1 ;;; GNU Guix --- Functional package management for GNU
2 ;;; Copyright © 2013, 2014, 2015, 2019 Ludovic Courtès <ludo@gnu.org>
3 ;;; Copyright © 2013 Andreas Enge <andreas@enge.fr>
4 ;;; Copyright © 2016 Leo Famulari <leo@famulari.name>
5 ;;; Copyright © 2017, 2018, 2019 Ricardo Wurmus <rekado@elephly.net>
6 ;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
8 ;;; This file is part of GNU Guix.
10 ;;; GNU Guix is free software; you can redistribute it and/or modify it
11 ;;; under the terms of the GNU General Public License as published by
12 ;;; the Free Software Foundation; either version 3 of the License, or (at
13 ;;; your option) any later version.
15 ;;; GNU Guix is distributed in the hope that it will be useful, but
16 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
17 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 ;;; GNU General Public License for more details.
20 ;;; You should have received a copy of the GNU General Public License
21 ;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
23 (define-module (gnu packages openldap)
24 #:use-module (gnu packages autotools)
25 #:use-module (gnu packages check)
26 #:use-module (gnu packages compression)
27 #:use-module (gnu packages cyrus-sasl)
28 #:use-module (gnu packages dbm)
29 #:use-module (gnu packages documentation)
30 #:use-module (gnu packages gettext)
31 #:use-module (gnu packages gnupg)
32 #:use-module (gnu packages groff)
33 #:use-module (gnu packages icu4c)
34 #:use-module (gnu packages kerberos)
35 #:use-module (gnu packages libevent)
36 #:use-module (gnu packages linux)
37 #:use-module (gnu packages networking)
38 #:use-module (gnu packages nss)
39 #:use-module (gnu packages password-utils)
40 #:use-module (gnu packages pcre)
41 #:use-module (gnu packages perl)
42 #:use-module (gnu packages pkg-config)
43 #:use-module (gnu packages python)
44 #:use-module (gnu packages python-xyz)
45 #:use-module (gnu packages rsync)
46 #:use-module (gnu packages selinux)
47 #:use-module (gnu packages time)
48 #:use-module (gnu packages tls)
49 #:use-module (gnu packages web)
50 #:use-module (gnu packages)
51 #:use-module ((guix licenses) #:select (openldap2.8 lgpl2.1+ gpl3+ psfl))
52 #:use-module (guix packages)
53 #:use-module (guix download)
54 #:use-module (guix build-system gnu)
55 #:use-module (guix build-system python))
57 (define-public openldap
64 ;; See <http://www.openldap.org/software/download/> for a list of
66 (uri (list (string-append
67 "ftp://mirror.switch.ch/mirror/OpenLDAP/"
68 "openldap-release/openldap-" version ".tgz")
70 "https://www.openldap.org/software/download/OpenLDAP/"
71 "openldap-release/openldap-" version ".tgz")
73 "ftp://ftp.dti.ad.jp/pub/net/OpenLDAP/"
74 "openldap-release/openldap-" version ".tgz")))
77 "0bab1km8f2nan1x0zgwliknbxg0zlf2pafxrr867kblrdfwdr44s"))))
78 (build-system gnu-build-system)
79 (inputs `(("bdb" ,bdb-5.3)
80 ("cyrus-sasl" ,cyrus-sasl)
84 ("libgcrypt" ,libgcrypt)
86 (native-inputs `(("libtool" ,libtool)))
89 #:configure-flags '("--disable-static")
91 (modify-phases %standard-phases
92 (add-after 'install 'patch-sasl-path
93 ;; Give -L arguments for cyrus-sasl to avoid propagation.
94 (lambda* (#:key inputs outputs #:allow-other-keys)
95 (let ((out (assoc-ref outputs "out"))
96 (krb5 (assoc-ref inputs "mit-krb5"))) ;propagated from cyrus-sasl
98 ;; The ancient Libtool bundled with OpenLDAP copies the linker flags
99 ;; from Cyrus-SASL and embeds them into its own .la files. Add an
100 ;; absolute reference to Kerberos so it does not have to be propagated.
101 (substitute* (map (lambda (f) (string-append out "/" f))
102 '("lib/libldap.la" "lib/libldap_r.la"))
104 (string-append "-L" krb5 "/lib " lib)))
106 (synopsis "Implementation of the Lightweight Directory Access Protocol")
108 "OpenLDAP is a free implementation of the Lightweight Directory Access Protocol.")
