-
Notifications
You must be signed in to change notification settings - Fork 11
Open
Description
Setting up a security realm with authorization with LDAP and adding a group search parameter requires a jboss_batch command. When running the LDAP resource setup below, the jboss_batch is executed last (in the jboss_admin exec hierarchy) and even though the response returned is "reload-required", the cleanup process isn't executed, the server isn't reloaded, and then the manifest fails.
jboss_admin::server {'main':
base_path => '/opt/jboss/',
}
jboss_admin::resource::ldap_connection {'ldap_connection':
server => 'main',
search_credential => 'search',
search_dn => 'dn',
url => 'ldaps://test-domain',
ensure => present,
cli_path => '/core-service=management/ldap-connection=ldap_connection',
}
jboss_admin::resource::security_realm { 'ldap_security_realm':
server => 'main',
map_groups_to_roles => true,
ensure => 'present',
cli_path => '/core-service=management/security-realm=ldap_security_realm'
}
jboss_admin::resource::authentication_ldap {'ldap_auth':
server => 'main',
base_dn => 'DC=test,DC=ldap',
connection => 'ldap_connection',
recursive => true,
username_attribute => 'username',
ensure => present,
cli_path => '/core-service=management/security-realm=ldap_security_realm/authentication=ldap',
}
jboss_batch { "LDAP Setup Resource":
batch => [
{
address => '/core-service=management/security-realm=ldap_security_realm/authorization=ldap',
options => {
connection => 'ldap_connection',
},
ensure => present
},
{
address => '/core-service=management/security-realm=ldap_security_realm/authorization=ldap/group-search=principal-to-group',
options => {
group-dn-attribute => 'dn',
group-attribute => 'memberOf',
group-name => 'SIMPLE',
group-name-attribute => 'cn',
iterative => true,
},
ensure => present
}
],
server => main,
}
Metadata
Metadata
Assignees
Labels
No labels