bodgit/puppet-sssd

Puppet Module for managing SSSD

sssd

Table of Contents

1. Description
2. Setup - The basics of getting started with sssd
   • Beginning with sssd
3. Usage - Configuration options and additional functionality
4. Reference - An under-the-hood peek at what the module is doing and how
5. Limitations - OS compatibility, etc.
6. Development - Guide for contributing to the module

Description

This module will install the SSSD packages, configure any services and domains, and optionally configure the D-Bus system service.

CentOS, RHEL, Scientific and Oracle Enterprise Linux is supported using Puppet 5 or later.

Setup

Beginning with sssd

You need to configure at least one domain for SSSD to start up so the bare minimum would be:

include sssd
sssd::domain { 'example.com':
  id_provider => 'ldap',
  ...
}

Usage

Configure SSSD to use LDAP for NSS:

class { 'sssd':
  domains  => {
    'example.com' => {
      'id_provider'           => 'ldap',
      'ldap_schema'           => 'rfc2307',
      'ldap_uri'              => ['ldap://192.0.2.1'],
      'ldap_search_base'      => 'dc=example,dc=com',
      'ldap_tls_reqcert'      => 'never',
      'ldap_id_use_start_tls' => false,
      'ldap_default_bind_dn'  => 'cn=Manager,dc=example,dc=com',
      'ldap_default_authtok'  => 'secret',
    },
  },
  services => {
    'nss' => {},
  },
}

class { 'nsswitch':
  passwd => ['files', 'sss'],
  shadow => ['files', 'sss'],
  group  => ['files', 'sss'],
}

Class['sssd'] -> Class['nsswitch']

Extend the above example to also make the SSSD data available over D-Bus:

include dbus
include sssd
sssd::service { 'nss': }
sssd::domain { 'example.com':
  id_provider           => 'ldap',
  ldap_schema           => 'rfc2307',
  ldap_uri              => ['ldap://192.0.2.1'],
  ldap_search_base      => 'dc=example,dc=com',
  ldap_tls_reqcert      => 'never',
  ldap_id_use_start_tls => false,
  ldap_default_bind_dn  => 'cn=Manager,dc=example,dc=com',
  ldap_default_authtok  => 'secret',
}
include sssd::dbus

class { 'nsswitch':
  passwd => ['files', 'sss'],
  shadow => ['files', 'sss'],
  group  => ['files', 'sss'],
}

Class['sssd'] -> Class['nsswitch']

Reference

The reference documentation is generated with puppet-strings and the latest version of the documentation is hosted at https://bodgit.github.io/puppet-sssd/ and available also in the REFERENCE.md.

Limitations

This module takes the (somewhat laborious) approach of creating parameters for each sssd.conf setting rather than just pass in a large hash of settings which should result in more control.

Any setting that accepts the boolean TRUE/FALSE values is mapped to a native Puppet boolean type. Any multi-valued setting accepts an array of values.

Currently almost all parameters are optional, the only mandatory parameter is that of the identity provider (id_provider) for the sssd::domain defined type. This may change in the future if the logic becomes more obvious.

This module has been built on and tested against Puppet 5 and higher.

The module has been tested on:

• Red Hat/CentOS Enterprise Linux 6/7

Development

The module relies on PDK and has both rspec-puppet and beaker-rspec tests. Run them with:

$ bundle exec rake spec
$ PUPPET_INSTALL_TYPE=agent PUPPET_INSTALL_VERSION=x.y.z bundle exec rake beaker:<nodeset>

Please log issues or pull requests at github.

puppet-sssd's Issues

Convert to Litmus

transfer to voxpupuli?

@bodgit I believe it has been over a year since a commit has been made to this repo. Would you consider transferring the module to voxpupuli?

IP data types are in puppetlabs-stdlib

The metadata.json for this module notes a use of thrnio/ip. This module appears to be deprecated as the IP data types are in puppetlabs-stdlib now.

Migrate from Travis

Add support for configuring services and domains as class parameters

noop not working on sssd::domain as expected

sssd::domain {
        'example.com':
          noop                           => true,
          dyndns_update                  => true,
....

actual output

Notice: /Stage[main]/Base/Sssd::Domain[example.com]/Sssd_conf[domain/example.com/dyndns_update]/ensure: created

expected output

Notice: /Stage[main]/Base/Sssd::Domain[example.com]/Sssd_conf[domain/example.com/dyndns_update]/ensure: current_value 'absent', should be 'present' (noop)

SELinux labelling of directories with Systemd

Notice: /Stage[main]/Sssd::Config/File[/etc/systemd/system/sssd-autofs.service.d]/seltype: seltype changed 'sssd_unit_file_t' to 'systemd_unit_file_t'
Notice: /Stage[main]/Sssd::Config/File[/etc/systemd/system/sssd-pac.service.d]/seltype: seltype changed 'sssd_unit_file_t' to 'systemd_unit_file_t'
Notice: /Stage[main]/Sssd::Config/File[/etc/systemd/system/sssd-pam.service.d]/seltype: seltype changed 'sssd_unit_file_t' to 'systemd_unit_file_t'
Notice: /Stage[main]/Sssd::Config/File[/etc/systemd/system/sssd-ssh.service.d]/seltype: seltype changed 'sssd_unit_file_t' to 'systemd_unit_file_t'
Notice: /Stage[main]/Sssd::Config/File[/etc/systemd/system/sssd-sudo.service.d]/seltype: seltype changed 'sssd_unit_file_t' to 'systemd_unit_file_t'

Search base validation

Based on #1 we can validate DN's. However the search bases as specified in sssd.conf have additional parameters and also multiple search bases like search_base[?scope?[filter][?search_base?scope?[filter]]*].

