NixOS/nixos — pull request #33 by rickynils (2012-09-27 07:47:36+00:00)
Title: Nslcd

This adds the option users.ldap.daemon which, if set to true, handles NSS and PAM requests by talking to the nslcd daemon (http://arthurdejong.org/nss-pam-ldapd/) instead of directly to the LDAP server. This can improve performance and security, since only nslcd needs to have access to LDAP, not every user of NSS/PAM.

This commit also cleans up modules/config/nsswitch.nix a bit (removing LDAP specific parts from it), but the PAM stuff still needs to get its LDAP stuff ripped out (this commit does at least not add anything to it, it just uses another PAM module if the daemon option is specified).

I have tested this on a couple of machines and it works great, but it could need more testing on a broader range of environments. However, if the daemon isn't activated, this shouldn't mess up things too much.