From 55d5a4fb18176341839d77d25baa5fb950453197 Mon Sep 17 00:00:00 2001
From: Ari Gato <ar@is-a.cat>
Date: Sun, 15 Feb 2026 16:29:36 +0100
Subject: [PATCH] openldap: enable spasswd for sasl passthrough authentication

This change allows the use of sasl passthrough authentication in openldap,
specifically through `userPassword` attributes starting with `{SASL}` scheme.

This mechanism depends on cyrus_sasl, but the openldap package already has a
hard requirement on that.

See also:
https://www.openldap.org/doc/admin24/security.html#Pass-Through%20authentication
---
 pkgs/by-name/op/openldap/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/op/openldap/package.nix b/pkgs/by-name/op/openldap/package.nix
index c50d7b3bda3c..f049722dc550 100644
--- a/pkgs/by-name/op/openldap/package.nix
+++ b/pkgs/by-name/op/openldap/package.nix
@@ -77,6 +77,7 @@ stdenv.mkDerivation (finalAttrs: {
   configureFlags = [
     "--enable-crypt"
     "--enable-overlays"
+    "--enable-spasswd"
     (lib.enableFeature withModules "argon2")
     (lib.enableFeature withModules "modules")
   ]