gnu/packages/openldap.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2013, 2014, 2015, 2019 Ludovic Courtès <ludo@gnu.org>
   3 ;;; Copyright © 2013 Andreas Enge <andreas@enge.fr>
   4 ;;; Copyright © 2016 Leo Famulari <leo@famulari.name>
   5 ;;; Copyright © 2017, 2018, 2019 Ricardo Wurmus <rekado@elephly.net>
   6 ;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
   7 ;;; Copyright © 2020 Lars-Dominik Braun <ldb@leibniz-psychology.org>
   8 ;;; Copyright © 2020 Efraim Flashner <efraim@flashner.co.il>
   9 ;;;
  10 ;;; This file is part of GNU Guix.
  11 ;;;
  12 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  13 ;;; under the terms of the GNU General Public License as published by
  14 ;;; the Free Software Foundation; either version 3 of the License, or (at
  15 ;;; your option) any later version.
  16 ;;;
  17 ;;; GNU Guix is distributed in the hope that it will be useful, but
  18 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  19 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20 ;;; GNU General Public License for more details.
  21 ;;;
  22 ;;; You should have received a copy of the GNU General Public License
  23 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  24
  25 (define-module (gnu packages openldap)
  26   #:use-module (gnu packages autotools)
  27   #:use-module (gnu packages check)
  28   #:use-module (gnu packages compression)
  29   #:use-module (gnu packages cyrus-sasl)
  30   #:use-module (gnu packages dbm)
  31   #:use-module (gnu packages documentation)
  32   #:use-module (gnu packages gettext)
  33   #:use-module (gnu packages gnupg)
  34   #:use-module (gnu packages groff)
  35   #:use-module (gnu packages icu4c)
  36   #:use-module (gnu packages kerberos)
  37   #:use-module (gnu packages libevent)
  38   #:use-module (gnu packages linux)
  39   #:use-module (gnu packages networking)
  40   #:use-module (gnu packages nss)
  41   #:use-module (gnu packages password-utils)
  42   #:use-module (gnu packages pcre)
  43   #:use-module (gnu packages perl)
  44   #:use-module (gnu packages pkg-config)
  45   #:use-module (gnu packages python)
  46   #:use-module (gnu packages python-xyz)
  47   #:use-module (gnu packages rsync)
  48   #:use-module (gnu packages selinux)
  49   #:use-module (gnu packages time)
  50   #:use-module (gnu packages tls)
  51   #:use-module (gnu packages web)
  52   #:use-module (gnu packages)
  53   #:use-module ((guix licenses) #:select (openldap2.8 lgpl2.1+ gpl3+ psfl expat))
  54   #:use-module (guix packages)
  55   #:use-module (guix download)
  56   #:use-module (guix build-system gnu)
  57   #:use-module (guix build-system python))
  58
  59 (define-public openldap
  60   (package
  61    (name "openldap")
  62    (replacement openldap-2.4.50)
  63    (version "2.4.47")
  64    (source (origin
  65             (method url-fetch)
  66
  67             ;; See <http://www.openldap.org/software/download/> for a list of
  68             ;; mirrors.
  69             (uri (list (string-append
  70                         "ftp://mirror.switch.ch/mirror/OpenLDAP/"
  71                         "openldap-release/openldap-" version ".tgz")
  72                        (string-append
  73                         "https://www.openldap.org/software/download/OpenLDAP/"
  74                         "openldap-release/openldap-" version ".tgz")
  75                        (string-append
  76                         "ftp://ftp.dti.ad.jp/pub/net/OpenLDAP/"
  77                         "openldap-release/openldap-" version ".tgz")))
  78             (sha256
  79              (base32
  80               "02sj0p1pq12hqq29b22m3f5zs2rykgvc0q3wlynxjcsjhrvmhk7m"))))
  81    (build-system gnu-build-system)
  82    (inputs `(("bdb" ,bdb-5.3)
  83              ("cyrus-sasl" ,cyrus-sasl)
  84              ("gnutls" ,gnutls)
  85              ("groff" ,groff)
  86              ("icu4c" ,icu4c)
  87              ("libgcrypt" ,libgcrypt)
  88              ("zlib" ,zlib)))
  89    (native-inputs `(("libtool" ,libtool)))
  90    (arguments
  91     `(#:tests? #f
  92       #:configure-flags '("--disable-static")
  93       #:phases
  94       (modify-phases %standard-phases
  95         (add-after 'install 'patch-sasl-path
  96           ;; Give -L arguments for cyrus-sasl to avoid propagation.
