gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

kanidm_1_7: init at 1.7.1 (#430205)

Browse Source
This commit is contained in:
Adam C. Stephens
2025-08-06 14:54:56 -04:00
committed by GitHub
parent b8d3005ad8 48aeb444ad
commit da4f70e2ad
16 changed files with 376 additions and 72 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/modules/services/security/kanidm.nix
+2
View File
@@ -671,6 +671,8 @@ in
};
config = mkIf (cfg.enableClient || cfg.enableServer || cfg.enablePam) {
warnings = lib.optionals (cfg.package.eolMessage != "") [ cfg.package.eolMessage ];
assertions =
let
entityList =
nixos/tests/all-tests.nix
+12 -2
View File
@@ -772,8 +772,18 @@ in
k3s = handleTest ./k3s { };
kafka = handleTest ./kafka { };
kanboard = runTest ./web-apps/kanboard.nix;
kanidm = runTest ./kanidm.nix;
kanidm-provisioning = runTest ./kanidm-provisioning.nix;
kanidm =
kanidmVersion:
runTest {
imports = [ ./kanidm.nix ];
_module.args = { inherit kanidmVersion; };
};
kanidm-provisioning =
kanidmVersion:
runTest {
imports = [ ./kanidm-provisioning.nix ];
_module.args = { inherit kanidmVersion; };
};
karma = runTest ./karma.nix;
kavita = runTest ./kavita.nix;
kbd-setfont-decompress = runTest ./kbd-setfont-decompress.nix;
nixos/tests/kanidm-provisioning.nix
+9 -7
View File
@@ -1,4 +1,4 @@
{ pkgs, ... }:
{ kanidmVersion, pkgs, ... }:
let
certs = import ./common/acme/server/snakeoil-certs.nix;
serverDomain = certs.domain;
@@ -13,6 +13,8 @@ let
provisionAdminPassword = "very-strong-password-for-admin";
provisionIdmAdminPassword = "very-strong-password-for-idm-admin";
provisionIdmAdminPassword2 = "very-strong-alternative-password-for-idm-admin";
kanidmPackage = pkgs."kanidmWithSecretProvisioning_${kanidmVersion}";
in
{
name = "kanidm-provisioning";
@@ -22,7 +24,7 @@ in
{ pkgs, lib, ... }:
{
services.kanidm = {
package = pkgs.kanidmWithSecretProvisioning_1_6;
package = kanidmPackage;
enableServer = true;
serverSettings = {
origin = "https://${serverDomain}";
@@ -273,11 +275,11 @@ in
users.users.kanidm.shell = pkgs.bashInteractive;
environment.systemPackages = with pkgs; [
kanidm
openldap
ripgrep
jq
environment.systemPackages = [
kanidmPackage
pkgs.openldap
pkgs.ripgrep
pkgs.jq
];
};
nixos/tests/kanidm.nix
+9 -7
View File
@@ -1,4 +1,4 @@
{ pkgs, ... }:
{ kanidmVersion, pkgs, ... }:
let
certs = import ./common/acme/server/snakeoil-certs.nix;
serverDomain = certs.domain;
@@ -13,6 +13,8 @@ let
cp ${certs."${serverDomain}".cert} $out/snakeoil.crt
cp ${certs."${serverDomain}".key} $out/snakeoil.key
'';
kanidmPackage = pkgs."kanidm_${kanidmVersion}";
in
{
name = "kanidm";
@@ -25,7 +27,7 @@ in
{ pkgs, ... }:
{
services.kanidm = {
package = pkgs.kanidm_1_6;
package = kanidmPackage;
enableServer = true;
serverSettings = {
origin = "https://${serverDomain}";
@@ -44,10 +46,10 @@ in
users.users.kanidm.shell = pkgs.bashInteractive;
environment.systemPackages = with pkgs; [
kanidm
openldap
ripgrep
environment.systemPackages = [
kanidmPackage
pkgs.openldap
pkgs.ripgrep
];
};
@@ -55,7 +57,7 @@ in
{ nodes, ... }:
{
services.kanidm = {
package = pkgs.kanidm_1_6;
