2 # Implements ldap configuration for keystone.
8 # Dan Bode dan@puppetlabs.com
9 # Matt Fischer matt.fischer@twcable.com
13 # Copyright 2012 Puppetlabs Inc, unless otherwise noted.
22 $user_tree_dn = undef,
24 $user_objectclass = undef,
25 $user_id_attribute = undef,
26 $user_name_attribute = undef,
27 $user_mail_attribute = undef,
28 $user_enabled_attribute = undef,
29 $user_enabled_mask = undef,
30 $user_enabled_default = undef,
31 $user_enabled_invert = undef,
32 $user_attribute_ignore = undef,
33 $user_default_project_id_attribute = undef,
34 $user_allow_create = undef,
35 $user_allow_update = undef,
36 $user_allow_delete = undef,
37 $user_pass_attribute = undef,
38 $user_enabled_emulation = undef,
39 $user_enabled_emulation_dn = undef,
40 $user_additional_attribute_mapping = undef,
41 $tenant_tree_dn = undef, #DEPRECATED
42 $project_tree_dn = undef,
43 $tenant_filter = undef, #DEPRECATED
44 $project_filter = undef,
45 $tenant_objectclass = undef, #DEPRECATED
46 $project_objectclass = undef,
47 $tenant_id_attribute = undef, #DEPRECATED
48 $project_id_attribute = undef,
49 $tenant_member_attribute = undef, #DEPRECATED
50 $project_member_attribute = undef,
51 $tenant_desc_attribute = undef, #DEPRECATED
52 $project_desc_attribute = undef,
53 $tenant_name_attribute = undef, #DEPRECATED
54 $project_name_attribute = undef,
55 $tenant_enabled_attribute = undef, #DEPRECATED
56 $project_enabled_attribute = undef,
57 $tenant_domain_id_attribute = undef, #DEPRECATED
58 $project_domain_id_attribute = undef,
59 $tenant_attribute_ignore = undef, #DEPRECATED
60 $project_attribute_ignore = undef,
61 $tenant_allow_create = undef, #DEPRECATED
62 $project_allow_create = undef,
63 $tenant_allow_update = undef, #DEPRECATED
64 $project_allow_update = undef,
65 $tenant_allow_delete = undef, #DEPRECATED
66 $project_allow_delete = undef,
67 $tenant_enabled_emulation = undef, #DEPRECATED
68 $project_enabled_emulation = undef,
69 $tenant_enabled_emulation_dn = undef, #DEPRECATED
70 $project_enabled_emulation_dn = undef,
71 $tenant_additional_attribute_mapping = undef, #DEPRECATED
72 $project_additional_attribute_mapping= undef,
73 $role_tree_dn = undef,
75 $role_objectclass = undef,
76 $role_id_attribute = undef,
77 $role_name_attribute = undef,
78 $role_member_attribute = undef,
79 $role_attribute_ignore = undef,
80 $role_allow_create = undef,
81 $role_allow_update = undef,
82 $role_allow_delete = undef,
83 $role_additional_attribute_mapping = undef,
84 $group_tree_dn = undef,
85 $group_filter = undef,
86 $group_objectclass = undef,
87 $group_id_attribute = undef,
88 $group_name_attribute = undef,
89 $group_member_attribute = undef,
90 $group_desc_attribute = undef,
91 $group_attribute_ignore = undef,
92 $group_allow_create = undef,
93 $group_allow_update = undef,
94 $group_allow_delete = undef,
95 $group_additional_attribute_mapping = undef,
97 $tls_cacertdir = undef,
98 $tls_cacertfile = undef,
99 $tls_req_cert = undef,
100 $identity_driver = undef,
101 $assignment_driver = undef,
105 $pool_retry_delay = 0.1,
106 $pool_connection_timeout = -1,
107 $pool_connection_lifetime = 600,
108 $use_auth_pool = false,
109 $auth_pool_size = 100,
110 $auth_pool_connection_lifetime = 60,
113 # In Juno the term "tenant" was deprecated in the config in favor of "project"
114 # Let's assume project_ is being used and warning otherwise. If both are set we will
115 # fail, because having both set may cause unexpected results in Keystone.
