gnu/packages/openldap.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2013, 2014, 2015, 2019 Ludovic Courtès <ludo@gnu.org>
   3 ;;; Copyright © 2013 Andreas Enge <andreas@enge.fr>
   4 ;;; Copyright © 2016 Leo Famulari <leo@famulari.name>
   5 ;;; Copyright © 2017, 2018, 2019 Ricardo Wurmus <rekado@elephly.net>
   6 ;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
   7 ;;; Copyright © 2019 Mathieu Othacehe <m.othacehe@gmail.com>
   8 ;;;
   9 ;;; This file is part of GNU Guix.
  10 ;;;
  11 ;;; GNU Guix is free software; you can redistribute it and/or modify it
  12 ;;; under the terms of the GNU General Public License as published by
  13 ;;; the Free Software Foundation; either version 3 of the License, or (at
  14 ;;; your option) any later version.
  15 ;;;
  16 ;;; GNU Guix is distributed in the hope that it will be useful, but
  17 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  18 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19 ;;; GNU General Public License for more details.
  20 ;;;
  21 ;;; You should have received a copy of the GNU General Public License
  22 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  23
  24 (define-module (gnu packages openldap)
  25   #:use-module (gnu packages autotools)
  26   #:use-module (gnu packages check)
  27   #:use-module (gnu packages compression)
  28   #:use-module (gnu packages cyrus-sasl)
  29   #:use-module (gnu packages dbm)
  30   #:use-module (gnu packages documentation)
  31   #:use-module (gnu packages gettext)
  32   #:use-module (gnu packages gnupg)
  33   #:use-module (gnu packages groff)
  34   #:use-module (gnu packages icu4c)
  35   #:use-module (gnu packages kerberos)
  36   #:use-module (gnu packages libevent)
  37   #:use-module (gnu packages linux)
  38   #:use-module (gnu packages networking)
  39   #:use-module (gnu packages nss)
  40   #:use-module (gnu packages password-utils)
  41   #:use-module (gnu packages pcre)
  42   #:use-module (gnu packages perl)
  43   #:use-module (gnu packages pkg-config)
  44   #:use-module (gnu packages python)
  45   #:use-module (gnu packages python-xyz)
  46   #:use-module (gnu packages rsync)
  47   #:use-module (gnu packages selinux)
  48   #:use-module (gnu packages time)
  49   #:use-module (gnu packages tls)
  50   #:use-module (gnu packages web)
  51   #:use-module (gnu packages)
  52   #:use-module ((guix licenses) #:select (openldap2.8 lgpl2.1+ gpl3+ psfl))
  53   #:use-module (guix packages)
  54   #:use-module (guix utils)
  55   #:use-module (guix download)
  56   #:use-module (guix build-system gnu)
  57   #:use-module (guix build-system python))
  58
  59 (define-public openldap
  60   (package
  61    (name "openldap")
  62    (version "2.4.49")
  63    (source (origin
  64             (method url-fetch)
  65
  66             ;; See <http://www.openldap.org/software/download/> for a list of
  67             ;; mirrors.
  68             (uri (list (string-append
  69                         "ftp://mirror.switch.ch/mirror/OpenLDAP/"
  70                         "openldap-release/openldap-" version ".tgz")
  71                        (string-append
  72                         "https://www.openldap.org/software/download/OpenLDAP/"
  73                         "openldap-release/openldap-" version ".tgz")
  74                        (string-append
  75                         "ftp://ftp.dti.ad.jp/pub/net/OpenLDAP/"
  76                         "openldap-release/openldap-" version ".tgz")))
  77             (sha256
  78              (base32
  79               "0vp524rsngdcykf6ki7vprsyg7gj8z7hszg8xwxz50219fa1gcg3"))))
  80    (build-system gnu-build-system)
  81    (inputs `(("bdb" ,bdb-5.3)
  82              ("cyrus-sasl" ,cyrus-sasl)
  83              ("gnutls" ,gnutls)
  84              ("icu4c" ,icu4c)
  85              ("libgcrypt" ,libgcrypt)
  86              ("zlib" ,zlib)))
  87    (native-inputs `(("libtool" ,libtool)
  88                     ("groff" ,groff)
  89                     ("bdb" ,bdb-5.3)
  90                     ;; For up to date 'config.guess' and 'config.sub'.
  91                     ("automake" ,automake)))
  92    (arguments
  93     `(#:tests? #f
  94       #:configure-flags
  95       '("--disable-static"
  96         ,@(if (%current-target-system)
  97               '("--with-yielding_select=yes"
  98                 "ac_cv_func_memcmp_working=yes")
  99               '()))
 100       ;; Disable install stripping as it breaks cross-compiling.
