{"action":"created","issue":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/22789","repository_url":"https://api.github.com/repos/NixOS/nixpkgs","labels_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/22789/labels{/name}","comments_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/22789/comments","events_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/22789/events","html_url":"https://github.com/NixOS/nixpkgs/pull/22789","id":207501747,"number":22789,"title":"freeipa: init at 4.4.3","user":{"login":"e-user","id":93086,"avatar_url":"https://avatars3.githubusercontent.com/u/93086?v=4","gravatar_id":"","url":"https://api.github.com/users/e-user","html_url":"https://github.com/e-user","followers_url":"https://api.github.com/users/e-user/followers","following_url":"https://api.github.com/users/e-user/following{/other_user}","gists_url":"https://api.github.com/users/e-user/gists{/gist_id}","starred_url":"https://api.github.com/users/e-user/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/e-user/subscriptions","organizations_url":"https://api.github.com/users/e-user/orgs","repos_url":"https://api.github.com/users/e-user/repos","events_url":"https://api.github.com/users/e-user/events{/privacy}","received_events_url":"https://api.github.com/users/e-user/received_events","type":"User","site_admin":false},"labels":[{"id":292322837,"url":"https://api.github.com/repos/NixOS/nixpkgs/labels/2.status:%20merge%20conflict","name":"2.status: merge conflict","color":"e6e6e6","default":false},{"id":126506370,"url":"https://api.github.com/repos/NixOS/nixpkgs/labels/2.status:%20work-in-progress","name":"2.status: work-in-progress","color":"e6e6e6","default":false},{"id":60265212,"url":"https://api.github.com/repos/NixOS/nixpkgs/labels/6.topic:%20nixos","name":"6.topic: nixos","color":"fef2c0","default":false},{"id":9820195,"url":"https://api.github.com/repos/NixOS/nixpkgs/labels/6.topic:%20python","name":"6.topic: python","color":"fef2c0","default":false}],"state":"open","locked":false,"assignee":{"login":"fpletz","id":114159,"avatar_url":"https://avatars2.githubusercontent.com/u/114159?v=4","gravatar_id":"","url":"https://api.github.com/users/fpletz","html_url":"https://github.com/fpletz","followers_url":"https://api.github.com/users/fpletz/followers","following_url":"https://api.github.com/users/fpletz/following{/other_user}","gists_url":"https://api.github.com/users/fpletz/gists{/gist_id}","starred_url":"https://api.github.com/users/fpletz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fpletz/subscriptions","organizations_url":"https://api.github.com/users/fpletz/orgs","repos_url":"https://api.github.com/users/fpletz/repos","events_url":"https://api.github.com/users/fpletz/events{/privacy}","received_events_url":"https://api.github.com/users/fpletz/received_events","type":"User","site_admin":false},"assignees":[{"login":"fpletz","id":114159,"avatar_url":"https://avatars2.githubusercontent.com/u/114159?v=4","gravatar_id":"","url":"https://api.github.com/users/fpletz","html_url":"https://github.com/fpletz","followers_url":"https://api.github.com/users/fpletz/followers","following_url":"https://api.github.com/users/fpletz/following{/other_user}","gists_url":"https://api.github.com/users/fpletz/gists{/gist_id}","starred_url":"https://api.github.com/users/fpletz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fpletz/subscriptions","organizations_url":"https://api.github.com/users/fpletz/orgs","repos_url":"https://api.github.com/users/fpletz/repos","events_url":"https://api.github.com/users/fpletz/events{/privacy}","received_events_url":"https://api.github.com/users/fpletz/received_events","type":"User","site_admin":false}],"milestone":null,"comments":7,"created_at":"2017-02-14T12:27:22Z","updated_at":"2017-11-11T15:48:20Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/NixOS/nixpkgs/pulls/22789","html_url":"https://github.com/NixOS/nixpkgs/pull/22789","diff_url":"https://github.com/NixOS/nixpkgs/pull/22789.diff","patch_url":"https://github.com/NixOS/nixpkgs/pull/22789.patch"},"body":"libverto: init at 0.2.6\r\npythonPackages.nss: init at 1.0.0\r\npythonPackages.pki: init at 10.3.5\r\npythonPackages.lesscpy: init at 0.12.0\r\npythonPackages.python-yubico: init at 1.3.2\r\n\r\nChanged bind to optionally build with Kerberos support.\r\nChanged krb to optionally build with system libverto.\r\n\r\n###### Motivation for this change\r\n\r\nThis changeset contains all packages and other changes to turn NixOS into a fully capable, well-behaving [FreeIPA](http://www.freeipa.org/page/Main_Page) client and domain member. While only the client portion of FreeIPA is fully implemented, some of the work for building the server component has also been done to actually make the client build succeed.\r\n\r\nFreeIPA needs several packages to be build with MIT Kerberos, which in turn needs to use a newer version of libverto than the one bundled with krb5. Because of transitive dependencies, Samba 4 also needs to be build with that same version of MIT Kerberos. It might be worth discussing whether krb5 should much rather always be built with system libverto, which will trigger a mass-rebuild but save time and space in the long run because no duplicate versions of krb5 dependents are needed and `freeipaKerberos`, `freeipaKerberosLib` and `freeipaSamba` can be removed.