5 files changed, 54 insertions, 0 deletions

diff --git a/.gitmodules b/.gitmodules
index d68cf4e..f8ff2b7 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -67,3 +67,9 @@
 [submodule "external_modules/patch"]
         path = external_modules/patch
         url = git://git.immae.eu/github/tohuwabohu/puppet-patch.git
+[submodule "external_modules/augeasproviders_pam"]
+        path = external_modules/augeasproviders_pam
+        url = git://git.immae.eu/github/hercules-team/augeasproviders_pam.git
+[submodule "external_modules/augeasproviders_core"]
+        path = external_modules/augeasproviders_core
+        url = git://git.immae.eu/github/hercules-team/augeasproviders_core.git
diff --git a/external_modules/augeasproviders_core b/external_modules/augeasproviders_core
new file mode 160000
+Subproject 604680cb5fe7e32fd1ad1051fc34ef100a4d692
diff --git a/external_modules/augeasproviders_pam b/external_modules/augeasproviders_pam
new file mode 160000
+Subproject e20796872f094c56a201519bab7716f099c7881
diff --git a/modules/base_installation/manifests/ldap.pp b/modules/base_installation/manifests/ldap.pp
index 1825700..acc0014 100644
--- a/modules/base_installation/manifests/ldap.pp
+++ b/modules/base_installation/manifests/ldap.pp
@@ -21,4 +21,45 @@ class base_installation::ldap inherits base_installation {
     require => File['/etc/openldap'],
   }
 
+  $password_seed  = lookup("base_installation::puppet_pass_seed")
+  $ldap_server    = lookup("base_installation::ldap_server")
+  $ldap_base      = lookup("base_installation::ldap_base")
+  $ldap_dn        = lookup("base_installation::ldap_dn")
+  $ldap_password  = generate_password(24, $password_seed, "ldap")
+  $ldap_attribute = "uid"
+
+  ensure_packages(["pam_ldap"])
+  file { "/etc/pam_ldap.conf":
+    ensure  => "present",
+    mode    => "0400",
+    owner   => "root",
+    group   => "root",
+    content => template("base_installation/ldap/pam_ldap.conf.erb"),
+  }
+
+  ["system-auth", "passwd"].each |$service| {
+    pam { "Allow to change ldap password via $service":
+      ensure    => present,
+      service   => $service,
+      type      => "password",
+      control   => "[success=done new_authtok_reqd=ok ignore=ignore default=bad]",
+      module    => "pam_ldap.so",
+      arguments => "ignore_unknown_user",
+      position  => 'before *[type="password" and module="pam_unix.so"]',
+    }
+  }
+
+  ["system-auth", "su", "su-l"].each |$service| {
+    ["auth", "account"].each |$type| {
+      pam { "Allow $service to $type with ldap password":
+        ensure    => present,
+        service   => $service,
+        type      => $type,
+        control   => "[success=done new_authtok_reqd=ok ignore=ignore default=bad]",
+        module    => "pam_ldap.so",
+        arguments => "ignore_unknown_user",
+        position  => "before *[type=\"$type\" and module=\"pam_unix.so\"]",
+      }
+    }
+  }
 }
diff --git a/modules/base_installation/templates/ldap/pam_ldap.conf.erb b/modules/base_installation/templates/ldap/pam_ldap.conf.erb
new file mode 100644
index 0000000..f07490a
--- /dev/null
+++ b/modules/base_installation/templates/ldap/pam_ldap.conf.erb
@@ -0,0 +1,7 @@
+host <%= @ldap_server %>
+
+base <%= @ldap_base %>
+binddn <%= @ldap_dn %>
+bindpw <%= @ldap_password %>
+pam_login_attribute <%= @ldap_attribute %>
+