Skip to content

Use LDAP for user authentication, authorisation and related name resolution

Notifications You must be signed in to change notification settings

erwbgy/puppet-pamldap

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

30 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Unmaintained

I no longer use Puppet actively and this software has not been maintained for some time.

puppet-pamldap

Configure a system to use LDAP for user authentication, authorisation and related name resolution.

Currently only tested on Redhat-like systems.

Usage

Include the pamldap module in your puppet configuration:

include pamldap

and add required hiera configuration - for example:

pamldap::base_dn: 'dc=example,dc=com'
pamldap::uris: [ 'ldap://10.7.96.13', 'ldap://10.7.96.14' ]

It can also be used as a parameterised class - for example:

class { 'pamldap':
  base_dn => 'dc=example,dc=com',
  uris    => [ 'ldap://10.7.96.13', 'ldap://10.7.96.14' ],
}

Parameters

base_dn: LDAP base distinguished name used in user and group entries

uris: LDAP server connection details - a list of URIs in the format ldap:://[hostname]

Show user and group info from LDAP

Create userinfo and groupinfo aliases in ~/.bashrc:

$ vim ~/.bashrc
alias userinfo='perl -le "print join(qw(:),getpwnam(\$_)) foreach @ARGV"'
alias groupinfo='perl -le "print join(qw(:),getgrnam(\$_)) foreach @ARGV"'

Then you can query user and group information from LDAP that you would normally see in /etc/passwd and /etc/group:

$ groupinfo users
users:x:100:
$ userinfo kburdis fbloggs
kburdis:x:500:100:::Keith Burdis:/home/kburdis:/bin/bash
fbloggs:x:501:100:::Fred Bloggs:/home/kburdis:/bin/bash

When run as root you will see information from LDAP that would normally be in /etc/shadow:

# userinfo kburdis fbloggs
kburdis:$6$oniRviiF...:500:100:::Keith Burdis:/home/kburdis:/bin/bash
fbloggs:$7$OghzqIlp...:501:100:::Fred Bloggs:/home/fbloggs:/bin/bash
# groupinfo sysadmins users
sysadmins:x:514:kburdis
users:x:100:

Credits

Originally based on detailed documentation and setup by my colleague Neil McBennett. He did all the hard work, I just puppetised it.

Ubuntu support contributed by Markus Heberling (tisoft). I changed things though so if it doesn't work blame me.

About

Use LDAP for user authentication, authorisation and related name resolution

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published