ghoneycutt / puppet-module-nsswitch Goto Github PK

We need them

Need to validate the parameters. See the validation functions in https://github.com/puppetlabs/puppetlabs-stdlib/tree/3.2.0

Hello,

Pull request #37 introduced a bug with its default settings causing an error message every time a user runs the sudo command. This only occurs if the package sssd is not installed. The missing library seems to be present in sssd-common.

Since sssd is not always installed on RHEL7 systems I would propose to remove 'sss' for the default sudoers nsswitch configuration or make a test which only applies if the package sssd is present on the system.

sudo: Unable to dlopen /usr/lib64/libsss_sudo.so: (null)
sudo: Unable to initialize SSS source. Is SSSD installed on your machine?

Release 1.0 version

I'm curious what level of changes to this module would be accepted in a PR to support 'sssd'. The simplest I'm implementing is to add a parameter called ldap_nss_module which defaults to ldap but can be changed to sssd. However in some of my environments I do not enable SSSD to manage automount, for example, so leaving some lines in nsswitch.conf to only have files would be ideal since SSSD's supported services are individually enabled.

A few more extensive "refactor" ideas:

1. Add a parameter for each database in nsswitch.conf, for example ensure_ldap_passwd, ensure_sssd_passwd, etc. That list of parameters could get long.
2. Replace current ensure parameters with ones like passwd, shadow, etc that is either a string or array that is joined to form a string used in the template.

In recent versions of sudo and sssd, sudo can query sssd for rules.

http://www.freeipa.org/images/7/77/Freeipa30_SSSD_SUDO_Integration.pdf

Can the template be modified to accept a sudo_real?

https://github.com/ghoneycutt/puppet-module-utils/blob/master/Rakefile
https://github.com/ghoneycutt/puppet-module-utils/blob/master/.travis.yml