Add a more complete list of parameters to freeradius::module::ldap (1610d8f6) · Commits · Projets publics / puppet-freeradius

manifests/module/ldap.pp

+60 −49

Changes for manifests/module/ldap.pp: 60 added lines, 49 removed lines.
Original line number	Diff line number	Diff line
		# Configure LDAP support for FreeRADIUS
		define freeradius::module::ldap (
		$identity,
		$password,
		$basedn,
		String $basedn,
		Enum['present','absent'] $ensure = 'present',
		$server = ['localhost'],
		$port = 389,
		$uses = 0,
		$idle = 60,
		$probes = 3,
		$interval = 3,
		$timeout = 10,
		$start = '${thread[pool].start_servers}',
		$min = '${thread[pool].min_spare_servers}',
		$max = '${thread[pool].max_servers}',
		$spare = '${thread[pool].max_spare_servers}',
		$ensure = 'present',
		$starttls = 'no',
		$cafile = undef,
		$certfile = undef,
		$keyfile = undef,
		$requirecert = 'allow',
		Integer $port = 389,
		Optional[String] $identity = undef,
		Optional[String] $password = undef,
		Optional[Freeradius::Sasl] $sasl = {},
		Optional[String] $valuepair_attribute = undef,
		Optional[Array[String]] $update = undef,
		Optional[Freeradius::Boolean] $edir = undef,
		Optional[Freeradius::Boolean] $edir_autz = undef,
		String $user_base_dn = "\${..base_dn}",
		String $user_filter = '(uid=%{%{Stripped-User-Name}:-%{User-Name}})',
		Optional[Freeradius::Sasl] $user_sasl = {},
		Optional[Freeradius::Scope] $user_scope = undef,
		Optional[String] $user_sort_by = undef,
		Optional[String] $user_access_attribute = undef,
		Optional[Freeradius::Boolean] $user_access_positive = undef,
		String $group_base_dn = "\${..base_dn}",
		String $group_filter = '(objectClass=posixGroup)',
		Optional[Freeradius::Scope] $group_scope = undef,
		Optional[String] $group_name_attribute = undef,
		Optional[String] $group_membership_filter = undef,
		String $group_membership_attribute = 'memberOf',
		Optional[Freeradius::Boolean] $group_cacheable_name = undef,
		Optional[Freeradius::Boolean] $group_cacheable_dn = undef,
		Optional[String] $group_cache_attribute = undef,
		Optional[String] $group_attribute = undef,
		Optional[String] $profile_filter = undef,
		Optional[String] $profile_default = undef,
		Optional[String] $profile_attribute = undef,
		String $client_base_dn = "\${..base_dn}",
		String $client_filter = '(objectClass=radiusClient)',
		Optional[Freeradius::Boolean] $client_scope = undef,
		Optional[Freeradius::Boolean] $read_clients = undef,
		Optional[Enum['never','searching','finding','always']] $dereference = undef,
		Freeradius::Boolean $chase_referrals = 'yes',
		Freeradius::Boolean $rebind = 'yes',
		Freeradius::Boolean $use_referral_credentials = 'no',
		Optional[Freeradius::Boolean] $session_tracking = undef,
		Integer $timeout = 10,
		Integer $timelimit = 3,
		Integer $idle = 60,
		Integer $probes = 3,
		Integer $interval = 3,
		String $ldap_debug = '0x0028',
		Freeradius::Boolean $starttls = 'no',
		Optional[String] $cafile = undef,
		Optional[String] $certfile = undef,
		Optional[String] $keyfile = undef,
		Optional[String] $random_file = undef,
		Enum['never','allow','demand','hard'] $requirecert = 'allow',
		Freeradius::Integer $start = '${thread[pool].start_servers}',
		Freeradius::Integer $min = '${thread[pool].min_spare_servers}',
		Freeradius::Integer $max = '${thread[pool].max_servers}',
		Freeradius::Integer $spare = '${thread[pool].max_spare_servers}',
		Integer $uses = 0,
		Integer $retry_delay = 30,
		Integer $lifetime = 0,
		Integer $idle_timeout = 60,
		Float $connect_timeout = 3.0,
		) {
		$fr_package = $::freeradius::params::fr_package
		$fr_service = $::freeradius::params::fr_service
		@@ -42,36 +83,6 @@ define freeradius::module::ldap (
		default => $serverarray,
		}

		# Fake booleans (FR uses yes/no instead of true/false)
		unless $starttls in ['yes', 'no'] {
		fail('$starttls must be yes or no')
		}

		# Validate multiple choice options
		unless $requirecert in ['never', 'allow', 'demand', 'hard'] {
		fail('$requirecert must be one of never, allow, demand, hard')
		}