package = kanidmPackage;
enableClient = true;
clientSettings = {
uri = "https://${serverDomain}";
pkgs/by-name/ka/kanidm/1_5.nix
-1
View File
@@ -2,6 +2,5 @@ import ./generic.nix {
version = "1.5.0";
hash = "sha256-swrqyjA7Wgq17vd+753LDFcXrSFixVNLhTvj1bhG3DU=";
cargoHash = "sha256-72IwS8Nk1y6xDH9y8JW2LpbhFWaq0tpORx7JQSCF5/M=";
patchDir = ./patches/1_5;
unsupported = true;
}
pkgs/by-name/ka/kanidm/1_6.nix
+1 -1
View File
@@ -2,5 +2,5 @@ import ./generic.nix {
version = "1.6.4";
hash = "sha256-ui3w1HDHXHARsjQ3WtJfZbM7Xgg3ODnUneXJMQwaOMw=";
cargoHash = "sha256-KJGELBzScwsLd6g3GR9Vk0nfDU2EjZBfXwlXJ+bZb1k=";
patchDir = ./patches/1_6;
eolDate = "2025-09-01";
}
pkgs/by-name/ka/kanidm/1_7.nix
+5
View File
@@ -0,0 +1,5 @@
import ./generic.nix {
version = "1.7.1";
hash = "sha256-CG4s6fYxTM2I/kFjD905g8/DSFkyB+0pnGVXgyRXtlE=";
cargoHash = "sha256-9bE3hSCFBJF8f3Lm5SzEuDtEpJBbCBijUDfqGiPnRsc=";
}
pkgs/by-name/ka/kanidm/README.md
+1
View File
@@ -19,6 +19,7 @@ For example, when upgrading from 1.4 -> 1.5
1. `cp -r pkgs/by-name/ka/kanidm/patches/1_4 pkgs/by-name/ka/kanidm/patches/1_5`
1. Update `1_5.nix` hashes/paths, and as needed for upstream changes, `generic.nix`
1. Update `all-packages.nix` to add `kanidm_1_5` and `kanidmWithSecretProvisioning_1_5`, leave default
1. Update the previous release, e.g. `1_4.nix` and set `eolDate = "YYYY-MM-DD"` where the date is 30 days from release of 1.5.
1. Create commit, `kanidm_1_5: init at 1.5.0` - this is the only commit that will be backported
### Update default
pkgs/by-name/ka/kanidm/generic.nix
+51 -54
View File
@@ -2,9 +2,8 @@
version,
hash,
cargoHash,
patchDir,
extraMeta ? { },
unsupported ? false,
eolDate ? null,
}:
{
@@ -35,8 +34,24 @@
let
arch = if stdenv.hostPlatform.isx86_64 then "x86_64" else "generic";
versionUnderscored = builtins.replaceStrings [ "." ] [ "_" ] (
lib.versions.majorMinor kanidm.version
);
provisionPatches = [
(./. + "/provision-patches/${versionUnderscored}/oauth2-basic-secret-modify.patch")
(./. + "/provision-patches/${versionUnderscored}/recover-account.patch")
];
upgradeNote = ''
Please upgrade by verifying `kanidmd domain upgrade-check` and choosing the
next version with `services.kanidm.package = pkgs.kanidm_1_x;`
See upgrade guide at https://kanidm.github.io/kanidm/master/server_updates.html
'';
in
rustPlatform.buildRustPackage rec {
rustPlatform.buildRustPackage (finalAttrs: {
pname = "kanidm" + (lib.optionalString enableSecretProvisioning "-with-secret-provisioning");
inherit version cargoHash;
@@ -49,16 +64,13 @@ rustPlatform.buildRustPackage rec {
inherit hash;
};
KANIDM_BUILD_PROFILE = "release_nixpkgs_${arch}";
env.KANIDM_BUILD_PROFILE = "release_nixpkgs_${arch}";
patches = lib.optionals enableSecretProvisioning [
"${patchDir}/oauth2-basic-secret-modify.patch"
"${patchDir}/recover-account.patch"
];
patches = lib.optionals enableSecretProvisioning provisionPatches;
postPatch =
let
format = (formats.toml { }).generate "${KANIDM_BUILD_PROFILE}.toml";
format = (formats.toml { }).generate "${finalAttrs.env.KANIDM_BUILD_PROFILE}.toml";
