Resource Type: krb5kdc_auto_keytabs

Defined in:

lib/puppet/type/krb5kdc_auto_keytabs.rb

Providers:

generate

Overview

Auto-generates principals and keytabs on a functional KDC and outputs the keytabs to a directory of the user’s choosing.

Can optionally take a hash of hosts, with associated principal metadata, to be created on the KDC. Will warn if you are attempting to add a host that does not have a valid REALM.

Properties

• ensure (defaults to: present)

  The state to enforce on the resource

  Supported values:

  • present
  • generated
  • absent

Parameters

• all_known (defaults to: false)

  Generate keytabs for any ‘host/.*’ entires known to the KDC.

  Supported values:

  • true
  • false
  • yes
  • no
• global_services

  The global services that should be applied to every auto-generated principal

• group (defaults to: group)

  The group that should own the generated keytabs, defaults to ‘#:group’ when installing into a Puppet Environment and ‘root’ otherwise.

• hosts

  A Hash of hosts that should be managed in the KDC.

  The Hash format should be as follows:

  {

  'fqdn' => {
    'ensure'   => ('absent' | 'present') # Required
    'realms'   => ['REALM1', 'REALM2']   # Optional. Will be auto-upcased
    'services' => ['svc1','svc2']        # Optional
  }
  

  }

  If ‘$global_services’ is set, it will be added to the list of services for each host here.

• introspect (defaults to: true)

  Attempt to discover, and create, all relevant keytabs from data on the Puppet server.

  This will create host principals for discovered entities if they do not exist already!

  This takes a best guess from the SIMP default PKI key locations:

  * `${environmentpath}/${environment}/keydist`
  * `/var/simp/environments/${environment}/site_files/pki_files/files/keydist`
  

  If ‘$environmentpath` is not set, then `$confdir` will be substituted for `$environmentpath/$environment`

  Supported values:

  • true
  • false
  • yes
  • no
• name (namevar)

  The output directory to which to write the keytabs

  If ‘__default__’ will be set to either ‘/var/simp/environments/$environment/site_files/krb5_files/files/keytabs` or `/var/kerberos/krb5kdc/generated_keytabs` depending on which target path exists.

• provider

  The specific backend to use for this ‘krb5kdc_auto_keytabs` resource. You will seldom need to specify this — Puppet will usually discover the appropriate provider for your platform.

• purge (defaults to: true)

  Remove all unmanaged keytabs from the ‘$name’ directory

  Supported values:

  • true
  • false
  • yes
  • no
• realms (defaults to: Facter.value(:domain))

  The realms under which the hosts should be generated

• user (defaults to: root)

  The user that should own the generated keytabs, defaults to ‘#:user’ when installing into a Puppet Environment and ‘root’ otherwise.