		# Validate integers
		unless is_integer($port) {
		fail('$port must be an integer')
		}
		unless is_integer($uses) {
		fail('$uses must be an integer')
		}
		unless is_integer($idle) {
		fail('$idle must be an integer')
		}
		unless is_integer($probes) {
		fail('$probes must be an integer')
		}
		unless is_integer($interval) {
		fail('$interval must be an integer')
		}
		unless is_integer($timeout) {
		fail('$timeout must be an integer')
		}

		# Generate a module config, based on ldap.conf
		file { "${fr_modulepath}/${name}":
		ensure => $ensure,

templates/ldap.erb

+111 −17

Changes for templates/ldap.erb: 111 added lines, 17 removed lines.
Original line number	Diff line number	Diff line
		@@ -26,8 +26,12 @@ ldap <%= @name %> {

		# Administrator account for searching and possibly modifying.
		# If using SASL + KRB5 these should be commented out.
		<%- if @identity -%>
		identity = '<%= @identity %>'
		password = '<%= @password %>'
		<%- end -%>
		<%- if @password -%>
		password = <%= @password %>
		<%- end -%>

		# Unless overridden in another section, the dn from which all
		# searches will start from.
		@@ -56,12 +60,21 @@ ldap <%= @name %> {
		sasl {
		# SASL mechanism
		# mech = 'PLAIN'
		<%- if @sasl.has_key?('mech') -%>
		mech = '<%= @sasl['mech'] %>'
		<%- end -%>

		# SASL authorisation identity to proxy.
		# proxy = 'autz_id'
		<%- if @sasl.has_key?('proxy') -%>
		proxy = '<%= @sasl['proxy'] %>'
		<%- end -%>

		# SASL realm. Used for kerberos.
		# realm = 'example.org'
		<%- if @sasl.has_key?('realm') -%>
		realm = '<%= @sasl['realm'] %>'
		<%- end -%>
		}

		#
		@@ -82,6 +95,9 @@ ldap <%= @name %> {
		# If the value is wrapped in double quotes it
		# will be xlat expanded.
		# valuepair_attribute = 'radiusAttribute'
		<%- if @valuepair_attribute -%>
		valuepair_attribute = <%= @valuepair_attribute %>
		<%- end -%>

		#
		# Mapping of LDAP directory attributes to RADIUS dictionary attributes.
		@@ -110,6 +126,11 @@ ldap <%= @name %> {
		# Note: LDAP attribute names should be single quoted unless you want
		# the name to be derived from an xlat expansion, or an attribute ref.
		#
		<%- if @update -%>
		update {
		<%= @update.join("\n ") %>
		}
		<%- else -%>
		update {
		control:Password-With-Header += 'userPassword'
		# control:NT-Password := 'ntPassword'
		@@ -125,15 +146,22 @@ ldap <%= @name %> {
		request: += 'radiusRequestAttribute'
		reply: += 'radiusReplyAttribute'
		}
		<%- end -%>

		# Set to yes if you have eDirectory and want to use the universal
		# password mechanism.
		# edir = no
		<%- if @edir -%>
		edir = <%= @edir %>
		<%- end -%>

		# Set to yes if you want to bind as the user after retrieving the
		# Cleartext-Password. This will consume the login grace, and
		# verify user authorization.
		# edir_autz = no
		<%- if @edir_autz -%>
		edir_autz = <%= @edir_autz %>
		<%- end -%>

		# Note: set_auth_type was removed in v3.x.x
		# Equivalent functionality can be achieved by adding the following
		@@ -151,11 +179,11 @@ ldap <%= @name %> {
		#
		user {
		# Where to start searching in the tree for users
		base_dn = "${..base_dn}"
		base_dn = "<%= @user_base_dn %>"

		# Filter for user objects, should be specific enough
		# to identify a single user object.
		filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
		filter = "<%= @user_filter %>"

		# SASL parameters to use for user binds
		#
		@@ -169,16 +197,28 @@ ldap <%= @name %> {
		sasl {
		# SASL mechanism
		# mech = 'PLAIN'
		<%- if @user_sasl.has_key?('mech') -%>
		mech = '<%= @user_sasl['mech'] %>'
		<%- end -%>

		# SASL authorisation identity to proxy.
		# proxy = &User-Name
		<%- if @user_sasl.has_key?('proxy') -%>
		proxy = '<%= @user_sasl['proxy'] %>'
		<%- end -%>

		# SASL realm. Used for kerberos.
		# realm = 'example.org'
		<%- if @user_sasl.has_key?('realm') -%>
		realm = '<%= @user_sasl['realm'] %>'
		<%- end -%>
		}

		# Search scope, may be 'base', 'one', sub' or 'children'
		# scope = 'sub'
		<%- if @user_scope -%>
		scope = '<%= @user_scope %>'
		<%- end -%>