socket_path = if stdenv.hostPlatform.isLinux then "/run/kanidmd/sock" else "/var/run/kanidm.socket";
profile = {
cpu_flags = if stdenv.hostPlatform.isx86_64 then "x86_64_legacy" else "none";
@@ -70,23 +82,11 @@ rustPlatform.buildRustPackage rec {
server_admin_bind_path = socket_path;
server_config_path = "/etc/kanidm/server.toml";
server_ui_pkg_path = "@htmx_ui_pkg_path@";
}
// lib.optionalAttrs (lib.versionOlder version "1.5") {
admin_bind_path = socket_path;
default_config_path = "/etc/kanidm/server.toml";
default_unix_shell_path = "${lib.getBin bashInteractive}/bin/bash";
htmx_ui_pkg_path = "@htmx_ui_pkg_path@";
}
// lib.optionalAttrs (lib.versions.majorMinor version == "1.3") {
web_ui_pkg_path = "@web_ui_pkg_path@";
};
in
''
cp ${format profile} libs/profiles/${KANIDM_BUILD_PROFILE}.toml
substituteInPlace libs/profiles/${KANIDM_BUILD_PROFILE}.toml --replace-fail '@htmx_ui_pkg_path@' "$out/ui/hpkg"
''
+ lib.optionalString (lib.versions.majorMinor version == "1.3") ''
substituteInPlace libs/profiles/${KANIDM_BUILD_PROFILE}.toml --replace-fail '@web_ui_pkg_path@' "$out/ui/pkg"
cp ${format profile} libs/profiles/${finalAttrs.env.KANIDM_BUILD_PROFILE}.toml
substituteInPlace libs/profiles/${finalAttrs.env.KANIDM_BUILD_PROFILE}.toml --replace-fail '@htmx_ui_pkg_path@' "$out/ui/hpkg"
'';
nativeBuildInputs = [
@@ -108,9 +108,6 @@ rustPlatform.buildRustPackage rec {
postBuild = ''
mkdir -p $out/ui
cp -r server/core/static $out/ui/hpkg
''
+ lib.optionalString (lib.versions.majorMinor version == "1.3") ''
cp -r server/web_ui/pkg $out/ui/pkg
'';
# Upstream runs with the Rust equivalent of -Werror,
@@ -139,48 +136,48 @@ rustPlatform.buildRustPackage rec {
passthru = {
tests = {
inherit (nixosTests) kanidm kanidm-provisioning;
kanidm = nixosTests.kanidm versionUnderscored;
kanidm-provisioning = nixosTests.kanidm-provisioning versionUnderscored;
};
updateScript = lib.optionals (!enableSecretProvisioning) (nix-update-script {
# avoid spurious releases and tags such as "debs"
extraArgs = [
"-vr"
"v([0-9\\.]*)"
"v(${lib.versions.major kanidm.version}\\.${lib.versions.minor kanidm.version}\\.[0-9]*)"
"--override-filename"
"pkgs/by-name/ka/kanidm/${
builtins.replaceStrings [ "." ] [ "_" ] (lib.versions.majorMinor kanidm.version)
}.nix"
"pkgs/by-name/ka/kanidm/${versionUnderscored}.nix"
];
});
inherit enableSecretProvisioning;
withSecretProvisioning = kanidm.override { enableSecretProvisioning = true; };
eolMessage = lib.optionalString (eolDate != null) ''
kanidm ${lib.versions.majorMinor version} is deprecated and will reach end-of-life on ${eolDate}
${upgradeNote}
'';
};
# can take over 4 hours on 2 cores and needs 16GB+ RAM
requiredSystemFeatures = [ "big-parallel" ];
meta =
with lib;
{
changelog = "https://github.com/kanidm/kanidm/releases/tag/v${version}";
description = "Simple, secure and fast identity management platform";
homepage = "https://github.com/kanidm/kanidm";
license = licenses.mpl20;
platforms = platforms.linux ++ platforms.darwin;
maintainers = with maintainers; [
adamcstephens
Flakebi
];
knownVulnerabilities = lib.optionals unsupported [
''
kanidm ${version} has reached EOL.
