Skip to content

REFERENCE.md

Latest commit

 

History

History
1965 lines (1024 loc) · 45.8 KB

REFERENCE.md

File metadata and controls

1965 lines (1024 loc) · 45.8 KB
Raw

Reference

Table of Contents

Classes

Defined types

Resource types

Functions

  • openldap_password: Returns the openldap password hash from the clear text password.

Data types

Classes

openldap::client

See README.md for details.

Parameters

The following parameters are available in the openldap::client class:

package

Data type: String[1]

Default value: 'openldap'

file

Data type: Stdlib::Absolutepath

Default value: '/etc/openldap/ldap.conf'

package_version

Data type: String[1]

Default value: installed

base

Data type: Optional[String[1]]

Default value: undef

bind_policy

Data type: Optional[String[1]]

Default value: undef

bind_timelimit

Data type: Optional[String[1]]

Default value: undef

binddn

Data type: Optional[String[1]]

Default value: undef

bindpw

Data type: Optional[String[1]]

Default value: undef

ldap_version

Data type: Optional[String[1]]

Default value: undef

network_timeout

Data type: Optional[String[1]]

Default value: undef

scope

Data type: Optional[String[1]]

Default value: undef

ssl

Data type: Optional[String[1]]

Default value: undef

suffix

Data type: Optional[String[1]]

Default value: undef

timelimit

Data type: Optional[String[1]]

Default value: undef

timeout

Data type: Optional[String[1]]

Default value: undef

uri

Data type: Optional[Variant[String[1],Array[String[1]]]]

Default value: undef

nss_base_group

Data type: Optional[String[1]]

Default value: undef

nss_base_hosts

Data type: Optional[String[1]]

Default value: undef

nss_base_passwd

Data type: Optional[String[1]]

Default value: undef

nss_base_shadow

Data type: Optional[String[1]]

Default value: undef

nss_initgroups_ignoreusers

Data type: Optional[String[1]]

Default value: undef

pam_filter

Data type: Optional[String[1]]

Default value: undef

pam_login_attribute

Data type: Optional[String[1]]

Default value: undef

pam_member_attribute

Data type: Optional[String[1]]

Default value: undef

pam_password

Data type: Optional[String[1]]

Default value: undef

tls_cacert

Data type: Optional[Stdlib::Absolutepath]

Default value: undef

tls_cacertdir

Data type: Optional[Stdlib::Absolutepath]

Default value: undef

tls_checkpeer

Data type: Optional[String[1]]

Default value: undef

tls_reqcert

Data type: Optional[String[1]]

Default value: undef

tls_moznss_compatibility

Data type: Optional[Openldap::Tls_moznss_compatibility]

Default value: undef

sasl_mech

Data type: Optional[String[1]]

Default value: undef

sasl_realm

Data type: Optional[String[1]]

Default value: undef

sasl_authcid

Data type: Optional[String[1]]

Default value: undef

sasl_secprops

Data type: Optional[Array[String[1]]]

Default value: undef

sasl_nocanon

Data type: Optional[Boolean]

Default value: undef

gssapi_sign

Data type: Optional[Boolean]

Default value: undef

gssapi_encrypt

Data type: Optional[Boolean]

Default value: undef

gssapi_allow_remote_principal

Data type: Optional[String[1]]

Default value: undef

sudoers_base

Data type: Optional[String[1]]

Default value: undef

openldap::client::config

See README.md for details.

openldap::client::install

See README.md for details.

openldap::client::ldapvi

See README.md for details.

Parameters

The following parameters are available in the openldap::client::ldapvi class:

package

Data type: String[1]

Default value: 'ldapvi'

openldap::client::utils

The openldap::client::utils class.

openldap::server

See README.md for details.

