Merge pull request #66 from amateo/feature/ldap (18434494) · Commits · Projets publics / puppet-freeradius

README.md

+143 −0

Original line number	Diff line number	Diff line
		@@ -20,6 +20,7 @@
		* [`freeradius::home_server_pool`](#freeradiushomeserverpool)
		* [`freeradius::instantiate`](#freeradiusinstantiate)
		* [`freeradius::ldap`](#freeradiusldap)
		* [`freeradius::module::ldap`](#freeradiusmoduleldap)
		* [`freeradius::krb5`](#freeradiuskrb5)
		* [`freeradius::module`](#freeradiusmodule)
		* [`freeradius::policy`](#freeradiuspolicy)
		@@ -439,15 +440,31 @@ freeradius::instantiate { 'mymodule': }
		```

		#### `freeradius::ldap`
		Deprecated. Use `freeradius::module::ldap` instead.

		#### `freeradius::module::ldap`

		Configure LDAP support for FreeRADIUS

		##### `ensure`

		Whether the site should be present or not.

		##### `identity`
		LDAP account for searching the directory. Required.

		##### `password`
		Password for the `identity` account. Required.

		##### `sasl`
		SASL parameters to use for admin binds to the ldap server. This is a hash with 3 possible keys:

		* `mech`: The SASL mechanism used.
		* `proxy`: SASL authorizatino identity to proxy.
		* `realm`: SASL realm (used for kerberos)

		Default: `{}`

		##### `basedn`
		Unless overridden in another section, the dn from which all searches will start from. Required.

		@@ -458,10 +475,127 @@ server certificate, if you're using ldaps. Default: [`localhost`]
		##### `port`
		Port to connect to the LDAP server on. Default: `389`

		##### `valuepair_attribute`
		Generic valuepair attribute. If set, this attribute will be retrieved in addition to any mapped attributes. Default: `undef`.

		##### `update`
		Array with mapping of LDAP directory attributes to RADIUS dictionary attributes. Default: `[]`

		##### `edir`
		Se to `yes` if you have eDirectory and want to use the universal password mechanisms. Possible values are `yes` and `no`. Default: `undef`.

		##### `edir_autz`
		Set to `yes`if you want to bind as the user after retrieving the Cleartest-Password. Possible values are `yes` and `no`. Default: `undef`.

		##### `user_base_dn`
		Where to start searching for users in the LDAP tree. Default: `${..base_dn}`.

		##### `user_filter`
		Filter for user objects. Default: `uid=%{%{Stripped-User-Name}-%{User-Name}})`

		##### `user_sasl`
		SASL parameters to use for user binds to the ldap server. This is a hash with 3 possible keys:

		* `mech`: The SASL mechanism used.
		* `proxy`: SASL authorizatino identity to proxy.
		* `realm`: SASL realm (used for kerberos)

		Default: `{}`

		##### `user_scope`
		Search scope for users. Valid values are `base`, `one`, `sub` and `children`. Default: `undef` (`sub` is applied).

		##### `user_sort_by`
		Server side result sorting. A list of space delimited attributes to order the result set by. Default: `undef`.

		##### `user_access_attribute`
		If this undefined, anyone is authorized. If it is defined, the contents of this attribute determine whether or not the user is authorised. Default: `undef`.

		##### `user_access_positive`
		Control whether the presence of 'access_attribute' allows access or denys access. Default: `undef`.

		##### `group_base_dn`
		Where to start searching for groups in the LDAP tree. Default: `${..base_dn}`.

		##### `group_filter`
		Filter for group objects. Default: `'(objectClass=posixGroup)'`.

		##### `group_scope`
		Search scope for groups. Valid values are `base`, `one`, `sub` and `children`. Default: `undef` (`sub` is applied).

		##### `group_name_attribute`
		Attribute that uniquely identifies a group. Default: `undef` (`'cn'` is applied).

