commit 7b3486bdc39d5b70e59215c7a0b23e5ff75101f3 · pyrox.dev/nixpkgs

+4 -4

nixos/modules/services/security/kanidm.nix

···

       185
        
       

     

       186
        
         finalJson =

     

       187
        
           if cfg.provision.extraJsonFile != null then

     

       188
       -
             "<(${lib.getExe pkgs.jq} -s '.[0] * .[1]' ${provisionStateJson} ${cfg.provision.extraJsonFile})"

     

       0
        
       
     

       0
        
       
     

       189
        
           else

     

       190
        
             provisionStateJson;

     

       191
        
       

     
···

       442
        
               description = ''

     

       443
        
                 A JSON file for provisioning persons, groups & systems.

     

       444
        
                 Options set in this file take precedence over values set using the other options.

     

       445
       -
                 In the case of duplicates, `jq` will remove all but the last one

     

       446
       -
                 when merging this file with the options.

     

       447
        
                 The accepted JSON schema can be found at <https://github.com/oddlama/kanidm-provision#json-schema>.

     

       448
       -
                 Note: theoretically `jq` cannot merge nested types, but this does not pose an issue as kanidm-provision's JSON scheme does not use nested types.

     

       449
        
               '';

     

       450
        
               type = types.nullOr types.path;

     

       451
        
               default = null;

···

       185
        
       

     

       186
        
         finalJson =

     

       187
        
           if cfg.provision.extraJsonFile != null then

     

       188
       +
             ''

     

       189
       +
               <(${lib.getExe pkgs.yq-go} '. *+ load("${cfg.provision.extraJsonFile}") | (.. | select(type == "!!seq")) |= unique' ${provisionStateJson})

     

       190
       +
             ''

     

       191
        
           else

     

       192
        
             provisionStateJson;

     

       193
        
       

     
···

       444
        
               description = ''

     

       445
        
                 A JSON file for provisioning persons, groups & systems.

     

       446
        
                 Options set in this file take precedence over values set using the other options.

     

       447
       +
                 The files get deeply merged, and deduplicated.

     

       0
        
       
     

       448
        
                 The accepted JSON schema can be found at <https://github.com/oddlama/kanidm-provision#json-schema>.

     

       0
        
       
     

       449
        
               '';

     

       450
        
               type = types.nullOr types.path;

     

       451
        
               default = null;

+42

nixos/tests/kanidm-provisioning.nix

···

       234
        
                 };

     

       235
        
               };

     

       236
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       237
        
             security.pki.certificateFiles = [ certs.ca.cert ];

     

       238
        
       

     

       239
        
             networking.hosts."::1" = [ serverDomain ];

     
···

       514
        
       

     

       515
        
                 out = provision.succeed("kanidm system oauth2 get service2")

     

       516
        
                 assert_lacks(out, "name: service2")

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       517
        
       

     

       518
        
                 provision.succeed("kanidm logout -D idm_admin")

     

       519
        
           '';

···

       234
        
                 };

     

       235
        
               };

     

       236
        
       

     

       237
       +
             specialisation.extraJsonFile.configuration =

     

       238
       +
               { ... }:

     

       239
       +
               {

     

       240
       +
                 services.kanidm.provision = lib.mkForce {

     

       241
       +
                   enable = true;

     

       242
       +
                   idmAdminPasswordFile = pkgs.writeText "idm-admin-pw" provisionIdmAdminPassword;

     

       243
       +
       

     

       244
       +
                   extraJsonFile = pkgs.writeText "extra-json.json" (

     

       245
       +
                     builtins.toJSON {

     

       246
       +
                       persons.testuser2.displayName = "Test User 2";

     

       247
       +
                       groups.testgroup1.members = [ "testuser2" ];

     

       248
       +
                     }

     

       249
       +
                   );

     

       250
       +
       

     

       251
       +
                   groups.testgroup1 = { };

     

       252
       +
       

     

       253
       +
                   persons.testuser1 = {

     

       254
       +
                     displayName = "Test User 1";

     

       255
       +
                     groups = [ "testgroup1" ];

     

       256
       +
                   };

     

       257
       +
                 };

     

       258
       +
               };

     

       259
       +
       

     

       260
        
             security.pki.certificateFiles = [ certs.ca.cert ];

     

       261
        
       

     

       262
        
             networking.hosts."::1" = [ serverDomain ];

     
···

       537
        
       

     

       538
        
                 out = provision.succeed("kanidm system oauth2 get service2")

     

       539
        
                 assert_lacks(out, "name: service2")

     

       540
       +
       

     

       541
       +
                 provision.succeed("kanidm logout -D idm_admin")

     

       542
       +
       

     

       543
       +
             with subtest("Test Provisioning - extraJsonFile"):

     

       544
       +
                 provision.succeed('${specialisations}/extraJsonFile/bin/switch-to-configuration test')

     

       545
       +
                 provision_login("${provisionIdmAdminPassword}")

     

       546
       +
       

     

       547
       +
                 out = provision.succeed("kanidm group get testgroup1")

     

       548
       +
                 assert_contains(out, "name: testgroup1")

     

       549
       +
       

     

       550
       +
                 out = provision.succeed("kanidm person get testuser1")

     

       551
       +
                 assert_contains(out, "name: testuser1")

     

       552
       +
       

     

       553
       +
                 out = provision.succeed("kanidm person get testuser2")

     

       554
       +
                 assert_contains(out, "name: testuser2")

     

       555
       +
       

     

       556
       +
                 out = provision.succeed("kanidm group get testgroup1")

     

       557
       +
                 assert_contains(out, "member: testuser1")

     

       558
       +
                 assert_contains(out, "member: testuser2")

     

       559
        
       

     

       560
        
                 provision.succeed("kanidm logout -D idm_admin")

     

       561
        
           '';