+++ /dev/null
-#
-# Implements ldap configuration for keystone.
-#
-# == Dependencies
-# == Examples
-# == Authors
-#
-# Dan Bode dan@puppetlabs.com
-# Matt Fischer matt.fischer@twcable.com
-#
-# == Copyright
-#
-# Copyright 2012 Puppetlabs Inc, unless otherwise noted.
-#
-class keystone::ldap(
- $url = undef,
- $user = undef,
- $password = undef,
- $suffix = undef,
- $query_scope = undef,
- $page_size = undef,
- $user_tree_dn = undef,
- $user_filter = undef,
- $user_objectclass = undef,
- $user_id_attribute = undef,
- $user_name_attribute = undef,
- $user_mail_attribute = undef,
- $user_enabled_attribute = undef,
- $user_enabled_mask = undef,
- $user_enabled_default = undef,
- $user_enabled_invert = undef,
- $user_attribute_ignore = undef,
- $user_default_project_id_attribute = undef,
- $user_allow_create = undef,
- $user_allow_update = undef,
- $user_allow_delete = undef,
- $user_pass_attribute = undef,
- $user_enabled_emulation = undef,
- $user_enabled_emulation_dn = undef,
- $user_additional_attribute_mapping = undef,
- $tenant_tree_dn = undef, #DEPRECATED
- $project_tree_dn = undef,
- $tenant_filter = undef, #DEPRECATED
- $project_filter = undef,
- $tenant_objectclass = undef, #DEPRECATED
- $project_objectclass = undef,
- $tenant_id_attribute = undef, #DEPRECATED
- $project_id_attribute = undef,
- $tenant_member_attribute = undef, #DEPRECATED
- $project_member_attribute = undef,
- $tenant_desc_attribute = undef, #DEPRECATED
- $project_desc_attribute = undef,
- $tenant_name_attribute = undef, #DEPRECATED
- $project_name_attribute = undef,
- $tenant_enabled_attribute = undef, #DEPRECATED
- $project_enabled_attribute = undef,
- $tenant_domain_id_attribute = undef, #DEPRECATED
- $project_domain_id_attribute = undef,
- $tenant_attribute_ignore = undef, #DEPRECATED
- $project_attribute_ignore = undef,
- $tenant_allow_create = undef, #DEPRECATED
- $project_allow_create = undef,
- $tenant_allow_update = undef, #DEPRECATED
- $project_allow_update = undef,
- $tenant_allow_delete = undef, #DEPRECATED
- $project_allow_delete = undef,
- $tenant_enabled_emulation = undef, #DEPRECATED
- $project_enabled_emulation = undef,
- $tenant_enabled_emulation_dn = undef, #DEPRECATED
- $project_enabled_emulation_dn = undef,
- $tenant_additional_attribute_mapping = undef, #DEPRECATED
- $project_additional_attribute_mapping= undef,
- $role_tree_dn = undef,
- $role_filter = undef,
- $role_objectclass = undef,
- $role_id_attribute = undef,
- $role_name_attribute = undef,
- $role_member_attribute = undef,
- $role_attribute_ignore = undef,
- $role_allow_create = undef,
- $role_allow_update = undef,
- $role_allow_delete = undef,
- $role_additional_attribute_mapping = undef,
- $group_tree_dn = undef,
- $group_filter = undef,
- $group_objectclass = undef,
- $group_id_attribute = undef,
- $group_name_attribute = undef,
- $group_member_attribute = undef,
- $group_desc_attribute = undef,
- $group_attribute_ignore = undef,
- $group_allow_create = undef,
- $group_allow_update = undef,
- $group_allow_delete = undef,
- $group_additional_attribute_mapping = undef,
- $use_tls = undef,
- $tls_cacertdir = undef,
- $tls_cacertfile = undef,
- $tls_req_cert = undef,
- $identity_driver = undef,
- $assignment_driver = undef,
- $use_pool = false,
- $pool_size = 10,
- $pool_retry_max = 3,
- $pool_retry_delay = 0.1,
- $pool_connection_timeout = -1,
- $pool_connection_lifetime = 600,
- $use_auth_pool = false,
- $auth_pool_size = 100,
- $auth_pool_connection_lifetime = 60,
-) {
-
- # In Juno the term "tenant" was deprecated in the config in favor of "project"
- # Let's assume project_ is being used and warning otherwise. If both are set we will
- # fail, because having both set may cause unexpected results in Keystone.