Parameters

The following parameters are available in the openldap::server class:

krb5_keytab_file

Data type: Optional[Stdlib::Absolutepath]

if set, manage the env variable KRB5_KTNAME on Debian based operating systems. This is required when configuring sasl with backend GSSAPI

Default value: undef

krb5_client_keytab_file

Data type: Optional[Stdlib::Absolutepath]

if set, manage the env variable KRB5_CLIENT_KTNAME on Debian based operating systems. This is required when configuring sasl with backend GSSAPI

Default value: undef

pldap_ifs

Data type: Array[String[1]]

Allows to configure the HAProxy PROXY protol handling of openldap. This allows to get IPs of clients through a load-balancer for logging or filtering. Must not use the same ports as the native listeners.

Default value: []

pldaps_ifs

Data type: Array[String[1]]

Allows to configure the HAProxy PROXY protol handling of openldap. This allows to get IPs of clients through a load-balancer for logging or filtering. Must not use the same ports as the native listeners.

Default value: []

package

Data type: String[1]

confdir

Data type: String[1]

Default value: '/etc/openldap/slapd.d'

conffile

Data type: String[1]

Default value: '/etc/openldap/slapd.conf'

service

Data type: String[1]

Default value: 'slapd'

owner

Data type: String[1]

Default value: 'ldap'

group

Data type: String[1]

Default value: 'ldap'

escape_ldapi_ifs

Data type: Boolean

Default value: false

ldapi_ifs

Data type: Array[String[1]]

Default value: ['/']

default_directory

Data type: Stdlib::Absolutepath

Default value: '/var/lib/ldap'

manage_epel

Data type: Boolean

Default value: true

package_version

Data type: String[1]

Default value: installed

enable_chown

Data type: Optional[Boolean]

Default value: undef

service_hasstatus

Data type: Optional[Boolean]

Default value: undef

enable

Data type: Boolean

Default value: true

start

Data type: Boolean

Default value: true

ssl_key

Data type: Optional[Stdlib::Absolutepath]

Default value: undef

ssl_cert

Data type: Optional[Stdlib::Absolutepath]

Default value: undef

ssl_ca

Data type: Optional[Stdlib::Absolutepath]

Default value: undef

databases

Data type: Hash

Default value: {}

ldap_ifs

Data type: Array[String[1]]

Default value: ['/']

ldaps_ifs

Data type: Array[String[1]]

Default value: []

slapd_params

Data type: Optional[String]

Default value: undef

ldap_port

Data type: Optional[Stdlib::Port]

Default value: undef

ldap_address

Data type: Optional[Stdlib::IP::Address]

Default value: undef

ldaps_port

Data type: Optional[Stdlib::Port]

Default value: undef

ldaps_address

Data type: Optional[Stdlib::IP::Address]

Default value: undef

ldapi_socket_path

Data type: Optional[Stdlib::Absolutepath]

Default value: undef

register_slp

Data type: Optional[Boolean]

Default value: undef

ldap_config_backend

Data type: Optional[String]

Default value: undef

enable_memory_limit

Data type: Optional[Boolean]

Default value: undef

openldap::server::config

See README.md for details.

openldap::server::install

See README.md for details.

openldap::server::service

See README.md for details.

openldap::server::slapdconf

See README.md for details.

openldap::utils

See README.md for details.

Parameters

The following parameters are available in the openldap::utils class:

package

Data type: Optional[String[1]]

Default value: undef

package_version

Data type: String[1]

Default value: installed

Defined types

openldap::server::access

See README.md for details.

Parameters

The following parameters are available in the openldap::server::access defined type:

what

Data type: String[1]

access

Data type: Array[Openldap::Access_rule]

ensure

Data type: Enum['present', 'absent']

Default value: 'present'

openldap::server::access_wrapper

== Define openldap::server::access_wrapper

Generate access from a given hash.