  97           (lambda* (#:key inputs outputs #:allow-other-keys)
  98             (let ((out (assoc-ref outputs "out"))
  99                   (krb5 (assoc-ref inputs "mit-krb5"))) ;propagated from cyrus-sasl
 100
 101               ;; The ancient Libtool bundled with OpenLDAP copies the linker flags
 102               ;; from Cyrus-SASL and embeds them into its own .la files.  Add an
 103               ;; absolute reference to Kerberos so it does not have to be propagated.
 104               (substitute* (map (lambda (f) (string-append out "/" f))
 105                                 '("lib/libldap.la" "lib/libldap_r.la"))
 106                 (("-lkrb5" lib)
 107                  (string-append "-L" krb5 "/lib " lib)))
 108               #t))))))
 109    (synopsis "Implementation of the Lightweight Directory Access Protocol")
 110    (description
 111     "OpenLDAP is a free implementation of the Lightweight Directory Access Protocol.")
 112    (license openldap2.8)
 113    (home-page "https://www.openldap.org/")))
 114
 115 (define openldap-2.4.50
 116   (package
 117     (inherit openldap)
 118     (version "2.4.50")
 119     (source (origin
 120               (method url-fetch)
 121               (uri (string-append "https://www.openldap.org/software/download/"
 122                                   "OpenLDAP/openldap-release/openldap-" version
 123                                   ".tgz"))
 124               (sha256
 125                (base32
 126                 "1f46nlfwmys110j36sifm7ah8m8f3s10c3vaiikmmigmifapvdaw"))))))
 127
 128 (define-public nss-pam-ldapd
 129   (package
 130     (name "nss-pam-ldapd")
 131     (version "0.9.11")
 132     (source (origin
 133               (method url-fetch)
 134               (uri (string-append "https://arthurdejong.org/nss-pam-ldapd/"
 135                                   "nss-pam-ldapd-" version ".tar.gz"))
 136               (sha256
 137                (base32
 138                 "1dna3r0q6sjhhlkhcp8x2zkslrd4y7701kk6fl5r940sdph1pmyh"))))
 139     (build-system gnu-build-system)
 140     (arguments
 141      `(#:configure-flags
 142        (list (string-append "--with-pam-seclib-dir="
 143                             (assoc-ref %outputs "out") "/lib/security/")
 144              ;; nslcd cannot be convinced to look at run-time for its
 145              ;; configuration file at a location that differs from the
 146              ;; configured location.
 147              "--with-ldap-conf-file=/etc/nslcd.conf")
 148        #:phases
 149        (modify-phases %standard-phases
 150          ;; This is necessary because we tell nslcd with configure flags that
 151          ;; it should look for its configuration file at /etc/nslcd.conf.  The
 152          ;; build system tries to install a default configuration to that very
 153          ;; location.