		# Server side result sorting
		#
		@@ -196,11 +236,17 @@ ldap <%= @name %> {
		# If a search returns multiple user objects and sort_by is not
		# set, the search will fail.
		# sort_by = '-uid'
		<%- if @user_sort_by -%>
		sort_by = '<%= @user_sort_by %>'
		<%- end -%>

		# If this is undefined, anyone is authorised.
		# If it is defined, the contents of this attribute
		# determine whether or not the user is authorised
		# access_attribute = 'dialupAccess'
		<%- if @user_access_attribute -%>
		access_attribute = '<%= @user_access_attribute %>'
		<%- end -%>

		# Control whether the presence of 'access_attribute'
		# allows access, or denys access.
		@@ -225,6 +271,9 @@ ldap <%= @name %> {
		#
		# Will result in the user being locked out.
		# access_positive = yes
		<%- if @user_access_positive -%>
		access_positive = <%= @user_access_positive %>
		<%- end -%>
		}

		#
		@@ -232,24 +281,33 @@ ldap <%= @name %> {
		#
		group {
		# Where to start searching in the tree for groups
		base_dn = "${..base_dn}"
		base_dn = "<%= @group_base_dn %>"

		# Filter for group objects, should match all available
		# group objects a user might be a member of.
		filter = '(objectClass=posixGroup)'
		filter = "<%= @group_filter %>"

		# Search scope, may be 'base', 'one', sub' or 'children'
		# scope = 'sub'
		<%- if @group_scope -%>
		scope = '<%= @group_scope %>'
		<%- end -%>

		# Attribute that uniquely identifies a group.
		# Is used when converting group DNs to group
		# names.
		# name_attribute = cn
		<%- if @group_name_attribute -%>
		name_attribute = <%= @group_name_attribute %>
		<%- end -%>

		# Filter to find group objects a user is a member of.
		# That is, group objects with attributes that
		# identify members (the inverse of membership_attribute).
		# membership_filter = "(\|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))"
		<%- if @group_membership_filter -%>
		membership_filter = "<%= @group_membership_filter %>"
		<%- end -%>

		# The attribute in user objects which contain the names
		# or DNs of groups a user is a member of.
		@@ -257,7 +315,7 @@ ldap <%= @name %> {
		# Unless a conversion between group name and group DN is
		# needed, there's no requirement for the group objects
		# referenced to actually exist.
		membership_attribute = 'memberOf'
		membership_attribute = '<%= @group_membership_attribute %>'

		# If cacheable_name or cacheable_dn are enabled,
		# all group information for the user will be
		@@ -274,17 +332,29 @@ ldap <%= @name %> {
		# i.e. if your groups are specified as DNs then enable
		# cacheable_dn else enable cacheable_name.
		# cacheable_name = 'no'
		<%- if @group_cacheable_name -%>
		cacheable_name = '<%= @group_cacheable_name %>'
		<%- end -%>
		# cacheable_dn = 'no'
		<%- if @group_cacheable_dn -%>
		cacheable_dn = '<%= @group_cacheable_dn %>'
		<%- end -%>

		# Override the normal cache attribute (<inst>-LDAP-Group or
		# LDAP-Group if using the default instance) and create a
		# custom attribute. This can help if multiple module instances
		# are used in fail-over.
		# cache_attribute = 'LDAP-Cached-Membership'
		<%- if @group_cache_attribute -%>
		cache_attribute = '<%= @group_cache_attribute %>'
		<%- end -%>

		# Override the normal group comparison attribute name
		# (<inst>-LDAP-Group or LDAP-Group if using the default instance) .
		# group_attribute = "${.:instance}-${.:name}-Group"
		<%- if @group_attribute -%>
		group_attribute = '<%= @group_attribute %>'
		<%- end -%>
		}

		#
		@@ -295,6 +365,9 @@ ldap <%= @name %> {
		profile {
		# Filter for RADIUS profile objects
		# filter = '(objectclass=radiusprofile)'
		<%- if @profile_filter -%>
		filter = '<%= @profile_filter %>'
		<%- end -%>

		# The default profile. This may be a DN or an attribute
		# reference.
		@@ -302,6 +375,9 @@ ldap <%= @name %> {
		# &User-Profile attribute to specify the default profile,
		# set this to &control:User-Profile.
		# default = 'cn=radprofile,dc=example,dc=org'
		<%- if @profile_default -%>
		default = '<%= @profile_default %>'
		<%- end -%>

		# The LDAP attribute containing profile DNs to apply
		# in addition to the default profile above. These are
		@@ -309,6 +385,9 @@ ldap <%= @name %> {
		# attributes from the update section, are are applied
		# if authorization is successful.
		# attribute = 'radiusProfileDn'
		<%- if @profile_default -%>
		attribute = '<%= @profile_attribute %>'
		<%- end -%>
		}

