gnu/services/kerberos.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2016 John Darrington <jmd@gnu.org>
   3 ;;;
   4 ;;; This file is part of GNU Guix.
   5 ;;;
   6 ;;; GNU Guix is free software; you can redistribute it and/or modify it
   7 ;;; under the terms of the GNU General Public License as published by
   8 ;;; the Free Software Foundation; either version 3 of the License, or (at
   9 ;;; your option) any later version.
  10 ;;;
  11 ;;; GNU Guix is distributed in the hope that it will be useful, but
  12 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  13 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14 ;;; GNU General Public License for more details.
  15 ;;;
  16 ;;; You should have received a copy of the GNU General Public License
  17 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  18
  19 (define-module (gnu services kerberos)
  20   #:use-module (gnu packages admin)
  21   #:use-module (gnu services)
  22   #:use-module (gnu system pam)
  23   #:use-module (guix gexp)
  24   #:use-module (guix records)
  25   #:export (pam-krb5-configuration
  26             pam-krb5-configuration?
  27             pam-krb5-service-type))
  28
  29 (define-record-type* <pam-krb5-configuration>
  30   pam-krb5-configuration  make-pam-krb5-configuration
  31   pam-krb5-configuration?
  32   (pam-krb5               pam-krb5-configuration-pam-krb5
  33                           (default pam-krb5))
  34   (minimum-uid            pam-krb5-configuration-minimum-uid
  35                           (default 1000)))
  36
  37 (define (pam-krb5-pam-service config)
  38   "Return a PAM service for Kerberos authentication."
  39   (lambda (pam)
  40     (define pam-krb5-module
  41       #~(string-append #$(pam-krb5-configuration-pam-krb5 config)
  42                        "/lib/security/pam_krb5.so"))
  43
  44     (let ((pam-krb5-sufficient
  45            (pam-entry
  46             (control "sufficient")
  47             (module pam-krb5-module)
  48             (arguments
  49              (list
  50               (format #f "minimum_uid=~a"
  51                       (pam-krb5-configuration-minimum-uid config)))))))
  52       (pam-service
  53        (inherit pam)
  54        (auth (cons* pam-krb5-sufficient
  55                     (pam-service-auth pam)))
  56        (session (cons* pam-krb5-sufficient
  57                        (pam-service-session pam)))
  58        (account (cons* pam-krb5-sufficient
  59                        (pam-service-account pam)))))))
  60
  61 (define (pam-krb5-pam-services config)
  62   (list (pam-krb5-pam-service config)))
  63
  64 (define pam-krb5-service-type
  65   (service-type (name 'pam-krb5)
  66                 (extensions
  67                  (list
  68                   (service-extension pam-root-service-type
  69                                      pam-krb5-pam-services)))))