 101       #:make-flags '("STRIP=")
 102       #:phases
 103       (modify-phases %standard-phases
 104         (add-after 'unpack 'fix-configure
 105           (lambda* (#:key inputs native-inputs #:allow-other-keys)
 106             ;; Replace outdated config.sub and config.guess:
 107             (with-directory-excursion "build"
 108               (for-each (lambda (file)
 109                           (install-file (string-append
 110                                          (assoc-ref
 111                                           (or native-inputs inputs) "automake")
 112                                          "/share/automake-"
 113                                          ,(version-major+minor
 114                                            (package-version automake))
 115                                          "/" file) "."))
 116                         '("config.sub" "config.guess")))
 117             #t))
 118         ,@(if (%current-target-system)
 119               '((add-before 'configure 'fix-cross-gcc
 120                   (lambda* (#:key target #:allow-other-keys)
 121                     (setenv "CC" (string-append target "-gcc"))
 122                     #t)))
 123               '())
 124         (add-after 'install 'patch-sasl-path
 125           ;; Give -L arguments for cyrus-sasl to avoid propagation.
 126           (lambda* (#:key inputs outputs #:allow-other-keys)
 127             (let ((out (assoc-ref outputs "out"))
 128                   (krb5 (assoc-ref inputs "mit-krb5"))) ;propagated from cyrus-sasl
 129
 130               ;; The ancient Libtool bundled with OpenLDAP copies the linker flags
 131               ;; from Cyrus-SASL and embeds them into its own .la files.  Add an
 132               ;; absolute reference to Kerberos so it does not have to be propagated.
 133               (substitute* (map (lambda (f) (string-append out "/" f))
 134                                 '("lib/libldap.la" "lib/libldap_r.la"))
 135                 (("-lkrb5" lib)
 136                  (string-append "-L" krb5 "/lib " lib)))
 137               #t))))))
 138    (synopsis "Implementation of the Lightweight Directory Access Protocol")
 139    (description
 140     "OpenLDAP is a free implementation of the Lightweight Directory Access Protocol.")
 141    (license openldap2.8)
 142    (home-page "https://www.openldap.org/")))
 143
 144 (define-public nss-pam-ldapd
 145   (package
 146     (name "nss-pam-ldapd")
 147     (version "0.9.11")
 148     (source (origin
 149               (method url-fetch)
 150               (uri (string-append "https://arthurdejong.org/nss-pam-ldapd/"
 151                                   "nss-pam-ldapd-" version ".tar.gz"))
 152               (sha256
 153                (base32
 154                 "1dna3r0q6sjhhlkhcp8x2zkslrd4y7701kk6fl5r940sdph1pmyh"))))
 155     (build-system gnu-build-system)
 156     (arguments
 157      `(#:configure-flags
 158        (list (string-append "--with-pam-seclib-dir="
 159                             (assoc-ref %outputs "out") "/lib/security/")
 160              ;; nslcd cannot be convinced to look at run-time for its
 161              ;; configuration file at a location that differs from the
 162              ;; configured location.
 163              "--with-ldap-conf-file=/etc/nslcd.conf")
 164        #:phases
 165        (modify-phases %standard-phases
 166          ;; This is necessary because we tell nslcd with configure flags that
 167          ;; it should look for its configuration file at /etc/nslcd.conf.  The
 168          ;; build system tries to install a default configuration to that very
 169          ;; location.
 170          (add-after 'unpack 'override-nslcd.conf-install-path
 171            (lambda* (#:key outputs #:allow-other-keys)
 172              (substitute* "Makefile.in"
 173                (("\\$\\(DESTDIR\\)\\$\\(NSLCD_CONF_PATH\\)")
 174                 (string-append (assoc-ref outputs "out")
 175                                "/etc/nslcd.conf.example")))
 176              #t)))))
 177     (inputs
 178      `(("linux-pam" ,linux-pam)
 179        ("openldap" ,openldap)
 180        ("mit-krb5" ,mit-krb5)
 181        ("python" ,python)))
 182     (home-page "https://arthurdejong.org/nss-pam-ldapd")
 183     (synopsis "NSS and PAM modules for LDAP")
 184     (description "nss-pam-ldapd provides a @dfn{Name Service Switch} (NSS)
 185 module that allows your LDAP server to provide user account, group, host name,
 186 alias, netgroup, and basically any other information that you would normally
 187 get from @file{/etc} flat files or NIS.  It also provides a @dfn{Pluggable
 188 Authentication Module} (PAM) to do identity and authentication management with
 189 an LDAP server.")