109 (license openldap2.8)
110 (home-page "https://www.openldap.org/")))
112 (define-public nss-pam-ldapd
114 (name "nss-pam-ldapd")
118 (uri (string-append "https://arthurdejong.org/nss-pam-ldapd/"
119 "nss-pam-ldapd-" version ".tar.gz"))
122 "1cqamcr6qpgwxijlr6kg7jspjamjra8w0haan0qssn0yxn95d7c0"))))
123 (build-system gnu-build-system)
126 (list (string-append "--with-pam-seclib-dir="
127 (assoc-ref %outputs "out") "/lib/security/")
128 ;; nslcd cannot be convinced to look at run-time for its
129 ;; configuration file at a location that differs from the
130 ;; configured location.
131 "--with-ldap-conf-file=/etc/nslcd.conf")
133 (modify-phases %standard-phases
134 ;; This is necessary because we tell nslcd with configure flags that
135 ;; it should look for its configuration file at /etc/nslcd.conf. The
136 ;; build system tries to install a default configuration to that very
138 (add-after 'unpack 'override-nslcd.conf-install-path
139 (lambda* (#:key outputs #:allow-other-keys)
140 (substitute* "Makefile.in"
141 (("\\$\\(DESTDIR\\)\\$\\(NSLCD_CONF_PATH\\)")
142 (string-append (assoc-ref outputs "out")
143 "/etc/nslcd.conf.example")))
146 `(("linux-pam" ,linux-pam)
147 ("openldap" ,openldap)
148 ("mit-krb5" ,mit-krb5)
149 ("python" ,python-2)))
150 (home-page "https://arthurdejong.org/nss-pam-ldapd")
151 (synopsis "NSS and PAM modules for LDAP")
152 (description "nss-pam-ldapd provides a @dfn{Name Service Switch} (NSS)
153 module that allows your LDAP server to provide user account, group, host name,
154 alias, netgroup, and basically any other information that you would normally
155 get from @file{/etc} flat files or NIS. It also provides a @dfn{Pluggable
156 Authentication Module} (PAM) to do identity and authentication management with
160 (define-public python-ldap
167 (uri (pypi-uri "python-ldap" version))
170 "1i97nwfnraylyn0myxlf3vciicrf5h6fymrcff9c00k581wmx5s1"))))
171 (build-system python-build-system)
174 (modify-phases %standard-phases
175 (add-after 'unpack 'configure-openldap-locations
176 (lambda* (#:key inputs #:allow-other-keys)
177 (let ((openldap (assoc-ref inputs "openldap")))
179 (string-append openldap
182 (string-append openldap
183 "/etc/openldap/schema/")))
186 `(("openldap" ,openldap)
187 ("cyrus-sasl" ,cyrus-sasl)
188 ("mit-krb5" ,mit-krb5)))
190 `(("python-pyasn1" ,python-pyasn1)
191 ("python-pyasn1-modules" ,python-pyasn1-modules)))
192 (home-page "https://www.python-ldap.org/")
193 (synopsis "Python modules for implementing LDAP clients")
195 "This package provides an object-oriented API to access LDAP directory
196 servers from Python programs.")
199 (define-public 389-ds-base
205 (uri (string-append "https://releases.pagure.org/389-ds-base/"
206 "389-ds-base-" version ".tar.bz2"))
209 "1qd1ap5d5nxyiq0d19czfwc3h7iwl9lmr5sy7d7xmpr2by59aysr"))))
210 (build-system gnu-build-system)
212 `(#:modules ((srfi srfi-1)
213 (guix build gnu-build-system)
216 (list (string-append "--with-db="
217 (assoc-ref %build-inputs "bdb"))
218 (string-append "--with-sasl="
219 (assoc-ref %build-inputs "cyrus-sasl"))
220 (string-append "--with-netsnmp="
221 (assoc-ref %build-inputs "net-snmp"))
222 (string-append "--with-pcre="
223 (assoc-ref %build-inputs "pcre"))
224 (string-append "--with-selinux="
225 (assoc-ref %build-inputs "libselinux"))
226 "--localstatedir=/var"
227 "--with-instconfigdir=/etc/dirsrv"
228 ;; The Perl scripts are being removed in the 1.4.0 release.
229 ;; Building them would require packaging of the outdated Mozilla
230 ;; LDAP SDK (instead of OpenLDAP) and PerLDAP.
233 (modify-phases %standard-phases
234 (add-after 'unpack 'fix-references
236 (substitute* "include/ldaputil/certmap.h"
237 (("nss3/cert.h") "nss/cert.h"))
238 (substitute* "src/lib389/lib389/nss_ssl.py"
239 (("'/usr/bin/certutil'")
240 (string-append "'" (which "certutil") "'"))
241 (("'/usr/bin/c_rehash'")
242 (string-append "'" (which "perl") "', '" (which "c_rehash") "'")))
244 (add-after 'unpack 'overwrite-default-locations
245 (lambda* (#:key outputs #:allow-other-keys)
246 (let ((out (assoc-ref outputs "out")))
247 (substitute* "src/lib389/lib389/paths.py"
248 (("/usr/share/dirsrv/inf/defaults.inf")
249 (string-append out "/share/dirsrv/inf/defaults.inf")))
250 ;; This directory can only be specified relative to sysconfdir. This
251 ;; is used to determine where to look for installed directory
252 ;; servers, so in the absence of a search path it needs to be global.