		#
		@@ -316,15 +395,18 @@ ldap <%= @name %> {
		#
		client {
		# Where to start searching in the tree for clients
		base_dn = "${..base_dn}"
		base_dn = "<%= @client_base_dn %>"

		#
		# Filter to match client objects
		#
		filter = '(objectClass=radiusClient)'
		filter = '<%= @client_filter %>'

		# Search scope, may be 'base', 'one', 'sub' or 'children'
		# scope = 'sub'
		<%- if @client_scope -%>
		scope = '<%= @client_scope %>'
		<%- end -%>

		#
		# Sets default values (not obtained from LDAP) for new client entries
		@@ -367,6 +449,9 @@ ldap <%= @name %> {

		# Load clients on startup
		# read_clients = no
		<%- if @read_clients -%>
		read_clients = <%= @read_clients %>
		<%- end -%>

		#
		# Modify user object on receiving Accounting-Request
		@@ -433,6 +518,9 @@ ldap <%= @name %> {
		#
		# LDAP_OPT_DEREF is set to this value.
		# dereference = 'always'
		<%- if @dereference -%>
		dereference = '<%= @dereference %>'
		<%- end -%>

		#
		# The following two configuration items control whether the
		@@ -441,15 +529,15 @@ ldap <%= @name %> {
		# If you set these to 'no', then searches will likely return
		# 'operations error', instead of a useful result.
		#
		chase_referrals = yes
		rebind = yes
		chase_referrals = <%= @chase_referrals %>
		rebind = <%= @rebind %>

		#
		# On rebind, use the credentials from the rebind url instead
		# of admin credentials used during the initial bind.
		# Default 'no'
		#
		use_referral_credentials = no
		use_referral_credentials = <%= @use_referral_credentials %>

		#
		# If 'yes', then include draft-wahl-ldap-session tracking
		@@ -461,6 +549,9 @@ ldap <%= @name %> {
		# Default 'no'.
		#
		# session_tracking = yes
		<%- if @session_tracking -%>
		session_tracking = <%= @session_tracking %>
		<%- end -%>

		# Seconds to wait for LDAP query to finish. default: 20
		res_timeout = <%= @timeout %>
		@@ -469,7 +560,7 @@ ldap <%= @name %> {
		# time limit). default: 20
		#
		# LDAP_OPT_TIMELIMIT is set to this value.
		srv_timelimit = 3
		srv_timelimit = <%= @timelimit %>

		# LDAP_OPT_X_KEEPALIVE_IDLE
		idle = <%= @idle %>
		@@ -487,7 +578,7 @@ ldap <%= @name %> {
		#
		# default: 0x0000 (no debugging messages)
		# Example:(LDAP_DEBUG_FILTER+LDAP_DEBUG_CONNS)
		ldap_debug = 0x0028
		ldap_debug = <%= @ldap_debug %>
		}

		#
		@@ -519,6 +610,9 @@ ldap <%= @name %> {
		private_key_file = <%= @keyfile %>
		<% end -%>
		# random_file = /dev/urandom
		<%- if @random_file -%>
		random_file = <%= @random_file %>
		<%- end -%>

		# Certificate Verification requirements. Can be:
		# 'never' (do not even bother trying)
		@@ -581,19 +675,19 @@ ldap <%= @name %> {
		# The number of seconds to wait after the server tries
		# to open a connection, and fails. During this time,
		# no new connections will be opened.
		retry_delay = 30
		retry_delay = <%= @retry_delay %>

		# The lifetime (in seconds) of the connection
		lifetime = 0
		lifetime = <%= @lifetime %>

		# Idle timeout (in seconds). A connection which is
		# unused for this length of time will be closed.
		idle_timeout = 60
		idle_timeout = <%= @idle_timeout %>

		# Connection timeout (in seconds). The maximum amount of
		# time to wait for a new connection to be established.
		# Sets LDAP_OPT_NETWORK_TIMEOUT in libldap.
		connect_timeout = 3.0
		connect_timeout = <%= @connect_timeout %>

		# NOTE: All configuration settings are enforced. If a
		# connection is closed because of 'idle_timeout',

types/sasl.pp

0 → 100644

+7 −0

Changes for types/sasl.pp: 7 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		type Freeradius::Sasl = Struct[
		{
		mech => Optional[String],
		proxy => Optional[String],
		realm => Optional[String],
		},
		]

types/scope.pp

0 → 100644

+1 −0

Changes for types/scope.pp: 1 added line, 0 removed lines.
Original line number	Diff line number	Diff line
		type Freeradius::Scope = Enum['base','one','sub','children']