116 if ($tenant_tree_dn) {
117 $project_tree_dn_real = $tenant_tree_dn
118 warning ('tenant_tree_dn is deprecated in Juno. switch to project_tree_dn')
119 if ($project_tree_dn) {
120 fail ('tenant_tree_dn and project_tree_dn are both set. results may be unexpected')
124 $project_tree_dn_real = $project_tree_dn
127 if ($tenant_filter) {
128 $project_filter_real = $tenant_filter
129 warning ('tenant_filter is deprecated in Juno. switch to project_filter')
130 if ($project_filter) {
131 fail ('tenant_filter and project_filter are both set. results may be unexpected')
135 $project_filter_real = $project_filter
138 if ($tenant_objectclass) {
139 $project_objectclass_real = $tenant_objectclass
140 warning ('tenant_objectclass is deprecated in Juno. switch to project_objectclass')
141 if ($project_objectclass) {
142 fail ('tenant_objectclass and project_objectclass are both set. results may be unexpected')
146 $project_objectclass_real = $project_objectclass
149 if ($tenant_id_attribute) {
150 $project_id_attribute_real = $tenant_id_attribute
151 warning ('tenant_id_attribute is deprecated in Juno. switch to project_id_attribute')
152 if ($project_id_attribute) {
153 fail ('tenant_id_attribute and project_id_attribute are both set. results may be unexpected')
157 $project_id_attribute_real = $project_id_attribute
160 if ($tenant_member_attribute) {
161 $project_member_attribute_real = $tenant_member_attribute
162 warning ('tenant_member_attribute is deprecated in Juno. switch to project_member_attribute')
163 if ($project_member_attribute) {
164 fail ('tenant_member_attribute and project_member_attribute are both set. results may be unexpected')
168 $project_member_attribute_real = $project_member_attribute
171 if ($tenant_desc_attribute) {
172 $project_desc_attribute_real = $tenant_desc_attribute
173 warning ('tenant_desc_attribute is deprecated in Juno. switch to project_desc_attribute')
174 if ($project_desc_attribute) {
175 fail ('tenant_desc_attribute and project_desc_attribute are both set. results may be unexpected')
179 $project_desc_attribute_real = $project_desc_attribute
182 if ($tenant_name_attribute) {
183 $project_name_attribute_real = $tenant_name_attribute
184 warning ('tenant_name_attribute is deprecated in Juno. switch to project_name_attribute')
185 if ($project_name_attribute) {
186 fail ('tenant_name_attribute and project_name_attribute are both set. results may be unexpected')
190 $project_name_attribute_real = $project_name_attribute
193 if ($tenant_enabled_attribute) {
194 $project_enabled_attribute_real = $tenant_enabled_attribute
195 warning ('tenant_enabled_attribute is deprecated in Juno. switch to project_enabled_attribute')
196 if ($project_enabled_attribute) {
197 fail ('tenant_enabled_attribute and project_enabled_attribute are both set. results may be unexpected')
201 $project_enabled_attribute_real = $project_enabled_attribute
204 if ($tenant_attribute_ignore) {
205 $project_attribute_ignore_real = $tenant_attribute_ignore
206 warning ('tenant_attribute_ignore is deprecated in Juno. switch to project_attribute_ignore')
207 if ($project_attribute_ignore) {
208 fail ('tenant_attribute_ignore and project_attribute_ignore are both set. results may be unexpected')
212 $project_attribute_ignore_real = $project_attribute_ignore
215 if ($tenant_domain_id_attribute) {
216 $project_domain_id_attribute_real = $tenant_domain_id_attribute
217 warning ('tenant_domain_id_attribute is deprecated in Juno. switch to project_domain_id_attribute')
218 if ($project_domain_id_attribute) {
219 fail ('tenant_domain_id_attribute and project_domain_id_attribute are both set. results may be unexpected')
223 $project_domain_id_attribute_real = $project_domain_id_attribute
226 if ($tenant_allow_create) {
227 $project_allow_create_real = $tenant_allow_create
228 warning ('tenant_allow_create is deprecated in Juno. switch to project_allow_create')
