make.";

            description = ''

              The changes the principal is allowed to make.



              :::{.important}

              The "all" permission does not imply the "get-keys" permission. This

              is consistent with the behavior of both MIT Kerberos and Heimdal.

              :::

            '';

          };

          target = mkOption {

            type = str;

nixos/modules/services/system/kerberos/mit.nix

+2 −1
Original line number Diff line number Diff line
@@ -19,10 +19,11 @@ let 
    add = "a";

    cpw = "c";

    delete = "d";

    get-keys = "e";

    get = "i";

    list = "l";

    modify = "m";

    all = "*";

    all = "x";

  };



  aclConfigs = lib.pipe cfg.settings.realms [