- if ($tenant_tree_dn) {
- $project_tree_dn_real = $tenant_tree_dn
- warning ('tenant_tree_dn is deprecated in Juno. switch to project_tree_dn')
- if ($project_tree_dn) {
- fail ('tenant_tree_dn and project_tree_dn are both set. results may be unexpected')
- }
- }
- else {
- $project_tree_dn_real = $project_tree_dn
- }
-
- if ($tenant_filter) {
- $project_filter_real = $tenant_filter
- warning ('tenant_filter is deprecated in Juno. switch to project_filter')
- if ($project_filter) {
- fail ('tenant_filter and project_filter are both set. results may be unexpected')
- }
- }
- else {
- $project_filter_real = $project_filter
- }
-
- if ($tenant_objectclass) {
- $project_objectclass_real = $tenant_objectclass
- warning ('tenant_objectclass is deprecated in Juno. switch to project_objectclass')
- if ($project_objectclass) {
- fail ('tenant_objectclass and project_objectclass are both set. results may be unexpected')
- }
- }
- else {
- $project_objectclass_real = $project_objectclass
- }
-
- if ($tenant_id_attribute) {
- $project_id_attribute_real = $tenant_id_attribute
- warning ('tenant_id_attribute is deprecated in Juno. switch to project_id_attribute')
- if ($project_id_attribute) {
- fail ('tenant_id_attribute and project_id_attribute are both set. results may be unexpected')
- }
- }
- else {
- $project_id_attribute_real = $project_id_attribute
- }
-
- if ($tenant_member_attribute) {
- $project_member_attribute_real = $tenant_member_attribute
- warning ('tenant_member_attribute is deprecated in Juno. switch to project_member_attribute')
- if ($project_member_attribute) {
- fail ('tenant_member_attribute and project_member_attribute are both set. results may be unexpected')
- }
- }
- else {
- $project_member_attribute_real = $project_member_attribute
- }
-
- if ($tenant_desc_attribute) {
- $project_desc_attribute_real = $tenant_desc_attribute
- warning ('tenant_desc_attribute is deprecated in Juno. switch to project_desc_attribute')
- if ($project_desc_attribute) {
- fail ('tenant_desc_attribute and project_desc_attribute are both set. results may be unexpected')
- }
- }
- else {
- $project_desc_attribute_real = $project_desc_attribute
- }
-
- if ($tenant_name_attribute) {
- $project_name_attribute_real = $tenant_name_attribute
- warning ('tenant_name_attribute is deprecated in Juno. switch to project_name_attribute')
- if ($project_name_attribute) {
- fail ('tenant_name_attribute and project_name_attribute are both set. results may be unexpected')
- }
- }
- else {
- $project_name_attribute_real = $project_name_attribute
- }
-
- if ($tenant_enabled_attribute) {
- $project_enabled_attribute_real = $tenant_enabled_attribute
- warning ('tenant_enabled_attribute is deprecated in Juno. switch to project_enabled_attribute')
- if ($project_enabled_attribute) {
- fail ('tenant_enabled_attribute and project_enabled_attribute are both set. results may be unexpected')
- }
- }
- else {
- $project_enabled_attribute_real = $project_enabled_attribute
- }
-
- if ($tenant_attribute_ignore) {
- $project_attribute_ignore_real = $tenant_attribute_ignore
- warning ('tenant_attribute_ignore is deprecated in Juno. switch to project_attribute_ignore')
- if ($project_attribute_ignore) {
- fail ('tenant_attribute_ignore and project_attribute_ignore are both set. results may be unexpected')
- }
- }
- else {
- $project_attribute_ignore_real = $project_attribute_ignore
- }
-
- if ($tenant_domain_id_attribute) {
- $project_domain_id_attribute_real = $tenant_domain_id_attribute
- warning ('tenant_domain_id_attribute is deprecated in Juno. switch to project_domain_id_attribute')
- if ($project_domain_id_attribute) {
- fail ('tenant_domain_id_attribute and project_domain_id_attribute are both set. results may be unexpected')
- }
- }
- else {
- $project_domain_id_attribute_real = $project_domain_id_attribute
- }
-
- if ($tenant_allow_create) {
- $project_allow_create_real = $tenant_allow_create