meta = {
changelog = "https://github.com/kanidm/kanidm/releases/tag/v${version}";
description = "Simple, secure and fast identity management platform";
homepage = "https://github.com/kanidm/kanidm";
license = lib.licenses.mpl20;
platforms = lib.platforms.linux ++ lib.platforms.darwin;
maintainers = with lib.maintainers; [
adamcstephens
Flakebi
];
knownVulnerabilities = lib.optionals unsupported [
''
kanidm ${lib.versions.majorMinor version} has reached end-of-life.
Please upgrade by verifying `kanidmd domain upgrade-check` and choosing the next version with `services.kanidm.package = pkgs.kanidm_1_x;`
See upgrade guide at https://kanidm.github.io/kanidm/master/server_updates.html
''
];
}
// extraMeta;
}
${upgradeNote}
''
];
};
})
pkgs/by-name/ka/kanidm/patches/1_5/oauth2-basic-secret-modify.patch → pkgs/by-name/ka/kanidm/provision-patches/1_5/oauth2-basic-secret-modify.patch
View File
pkgs/by-name/ka/kanidm/patches/1_5/recover-account.patch → pkgs/by-name/ka/kanidm/provision-patches/1_5/recover-account.patch
View File
pkgs/by-name/ka/kanidm/patches/1_6/oauth2-basic-secret-modify.patch → pkgs/by-name/ka/kanidm/provision-patches/1_6/oauth2-basic-secret-modify.patch
View File
pkgs/by-name/ka/kanidm/patches/1_6/recover-account.patch → pkgs/by-name/ka/kanidm/provision-patches/1_6/recover-account.patch
View File
pkgs/by-name/ka/kanidm/provision-patches/1_7/oauth2-basic-secret-modify.patch
+159
View File
@@ -0,0 +1,159 @@
From fc26fe5ac9e9cd65af82609c5a4966c8f756ea0f Mon Sep 17 00:00:00 2001
From: oddlama <oddlama@oddlama.org>
Date: Fri, 21 Mar 2025 16:07:54 +0100
Subject: [PATCH 1/2] oauth2 basic secret modify
---
server/core/src/actors/v1_write.rs | 42 +++++++++++++++++++++++++++++
server/core/src/https/v1.rs | 6 ++++-
server/core/src/https/v1_oauth2.rs | 29 ++++++++++++++++++++
server/lib/src/server/migrations.rs | 16 +++++++++++
4 files changed, 92 insertions(+), 1 deletion(-)
diff --git a/server/core/src/actors/v1_write.rs b/server/core/src/actors/v1_write.rs
index 732e826c8..a2b8e503f 100644
--- a/server/core/src/actors/v1_write.rs
+++ b/server/core/src/actors/v1_write.rs
@@ -324,6 +324,48 @@ impl QueryServerWriteV1 {
.and_then(|_| idms_prox_write.commit().map(|_| ()))
}
+ #[instrument(
+ level = "info",
+ skip_all,
+ fields(uuid = ?eventid)
+ )]
+ pub async fn handle_oauth2_basic_secret_write(
+ &self,
+ client_auth_info: ClientAuthInfo,
+ filter: Filter<FilterInvalid>,
+ new_secret: String,
+ eventid: Uuid,
+ ) -> Result<(), OperationError> {
+ // Given a protoEntry, turn this into a modification set.