=== Parameters

[suffix] Default: $name Mandatory. The suffix to apply acls

[acl] Default: Mandatory. Array of Hash in the form { => , ... }

example: $acl = [ { 'to *' => [ 'by dn.base="cn=replicator,dc=suretecsystems,dc=com" write', 'by * break' ], }, { 'to dn.base=""' => [ 'by * read', ], }, { 'to dn.base="cn=Subschema"' => [ 'by * read', ], }, { 'to dn.subtree="cn=Monitor"' => [ 'by dn.exact="uid=admin,dc=suretecsystems,dc=com" write', 'by users read', 'by * none', ], }, { 'to *' => [ 'by self write', 'by * none', ] }, ]

Parameters

The following parameters are available in the openldap::server::access_wrapper defined type:

acl

Data type: Array[Hash[Pattern[/\Ato\s/], Array[Openldap::Access_rule], 1, 1]]

suffix

Data type: String[1]

Default value: $name

openldap::server::database

See README.md for details.

Parameters

The following parameters are available in the openldap::server::database defined type:

ensure

Data type: Enum['present', 'absent']

Default value: present

directory

Data type: Optional[Stdlib::Absolutepath]

Default value: undef

suffix

Data type: String[1]

Default value: $title

relay

Data type: Optional[String[1]]

Default value: undef

backend

Data type: Optional[String[1]]

Default value: undef

rootdn

Data type: Optional[Variant[Sensitive[String[1]],String[1]]]

Default value: undef

rootpw

Data type: Optional[Variant[Sensitive[String[1]],String[1]]]

Default value: undef

initdb

Data type: Optional[Boolean]

Default value: undef

readonly

Data type: Boolean

Default value: false

sizelimit

Data type: Optional[String[1]]

Default value: undef

dbmaxsize

Data type: Optional[String[1]]

Default value: undef

timelimit

Data type: Optional[String[1]]

Default value: undef

updateref

Data type: Optional[String[1]]

Default value: undef

lastbind

Data type: Optional[Boolean]

Default value: undef

lastbindprecision

Data type: Optional[Integer[0]]

Default value: undef

limits

Data type: Openldap::Limits

Default value: {}

dboptions

Data type: Hash[String[1],Variant[String[1],Array[String[1]]]]

Default value: {}

synctype

Data type: Optional[String[1]]

Default value: undef

mirrormode

Data type: Optional[Boolean]

Default value: undef

multiprovider

Data type: Optional[Boolean]

Default value: undef

syncusesubentry

Data type: Optional[String[1]]

Default value: undef

syncrepl

Data type: Array[Openldap::Syncrepl]

Default value: []

security

Data type:

Hash[
    Enum[
      'transport',
      'sasl',
      'simple_bind',
      'ssf',
      'tls',
      'update_sasl',
      'update_ssf',
      'update_tls',
      'update_transport',
    ],
    Integer[0]
  ]

Default value: {}

openldap::server::dbindex

See README.md for details.

Parameters

The following parameters are available in the openldap::server::dbindex defined type:

ensure

Data type: Optional[Enum['present', 'absent']]

Default value: undef

suffix

Data type: Optional[String[1]]

Default value: undef

attribute

Data type: String[1]

Default value: $name

indices

Data type: Optional[String[1]]

Default value: undef

openldap::server::globalconf

See README.md for details.

Parameters

The following parameters are available in the openldap::server::globalconf defined type:

value

Data type: Variant[String[1],Array[String[1],1],Openldap::Attributes]

ensure

Data type: Enum['present', 'absent']

Default value: 'present'

openldap::server::iterate_access

This is a 'private' class used by openldap::server::access_wrapper

Parameters

The following parameters are available in the openldap::server::iterate_access defined type:

hash

Data type: Openldap::Access_hash

openldap::server::module

See README.md for details.

Parameters

The following parameters are available in the openldap::server::module defined type:

ensure

Data type: Optional[Enum['present', 'absent']]

Default value: undef

openldap::server::overlay

See README.md for details.