229 if ($project_allow_create) {
230 fail ('tenant_allow_create and project_allow_create are both set. results may be unexpected')
234 $project_allow_create_real = $project_allow_create
237 if ($tenant_allow_update) {
238 $project_allow_update_real = $tenant_allow_update
239 warning ('tenant_allow_update is deprecated in Juno. switch to project_allow_update')
240 if ($project_allow_update) {
241 fail ('tenant_allow_update and project_allow_update are both set. results may be unexpected')
245 $project_allow_update_real = $project_allow_update
248 if ($tenant_allow_delete) {
249 $project_allow_delete_real = $tenant_allow_delete
250 warning ('tenant_allow_delete is deprecated in Juno. switch to project_allow_delete')
251 if ($project_allow_delete) {
252 fail ('tenant_allow_delete and project_allow_delete are both set. results may be unexpected')
256 $project_allow_delete_real = $project_allow_delete
259 if ($tenant_enabled_emulation) {
260 $project_enabled_emulation_real = $tenant_enabled_emulation
261 warning ('tenant_enabled_emulation is deprecated in Juno. switch to project_enabled_emulation')
262 if ($project_enabled_emulation) {
263 fail ('tenant_enabled_emulation and project_enabled_emulation are both set. results may be unexpected')
267 $project_enabled_emulation_real = $project_enabled_emulation
270 if ($tenant_enabled_emulation_dn) {
271 $project_enabled_emulation_dn_real = $tenant_enabled_emulation_dn
272 warning ('tenant_enabled_emulation_dn is deprecated in Juno. switch to project_enabled_emulation_dn')
273 if ($project_enabled_emulation_dn) {
274 fail ('tenant_enabled_emulation_dn and project_enabled_emulation_dn are both set. results may be unexpected')
278 $project_enabled_emulation_dn_real = $project_enabled_emulation_dn
281 if ($tenant_additional_attribute_mapping) {
282 $project_additional_attribute_mapping_real = $tenant_additional_attribute_mapping
283 warning ('tenant_additional_attribute_mapping is deprecated in Juno. switch to project_additional_attribute_mapping')
284 if ($project_additional_attribute_mapping) {
285 fail ('tenant_additional_attribute_mapping and project_additional_attribute_mapping are both set. results may be unexpected')
289 $project_additional_attribute_mapping_real = $project_additional_attribute_mapping
292 $ldap_packages = ['python-ldap', 'python-ldappool']
293 package { $ldap_packages:
297 # check for some common driver name mistakes
298 if ($assignment_driver != undef) {
299 if ! ($assignment_driver =~ /^keystone.assignment.backends.*Assignment$/) {
300 fail('assigment driver should be of the form \'keystone.assignment.backends.*Assignment\'')
304 if ($identity_driver != undef) {
305 if ! ($identity_driver =~ /^keystone.identity.backends.*Identity$/) {
306 fail('identity driver should be of the form \'keystone.identity.backends.*Identity\'')
310 if ($tls_cacertdir != undef) {
311 file { $tls_cacertdir:
317 'ldap/url': value => $url;
318 'ldap/user': value => $user;
319 'ldap/password': value => $password, secret => true;
320 'ldap/suffix': value => $suffix;
321 'ldap/query_scope': value => $query_scope;
322 'ldap/page_size': value => $page_size;
323 'ldap/user_tree_dn': value => $user_tree_dn;
324 'ldap/user_filter': value => $user_filter;
325 'ldap/user_objectclass': value => $user_objectclass;
326 'ldap/user_id_attribute': value => $user_id_attribute;
327 'ldap/user_name_attribute': value => $user_name_attribute;
328 'ldap/user_mail_attribute': value => $user_mail_attribute;
329 'ldap/user_enabled_attribute': value => $user_enabled_attribute;
330 'ldap/user_enabled_mask': value => $user_enabled_mask;
331 'ldap/user_enabled_default': value => $user_enabled_default;
332 'ldap/user_enabled_invert': value => $user_enabled_invert;
333 'ldap/user_attribute_ignore': value => $user_attribute_ignore;
334 'ldap/user_default_project_id_attribute': value => $user_default_project_id_attribute;
