salt.pillar.pillar_ldap¶

Use LDAP data as a Pillar source

This pillar module executes a series of LDAP searches. Data returned by these searches are aggregated, whereby data returned by later searches override data by previous searches with the same key.

The final result is merged with existing pillar data.

The configuration of this external pillar module is done via an external file which provides the actual configuration for the LDAP searches.

Configuring the LDAP ext_pillar¶

The basic configuration is part of the master configuration.

ext_pillar:
  - pillar_ldap: /etc/salt/master.d/pillar_ldap.yaml

Note

When placing the file in the master.d directory, make sure its name doesn't end in .conf, otherwise the salt-master process will attempt to parse its content.

Warning

Make sure this file has very restrictive permissions, as it will contain possibly sensitive LDAP credentials!

The only required key in the master configuration is pillar_ldap pointing to a file containing the actual configuration.

Configuring the LDAP searches¶

The file is processed using Salt's Renderers <renderers> which makes it possible to reference grains within the configuration.

Warning

When using Jinja in this file, make sure to do it in a way which prevents leaking sensitive information. A rogue minion could send arbitrary grains to trick the master into returning secret data. Use only the 'id' grain which is verified through the minion's key/cert.

Map Mode¶

The it-admins configuration below returns the Pillar it-admins by:

filtering for: - members of the group it-admins - objects with objectclass=user
returning the data of users, where each user is a dictionary containing the configured string or list attributes.

Configuration¶

salt-users:
  server:    ldap.company.tld
  port:      389
  tls:       true
  dn:        'dc=company,dc=tld'
  binddn:    'cn=salt-pillars,ou=users,dc=company,dc=tld'
  bindpw:    bi7ieBai5Ano
  referrals: false
  anonymous: false
  mode:      map
  dn:        'ou=users,dc=company,dc=tld'
  filter:    '(&(memberof=cn=it-admins,ou=groups,dc=company,dc=tld)(objectclass=user))'
  attrs:
    - cn
    - displayName
    - givenName
    - sn
  lists:
    - memberOf

search_order:
  - salt-users

Result¶

{
    'salt-users': [
        {
            'cn': 'cn=johndoe,ou=users,dc=company,dc=tld',
            'displayName': 'John Doe'
            'givenName': 'John'
            'sn': 'Doe'
            'memberOf': [
              'cn=it-admins,ou=groups,dc=company,dc=tld',
              'cn=team01,ou=groups,dc=company'
            ]
        },
        {
            'cn': 'cn=janedoe,ou=users,dc=company,dc=tld',
            'displayName': 'Jane Doe',
            'givenName': 'Jane',
            'sn': 'Doe',
            'memberOf': [
              'cn=it-admins,ou=groups,dc=company,dc=tld',
              'cn=team02,ou=groups,dc=company'
            ]
        }
    ]
}

salt.pillar.pillar_ldap.ext_pillar(minion_id, pillar, config_file)¶: Execute LDAP searches and return the aggregated data