Parameters

The following parameters are available in the openldap::server::overlay defined type:

ensure

Data type: Enum['present', 'absent']

Default value: present

overlay

Data type: String[1]

Default value: regsubst($title, '^(\S+)\s+on\s+(\S+)$', '\1')

suffix

Data type: String[1]

Default value: regsubst($title, '^(\S+)\s+on\s+(\S+)$', '\2')

options

Data type: Optional[Openldap::Attributes]

Default value: undef

openldap::server::schema

See README.md for details.

Parameters

The following parameters are available in the openldap::server::schema defined type:

ensure

Data type: Optional[Enum['present', 'absent']]

Default value: undef

path

Data type: Stdlib::Absolutepath

Default value:

$facts['os']['family'] ? {
    'Debian' => "/etc/ldap/schema/${title}.schema",
    'Redhat' => "/etc/openldap/schema/${title}.schema",
    'Archlinux' => "/etc/openldap/schema/${title}.schema",
    'FreeBSD' => "/usr/local/etc/openldap/schema/${title}.schema",
    'Suse' => "/etc/openldap/schema/${title}.schema"

Resource types

openldap_access

Manages OpenLDAP ACPs/ACLs

Properties

The following properties are available in the openldap_access type.

access

Access rule.

ensure

Valid values: present, absent

The basic property that the resource should be in.

Default value: present

what

The entries and/or attributes to which the access applies

Parameters

The following parameters are available in the openldap_access type.

name

namevar

The default namevar

position

Where to place the new entry

provider

The specific backend to use for this openldap_access resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

suffix

The suffix to which the access applies

target

The slapd.conf file

openldap_database

Manages OpenLDAP BDB and HDB databases.

Properties

The following properties are available in the openldap_database type.

backend

Valid values: bdb, hdb, mdb, monitor, config, relay, ldap

The name of the backend.

dbmaxsize

Specifies the maximum size of the DB in bytes.

dboptions

Hash to pass specific HDB/BDB options for the database

directory

The directory where the BDB files containing this database and associated indexes live.

ensure

Valid values: present, absent

The basic property that the resource should be in.

Default value: present

index

The index of the database.

lastbind

Valid values: true, false

This option controls whether slapd will automatically maintain the pwdLastSuccess attribute for entries

lastbindprecision

specifies how frequently pwdLastSuccess will be updated

limits

Limits the number entries returned and/or the time spent by a request

mirrormode

Valid values: true, false

This option puts a replica database into "mirror" mode, deprecated as of 2.5

multiprovider

Valid values: true, false

This option puts a replica database into "multiprovider" mode

readonly

Puts the database into read-only mode.

rootdn

The distinguished name that is not subject to access control or administrative limit restrictions for operations on this database.

rootpw

Password (or hash of the password) for the rootdn.

security

The olcSecurity configuration.

sizelimit

Specifies the maximum number of entries to return from a search operation.

syncrepl

Specify the current database as a consumer which is kept up-to-date with the provider content by establishing the current slapd(8) as a replication consumer site running a syncrepl replication engine.

syncusesubentry

Store the syncrepl contextCSN in a subentry instead of the context entry of the database

timelimit

Specifies the maximum number of seconds (in real time) slapd will spend answering a search request.

updateref

This directive is only applicable in a replica (or shadow) slapd. It specifies the URL to return to clients which submit update requests upon the replica.

Parameters

The following parameters are available in the openldap_database type.

initdb

Valid values: true, false

When true it initiales the database with the top object. When false, it does not create any object in the database, so you have to create it by other mechanism. It defaults to false when the backend is one of config, ldap, monitor or relay, true otherwise.

organization

Organization name used when initdb is true

provider

The specific backend to use for this openldap_database resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

relay

The relay configuration.

suffix

The default namevar.

synctype

Valid values: inclusive, minimum

Whether specified dboptions should be considered the complete list (inclusive) or the minimum list (minimum) of dboptions the database should have. Defaults to minimum.

Valid values are inclusive, minimum.