 154          (add-after 'unpack 'override-nslcd.conf-install-path
 155            (lambda* (#:key outputs #:allow-other-keys)
 156              (substitute* "Makefile.in"
 157                (("\\$\\(DESTDIR\\)\\$\\(NSLCD_CONF_PATH\\)")
 158                 (string-append (assoc-ref outputs "out")
 159                                "/etc/nslcd.conf.example")))
 160              #t)))))
 161     (inputs
 162      `(("linux-pam" ,linux-pam)
 163        ("openldap" ,openldap)
 164        ("mit-krb5" ,mit-krb5)
 165        ("python" ,python)))
 166     (home-page "https://arthurdejong.org/nss-pam-ldapd")
 167     (synopsis "NSS and PAM modules for LDAP")
 168     (description "nss-pam-ldapd provides a @dfn{Name Service Switch} (NSS)
 169 module that allows your LDAP server to provide user account, group, host name,
 170 alias, netgroup, and basically any other information that you would normally
 171 get from @file{/etc} flat files or NIS.  It also provides a @dfn{Pluggable
 172 Authentication Module} (PAM) to do identity and authentication management with
 173 an LDAP server.")
 174     (license lgpl2.1+)))
 175
 176 (define-public python-ldap
 177   (package
 178     (name "python-ldap")
 179     (version "3.1.0")
 180     (source
 181      (origin
 182        (method url-fetch)
 183        (uri (pypi-uri "python-ldap" version))
 184        (sha256
 185         (base32
 186          "1i97nwfnraylyn0myxlf3vciicrf5h6fymrcff9c00k581wmx5s1"))))
 187     (build-system python-build-system)
 188     (arguments
 189      `(#:phases
 190        (modify-phases %standard-phases
 191          (add-after 'unpack 'configure-openldap-locations
 192            (lambda* (#:key inputs #:allow-other-keys)
 193              (let ((openldap (assoc-ref inputs "openldap")))
 194                (setenv "SLAPD"
 195                        (string-append openldap
 196                                       "/libexec/slapd"))
 197                (setenv "SCHEMA"
 198                        (string-append openldap
 199                                       "/etc/openldap/schema/")))
 200              #t)))))
 201     (inputs
 202      `(("openldap" ,openldap)
 203        ("cyrus-sasl" ,cyrus-sasl)
 204        ("mit-krb5" ,mit-krb5)))
 205     (propagated-inputs
 206      `(("python-pyasn1" ,python-pyasn1)
 207        ("python-pyasn1-modules" ,python-pyasn1-modules)))
 208     (home-page "https://www.python-ldap.org/")
 209     (synopsis "Python modules for implementing LDAP clients")
 210     (description
 211      "This package provides an object-oriented API to access LDAP directory
 212 servers from Python programs.")
 213     (license psfl)))
 214
 215 (define-public 389-ds-base
 216   (package
 217     (name "389-ds-base")
 218     (version "1.4.0.21")
 219     (source (origin
 220               (method url-fetch)
 221               (uri (string-append "https://releases.pagure.org/389-ds-base/"
 222                                   "389-ds-base-" version ".tar.bz2"))
 223               (sha256
 224                (base32
 225                 "1qd1ap5d5nxyiq0d19czfwc3h7iwl9lmr5sy7d7xmpr2by59aysr"))))
 226     (build-system gnu-build-system)
 227     (arguments
 228      `(#:modules ((srfi srfi-1)
 229                   (guix build gnu-build-system)
 230                   ((guix build python-build-system)
 231                    #:select (python-version))
 232                   (guix build utils))
 233        #:imported-modules ((guix build python-build-system)
 234                            ,@%gnu-build-system-modules)
 235        #:configure-flags
 236        (list (string-append "--with-db="
 237                             (assoc-ref %build-inputs "bdb"))
 238              (string-append "--with-sasl="
 239                             (assoc-ref %build-inputs "cyrus-sasl"))
 240              (string-append "--with-netsnmp="
 241                             (assoc-ref %build-inputs "net-snmp"))
 242              (string-append "--with-pcre="
 243                             (assoc-ref %build-inputs "pcre"))
 244              (string-append "--with-selinux="
 245                             (assoc-ref %build-inputs "libselinux"))
 246              "--localstatedir=/var"
 247              "--with-instconfigdir=/etc/dirsrv"
 248              ;; The Perl scripts are being removed in the 1.4.0 release.
 249              ;; Building them would require packaging of the outdated Mozilla
 250              ;; LDAP SDK (instead of OpenLDAP) and PerLDAP.