335 'ldap/user_allow_create': value => $user_allow_create;
336 'ldap/user_allow_update': value => $user_allow_update;
337 'ldap/user_allow_delete': value => $user_allow_delete;
338 'ldap/user_pass_attribute': value => $user_pass_attribute;
339 'ldap/user_enabled_emulation': value => $user_enabled_emulation;
340 'ldap/user_enabled_emulation_dn': value => $user_enabled_emulation_dn;
341 'ldap/user_additional_attribute_mapping': value => $user_additional_attribute_mapping;
342 'ldap/project_tree_dn': value => $project_tree_dn_real;
343 'ldap/project_filter': value => $project_filter_real;
344 'ldap/project_objectclass': value => $project_objectclass_real;
345 'ldap/project_id_attribute': value => $project_id_attribute_real;
346 'ldap/project_member_attribute': value => $project_member_attribute_real;
347 'ldap/project_desc_attribute': value => $project_desc_attribute_real;
348 'ldap/project_name_attribute': value => $project_name_attribute_real;
349 'ldap/project_enabled_attribute': value => $project_enabled_attribute_real;
350 'ldap/project_attribute_ignore': value => $project_attribute_ignore_real;
351 'ldap/project_domain_id_attribute': value => $project_domain_id_attribute_real;
352 'ldap/project_allow_create': value => $project_allow_create_real;
353 'ldap/project_allow_update': value => $project_allow_update_real;
354 'ldap/project_allow_delete': value => $project_allow_delete_real;
355 'ldap/project_enabled_emulation': value => $project_enabled_emulation_real;
356 'ldap/project_enabled_emulation_dn': value => $project_enabled_emulation_dn_real;
357 'ldap/project_additional_attribute_mapping': value => $project_additional_attribute_mapping_real;
358 'ldap/role_tree_dn': value => $role_tree_dn;
359 'ldap/role_filter': value => $role_filter;
360 'ldap/role_objectclass': value => $role_objectclass;
361 'ldap/role_id_attribute': value => $role_id_attribute;
362 'ldap/role_name_attribute': value => $role_name_attribute;
363 'ldap/role_member_attribute': value => $role_member_attribute;
364 'ldap/role_attribute_ignore': value => $role_attribute_ignore;
365 'ldap/role_allow_create': value => $role_allow_create;
366 'ldap/role_allow_update': value => $role_allow_update;
367 'ldap/role_allow_delete': value => $role_allow_delete;
368 'ldap/role_additional_attribute_mapping': value => $role_additional_attribute_mapping;
369 'ldap/group_tree_dn': value => $group_tree_dn;
370 'ldap/group_filter': value => $group_filter;
371 'ldap/group_objectclass': value => $group_objectclass;
372 'ldap/group_id_attribute': value => $group_id_attribute;
373 'ldap/group_name_attribute': value => $group_name_attribute;
374 'ldap/group_member_attribute': value => $group_member_attribute;
375 'ldap/group_desc_attribute': value => $group_desc_attribute;
376 'ldap/group_attribute_ignore': value => $group_attribute_ignore;
377 'ldap/group_allow_create': value => $group_allow_create;
378 'ldap/group_allow_update': value => $group_allow_update;
379 'ldap/group_allow_delete': value => $group_allow_delete;
380 'ldap/group_additional_attribute_mapping': value => $group_additional_attribute_mapping;
381 'ldap/use_tls': value => $use_tls;
382 'ldap/tls_cacertdir': value => $tls_cacertdir;
383 'ldap/tls_cacertfile': value => $tls_cacertfile;
384 'ldap/tls_req_cert': value => $tls_req_cert;
385 'ldap/use_pool': value => $use_pool;
386 'ldap/pool_size': value => $pool_size;
387 'ldap/pool_retry_max': value => $pool_retry_max;
388 'ldap/pool_retry_delay': value => $pool_retry_delay;
389 'ldap/pool_connection_timeout': value => $pool_connection_timeout;
390 'ldap/pool_connection_lifetime': value => $pool_connection_lifetime;
391 'ldap/use_auth_pool': value => $use_auth_pool;
392 'ldap/auth_pool_size': value => $auth_pool_size;
393 'ldap/auth_pool_connection_lifetime': value => $auth_pool_connection_lifetime;
394 'identity/driver': value => $identity_driver;
395 'assignment/driver': value => $assignment_driver;