1 class base_installation::ldap inherits base_installation {
2 ensure_packages(["openldap"])
10 file { '/etc/openldap':
12 require => Package["openldap"],
18 file { '/etc/openldap/ldap.conf':
20 content => template("base_installation/ldap/ldap.conf.erb"),
21 require => File['/etc/openldap'],
24 $password_seed = lookup("base_installation::puppet_pass_seed")
25 unless empty(find_file($password_seed)) {
26 $ldap_server = lookup("base_installation::ldap_server")
27 $ldap_base = lookup("base_installation::ldap_base")
28 $ldap_dn = lookup("base_installation::ldap_dn")
29 $ldap_password = generate_password(24, $password_seed, "ldap")
30 $ldap_attribute = "uid"
32 ensure_packages(["pam_ldap", "ruby-augeas"])
33 file { "/etc/pam_ldap.conf":
38 content => template("base_installation/ldap/pam_ldap.conf.erb"),
41 ["system-auth", "passwd"].each |$service| {
42 pam { "Allow to change ldap password via $service":
46 control => "[success=done new_authtok_reqd=ok authinfo_unavail=ignore ignore=ignore default=bad]",
47 module => "pam_ldap.so",
48 arguments => ["ignore_unknown_user", "ignore_authinfo_unavail"],
49 position => 'before *[type="password" and module="pam_unix.so"]',
50 require => Package["ruby-augeas"],
54 ["system-auth", "su", "su-l"].each |$service| {
55 ["auth", "account"].each |$type| {
56 pam { "Allow $service to $type with ldap password":
60 control => "[success=done new_authtok_reqd=ok authinfo_unavail=ignore ignore=ignore default=bad]",
61 module => "pam_ldap.so",
62 arguments => ["ignore_unknown_user", "ignore_authinfo_unavail"],
63 position => "before *[type=\"$type\" and module=\"pam_unix.so\"]",
64 require => Package["ruby-augeas"],