<%#
kind: snippet
name: freeipa_register
%>
# FreeIPA Registration Snippet
#
# Optional parameters:
#
#   freeipa_server              IPA server
#
#   freeipa_sudo                Enable sudoers
#                               Default: true
#
#   freeipa_ssh                 Enable ssh integration
#                               Default: true
#
#   freeipa_automount           Enable automounter
#                               Default: false
#
#   freeipa_automount_location  Location for automounts
#
#   freeipa_mkhomedir           Enable automatically making home directories
#                               Default: true
#
#   freeipa_opts                Additional options to pass directly to installer
#
<% if @host.operatingsystem.family == 'Redhat' -%>
  <% if @host.operatingsystem.name == 'Fedora' -%>
    freeipa_client=freeipa-client
  <% else -%>
    freeipa_client=ipa-client
  <% end -%>
<% else -%>
  freeipa_client=freeipa-client
<% end -%>

<%= @host.operatingsystem.family == 'Redhat' ? 'yum install -y libsss_sudo' : 'apt-get install -y libsss-sudo' %> $freeipa_client

##
## IPA Client Installation
##
<% if @host.params['freeipa_server'] -%>
<% domain = @host.params['freeipa_domain'] || @host.realm.name.downcase -%>

freeipa_server="--server <%= @host.params['freeipa_server'] %> --domain <%=domain %>"
<% end -%>

<% unless @host.param_false? 'freeipa_mkhomedir' %>
freeipa_mkhomedir="--mkhomedir"
<% end -%>

<% if @host.param_false? 'freeipa_ssh' %>
freeipa_ssh="--no-ssh"
<% end -%>

<% if @host.params['freeipa_opts'] -%>
freeipa_opts="<%= @host.params['freeipa_opts'] %>"
<% end -%>

/usr/sbin/ipa-client-install -w '<%= @host.otp %>' --realm=<%= @host.realm %> -U $freeipa_mkhomedir $freeipa_opts $freeipa_server $freeipa_ssh

##
## Automounter
##

<% if @host.params['freeipa_automount_location'] -%>
automount_location="--location <%= @host.params['freeipa_automount_location'] %>"
<% end -%>

<% if @host.param_true? 'freeipa_automount' -%>
if [ -f /usr/sbin/ipa-client-automount ]
then
  /usr/sbin/ipa-client-automount $freeipa_server $automount_location --unattended
fi
<% end -%>

##
## Sudoers
##

<% unless @host.param_false? 'freeipa_enable_sudo' %>

freeipa_client_version=$(ipa-client-install --version)
freeipa_client_version_major=$(echo $freeipa_client_version | cut -f1 -d.)
freeipa_client_version_minor=$(echo $freeipa_client_version | cut -f2 -d.)
freeipa_realm=$(grep default_realm /etc/krb5.conf | cut -d"=" -f2 | tr -d ' ')
freeipa_domain=$(grep -A 2 domain_realm /etc/krb5.conf | tail -n1 | awk '{print $1}')
freeipa_dn=$(for word in $(echo $freeipa_domain | sed 's/\./ /g'); do echo -n dc=$word,; done)
sssd_version=$(sssd --version)
sssd_major=$(echo $sssd_version | cut -f1 -d.)
sssd_minor=$(echo $sssd_version | cut -f2 -d.)
LDAP_CONFIG=$(mktemp)

# >=ipa-client-4.1.0 automatically configures sssd for sudo
# =<ipa-client-3 requires manual configuration which this snippet takes care of

if [ $freeipa_client_version_major -lt 4 ]
then
  # Modify sssd.conf
  sed -i -e "s/services = .*/\0, sudo/" /etc/sssd/sssd.conf

  # Modify sssd.conf for sssd <1.11 (RHEL <6.6)
  if [ $sssd_minor -lt 11 ] || [ $sssd_major -lt 1 ]
  then
    <% if @host.params['freeipa_server'] -%>
    ldap_uri=", ldap://<%= @host.params['freeipa_server'] %>"
    krb5_server=<%= @host.params['freeipa_server'] %>
    <% else -%>
    krb5_server="_srv_"
    <% end -%>

cat <<EOF > $LDAP_CONFIG
sudo_provider = ldap
ldap_uri = _srv_ $ldap_uri
ldap_sudo_search_base = ou=SUDOers,${freeipa_dn%?}
ldap_sasl_mech = GSSAPI
ldap_sasl_authid = host/$HOSTNAME
ldap_sasl_realm = $freeipa_realm
krb5_server = $krb5_server
EOF
  sed -i -e "/\[domain\/.*\]/ r $LDAP_CONFIG" /etc/sssd/sssd.conf
  fi

  # Modify nsswitch.conf
  grep -q sudoers /etc/nsswitch.conf
  if [[ $? -eq 0 ]];
  then
    sed -i -e "s/^sudoers.*/sudoers:    files sss/" /etc/nsswitch.conf
  else
    echo "sudoers:    files sss" >> /etc/nsswitch.conf
  fi

  # Configure nisdomain
  <% if @host.operatingsystem.family == 'Redhat' -%>
    authconfig --nisdomain ${freeipa_domain} --update
    chkconfig sssd on
    
    if [[ $(rpm -qa systemd | wc -l) -gt 0 ]];
    then
      domain_service=/usr/lib/systemd/system/*-domainname.service
      
      # Workaround for BZ1071969 on RHEL 7.0
      grep -q "DefaultDependencies=no" $domain_service
      if [[ $? -ne 0 ]]
      then
        sed -i -e "s/\[Unit\]/\[Unit\]\nDefaultDependencies=no/" $domain_service
      fi

      systemctl start $(basename $domain_service)
      systemctl enable $(basename $domain_service)
    fi
  <% else -%>
  # OS is not RedHat
  sed -i -e '/^exit /d' /etc/rc.local
  echo "nisdomainname ${freeipa_domain}" >> /etc/rc.local
  echo "exit 0" >> /etc/rc.local
  nisdomainname ${freeipa_domain}  
  <% end -%>
fi

<% end -%>

