modules/base_installation/manifests/ldap.pp

   1 class base_installation::ldap inherits base_installation {
   2   ensure_packages(["openldap"])
   3
   4   File {
   5     mode  => "0644",
   6     owner => "root",
   7     group => "root",
   8   }
   9
  10   file { '/etc/openldap':
  11     ensure  => directory,
  12     require => Package["openldap"],
  13     recurse => true,
  14     purge   => true,
  15     force   => true,
  16   }
  17
  18   file { '/etc/openldap/ldap.conf':
  19     ensure  => present,
  20     content => template("base_installation/ldap/ldap.conf.erb"),
  21     require => File['/etc/openldap'],
  22   }
  23
  24   $password_seed  = lookup("base_installation::puppet_pass_seed")
  25   $ldap_server    = lookup("base_installation::ldap_server")
  26   $ldap_base      = lookup("base_installation::ldap_base")
  27   $ldap_dn        = lookup("base_installation::ldap_dn")
  28   $ldap_password  = generate_password(24, $password_seed, "ldap")
  29   $ldap_attribute = "uid"
  30
  31   ensure_packages(["pam_ldap"])
  32   file { "/etc/pam_ldap.conf":
  33     ensure  => "present",
  34     mode    => "0400",
  35     owner   => "root",
  36     group   => "root",
  37     content => template("base_installation/ldap/pam_ldap.conf.erb"),
  38   }
  39
  40   ["system-auth", "passwd"].each |$service| {
  41     pam { "Allow to change ldap password via $service":
  42       ensure    => present,
  43       service   => $service,
  44       type      => "password",
  45       control   => "[success=done new_authtok_reqd=ok ignore=ignore default=bad]",
  46       module    => "pam_ldap.so",
  47       arguments => "ignore_unknown_user",
  48       position  => 'before *[type="password" and module="pam_unix.so"]',
  49     }
  50   }
  51
  52   ["system-auth", "su", "su-l"].each |$service| {
  53     ["auth", "account"].each |$type| {
  54       pam { "Allow $service to $type with ldap password":
  55         ensure    => present,
  56         service   => $service,
  57         type      => $type,
  58         control   => "[success=done new_authtok_reqd=ok ignore=ignore default=bad]",
  59         module    => "pam_ldap.so",
  60         arguments => "ignore_unknown_user",
  61         position  => "before *[type=\"$type\" and module=\"pam_unix.so\"]",
  62       }
  63     }
  64   }
  65 }