+ let ct = duration_from_epoch_now();
+ let mut idms_prox_write = self.idms.proxy_write(ct).await?;
+ let ident = idms_prox_write
+ .validate_client_auth_info_to_ident(client_auth_info, ct)
+ .map_err(|e| {
+ admin_error!(err = ?e, "Invalid identity");
+ e
+ })?;
+
+ let modlist = ModifyList::new_purge_and_set(
+ Attribute::OAuth2RsBasicSecret,
+ Value::SecretValue(new_secret),
+ );
+
+ let mdf =
+ ModifyEvent::from_internal_parts(ident, &modlist, &filter, &idms_prox_write.qs_write)
+ .map_err(|e| {
+ admin_error!(err = ?e, "Failed to begin modify during handle_oauth2_basic_secret_write");
+ e
+ })?;
+
+ trace!(?mdf, "Begin modify event");
+
+ idms_prox_write
+ .qs_write
+ .modify(&mdf)
+ .and_then(|_| idms_prox_write.commit())
+ }
+
#[instrument(
level = "info",
skip_all,
diff --git a/server/core/src/https/v1.rs b/server/core/src/https/v1.rs
index 30de387b8..a11aa8ecd 100644
--- a/server/core/src/https/v1.rs
+++ b/server/core/src/https/v1.rs
@@ -4,7 +4,7 @@ use axum::extract::{Path, State};
use axum::http::{HeaderMap, HeaderValue};
use axum::middleware::from_fn;
use axum::response::{IntoResponse, Response};
-use axum::routing::{delete, get, post, put};
+use axum::routing::{delete, get, post, put, patch};
use axum::{Extension, Json, Router};
use axum_extra::extract::cookie::{Cookie, CookieJar, SameSite};
use compact_jwt::{Jwk, Jws, JwsSigner};
@@ -3129,6 +3129,10 @@ pub(crate) fn route_setup(state: ServerState) -> Router<ServerState> {
"/v1/oauth2/:rs_name/_basic_secret",
get(super::v1_oauth2::oauth2_id_get_basic_secret),
)
+ .route(
+ "/v1/oauth2/:rs_name/_basic_secret",
+ patch(super::v1_oauth2::oauth2_id_patch_basic_secret),
+ )
.route(
"/v1/oauth2/:rs_name/_scopemap/:group",
post(super::v1_oauth2::oauth2_id_scopemap_post)
diff --git a/server/core/src/https/v1_oauth2.rs b/server/core/src/https/v1_oauth2.rs
index f399539bc..ffad9921e 100644
--- a/server/core/src/https/v1_oauth2.rs
+++ b/server/core/src/https/v1_oauth2.rs
@@ -151,6 +151,35 @@ pub(crate) async fn oauth2_id_get_basic_secret(
.map_err(WebError::from)
}
+#[utoipa::path(
+ patch,
+ path = "/v1/oauth2/{rs_name}/_basic_secret",
+ request_body=ProtoEntry,
+ responses(
+ DefaultApiResponse,
+ ),
+ security(("token_jwt" = [])),
+ tag = "v1/oauth2",
+ operation_id = "oauth2_id_patch_basic_secret"
+)]
+/// Overwrite the basic secret for a given OAuth2 Resource Server.