- warning ('tenant_allow_create is deprecated in Juno. switch to project_allow_create')
- if ($project_allow_create) {
- fail ('tenant_allow_create and project_allow_create are both set. results may be unexpected')
- }
- }
- else {
- $project_allow_create_real = $project_allow_create
- }
-
- if ($tenant_allow_update) {
- $project_allow_update_real = $tenant_allow_update
- warning ('tenant_allow_update is deprecated in Juno. switch to project_allow_update')
- if ($project_allow_update) {
- fail ('tenant_allow_update and project_allow_update are both set. results may be unexpected')
- }
- }
- else {
- $project_allow_update_real = $project_allow_update
- }
-
- if ($tenant_allow_delete) {
- $project_allow_delete_real = $tenant_allow_delete
- warning ('tenant_allow_delete is deprecated in Juno. switch to project_allow_delete')
- if ($project_allow_delete) {
- fail ('tenant_allow_delete and project_allow_delete are both set. results may be unexpected')
- }
- }
- else {
- $project_allow_delete_real = $project_allow_delete
- }
-
- if ($tenant_enabled_emulation) {
- $project_enabled_emulation_real = $tenant_enabled_emulation
- warning ('tenant_enabled_emulation is deprecated in Juno. switch to project_enabled_emulation')
- if ($project_enabled_emulation) {
- fail ('tenant_enabled_emulation and project_enabled_emulation are both set. results may be unexpected')
- }
- }
- else {
- $project_enabled_emulation_real = $project_enabled_emulation
- }
-
- if ($tenant_enabled_emulation_dn) {
- $project_enabled_emulation_dn_real = $tenant_enabled_emulation_dn
- warning ('tenant_enabled_emulation_dn is deprecated in Juno. switch to project_enabled_emulation_dn')
- if ($project_enabled_emulation_dn) {
- fail ('tenant_enabled_emulation_dn and project_enabled_emulation_dn are both set. results may be unexpected')
- }
- }
- else {
- $project_enabled_emulation_dn_real = $project_enabled_emulation_dn
- }
-
- if ($tenant_additional_attribute_mapping) {
- $project_additional_attribute_mapping_real = $tenant_additional_attribute_mapping
- warning ('tenant_additional_attribute_mapping is deprecated in Juno. switch to project_additional_attribute_mapping')
- if ($project_additional_attribute_mapping) {
- fail ('tenant_additional_attribute_mapping and project_additional_attribute_mapping are both set. results may be unexpected')
- }
- }
- else {
- $project_additional_attribute_mapping_real = $project_additional_attribute_mapping
- }
-
- $ldap_packages = ['python-ldap', 'python-ldappool']
- package { $ldap_packages:
- ensure => present,
- }
-
- # check for some common driver name mistakes
- if ($assignment_driver != undef) {
- if ! ($assignment_driver =~ /^keystone.assignment.backends.*Assignment$/) {
- fail('assigment driver should be of the form \'keystone.assignment.backends.*Assignment\'')
- }
- }
-
- if ($identity_driver != undef) {
- if ! ($identity_driver =~ /^keystone.identity.backends.*Identity$/) {
- fail('identity driver should be of the form \'keystone.identity.backends.*Identity\'')
- }
- }
-
- if ($tls_cacertdir != undef) {
- file { $tls_cacertdir:
- ensure => directory
- }
- }
-
- keystone_config {
- 'ldap/url': value => $url;
- 'ldap/user': value => $user;
- 'ldap/password': value => $password, secret => true;
- 'ldap/suffix': value => $suffix;
- 'ldap/query_scope': value => $query_scope;
- 'ldap/page_size': value => $page_size;
- 'ldap/user_tree_dn': value => $user_tree_dn;
- 'ldap/user_filter': value => $user_filter;
- 'ldap/user_objectclass': value => $user_objectclass;
- 'ldap/user_id_attribute': value => $user_id_attribute;
- 'ldap/user_name_attribute': value => $user_name_attribute;
- 'ldap/user_mail_attribute': value => $user_mail_attribute;
- 'ldap/user_enabled_attribute': value => $user_enabled_attribute;
- 'ldap/user_enabled_mask': value => $user_enabled_mask;
- 'ldap/user_enabled_default': value => $user_enabled_default;
- 'ldap/user_enabled_invert': value => $user_enabled_invert;
- 'ldap/user_attribute_ignore': value => $user_attribute_ignore;