 190     (license lgpl2.1+)))
 191
 192 (define-public python-ldap
 193   (package
 194     (name "python-ldap")
 195     (version "3.1.0")
 196     (source
 197      (origin
 198        (method url-fetch)
 199        (uri (pypi-uri "python-ldap" version))
 200        (sha256
 201         (base32
 202          "1i97nwfnraylyn0myxlf3vciicrf5h6fymrcff9c00k581wmx5s1"))))
 203     (build-system python-build-system)
 204     (arguments
 205      `(#:phases
 206        (modify-phases %standard-phases
 207          (add-after 'unpack 'configure-openldap-locations
 208            (lambda* (#:key inputs #:allow-other-keys)
 209              (let ((openldap (assoc-ref inputs "openldap")))
 210                (setenv "SLAPD"
 211                        (string-append openldap
 212                                       "/libexec/slapd"))
 213                (setenv "SCHEMA"
 214                        (string-append openldap
 215                                       "/etc/openldap/schema/")))
 216              #t)))))
 217     (inputs
 218      `(("openldap" ,openldap)
 219        ("cyrus-sasl" ,cyrus-sasl)
 220        ("mit-krb5" ,mit-krb5)))
 221     (propagated-inputs
 222      `(("python-pyasn1" ,python-pyasn1)
 223        ("python-pyasn1-modules" ,python-pyasn1-modules)))
 224     (home-page "https://www.python-ldap.org/")
 225     (synopsis "Python modules for implementing LDAP clients")
 226     (description
 227      "This package provides an object-oriented API to access LDAP directory
 228 servers from Python programs.")
 229     (license psfl)))
 230
 231 (define-public 389-ds-base
 232   (package
 233     (name "389-ds-base")
 234     (version "1.4.0.21")
 235     (source (origin
 236               (method url-fetch)
 237               (uri (string-append "https://releases.pagure.org/389-ds-base/"
 238                                   "389-ds-base-" version ".tar.bz2"))
 239               (sha256
 240                (base32
 241                 "1qd1ap5d5nxyiq0d19czfwc3h7iwl9lmr5sy7d7xmpr2by59aysr"))))
 242     (build-system gnu-build-system)
 243     (arguments
 244      `(#:modules ((srfi srfi-1)
 245                   (guix build gnu-build-system)
 246                   ((guix build python-build-system)
 247                    #:select (python-version))
 248                   (guix build utils))
 249        #:imported-modules ((guix build python-build-system)
 250                            ,@%gnu-build-system-modules)
 251        #:configure-flags
 252        (list (string-append "--with-db="
 253                             (assoc-ref %build-inputs "bdb"))
 254              (string-append "--with-sasl="
 255                             (assoc-ref %build-inputs "cyrus-sasl"))
 256              (string-append "--with-netsnmp="
 257                             (assoc-ref %build-inputs "net-snmp"))
 258              (string-append "--with-pcre="
 259                             (assoc-ref %build-inputs "pcre"))
 260              (string-append "--with-selinux="
 261                             (assoc-ref %build-inputs "libselinux"))
 262              "--localstatedir=/var"
 263              "--with-instconfigdir=/etc/dirsrv"
 264              ;; The Perl scripts are being removed in the 1.4.0 release.
 265              ;; Building them would require packaging of the outdated Mozilla
 266              ;; LDAP SDK (instead of OpenLDAP) and PerLDAP.
 267              "--disable-perl")
 268        #:phases
 269        (modify-phases %standard-phases
 270          (add-after 'unpack 'fix-references
 271            (lambda _
 272              (substitute* "include/ldaputil/certmap.h"
 273                (("nss3/cert.h") "nss/cert.h"))
 274              (substitute* "src/lib389/lib389/nss_ssl.py"
 275                (("'/usr/bin/certutil'")
 276                 (string-append "'" (which "certutil") "'"))
 277                (("'/usr/bin/c_rehash'")
 278                 (string-append "'" (which "perl") "', '" (which "c_rehash") "'")))
 279              #t))
 280          (add-after 'unpack 'overwrite-default-locations
 281            (lambda* (#:key outputs #:allow-other-keys)
 282              (let ((out (assoc-ref outputs "out")))
 283                (substitute* "src/lib389/lib389/paths.py"
 284                  (("/usr/share/dirsrv/inf/defaults.inf")
 285                   (string-append out "/share/dirsrv/inf/defaults.inf")))
 286                ;; This directory can only be specified relative to sysconfdir.  This
 287                ;; is used to determine where to look for installed directory
 288                ;; servers, so in the absence of a search path it needs to be global.
 289                (substitute* "ldap/admin/src/defaults.inf.in"
 290                  (("^initconfig_dir =.*")
 291                   "initconfig_dir = /etc/dirsrv/registry\n"))
 292                ;; This is used to determine where to write certificate files
 293                ;; when installing new directory server instances.
 294                (substitute* '("src/lib389/lib389/instance/setup.py"
 295                               "src/lib389/lib389/instance/remove.py")
 296                  (("etc_dirsrv_path = .*")
 297                   "etc_dirsrv_path = '/etc/dirsrv/'\n"))
 298                #t)))
 299          (add-after 'unpack 'fix-install-location-of-python-tools
 300            (lambda* (#:key inputs outputs #:allow-other-keys)
 301              (let* ((out (assoc-ref outputs "out"))
 302                     (pythondir (string-append
 303                                 out "/lib/python"
 304                                 (python-version (assoc-ref inputs "python"))
 305                                 "/site-packages/")))
 306                ;; Install directory must be on PYTHONPATH.
