Skip to content

Latest commit

 

History

History
481 lines (249 loc) · 7.48 KB

REFERENCE.md

File metadata and controls

481 lines (249 loc) · 7.48 KB
Raw

Reference

Table of Contents

Classes

  • ssp: Install and configure self-service-password

Classes

ssp

Install and configure self-service-password

Examples

class { 'ssp' :
  system_owner      => 'ssp',
  ldap_binddn       => 'uid=bindssp,cn=sysaccounts,cn=etc,dc=example,dc=com',
  ldap_bindpw       => 'bindpw',
  ldap_base         => 'cn=users,cn=accounts,dc=example,dc=com',
  ldap_whochange_pw => 'manager',
  mail_from         => 'admin@example.com',
  manage_git        => true,
  ldap_url          => ['ldap://ldap_address'],
}

Parameters

The following parameters are available in the ssp class.

system_owner

Data type: String[1]

system user account that own files

ldap_binddn

Data type: String[1]

DN used to bind directory

ldap_bindpw

Data type: String[1]

Password of the DN used to bind directory

ldap_base

Data type: String[1]

Base search where users are searched.

ldap_whochange_pw

Data type: Enum['user','manager']

who change the password ?

  • user: the user itself
  • manager: the above binddn

Default value: 'user'

ldap_whochange_sshkey

Data type: Enum['user','manager']

who change the SSH key ?

  • user: the user itself
  • manager: the above binddn

Default value: 'user'

ldap_filter

Data type: String[1]

Filter on reserched objects in LDAP

Default value: '(&(objectClass=person)($ldap_login_attribute={login}))'

manage_git

Data type: Boolean

Install git if true, required if git is not installed by an other process.

Default value: false

manage_rootpath

Data type: Boolean

If true creates the path defined by $system_rootpath

Default value: false

system_rootpath

Data type: Stdlib::Absolutepath

Path where SSP is installed

Default value: '/var/ssp'

system_rootpath_mode

Data type: String

Unix mode set to path defined by $system_rootpath

Default value: '0750'

version_tag

Data type: Pattern['^v\d']

Version of installed SSP

Default value: 'v1.3'

ldap_url

Data type: Array[Pattern['^ldap']]

List of LDAP URLs

Default value: ['ldap://localhost']

ldap_starttls

Data type: Boolean

Use StartTLS instead of LDAP over SSL

Default value: true

ldap_login_attribute

Data type: String

LDAP attribute used as login

Default value: 'uid'

ldap_fullname_attribute

Data type: String

LDAP attribute used as full name

Default value: 'cn'

lang

Data type: String

Language of SSP webui.

Default value: 'en'

show_menu

Data type: Boolean

Display menu on top of SSP webui

Default value: true

show_help

Data type: Boolean

Display help messages

Default value: true

logo

Data type: Optional[String[1]]

URN of logo image

Default value: undef

background_image

Data type: Optional[String[1]]

URN of background image

Default value: undef

login_forbidden_chars

Data type: Optional[String[1]]

Characters considered as invalid in login

Default value: undef

obscure_failure_messages

Data type: Optional[String[1]]

Hide some messages to not disclose sensitive information. These messages will be replaced by value of obscure_failure_messages.

Default value: undef

default_action

Data type: Enum['change','sendtoken']

Default action displayed by the webui

Default value: 'change'

use_change

Data type: Boolean

enable (with true) or disable (with false) standard change form usage.

Default value: true

use_tokens

Data type: Boolean

enable (with true) or disable (with false) tokens usage.

Default value: true

crypt_tokens

Data type: Boolean

crypt tokens (with true) or no (with false)

Default value: true

token_lifetime

Data type: Integer

When token are used, the token lifetime.

Default value: 3600

mail_address_use_ldap

Data type: Boolean

Mail is got from LDAP.

Default value: true

mail_from

Data type: Pattern['^.+@.+']

Who the email should come from

Default value: "admin@${facts['networking']['domain']}"

mail_from_name

Data type: String

Name displayed with mail_from

Default value: 'Self Service Password'

mail_signature

Data type: String

Signature added in mail

Default value: ''

notify_on_change

Data type: Boolean

Notify users anytime their password is changed

Default value: false

mail_sendmailpath

Data type: Stdlib::Absolutepath

Sendmail path see https://github.com/PHPMailer/PHPMailer

Default value: '/usr/sbin/sendmail'

mail_smtp_host

Data type: Stdlib::Host

SMTP host to use

Default value: '127.0.0.1'

mail_smtp_port

Data type: Integer

SMTP port to use

Default value: 25

mail_smtp_auth

Data type: Boolean

Enable SMTP auth is true

Default value: false

mail_smtp_user

Data type: Optional[String[1]]

SMTP user used with SMTP auth

Default value: undef

mail_smtp_pass

Data type: Optional[String[1]]

SMTP password used with SMTP auth

Default value: undef

pwd_min_length

Data type: Integer

Local password policy applied before directory password policy. Minimal length.

Default value: 0

pwd_max_length

Data type: Integer

Local password policy applied before directory password policy. Maximum length

Default value: 0

pwd_min_lower

Data type: Integer

Local password policy applied before directory password policy. Minimal lower characters

Default value: 0

pwd_min_upper

Data type: Integer

Local password policy applied before directory password policy. Minimal upper characters

Default value: 0

pwd_min_digit

Data type: Integer

Local password policy applied before directory password policy. Minimal digit characters

Default value: 0

pwd_min_special

Data type: Integer

Local password policy applied before directory password policy. Minimal special characters

Default value: 0

pwd_no_reuse

Data type: Boolean

Local password policy applied before directory password policy. Don't reuse the same password as currently

Default value: false

pwd_special_chars

Data type: Optional[String]

Definition of special characters

Default value: undef

pwd_forbidden_chars

Data type: Optional[String[1]]

Definition of forbidden characters in password

Default value: undef

pwd_diff_login

Data type: Boolean

Check that password is different than login

Default value: true

pwd_complexity

Data type: Integer

Number of different class of character required

Default value: 0

pwd_show_policy

Data type: Enum['always','never','oneerror']

Show policy constraints message

Default value: 'never'

pwd_show_policy_pos

Data type: Enum['above','below']

Position of password policy constraints message

Default value: 'above'

pwd_no_special_at_ends

Data type: Boolean

Disallow use of the only special character as defined in $pwd_special_chars at the beginning and end

Default value: false

allow_change_sshkey

Data type: Boolean

If true allow changing of sshPublicKey

Default value: false

change_sshkey_attribute

Data type: String

What attribute should be changed by the changesshkey action

Default value: 'sshPublicKey'

notify_on_sshkey_change

Data type: Boolean

Notify users anytime their sshPublicKey is changed

Default value: false