\r\n\r\n`freeipaBind` and `freeipaCurl` could be removed if bind and curl are changed to build with MIT Kerberos support, by default, which might be a good idea since krb5 is usually pulled in somewhere, anyway.\r\n\r\n`freeipaBind` is required in the client because a version of `nsupdate` is needed that can use the host keytab to update the machine's hostname in the nameserver, likewise for `freeipaCurl` to authenticate any service that supports SSO through IPA via Kerberos.\r\n\r\nThe usual way to join a host to IPA is via `freeipa-client-install`, which normally modifies and backs up many different files in `/etc`, which is not possible on NixOS, for obvious reasons. Therefore, I created a nix module that does the same job idiomatically. The only manual step for a user is to prefetch the certificate from the server and specify the resulting hash in the configuration, as seen below.\r\n\r\nA typical, a valid set of FreeIPA configuration looks like this:\r\n```\r\n{\r\n  ipa = {\r\n    enable = true;\r\n    domain = \"in.foo.com\";\r\n    realm  = \"IN.FOO.COM\";\r\n    server = \"ipa.in.foo.com\";\r\n    basedn = \"dc=in,dc=foo,dc=com\";\r\n    certificate = pkgs.fetchurl {\r\n      url = http://ipa.in.foo.com/ipa/config/ca.crt;\r\n      sha256 = \"xxx\";\r\n    };\r\n  };\r\n  \r\n  services.sssd.enable = true;\r\n  services.ntp.enable = true;\r\n}\r\n```\r\n\r\nThe easiest way to test this is to create and set up a FreeIPA instance in a Fedora VM or docker container and build a NixOS version via `nixos-container`, bind-mounting nixpkgs like so:\r\n```\r\nsudo nixos-container create ipa-test\r\nsudo mkdir -p /nix/var/nix/profiles/per-container/ipa-test/per-user/root/channels/nixos\r\nsudo mount --bind /path/to/nixpkgs /nix/var/nix/profiles/per-container/ipa-test/per-user/root/channels/nixos\r\nsudo nixos-container start ipa-test\r\nln -s /path/to/nixpkgs /path/to/nixpkgs/nixpkgs # Yes, this is required!\r\nsudo nixos-container root-login ipa-test\r\nipa-test> cat > /etc/nixos/configuration.nix <<'EOF'\r\n{ config, lib, pkgs, ... }:\r\n\r\nwith lib;\r\n\r\n{ boot.isContainer = true;\r\n  networking.hostName = \"ipa-test.in.foo.com\";\r\n  networking.useDHCP = false;\r\n\r\n  ipa = {\r\n    enable = true;\r\n    domain = \"in.foo.com\";\r\n    realm  = \"IN.FOO.COM\";\r\n    server = \"ipa.in.foo.com\";\r\n    basedn = \"dc=in,dc=foo,dc=com\";\r\n    certificate = pkgs.fetchurl {\r\n      url = http://ipa.in.foo.com/ipa/config/ca.crt;\r\n      sha256 = \"xxx\";\r\n    };\r\n  };\r\n  \r\n  services.sssd.enable = true;\r\n  services.ntp.enable = true;\r\n}\r\nEOF\r\n\r\nipa-test> nixos-rebuild switch\r\n```\r\n\r\nI'm well aware this is not a trivial change but I believe the benefit makes up for it and I'm grateful for reviewers who feel like they could tackle this.\r\n\r\n###### Things done\r\n\r\n- [X] Tested using sandboxing\r\n  ([nix.useSandbox](http://nixos.org/nixos/manual/options.html#opt-nix.useSandbox) on NixOS,\r\n    or option `build-use-sandbox` in [`nix.conf`](http://nixos.org/nix/manual/#sec-conf-file)\r\n    on non-NixOS)\r\n- Built on platform(s)\r\n   - [X] NixOS\r\n   - [ ] macOS\r\n   - [ ] Linux\r\n- [ ] Tested compilation of all pkgs that depend on this change using `nix-shell -p nox --run \"nox-review wip\"`\r\n- [X] Tested execution of all binary files (usually in `./result/bin/`)\r\n- [X] Fits [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/.github/CONTRIBUTING.md).\r\n\r\n---\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/comments/343673934","html_url":"https://github.com/NixOS/nixpkgs/pull/22789#issuecomment-343673934","issue_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/22789","id":343673934,"user":{"login":"ts468","id":6641027,"avatar_url":"https://avatars2.githubusercontent.com/u/6641027?v=4","gravatar_id":"","url":"https://api.github.com/users/ts468","html_url":"https://github.com/ts468","followers_url":"https://api.github.com/users/ts468/followers","following_url":"https://api.github.com/users/ts468/following{/other_user}","gists_url":"https://api.github.com/users/ts468/gists{/gist_id}","starred_url":"https://api.github.com/users/ts468/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ts468/subscriptions","organizations_url":"https://api.github.com/users/ts468/orgs","repos_url":"https://api.github.com/users/ts468/repos","events_url":"https://api.github.com/users/ts468/events{/privacy}","received_events_url":"https://api.github.com/users/ts468/received_events","type":"User","site_admin":false},"created_at":"2017-11-11T15:48:20Z","updated_at":"2017-11-11T15:48:20Z","author_association":"CONTRIBUTOR","body":"I'd be interested in getting FreeIPA integrated as well!\r\n@e-user: How can I help? It would be a shame to loose all your hard work and effort!\r\n@FRidh, @fpletz: What are your current thoughts and comment about it? Should we pick it up?"}}
{"actor":{"display_login":"ts468"}}