		##### `group_membership_filter`
		Filter to find group objects a user is member of. That is, group objects with attributes that identify members (the inverse of `group_membership_attribute`). Default: `undef`.

		##### `group_membership_attribute`
		The attribute in user objects which contain the namos or DNs of groups a user is a member of. Default: `'memberOf'`.

		##### `group_cacheable_name`
		If `group_cacheable_name` or `group_cacheable_dn` are enabled, all group information for the user will be retrieved from the directory and written to LDAP-Group attributes appropiaate for the instance of rlm_ldap. Default: `undef`.

		##### `group_cacheable_dn`
		If `group_cacheable_name` or `group_cacheable_dn` are enabled, all group information for the user will be retrieved from the directory and written to LDAP-Group attributes appropiaate for the instance of rlm_ldap. Default: `undef`.

		##### `group_cache_attribute`
		Override the normal cache attribute (`<inst>-LDAP-Group` or `LDAP-Group` if using the default instance) and create a custom attribute. Default: `undef`.

		##### `group_attribute`
		Override the normal group comparison attribute name (`<inst>-LDAP-Group` or `LDAP-Group` if using the default instance). Default: `undef`.

		##### `profile_filter`
		Filter for RADIUS profile objects. Default: `undef`.

		##### `profile_default`
		The default profile. This may be a DN or an attribute reference. Default: `undef`.

		##### `profile_attribute`
		The LDAP attribute containing profile DNs to apply in addition to the default profile above. Default: `undef`.

		##### `client_base_dn`
		Where to start searching for clients in the LDAP tree. Default: `'${..base_dn}'`.

		##### `client_filter`
		Filter to match client objects. Default: `'(objectClass=radiusClient)'`.

		##### `client_scope`
		Search scope for clients. Valid values are `base`, `one`, `sub` and `children`. Default: `undef` (`sub` is applied).

		##### `read_clients`
		Load clients on startup. Default: `undef` (`'no'` is applied).

		##### `dereference`
		Control under which situations LDAP aliases are followed. May be one of `never`, `searching`, `finding` or `always`. Default: `undef` (`always` is applied).

		##### `chase_referrals`
		With `rebind` control whether the server follows references returned by LDAP directory. Mostly used for AD compatibility. Default: `yes`.

		##### `rebind`
		With `chase_referrals` control whether the server follows references returned by LDAP directory. Mostly used for AD compatibility. Default: `yes`.

		##### `use_referral_credentials`
		On rebind, use the credentials from the rebind url instead of admin credentials. Default: `no`.

		##### `session_tracking`
		If `'yes'`, then include draft-wahl-ldap-session tracking controls. Default: `undef`.

		##### `uses`
		How many times the connection can be used before being re-established. This is useful for things
		like load balancers, which may exhibit sticky behaviour without it. `0` is unlimited. Default: `0`

		##### `retry_delay`
		The number of seconds to wait after the server tries to open a connection, and fails. Default: `30'.

		##### `lifetime`
		The lifetime (in seconds) of the connection. Default: `0` (forever).

		##### `idle_timeout`
		Idle timeout (in seconds). A connection which is unused for this length of time will be closed. Default: `60`.

		##### `connect_timeout`
		Connection timeout (in seconds). The maximum amount of time to wait for a new connection to be established. Default: `3.0`.

		##### `idle`
		Sets the idle time before keepalive probes are sent. Default `60`

		@@ -483,6 +617,12 @@ output of `radiusd -X` then it is supported. Otherwise, it is unsupported and ch
		##### `timeout`
		Number of seconds to wait for LDAP query to finish. Default: `10`

		##### `timelimit`
		Seconds LDAP server has to process the query (server-side time limit). Default: `20`.

		##### `ldap_debug`
		Debug flag for LDAP SDK. Default: `0x0028`.

		##### `start`
		Connections to create during module instantiation. If the server cannot create specified number of
		connections during instantiation it will exit. Set to 0 to allow the server to start without the
		@@ -512,6 +652,9 @@ Path to cert file for TLS
		##### `keyfile`
		Path to key file for TLS

		##### `random_file`
		Random file used for TLS operations. Default: `undef` (`'/dev/urandom'` is used).