253 (substitute* "ldap/admin/src/defaults.inf.in"
254 (("^initconfig_dir =.*")
255 "initconfig_dir = /etc/dirsrv/registry\n"))
256 ;; This is used to determine where to write certificate files
257 ;; when installing new directory server instances.
258 (substitute* '("src/lib389/lib389/instance/setup.py"
259 "src/lib389/lib389/instance/remove.py")
260 (("etc_dirsrv_path = .*")
261 "etc_dirsrv_path = '/etc/dirsrv/'\n"))
263 (add-after 'unpack 'fix-install-location-of-python-tools
264 (lambda* (#:key inputs outputs #:allow-other-keys)
265 (let* ((out (assoc-ref outputs "out"))
267 ;; FIXME: copied from python-build-system
269 (let* ((version (last (string-split python #\-)))
270 (components (string-split version #\.))
271 (major+minor (take components 2)))
272 (string-join major+minor "."))))
273 (pythondir (string-append
275 (get-python-version (assoc-ref inputs "python"))
277 ;; Install directory must be on PYTHONPATH.
279 (string-append (getenv "PYTHONPATH")
281 ;; Install directory must exist.
283 (substitute* "src/lib389/setup.py"
285 (substitute* "Makefile.am"
286 (("setup.py install --skip-build" m)
287 (string-append m " --prefix=" out
288 " --root=/ --single-version-externally-managed"))))
290 (add-after 'build 'build-python-tools
291 (lambda* (#:key make-flags #:allow-other-keys)
292 ;; Set DETERMINISTIC_BUILD to override the embedded mtime in pyc
294 (setenv "DETERMINISTIC_BUILD" "1")
295 ;; Use deterministic hashes for strings, bytes, and datetime
297 (setenv "PYTHONHASHSEED" "0")
298 (apply invoke "make" "lib389" make-flags)
300 (add-after 'install 'install-python-tools
301 (lambda* (#:key make-flags #:allow-other-keys)
302 (apply invoke "make" "lib389-install" make-flags)
304 (add-after 'install-python-tools 'wrap-python-tools
305 (lambda* (#:key outputs #:allow-other-keys)
306 (let* ((out (assoc-ref outputs "out"))
307 (path (getenv "PYTHONPATH")))
308 (for-each (lambda (file)
309 (wrap-program (string-append out file)
310 `("PYTHONPATH" ":" prefix (,path))))
317 "/bin/readnsstate")))
321 ("cracklib" ,cracklib)
322 ("cyrus-sasl" ,cyrus-sasl)
326 ("libevent" ,libevent)
327 ("libselinux" ,libselinux)
328 ("linux-pam" ,linux-pam)
329 ("mit-krb5" ,mit-krb5)
330 ("net-snmp" ,net-snmp)
333 ("nss:bin" ,nss "bin") ; for certutil
334 ("openldap" ,openldap)
335 ("openssl" ,openssl) ; #included by net-snmp
339 ("python-pyasn1" ,python-pyasn1)
340 ("python-pyasn1-modules" ,python-pyasn1-modules)
341 ("python-pytest" ,python-pytest)
342 ("python-dateutil" ,python-dateutil)
343 ("python-six" ,python-six)
344 ("python-argcomplete" ,python-argcomplete)
345 ("python-argparse-manpage" ,python-argparse-manpage)
346 ("python-ldap" ,python-ldap)))
348 `(("autoconf" ,autoconf)
349 ("automake" ,automake)
351 ("gettext" ,gettext-minimal)
354 ("pkg-config" ,pkg-config)))
355 (home-page "https://directory.fedoraproject.org")
356 (synopsis "Enterprise-class LDAP server")
357 (description "389ds is an enterprise-class LDAP server. It is hardened by
358 real-world use, is full-featured, and supports multi-master replication.
360 Other features include:
363 @item Online, zero downtime, LDAP-based update of schema, configuration, and
364 management including @dfn{Access Control Information} (ACIs);
365 @item Asynchronous Multi-Master Replication, to provide fault tolerance and
366 high write performance;
367 @item Extensive documentation;
368 @item Secure authentication and transport (TLS, and SASL);
369 @item LDAPv3 compliant server.
371 ;; GPLv3+ with OpenSSL linking exception.