 307                (setenv "PYTHONPATH"
 308                        (string-append (getenv "PYTHONPATH")
 309                                       ":" pythondir))
 310                ;; Install directory must exist.
 311                (mkdir-p pythondir)
 312                (substitute* "src/lib389/setup.py"
 313                  (("/usr") out))
 314                (substitute* "Makefile.am"
 315                  (("setup.py install --skip-build" m)
 316                   (string-append m " --prefix=" out
 317                                  " --root=/ --single-version-externally-managed"))))
 318              #t))
 319          (add-after 'build 'build-python-tools
 320            (lambda* (#:key make-flags #:allow-other-keys)
 321              ;; Set DETERMINISTIC_BUILD to override the embedded mtime in pyc
 322              ;; files.
 323              (setenv "DETERMINISTIC_BUILD" "1")
 324              ;; Use deterministic hashes for strings, bytes, and datetime
 325              ;; objects.
 326              (setenv "PYTHONHASHSEED" "0")
 327              (apply invoke "make" "lib389" make-flags)
 328              #t))
 329          (add-after 'install 'install-python-tools
 330            (lambda* (#:key make-flags #:allow-other-keys)
 331              (apply invoke "make" "lib389-install" make-flags)
 332              #t))
 333          (add-after 'install-python-tools 'wrap-python-tools
 334            (lambda* (#:key outputs #:allow-other-keys)
 335              (let* ((out  (assoc-ref outputs "out"))
 336                     (path (getenv "PYTHONPATH")))
 337                (for-each (lambda (file)
 338                            (wrap-program (string-append out file)
 339                              `("PYTHONPATH" ":" prefix (,path))))
 340                          '("/sbin/dsconf"
 341                            "/sbin/dscreate"
 342                            "/sbin/dsctl"
 343                            "/sbin/dsidm"
 344                            "/bin/ds-logpipe.py"
 345                            "/bin/ds-replcheck"
 346                            "/bin/readnsstate")))
 347              #t)))))
 348     (inputs
 349      `(("bdb" ,bdb)
 350        ("cracklib" ,cracklib)
 351        ("cyrus-sasl" ,cyrus-sasl)
 352        ("gnutls" ,gnutls)
 353        ("httpd" ,httpd)
 354        ("icu4c" ,icu4c)
 355        ("libevent" ,libevent)
 356        ("libselinux" ,libselinux)
 357        ("linux-pam" ,linux-pam)
 358        ("mit-krb5" ,mit-krb5)
 359        ("net-snmp" ,net-snmp)
 360        ("nspr" ,nspr)
 361        ("nss" ,nss)
 362        ("nss:bin" ,nss "bin") ; for certutil
 363        ("openldap" ,openldap)
 364        ("openssl" ,openssl)             ; #included by net-snmp
 365        ("pcre" ,pcre)
 366        ("perl" ,perl)
 367        ("python" ,python)
 368        ("python-pyasn1" ,python-pyasn1)
 369        ("python-pyasn1-modules" ,python-pyasn1-modules)
 370        ("python-pytest" ,python-pytest)
 371        ("python-dateutil" ,python-dateutil)
 372        ("python-six" ,python-six)
 373        ("python-argcomplete" ,python-argcomplete)
 374        ("python-argparse-manpage" ,python-argparse-manpage)
 375        ("python-ldap" ,python-ldap)))
 376     (native-inputs
 377      `(("autoconf" ,autoconf)
 378        ("automake" ,automake)
 379        ("doxygen" ,doxygen)
 380        ("gettext" ,gettext-minimal)
 381        ("libtool" ,libtool)
 382        ("rsync" ,rsync)
 383        ("pkg-config" ,pkg-config)))
 384     (home-page "https://directory.fedoraproject.org")
 385     (synopsis "Enterprise-class LDAP server")
 386     (description "389ds is an enterprise-class LDAP server.  It is hardened by
 387 real-world use, is full-featured, and supports multi-master replication.
 388
 389 Other features include:
 390
 391 @enumerate
 392 @item Online, zero downtime, LDAP-based update of schema, configuration, and
 393   management including @dfn{Access Control Information} (ACIs);
 394 @item Asynchronous Multi-Master Replication, to provide fault tolerance and
 395   high write performance;
 396 @item Extensive documentation;
 397 @item Secure authentication and transport (TLS, and SASL);
 398 @item LDAPv3 compliant server.
 399 @end enumerate\n")
 400     ;; GPLv3+ with OpenSSL linking exception.
 401     (license gpl3+)))