		##### `requirecert`
		Certificate Verification requirements. Choose from:
		'never' (do not even bother trying)

manifests/ldap.pp

+22 −59

Original line number	Diff line number	Diff line
		@@ -21,65 +21,28 @@ define freeradius::ldap (
		$keyfile = undef,
		$requirecert = 'allow',
		) {
		$fr_package = $::freeradius::params::fr_package
		$fr_service = $::freeradius::params::fr_service
		$fr_modulepath = $::freeradius::params::fr_modulepath
		$fr_group = $::freeradius::params::fr_group
		warning('The use of freeradius::ldap is deprecated. You must use freeradius::module::ldap instead')

		# Validate our inputs
		# Hostnames
		$serverarray = any2array($server)
		unless is_array($serverarray) {
		fail('$server must be an array of hostnames or IP addresses')
		}

		# FR3.0 format server = 'ldap1.example.com, ldap1.example.com, ldap1.example.com'
		# FR3.1 format server = 'ldap1.example.com'
		# server = 'ldap2.example.com'
		# server = 'ldap3.example.com'
		$serverconcatarray = $::freeradius_version ? {
		/^3\.0\./ => any2array(join($serverarray, ',')),
		default => $serverarray,
		}

		# Fake booleans (FR uses yes/no instead of true/false)
		unless $starttls in ['yes', 'no'] {
		fail('$starttls must be yes or no')
		}

		# Validate multiple choice options
		unless $requirecert in ['never', 'allow', 'demand', 'hard'] {
		fail('$requirecert must be one of never, allow, demand, hard')
		}

		# Validate integers
		unless is_integer($port) {
		fail('$port must be an integer')
		}
		unless is_integer($uses) {
		fail('$uses must be an integer')
		}
		unless is_integer($idle) {
		fail('$idle must be an integer')
		}
		unless is_integer($probes) {
		fail('$probes must be an integer')
		}
		unless is_integer($interval) {
		fail('$interval must be an integer')
		}
		unless is_integer($timeout) {
		fail('$timeout must be an integer')
		}

		# Generate a module config, based on ldap.conf
		file { "${fr_modulepath}/${name}":
		freeradius::module::ldap {$name:
		ensure => $ensure,
		mode => '0640',
		owner => 'root',
		group => $fr_group,
		content => template('freeradius/ldap.erb'),
		require => [Package[$fr_package], Group[$fr_group]],
		notify => Service[$fr_service],
		identity => $identity,
		password => $password,
		basedn => $basedn,
		server => $server,
		port => $port,
		uses => $uses,
		idle => $idle,
		probes => $probes,
		interval => $interval,
		timeout => $timeout,
		start => $start,
		min => $min,
		max => $max,
		spare => $spare,
		starttls => $starttls,
		cafile => $cafile,
		certfile => $certfile,
		keyfile => $keyfile,
		requirecert => $requirecert,
		}
		}

manifests/module/ldap.pp

0 → 100644

+96 −0

Original line number	Diff line number	Diff line
		# Configure LDAP support for FreeRADIUS
		define freeradius::module::ldap (
		String $basedn,
		Enum['present','absent'] $ensure = 'present',
		$server = ['localhost'],
		Integer $port = 389,
		Optional[String] $identity = undef,
		Optional[String] $password = undef,
		Optional[Freeradius::Sasl] $sasl = {},
		Optional[String] $valuepair_attribute = undef,
		Optional[Array[String]] $update = undef,
		Optional[Freeradius::Boolean] $edir = undef,
		Optional[Freeradius::Boolean] $edir_autz = undef,
		String $user_base_dn = "\${..base_dn}",
		String $user_filter = '(uid=%{%{Stripped-User-Name}:-%{User-Name}})',
		Optional[Freeradius::Sasl] $user_sasl = {},
		Optional[Freeradius::Scope] $user_scope = undef,
