epflsti-epfl_sso

UNIX single sign-on using EPFL's LDAP and Kerberos servers


License
MIT
Install
puppet module install epflsti-epfl_sso --version 1.2.1

Documentation

puppet.epfl_sso

UNIX single sign-on using EPFL's LDAP and Kerberos servers

Apply one-shot

Install Puppet standalone then, as root:

  1. If you are attempting to join the domain for the first time (i.e. join_domain => true; see below) this will stop mid-way with an error message that directs you to join the domain interactively. Here is how that could go: kinit AD123456 /usr/local/sbin/adjoin join OU=iccluster,OU=IC
  2. Run the puppet apply command line from step 3 once more, this time to completion hopefully
  3. If home automounting was requested (i.e. ad_automount_home => true), reboot

Apply as part of a Puppet server + agent deployment

Refer to the Puppet documentation

Class Parameters (Examples)

💡 For the complete reference, see the comments at the top of init.pp

“Bells and whistles” configuration, if you are in command of a suitably powerful ADsciper account:

Poor man's “computer-object-less” configuration for unaccredited administrators: Kerberos outbound-only, no roaming /home, but still the same UIDs, passwords and (mostly) same groups as everyone else:

Development

To work off the latest ("master") version of epfl_sso:

  1. Be sure to remove previous version: puppet module uninstall epflsti-epfl_sso (add --ignore-changes if needed)
  2. Go in the puppet folder: cd /etc/puppet/code/modules (your mileage may vary on different distributions)
  3. Remove epfl_sso (but it should have been done at step 1)
  4. Clone the repo here: git clone https://gitlab.com/epfl-sti/puppet.epfl_sso.git epfl_sso