infrastructure/nixos/ldap/permissions.nix

{config, lib, ...}: let
  inherit (lib.modules) mkDefault;
  inherit (config.users) ldap;
  inherit (ldap.management) permissions;
in {
  config.users.ldap.management = {
    enable = mkDefault true;
    permissions = {
      "Custom Anonymous User Read" = {
        bindType = "anonymous";
        targetType = "user";
        attrs = [ "gidnumber" "homedirectory" "ipantsecurityidentifier" "loginshell" "manager" "objectclass" "title" "uid" "uidnumber" ];
      };
      "Custom Permission Admin" = {
        location = ldap.permissionDnSuffix;
        target = "cn=*";
        rights = "all";
        attrs = [
          "member" "cn" "o" "ou" "owner" "description" "objectclass" "seealso" "businesscategory"
          "ipapermtarget" "ipapermright" "ipapermincludedattr" "ipapermbindruletype" "ipapermexcludedattr" "ipapermtargetto" "ipapermissiontype" "ipapermlocation" "ipapermdefaultattr" "ipapermtargetfrom" "ipapermtargetfilter"
        ];
      };
      "Custom Privilege Admin" = {
        location = ldap.privilegeDnSuffix;
        target = "cn=*";
        rights = "all";
        attrs = [
          "member" "memberof" "cn" "o" "ou" "owner" "description" "objectclass" "seealso" "businesscategory"
        ];
      };
      "Custom Role Admin" = {
        location = ldap.roleDnSuffix;
        target = "cn=*";
        rights = "all";
        attrs = [
          "member" "memberof" "cn" "o" "ou" "owner" "description" "objectclass" "seealso" "businesscategory"
        ];
      };
      "Custom Role Modify" = {
        targetType = "role";
        rights = [ "write" "add" ];
        attrs = permissions."Custom Role Admin".attrs;
      };
      "Custom Host Permission" = {
        targetType = "host";
        rights = [ "write" ];
        attrs = [
          "memberof"
        ];
      };
      "Custom SysAccount Permission" = {
        targetType = "sysaccount";
        rights = "all";
        attrs = [
          "member" "memberof" "uid" "o" "ou" "description" "objectclass" "seealso" "businesscategory"
          "passwordExpirationTime" "nsIdleTimeout"
        ];
      };
      "Custom SysAccount Admin" = {
        location = ldap.sysAccountDnSuffix;
        target = "uid=*";
        rights = [ "add" "write" "delete" ];
        attrs = permissions."Custom SysAccount Permission".attrs ++ [
          "userPassword"
        ];
      };
      "Custom Service Permission" = {
        targetType = "service";
        rights = [ "write" ];
        attrs = [
          "memberof"
        ];
      };
    };
    privileges = {
      "Custom Management Admin" = {
        permissions = [
          "Custom Permission Admin"
          "Custom Privilege Admin"
          "Custom Role Admin"
          "Custom Role Modify"
          "Custom Host Permission"
          "Custom SysAccount Permission"
          "Custom SysAccount Admin"
          "Custom Service Permission"
        ];
      };
    };
    roles = {
      "Security Architect" = {
        privileges = [
          "Custom Management Admin"
          # you can't manage roles if you can't see them .-.
          "RBAC Readers"
        ];
        # allow reimu to actually make these changes...
        members = [
          "fqdn=reimu.${config.networking.domain},${ldap.hostDnSuffix}"
        ];
      };
    };
    sysAccounts = {
      peep = {
        passwordFile = config.sops.secrets.ldap-peep-password.path;
      };
      keycloak = {
        passwordFile = config.sops.secrets.ldap-keycloak-password.path;
      };
    };
    objects = {
      # change default public access
      "cn=System: Read User Compat Tree,${ldap.permissionDnSuffix}" = {
        settings.ipaPermBindRuleType = "all";
      };
      "cn=System: Read User Views Compat Tree,${ldap.permissionDnSuffix}" = {
        settings.ipaPermBindRuleType = "all";
      };
      "cn=System: Read User Standard Attributes,${ldap.permissionDnSuffix}" = {
        settings.ipaPermBindRuleType = "all";
      };
    };
  };
  config.sops.secrets = let
    sopsFile = mkDefault ../secrets/ldap.yaml;
  in {
    ldap-peep-password = {
      inherit sopsFile;
    };
    ldap-keycloak-password = {
      inherit sopsFile;
    };
  };
}