		Optional[String] $user_sort_by = undef,
		Optional[String] $user_access_attribute = undef,
		Optional[Freeradius::Boolean] $user_access_positive = undef,
		String $group_base_dn = "\${..base_dn}",
		String $group_filter = '(objectClass=posixGroup)',
		Optional[Freeradius::Scope] $group_scope = undef,
		Optional[String] $group_name_attribute = undef,
		Optional[String] $group_membership_filter = undef,
		String $group_membership_attribute = 'memberOf',
		Optional[Freeradius::Boolean] $group_cacheable_name = undef,
		Optional[Freeradius::Boolean] $group_cacheable_dn = undef,
		Optional[String] $group_cache_attribute = undef,
		Optional[String] $group_attribute = undef,
		Optional[String] $profile_filter = undef,
		Optional[String] $profile_default = undef,
		Optional[String] $profile_attribute = undef,
		String $client_base_dn = "\${..base_dn}",
		String $client_filter = '(objectClass=radiusClient)',
		Optional[Freeradius::Boolean] $client_scope = undef,
		Optional[Freeradius::Boolean] $read_clients = undef,
		Optional[Enum['never','searching','finding','always']] $dereference = undef,
		Freeradius::Boolean $chase_referrals = 'yes',
		Freeradius::Boolean $rebind = 'yes',
		Freeradius::Boolean $use_referral_credentials = 'no',
		Optional[Freeradius::Boolean] $session_tracking = undef,
		Integer $timeout = 10,
		Integer $timelimit = 3,
		Integer $idle = 60,
		Integer $probes = 3,
		Integer $interval = 3,
		String $ldap_debug = '0x0028',
		Freeradius::Boolean $starttls = 'no',
		Optional[String] $cafile = undef,
		Optional[String] $certfile = undef,
		Optional[String] $keyfile = undef,
		Optional[String] $random_file = undef,
		Enum['never','allow','demand','hard'] $requirecert = 'allow',
		Freeradius::Integer $start = '${thread[pool].start_servers}',
		Freeradius::Integer $min = '${thread[pool].min_spare_servers}',
		Freeradius::Integer $max = '${thread[pool].max_servers}',
		Freeradius::Integer $spare = '${thread[pool].max_spare_servers}',
		Integer $uses = 0,
		Integer $retry_delay = 30,
		Integer $lifetime = 0,
		Integer $idle_timeout = 60,
		Float $connect_timeout = 3.0,
		) {
		$fr_package = $::freeradius::params::fr_package
		$fr_service = $::freeradius::params::fr_service
		$fr_modulepath = $::freeradius::params::fr_modulepath
		$fr_group = $::freeradius::params::fr_group

		# Validate our inputs
		# Hostnames
		$serverarray = any2array($server)
		unless is_array($serverarray) {
		fail('$server must be an array of hostnames or IP addresses')
		}

		# FR3.0 format server = 'ldap1.example.com, ldap1.example.com, ldap1.example.com'
		# FR3.1 format server = 'ldap1.example.com'
		# server = 'ldap2.example.com'
		# server = 'ldap3.example.com'
		$serverconcatarray = $::freeradius_version ? {
		/^3\.0\./ => any2array(join($serverarray, ',')),
		default => $serverarray,
		}

		# Generate a module config, based on ldap.conf
		file { "${fr_modulepath}/${name}":
		ensure => $ensure,
		mode => '0640',
		owner => 'root',
		group => $fr_group,
		content => template('freeradius/ldap.erb'),
		require => [Package[$fr_package], Group[$fr_group]],
		notify => Service[$fr_service],
		}
		}

templates/ldap.erb

+112 −18

File changed.

Preview size limit exceeded, changes collapsed.

types/sasl.pp

0 → 100644

+7 −0

Original line number	Diff line number	Diff line
		type Freeradius::Sasl = Struct[
		{
		mech => Optional[String],
		proxy => Optional[String],
		realm => Optional[String],
		},
		]