+#[instrument(level = "info", skip(state, new_secret))]
+pub(crate) async fn oauth2_id_patch_basic_secret(
+ State(state): State<ServerState>,
+ Extension(kopid): Extension<KOpId>,
+ VerifiedClientInformation(client_auth_info): VerifiedClientInformation,
+ Path(rs_name): Path<String>,
+ Json(new_secret): Json<String>,
+) -> Result<Json<()>, WebError> {
+ let filter = oauth2_id(&rs_name);
+ state
+ .qe_w_ref
+ .handle_oauth2_basic_secret_write(client_auth_info, filter, new_secret, kopid.eventid)
+ .await
+ .map(Json::from)
+ .map_err(WebError::from)
+}
+
#[utoipa::path(
patch,
path = "/v1/oauth2/{rs_name}",
diff --git a/server/lib/src/server/migrations.rs b/server/lib/src/server/migrations.rs
index fd0bca8db..8621714f2 100644
--- a/server/lib/src/server/migrations.rs
+++ b/server/lib/src/server/migrations.rs
@@ -171,6 +171,22 @@ impl QueryServer {
reload_required = true;
};
+ // secret provisioning: allow idm_admin to modify OAuth2RsBasicSecret.
+ write_txn.internal_modify_uuid(
+ UUID_IDM_ACP_OAUTH2_MANAGE_V1,
+ &ModifyList::new_append(
+ Attribute::AcpCreateAttr,
+ Attribute::OAuth2RsBasicSecret.into(),
+ ),
+ )?;
+ write_txn.internal_modify_uuid(
+ UUID_IDM_ACP_OAUTH2_MANAGE_V1,
+ &ModifyList::new_append(
+ Attribute::AcpModifyPresentAttr,
+ Attribute::OAuth2RsBasicSecret.into(),
+ ),
+ )?;
+
// Execute whatever operations we have batched up and ready to go. This is needed
// to preserve ordering of the operations - if we reloaded after a remigrate then
// we would have skipped the patch level fix which needs to have occurred *first*.
--
2.49.0
pkgs/by-name/ka/kanidm/provision-patches/1_7/recover-account.patch
+122
View File
@@ -0,0 +1,122 @@
From 229165abe5be596fc2be8e285884813a1b5a38c8 Mon Sep 17 00:00:00 2001
From: oddlama <oddlama@oddlama.org>
Date: Fri, 21 Mar 2025 16:08:15 +0100
Subject: [PATCH 2/2] recover account
---
server/core/src/actors/internal.rs | 5 +++--
server/core/src/admin.rs | 6 +++---
server/daemon/src/main.rs | 23 ++++++++++++++++++++++-
server/daemon/src/opt.rs | 7 +++++++
4 files changed, 35 insertions(+), 6 deletions(-)
diff --git a/server/core/src/actors/internal.rs b/server/core/src/actors/internal.rs
index 420e72c6c..e252bca51 100644
--- a/server/core/src/actors/internal.rs
+++ b/server/core/src/actors/internal.rs
@@ -172,17 +172,18 @@ impl QueryServerWriteV1 {
#[instrument(
level = "info",
- skip(self, eventid),
+ skip(self, password, eventid),
fields(uuid = ?eventid)
)]
pub(crate) async fn handle_admin_recover_account(
&self,
name: String,
+ password: Option<String>,
eventid: Uuid,
) -> Result<String, OperationError> {
let ct = duration_from_epoch_now();
let mut idms_prox_write = self.idms.proxy_write(ct).await?;
- let pw = idms_prox_write.recover_account(name.as_str(), None)?;
+ let pw = idms_prox_write.recover_account(name.as_str(), password.as_deref())?;
idms_prox_write.commit().map(|()| pw)
}
diff --git a/server/core/src/admin.rs b/server/core/src/admin.rs
index 90ccb1927..85e31ddef 100644
--- a/server/core/src/admin.rs
+++ b/server/core/src/admin.rs
@@ -24,7 +24,7 @@ pub use kanidm_proto::internal::{
#[derive(Serialize, Deserialize, Debug)]
pub enum AdminTaskRequest {
- RecoverAccount { name: String },