 251              "--disable-perl")
 252        #:phases
 253        (modify-phases %standard-phases
 254          (add-after 'unpack 'fix-references
 255            (lambda _
 256              (substitute* "include/ldaputil/certmap.h"
 257                (("nss3/cert.h") "nss/cert.h"))
 258              (substitute* "src/lib389/lib389/nss_ssl.py"
 259                (("'/usr/bin/certutil'")
 260                 (string-append "'" (which "certutil") "'"))
 261                (("'/usr/bin/c_rehash'")
 262                 (string-append "'" (which "perl") "', '" (which "c_rehash") "'")))
 263              #t))
 264          (add-after 'unpack 'overwrite-default-locations
 265            (lambda* (#:key outputs #:allow-other-keys)
 266              (let ((out (assoc-ref outputs "out")))
 267                (substitute* "src/lib389/lib389/paths.py"
 268                  (("/usr/share/dirsrv/inf/defaults.inf")
 269                   (string-append out "/share/dirsrv/inf/defaults.inf")))
 270                ;; This directory can only be specified relative to sysconfdir.  This
 271                ;; is used to determine where to look for installed directory
 272                ;; servers, so in the absence of a search path it needs to be global.
 273                (substitute* "ldap/admin/src/defaults.inf.in"
 274                  (("^initconfig_dir =.*")
 275                   "initconfig_dir = /etc/dirsrv/registry\n"))
 276                ;; This is used to determine where to write certificate files
 277                ;; when installing new directory server instances.
 278                (substitute* '("src/lib389/lib389/instance/setup.py"
 279                               "src/lib389/lib389/instance/remove.py")
 280                  (("etc_dirsrv_path = .*")
 281                   "etc_dirsrv_path = '/etc/dirsrv/'\n"))
 282                #t)))
 283          (add-after 'unpack 'fix-install-location-of-python-tools
 284            (lambda* (#:key inputs outputs #:allow-other-keys)
 285              (let* ((out (assoc-ref outputs "out"))
 286                     (pythondir (string-append
 287                                 out "/lib/python"
 288                                 (python-version (assoc-ref inputs "python"))
 289                                 "/site-packages/")))
 290                ;; Install directory must be on PYTHONPATH.
 291                (setenv "PYTHONPATH"
 292                        (string-append (getenv "PYTHONPATH")
 293                                       ":" pythondir))
 294                ;; Install directory must exist.
 295                (mkdir-p pythondir)
 296                (substitute* "src/lib389/setup.py"
 297                  (("/usr") out))
 298                (substitute* "Makefile.am"
 299                  (("setup.py install --skip-build" m)
 300                   (string-append m " --prefix=" out
 301                                  " --root=/ --single-version-externally-managed"))))
 302              #t))
 303          (add-after 'build 'build-python-tools
 304            (lambda* (#:key make-flags #:allow-other-keys)
 305              ;; Set DETERMINISTIC_BUILD to override the embedded mtime in pyc
 306              ;; files.
 307              (setenv "DETERMINISTIC_BUILD" "1")
 308              ;; Use deterministic hashes for strings, bytes, and datetime
 309              ;; objects.