Default value: minimum

target

openldap_dbindex

Manages OpenLDAP DB indexes

Properties

The following properties are available in the openldap_dbindex type.

ensure

Valid values: present, absent

The basic property that the resource should be in.

Default value: present

indices

The indices to maintain

Parameters

The following parameters are available in the openldap_dbindex type.

attribute

The attribute to index

Default value: default

name

namevar

The default namevar

provider

The specific backend to use for this openldap_dbindex resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

suffix

The suffix to which the index applies

target

The slapd.conf file

openldap_global_conf

The openldap_global_conf type.

Properties

The following properties are available in the openldap_global_conf type.

ensure

Valid values: present, absent

The basic property that the resource should be in.

Default value: present

value

Parameters

The following parameters are available in the openldap_global_conf type.

name

namevar

provider

The specific backend to use for this openldap_global_conf resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

target

openldap_module

Manages OpenLDAP modules.

Properties

The following properties are available in the openldap_module type.

ensure

Valid values: present, absent

The basic property that the resource should be in.

Default value: present

Parameters

The following parameters are available in the openldap_module type.

name

namevar

The default namevar.

provider

The specific backend to use for this openldap_module resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

target

openldap_overlay

Manages OpenLDAP Overlays

Properties

The following properties are available in the openldap_overlay type.

ensure

Valid values: present, absent

The basic property that the resource should be in.

Default value: present

index

The index of the overlay.

options

Overlay options.

Parameters

The following parameters are available in the openldap_overlay type.

name

namevar

The default namevar

overlay

The name of the overlay to apply

provider

The specific backend to use for this openldap_overlay resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

suffix

The suffix to which the overlay applies

target

The slapd.conf file

openldap_schema

Manages OpenLDAP schemas.

Properties

The following properties are available in the openldap_schema type.

date

The modifyTimestamp of the schema.

ensure

Valid values: present, absent

The basic property that the resource should be in.

Default value: present

index

The index of the schema.

Parameters

The following parameters are available in the openldap_schema type.

name

namevar

The default namevar.

path

The location to the schema file.

provider

The specific backend to use for this openldap_schema resource. You will seldom need to specify this --- Puppet will usually discover the appropriate provider for your platform.

Functions

openldap_password

Type: Ruby 4.x API

Returns the openldap password hash from the clear text password.

openldap_password(String $secret, Optional[Enum["PBKDF2","CRYPT","MD5","SMD5","SSHA","SHA"]] $scheme, Optional[Integer] $iterations, Optional[Enum["SHA256", "SHA512"]] $hash_type)

The openldap_password function.

Returns: String The hashed secret.

secret

Data type: String

The secret to be hashed.

scheme

Data type: Optional[Enum["PBKDF2","CRYPT","MD5","SMD5","SSHA","SHA"]]

The optional scheme to use (defaults to SSHA).

iterations

Data type: Optional[Integer]

The number of iterations to use for the hashing (defaults to 60000). Only applicable for PBKDF2.

hash_type

Data type: Optional[Enum["SHA256", "SHA512"]]

The hash algorithm to use: 'SHA256' (32 bytes) or 'SHA512' (64 bytes). Defaults to 'SHA512'. Only applicable for PBKDF2.

Data types

Openldap::Access_hash

A valid acl value for openldap::server::access_wrapper

Alias of

Hash[Openldap::Access_title, Struct[{
    position => Optional[Variant[Integer,String[1]]],
    what     => Optional[String[1]],
    access   => Array[Openldap::Access_rule],
    suffix   => Optional[String[1]],
  }]]

Openldap::Access_rule

A valid access rule for openldap::server::access

Alias of Pattern[/\Aby /]

Openldap::Access_title

A valid title for an openldap::server::access resource

Alias of Pattern[/\A\d+ on /]

Openldap::Attribute

An LDAP attribute in the form "key: value"

Alias of Pattern[/\A[^ ]+: [^\n]+/]