+ RecoverAccount { name: String, password: Option<String> },
ShowReplicationCertificate,
RenewReplicationCertificate,
RefreshReplicationConsumer,
@@ -309,8 +309,8 @@ async fn handle_client(
let resp = async {
match req {
- AdminTaskRequest::RecoverAccount { name } => {
- match server_rw.handle_admin_recover_account(name, eventid).await {
+ AdminTaskRequest::RecoverAccount { name, password } => {
+ match server_rw.handle_admin_recover_account(name, password, eventid).await {
Ok(password) => AdminTaskResponse::RecoverAccount { password },
Err(e) => {
error!(err = ?e, "error during recover-account");
diff --git a/server/daemon/src/main.rs b/server/daemon/src/main.rs
index c3b40faa0..2a57a307c 100644
--- a/server/daemon/src/main.rs
+++ b/server/daemon/src/main.rs
@@ -923,13 +923,34 @@ async fn kanidm_main(config: Configuration, opt: KanidmdParser) -> ExitCode {
.await;
}
}
- KanidmdOpt::RecoverAccount { name, commonopts } => {
+ KanidmdOpt::RecoverAccount { name, from_environment, commonopts } => {
info!("Running account recovery ...");
let output_mode: ConsoleOutputMode = commonopts.output_mode.to_owned().into();
+ let password = if *from_environment {
+ match std::env::var("KANIDM_RECOVER_ACCOUNT_PASSWORD_FILE") {
+ Ok(path) => match tokio::fs::read_to_string(&path).await {
+ Ok(contents) => Some(contents),
+ Err(e) => {
+ error!("Failed to read password file '{}': {}", path, e);
+ return ExitCode::FAILURE;
+ }
+ },
+ Err(_) => match std::env::var("KANIDM_RECOVER_ACCOUNT_PASSWORD") {
+ Ok(val) => Some(val),
+ Err(_) => {
+ error!("Neither KANIDM_RECOVER_ACCOUNT_PASSWORD_FILE nor KANIDM_RECOVER_ACCOUNT_PASSWORD was set");
+ return ExitCode::FAILURE;
+ }
+ }
+ }
+ } else {
+ None
+ };
submit_admin_req(
config.adminbindpath.as_str(),
AdminTaskRequest::RecoverAccount {
name: name.to_owned(),
+ password,
},
output_mode,
)
diff --git a/server/daemon/src/opt.rs b/server/daemon/src/opt.rs
index f1b45a5b3..ca19fb6a5 100644
--- a/server/daemon/src/opt.rs
+++ b/server/daemon/src/opt.rs
@@ -236,6 +236,13 @@ enum KanidmdOpt {
#[clap(value_parser)]
/// The account name to recover credentials for.
name: String,
+ /// Use a password given via an environment variable.
+ /// - `KANIDM_RECOVER_ACCOUNT_PASSWORD_FILE` takes precedence and reads the desired
+ /// password from the given file
+ /// - `KANIDM_RECOVER_ACCOUNT_PASSWORD` directly takes a
+ /// password - beware that this will leave the password in the environment
+ #[clap(long = "from-environment")]
+ from_environment: bool,
#[clap(flatten)]
commonopts: CommonOpt,
},
--
2.49.0
pkgs/top-level/all-packages.nix
+5
View File
@@ -10136,6 +10136,7 @@ with pkgs;
kanidm_1_5 = callPackage ../by-name/ka/kanidm/1_5.nix { kanidm = kanidm_1_5; };
kanidm_1_6 = callPackage ../by-name/ka/kanidm/1_6.nix { kanidm = kanidm_1_6; };
kanidm_1_7 = callPackage ../by-name/ka/kanidm/1_7.nix { kanidm = kanidm_1_7; };
kanidmWithSecretProvisioning = kanidmWithSecretProvisioning_1_6;
@@ -10147,6 +10148,10 @@ with pkgs;
enableSecretProvisioning = true;
};
kanidmWithSecretProvisioning_1_7 = callPackage ../by-name/ka/kanidm/1_7.nix {
enableSecretProvisioning = true;
};
knot-resolver = callPackage ../servers/dns/knot-resolver {
systemd = systemdMinimal; # in closure already anyway
};