- 'ldap/user_default_project_id_attribute': value => $user_default_project_id_attribute;
- 'ldap/user_allow_create': value => $user_allow_create;
- 'ldap/user_allow_update': value => $user_allow_update;
- 'ldap/user_allow_delete': value => $user_allow_delete;
- 'ldap/user_pass_attribute': value => $user_pass_attribute;
- 'ldap/user_enabled_emulation': value => $user_enabled_emulation;
- 'ldap/user_enabled_emulation_dn': value => $user_enabled_emulation_dn;
- 'ldap/user_additional_attribute_mapping': value => $user_additional_attribute_mapping;
- 'ldap/project_tree_dn': value => $project_tree_dn_real;
- 'ldap/project_filter': value => $project_filter_real;
- 'ldap/project_objectclass': value => $project_objectclass_real;
- 'ldap/project_id_attribute': value => $project_id_attribute_real;
- 'ldap/project_member_attribute': value => $project_member_attribute_real;
- 'ldap/project_desc_attribute': value => $project_desc_attribute_real;
- 'ldap/project_name_attribute': value => $project_name_attribute_real;
- 'ldap/project_enabled_attribute': value => $project_enabled_attribute_real;
- 'ldap/project_attribute_ignore': value => $project_attribute_ignore_real;
- 'ldap/project_domain_id_attribute': value => $project_domain_id_attribute_real;
- 'ldap/project_allow_create': value => $project_allow_create_real;
- 'ldap/project_allow_update': value => $project_allow_update_real;
- 'ldap/project_allow_delete': value => $project_allow_delete_real;
- 'ldap/project_enabled_emulation': value => $project_enabled_emulation_real;
- 'ldap/project_enabled_emulation_dn': value => $project_enabled_emulation_dn_real;
- 'ldap/project_additional_attribute_mapping': value => $project_additional_attribute_mapping_real;
- 'ldap/role_tree_dn': value => $role_tree_dn;
- 'ldap/role_filter': value => $role_filter;
- 'ldap/role_objectclass': value => $role_objectclass;
- 'ldap/role_id_attribute': value => $role_id_attribute;
- 'ldap/role_name_attribute': value => $role_name_attribute;
- 'ldap/role_member_attribute': value => $role_member_attribute;
- 'ldap/role_attribute_ignore': value => $role_attribute_ignore;
- 'ldap/role_allow_create': value => $role_allow_create;
- 'ldap/role_allow_update': value => $role_allow_update;
- 'ldap/role_allow_delete': value => $role_allow_delete;
- 'ldap/role_additional_attribute_mapping': value => $role_additional_attribute_mapping;
- 'ldap/group_tree_dn': value => $group_tree_dn;
- 'ldap/group_filter': value => $group_filter;
- 'ldap/group_objectclass': value => $group_objectclass;
- 'ldap/group_id_attribute': value => $group_id_attribute;
- 'ldap/group_name_attribute': value => $group_name_attribute;
- 'ldap/group_member_attribute': value => $group_member_attribute;
- 'ldap/group_desc_attribute': value => $group_desc_attribute;
- 'ldap/group_attribute_ignore': value => $group_attribute_ignore;
- 'ldap/group_allow_create': value => $group_allow_create;
- 'ldap/group_allow_update': value => $group_allow_update;
- 'ldap/group_allow_delete': value => $group_allow_delete;
- 'ldap/group_additional_attribute_mapping': value => $group_additional_attribute_mapping;
- 'ldap/use_tls': value => $use_tls;
- 'ldap/tls_cacertdir': value => $tls_cacertdir;
- 'ldap/tls_cacertfile': value => $tls_cacertfile;
- 'ldap/tls_req_cert': value => $tls_req_cert;
- 'ldap/use_pool': value => $use_pool;
- 'ldap/pool_size': value => $pool_size;
- 'ldap/pool_retry_max': value => $pool_retry_max;
- 'ldap/pool_retry_delay': value => $pool_retry_delay;
- 'ldap/pool_connection_timeout': value => $pool_connection_timeout;
- 'ldap/pool_connection_lifetime': value => $pool_connection_lifetime;
- 'ldap/use_auth_pool': value => $use_auth_pool;
- 'ldap/auth_pool_size': value => $auth_pool_size;
- 'ldap/auth_pool_connection_lifetime': value => $auth_pool_connection_lifetime;
- 'identity/driver': value => $identity_driver;
- 'assignment/driver': value => $assignment_driver;
- }
-}
projects / dsa-puppet.git / blobdiff