Openldap::Attributes

A set of LDAP attributes

Alias of

Variant[Hash[
    String[1],
    Variant[
      String[1],
      Array[
        String[1],
        1,
      ],
    ],
  ], Array[
    Openldap::Attribute,
    1,
  ], Openldap::Attribute]

Openldap::Limits

Limits for clients

Alias of

Hash[String[1], Struct[
    {
      # Specify time limits
      Optional['time']           => Variant[Integer[0], Enum['unlimited']],
      Optional['time.soft']      => Variant[Integer[0], Enum['unlimited']],
      Optional['time.hard']      => Variant[Integer[0], Enum['unlimited']],
      # Specifying size limits
      Optional['size']           => Variant[Integer[0], Enum['unlimited']],
      Optional['size.soft']      => Variant[Integer[0], Enum['unlimited']],
      Optional['size.hard']      => Variant[Integer[0], Enum['unlimited']],
      Optional['size.unchecked'] => Variant[Integer[0], Enum['disabled', 'unlimited']],
      # Size limits and Paged Results
      Optional['size.pr']        => Variant[Integer[0], Enum['noEstimate', 'unlimited']],
      Optional['size.prtotal']   => Variant[Integer[0], Enum['disabled', 'unlimited']],
    },
  ]]

Openldap::Syncrepl

Parameters for database replication consumers

Alias of

Struct[{
    rid                        => Variant[Integer[0, 999], Pattern['\A\d{1,3}\z']],
    provider                   => Pattern['\Aldaps?://[^/:]+(:\d+)?\z'],
    searchbase                 => String[1],
    Optional['type']           => Enum['refreshOnly', 'refreshAndPersist'],
    Optional[interval]         => Pattern['\A\d{2}:\d{2}:\d{2}:\d{2}\z'],
    Optional[retry]            => String[1],
    Optional[filter]           => String[1],
    Optional[scope]            => Enum['sub', 'one','base'],
    Optional[attrs]            => String[1],
    Optional[exattrs]          => String[1],
    Optional[attrsonly]        => Boolean,
    Optional[sizelimit]        => Integer[0],
    Optional[timelimit]        => Integer[0],
    Optional[schemachecking]   => Enum['on', 'off'],
    Optional[network-timeout]  => Integer[0],
    Optional[timeout]          => Integer[0],
    Optional[updatedn]         => String[1],
    Optional[bindmethod]       => Enum['simple', 'sasl'],
    Optional[binddn]           => String[1],
    Optional[saslmech]         => String[1],
    Optional[authcid]          => String[1],
    Optional[authzid]          => String[1],
    Optional[credentials]      => Variant[String[1], Sensitive[String[1]]],
    Optional[realm]            => String[1],
    Optional[secprops]         => String[1],
    Optional[keepalive]        => Pattern['\A\d+:\d+:\d+\z'],
    Optional[starttls]         => Enum['yes', 'critical'],
    Optional[tls_cert]         => Stdlib::Absolutepath,
    Optional[tls_key]          => Stdlib::Absolutepath,
    Optional[tls_cacert]       => Stdlib::Absolutepath,
    Optional[tls_cacertdir]    => Stdlib::Absolutepath,
    Optional[tls_reqcert]      => Enum['never', 'allow', 'try', 'demand'],
    Optional[tls_cipher_suite] => String[1],
    Optional[tls_crlcheck]     => Enum['none', 'peer', 'all'],
    Optional[tls_protocol_min] => Pattern['\A\d+(\.\d+)?\z'],
    Optional[suffixmassage]    => String[1],
    Optional[logbase]          => String[1],
    Optional[logfilter]        => String[1],
    Optional[syncdata]         => Enum['default', 'accesslog', 'changelog'],
  }]

Openldap::Tls_moznss_compatibility

The list of possible values TLS_MOZNSS_COMPATIBILITY can have (based on the man page), and an 'absent' (a puppet directive to remove an existing declaration).

Alias of Enum['on', 'true', 'yes', 'off', 'false', 'no', 'absent']