 310              (setenv "PYTHONHASHSEED" "0")
 311              (apply invoke "make" "lib389" make-flags)
 312              #t))
 313          (add-after 'install 'install-python-tools
 314            (lambda* (#:key make-flags #:allow-other-keys)
 315              (apply invoke "make" "lib389-install" make-flags)
 316              #t))
 317          (add-after 'install-python-tools 'wrap-python-tools
 318            (lambda* (#:key outputs #:allow-other-keys)
 319              (let* ((out  (assoc-ref outputs "out"))
 320                     (path (getenv "PYTHONPATH")))
 321                (for-each (lambda (file)
 322                            (wrap-program (string-append out file)
 323                              `("PYTHONPATH" ":" prefix (,path))))
 324                          '("/sbin/dsconf"
 325                            "/sbin/dscreate"
 326                            "/sbin/dsctl"
 327                            "/sbin/dsidm"
 328                            "/bin/ds-logpipe.py"
 329                            "/bin/ds-replcheck"
 330                            "/bin/readnsstate")))
 331              #t)))))
 332     (inputs
 333      `(("bdb" ,bdb)
 334        ("cracklib" ,cracklib)
 335        ("cyrus-sasl" ,cyrus-sasl)
 336        ("gnutls" ,gnutls)
 337        ("httpd" ,httpd)
 338        ("icu4c" ,icu4c)
 339        ("libevent" ,libevent)
 340        ("libselinux" ,libselinux)
 341        ("linux-pam" ,linux-pam)
 342        ("mit-krb5" ,mit-krb5)
 343        ("net-snmp" ,net-snmp)
 344        ("nspr" ,nspr)
 345        ("nss" ,nss)
 346        ("nss:bin" ,nss "bin") ; for certutil
 347        ("openldap" ,openldap)
 348        ("openssl" ,openssl)             ; #included by net-snmp
 349        ("pcre" ,pcre)
 350        ("perl" ,perl)
 351        ("python" ,python)
 352        ("python-pyasn1" ,python-pyasn1)
 353        ("python-pyasn1-modules" ,python-pyasn1-modules)
 354        ("python-pytest" ,python-pytest)
 355        ("python-dateutil" ,python-dateutil)
 356        ("python-six" ,python-six)
 357        ("python-argcomplete" ,python-argcomplete)
 358        ("python-argparse-manpage" ,python-argparse-manpage)
 359        ("python-ldap" ,python-ldap)))
 360     (native-inputs
 361      `(("autoconf" ,autoconf)
 362        ("automake" ,automake)
 363        ("doxygen" ,doxygen)
 364        ("gettext" ,gettext-minimal)
 365        ("libtool" ,libtool)
 366        ("rsync" ,rsync)
 367        ("pkg-config" ,pkg-config)))
 368     (home-page "https://directory.fedoraproject.org")
 369     (synopsis "Enterprise-class LDAP server")
 370     (description "389ds is an enterprise-class LDAP server.  It is hardened by
 371 real-world use, is full-featured, and supports multi-master replication.
 372
 373 Other features include:
 374
 375 @enumerate
 376 @item Online, zero downtime, LDAP-based update of schema, configuration, and
 377   management including @dfn{Access Control Information} (ACIs);
 378 @item Asynchronous Multi-Master Replication, to provide fault tolerance and
 379   high write performance;
 380 @item Extensive documentation;
 381 @item Secure authentication and transport (TLS, and SASL);
 382 @item LDAPv3 compliant server.
 383 @end enumerate\n")
 384     ;; GPLv3+ with OpenSSL linking exception.
 385     (license gpl3+)))
 386
 387 (define-public python-bonsai
 388   (package
 389     (name "python-bonsai")
 390     (version "1.2.0")
 391     (source
 392      (origin
 393        (method url-fetch)
 394        (uri (pypi-uri "bonsai" version))
 395        (sha256
 396         (base32
 397          "013bl6h1m3f7vg1lk89d4vi28wbf31zdcs4f9g8css7ngx63v6px"))))
 398     (build-system python-build-system)
 399     (inputs
 400      `(("mit-krb5" ,mit-krb5)
 401        ("cyrus-sasl" ,cyrus-sasl)
 402        ("openldap" ,openldap)))
 403     ;; disabling tests, since they require docker and extensive setup
 404     (arguments `(#:tests? #f))
 405     (home-page "https://github.com/noirello/bonsai")
 406     (synopsis "Access LDAP directory servers from Python")
 407     (description
 408      "This is a module for handling LDAP operations in Python.  LDAP entries
 409 are mapped to a special Python case-insensitive dictionary, tracking the
 410 changes of the dictionary to modify the entry on the server easily.")
 411     (license expat)))
 412