[bug#52578,v2,0/2] OpenLDAP service

Hi,

Sorry for the delay.

Well, I am not convinced that the package 'openldap-for-services' is really
required and perhaps the tweak of openldap-2.6 is enough.

Moreover, do you need openssl instead of gnutls?  I would be in favor to keep
gnutls as the base package and if you absolutely need openssl, write a
variant; along the proposed modify-inputs.

About the old versions of openldap, I am going to send you a recipe for your
own channel.  I am not convinced that maintain such old variants makes sense
at the Guix level.


About the service, it still misses some documentation for the manual.  And
'tests' would also be very welcome. :-)

Note that gnu/tests/ldap.scm already some tests.  Maybe this file could be
updated with the new service.

WDYT?

Cheers,
simon


Jean-François Guillaume (1):
  DRAFT services: Add openldap service.

zimoun (1):
  DRAFT gnu: Add openldap-for-services.

 gnu/packages/openldap.scm | 47 ++++++++++++++++++++++
 gnu/services/openldap.scm | 84 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 131 insertions(+)
 create mode 100644 gnu/services/openldap.scm


base-commit: f76898be6ded531e459f106549886afbdc426a78
  

Hello,

> Sorry for the delay.

No worries, I must admit that I didn't have much time on hand to correct 
things on my side.

> Well, I am not convinced that the package 'openldap-for-services' is 
> really
> required and perhaps the tweak of openldap-2.6 is enough.

It's only required if you have the need for a fully featured server like 
we do (we use this definition in our openldap cluster infrastructure).
Given enough time, we will provides a stable repository and artifacts 
for our definitions.

> Moreover, do you need openssl instead of gnutls?

Nope, I just took the définition of the RHEL package and moved it into 
a guix format.

> About the old versions of openldap, I am going to send you a recipe for 
> your
> own channel.  I am not convinced that maintain such old variants makes 
> sense
> at the Guix level.

I think we still have this old version because it's the version provided 
in .deb anb .rpm distributions.

> About the service, it still misses some documentation for the manual.

Yep, I still need to take the time to check how to do it.

> And 'tests' would also be very welcome. :-)
> Note that gnu/tests/ldap.scm already some tests.  Maybe this file could 
> be
> updated with the new service.

 From what I see, what is already present gnu/tests/ldap.scm should be 
sufficient.

---
Cordialement,
Jean-François GUILLAUME
Plateforme Bioinformatique BiRD

Tél. : +33 (0)2 28 08 00 57
www.pf-bird.univ-nantes.fr

Inserm UMR 1087/CNRS UMR 6291
IRS-UN - 8 quai Moncousu - BP 70721
44007 Nantes Cedex 1
  

Hello,

Damn, it’s been two years already since you submitted these OpenLDAP
patches. 😱

You probably had problems with the NSS plugins to get LDAP user/group
lookups working.  I have good news: <https://issues.guix.gnu.org/70992>
probably fixes that.

(Besides, we should finally schedule some time to finish the reviewing
effort of these patches that Simon started.)

Ludo’.
  

Hi,

On jeu., 16 mai 2024 at 23:08, Ludovic Courtès <ludovic.courtes@inria.fr> wrote:

> (Besides, we should finally schedule some time to finish the reviewing
> effort of these patches that Simon started.)

Sorry, I have never felt confident about the service part.  Yeah, it
definitively needs some love. :-)

Cheers,
simon
  

Hello,

> Damn, it’s been two years already since you submitted these OpenLDAP
> patches. 😱

Well, damn the time fly fast...

> You probably had problems with the NSS plugins to get LDAP user/group
> lookups working.  I have good news: <https://issues.guix.gnu.org/70992>
> probably fixes that.

We indeed had a problème with lookup, we did trace it back to the 
libnss-ldap not in the correct path. We are doing a quick and dirty fix 
for now using our rc-local service :
> mount -o remount,rw /gnu/store
> echo 'export LD_LIBRARY_PATH="/run/current-system/profile/lib"' >> 
> /run/current-system/profile/etc/profile
> echo " " >> /run/current-system/profile/etc/profile
> mount -o remount,ro /gnu/store

Theses services indeed need some love, especially on the config file 
part. At glicid we are building it by using split files :
> (define slapd-part-1a (call-with-input-file 
> "../common/conf/slapd-part-01-a.conf" get-string-all))
> (define openldap-modules-path (string-append "modulepath " (with-store 
> store (package-output store glicid:openldap)) "/libexec/openldap"))
> (define slapd-part-1b (call-with-input-file 
> "../common/conf/slapd-part-01-b.conf" get-string-all))
> (define slapd-part-serverid (call-with-input-file 
> "./conf/serverID.conf" get-string-all))
> (define slapd-part-2 (call-with-input-file 
> "../common/conf/slapd-part-02.conf" get-string-all))
> (define slapd-part-syncrepl (call-with-input-file 
> "./conf/syncrepl.conf" get-string-all))
> (define slapd-part-3 (call-with-input-file 
> "../common/conf/slapd-part-03.conf" get-string-all))
> (define slapd-conf-file (plain-file "slapd-merged.conf"
>                                     (string-append slapd-part-1a
>                                                    
> openldap-modules-path
>                                                    slapd-part-1b
>                                                    slapd-part-serverid
>                                                    slapd-part-2
>                                                    slapd-part-syncrepl
>                                                    slapd-part-3)))

But it definitively need some love to have a proper config file builder 
(way above my current guix/guile expertise).

---
Cordialement,
Jean-François GUILLAUME

Ingénieur Systèmes, Réseaux, Virtualisation
Plateforme Bioinformatique BiRD, GLiCID, Nantes Université, CHU Nantes, 
CNRS, Inserm, BioCore, US16, SFR Bonamy, F

tél : 02-28-08-00-57 (320057)
mail: Jean-Francois.Guillaume@univ-nantes.fr

Bâtiment 06, IRS UN - 8 quai Moncousu - BP 70721 - 44007 Nantes Cedex 1
https://www.pf-bird.univ-nantes.fr/
https://clam.glicid.fr/
https://www.univ-nantes.fr/
  

Hi Jean-Francois,

Jean-Francois GUILLAUME <Jean-Francois.Guillaume@univ-nantes.fr>
skribis:

>> You probably had problems with the NSS plugins to get LDAP user/group
>> lookups working.  I have good news: <https://issues.guix.gnu.org/70992>
>> probably fixes that.
>
> We indeed had a problème with lookup, we did trace it back to the
> libnss-ldap not in the correct path. We are doing a quick and dirty
> fix for now using our rc-local service :

Ah well, you’ll no longer need this hack.  :-)

> But it definitively need some love to have a proper config file
> builder (way above my current guix/guile expertise).

Yes, one of us should take a closer look.

Thanks,
Ludo’.