It should be possible to create an SSSD-specific validation function that uses the bodgitlib-provided validate_ldap_dn and validate_ldap_filter functions and then it just needs to validate the scope values itself and that the whole string conforms to the right format.

Socket activation systemd units are slightly broken

The systemd units try to run each service as the sssd user when using socket activation. The man page explicitly says not to try running SSSD as non-root when doing that.

See BZ#1636002

Secrets responder

Apparently only works via Systemd socket activation anyway so dependent on #5, probably also doesn't work on RHEL/CentOS 6.

Missing ldap_sasl_maxssf parameter

Drop old Puppet versions

puppetlabs-stdlib 6.*.* support?

Please update to support stdlib 6..!

Delete spec/default_module_facts.yml

Once bodgit/puppet-dbus#4 is fixed

Update DBus dependency

Bump it to >=1.1.2 <3.0.0.

undefined method `sort' for nil:NilClass if no domains or services defined

SSSD won't even start if there isn't at least one domain however it shouldn't trigger a Ruby error.

ipa_server in version 2 no longer accepts _srv_

From the man page sssd-ipa

If no servers are specified, the back end automatically uses service discovery to try to find a server. Optionally, the user may choose to use both fixed server addresses and service discovery by inserting a special keyword, _srv_, in the list of servers

Error: Could not retrieve catalog from remote server: Error 500 on SERVER: Server Error: Evaluation Error: Error while evaluating a Resource Statement, Sssd::Domain[daboyz.lan.com]: parameter 'ipa_server' index 0 expects a Bodgitlib::Host = Variant[Bodgitlib::Hostname = Bodgitlib::Domain = Pattern[/(?x) ^ (?= [a-z0-9.-]{2,255} ) ( (?= [a-z0-9-]{1,63} \. ) [a-z0-9]+ ( - [a-z0-9]+ )* \. )* [a-z]{2,63} $/], IP::Address::NoSubnet = Variant[IP::Address::V4::NoSubnet = Pattern[/\A([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\.([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])){3}\z/], IP::Address::V6::NoSubnet = Variant[IP::Address::V6::NoSubnet::Full = Pattern[/\A[[:xdigit:]]{1,4}(:[[:xdigit:]]{1,4}){7}\z/], IP::Address::V6::NoSubnet::Compressed = Pattern[/\A:(:|(:[[:xdigit:]]{1,4}){1,7})\z/, /\A([[:xdigit:]]{1,4}:){1}(:|(:[[:xdigit:]]{1,4}){1,6})\z/, /\A([[:xdigit:]]{1,4}:){2}(:|(:[[:xdigit:]]{1,4}){1,5})\z/, /\A([[:xdigit:]]{1,4}:){3}(:|(:[[:xdigit:]]{1,4}){1,4})\z/, /\A([[:xdigit:]]{1,4}:){4}(:|(:[[:xdigit:]]{1,4}){1,3})\z/, /\A([[:xdigit:]]{1,4}:){5}(:|(:[[:xdigit:]]{1,4}){1,2})\z/, /\A([[:xdigit:]]{1,4}:){6}(:|(:[[:xdigit:]]{1,4}){1,1})\z/, /\A([[:xdigit:]]{1,4}:){7}:\z/], IP::Address::V6::NoSubnet::Alternative = Pattern[/\A([[:xdigit:]]{1,4}:){6}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\.([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])){3}\z/, /\A([[:xdigit:]]{1,4}:){5}:([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\.([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])){3}\z/, /\A([[:xdigit:]]{1,4}:){4}(:[[:xdigit:]]{1,4}){0,1}:([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\.([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])){3}\z/, /\A([[:xdigit:]]{1,4}:){3}(:[[:xdigit:]]{1,4}){0,2}:([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\.([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])){3}\z/, /\A([[:xdigit:]]{1,4}:){2}(:[[:xdigit:]]{1,4}){0,3}:([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\.([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])){3}\z/, /\A([[:xdigit:]]{1,4}:){1}(:[[:xdigit:]]{1,4}){0,4}:([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\.([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])){3}\z/, /\A:(:[[:xdigit:]]{1,4}){0,5}:([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\.([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])){3}\z/]]]] value, got String (file: /etc/puppetlabs/code/environments/development/modules/base/manifests/init.pp, line: 118) on node xxxxxxxxxxx

Support socket activation on Systemd systems

Instead of maintaining the services = ... section, enable sssd-${service}.socket. PAM is a special case as it has two sockets.

The ifp/dbus service already uses D-Bus activation.

Puppet 6

The tests now fail on Puppet 6.x which seems to be related to the augeasproviders_core module. See voxpupuli/puppet-augeasproviders_core#10 which may shed some light on things.

Bodgitlib::Domain $dns_discovery_main does not allow for SRV records

In sssd::domain, the dns_discovery_domain is being validated as a Bodgitlib::Domain. This is problematic as SSSD isn't actually asking for domain but a FQDN or SRV.

  Optional[Bodgitlib::Domain]                                                           $dns_discovery_domain 

I have been setting this value to something like dev._locations.example.com.

Allow managing of service(s) state

It can be occasionally useful to configure SSSD as stopped/disabled to at least get the packages installed and configured.

Bump bodgitlib requirement

Convert to PDK

herculesteam/augeasproviders_core is deprecated

herculesteam/augeasproviders_core has been deprecated maybe replace with puppetlabs-augeas_core?

Pull in bodgitlib for LDAP validation

There can now be better validation of certain LDAP parameters, (DN's, filters, URI's), etc.

Puppet 4/5 support

Needed for bodgit/puppet-bodgitlib#9.