salt.modules.ldapmod¶
Salt interface to LDAP commands
- depends:
ldap Python module
- configuration:
In order to connect to LDAP, certain configuration is required in the minion config on the LDAP server. The minimum configuration items that must be set are:
ldap.basedn: dc=acme,dc=com (example values, adjust to suit)
If your LDAP server requires authentication then you must also set:
ldap.anonymous: False ldap.binddn: admin ldap.bindpw: password
In addition, the following optional values may be set:
ldap.server: localhost (default=localhost, see warning below) ldap.port: 389 (default=389, standard port) ldap.tls: False (default=False, no TLS) ldap.no_verify: False (default=False, verify TLS) ldap.anonymous: True (default=True, bind anonymous) ldap.scope: 2 (default=2, ldap.SCOPE_SUBTREE) ldap.attrs: [saltAttr] (default=None, return all attributes)
Warning
At the moment this module only recommends connection to LDAP services
listening on localhost. This is deliberate to avoid the potentially
dangerous situation of multiple minions sending identical update commands
to the same LDAP server. It's easy enough to override this behavior, but
badness may ensue - you have been warned.
- salt.modules.ldapmod.search(filter, dn=None, scope=None, attrs=None, **kwargs)¶
Run an arbitrary LDAP query and return the results.
CLI Example:
salt 'ldaphost' ldap.search "filter=cn=myhost"
Return data:
{'myhost': {'count': 1, 'results': [['cn=myhost,ou=hosts,o=acme,c=gb', {'saltKeyValue': ['ntpserver=ntp.acme.local', 'foo=myfoo'], 'saltState': ['foo', 'bar']}]], 'time': {'human': '1.2ms', 'raw': '0.00123'}}}
Search and connection options can be overridden by specifying the relevant option as key=value pairs, for example:
salt 'ldaphost' ldap.search filter=cn=myhost dn=ou=hosts,o=acme,c=gb scope=1 attrs='' server='localhost' port='7393' tls=True bindpw='ssh'
