Puppet module to install PowerBroker open and join machines to domain

init.pp

class pbis (

  $domain = $pbis::params::domain,

  $ldapbindaccount = $pbis::params::ldapbindaccount,

  $ldapbindpassword = $pbis::params::ldapbindpassword,

  $sudogroup = $pbis::params::sudogroup,

) inherits pbis::params {

}

params.pp

class pbis::params {

  $domain = 'example.com'

  $ldapbindaccount = 'user'

  $ldapbindpassword = 'password'

  $sudogroup = 'domain^admins'

}

install.pp

class pbis::install inherits pbis {

  include apt

  apt::source { 'powerbroker':

    comment  => 'Powerbroker Identity Services',

    location => 'http://repo.pbis.beyondtrust.com/apt',

    release  => 'pbiso',

    repos    => 'main',

    pin      => '500',

    key      => {

      'source'     => 'http://repo.pbis.beyondtrust.com/yum/RPM-GPG-KEY-pbis',

      'id'         => 'BE7FF72A6B7C8A9FAE061F4F2E52CD89C9CEECEF',

    },

    include  => {     

      'deb' => true,

    },

  }

  exec { 'pbis-apt-get-update':

    command => '/usr/bin/apt-get update',

    refreshonly => true,

  }

  package { 'pbis-open' :

    ensure => installed,

    provider => apt,

#    source => '/root/pbis-open-8.3.0.3287.linux.x86_64.deb',

  }

  $joindomain = "#!/bin/bash

    domainjoin-cli join $domain \$1 \$2       

    cd /opt/pbis/bin/  

    ./config UserDomainPrefix $domain

    ./config AssumeDefaultDomain true

    ./config LoginShellTemplate /bin/bash

    ./config HomeDirTemplate %H/%U

    ./config RequireMembershipOf '$domain\domain^users'

    "

  file { '/usr/local/bin/join-domain.sh' :

    ensure => present,   

    owner => root,

    group => root,

    mode => '0544',

    content => "$joindomain"

  }

}

join.pp

class pbis::join inherits pbis {

$sudofile="#

# This file MUST be edited with the visudo command as root.

#

# Please consider adding local content in /etc/sudoers.d/ instead of

# directly modifying this file.

#

# See the man page for details on how to write a sudoers file.

#

Defaults        env_reset

Defaults        mail_badpass

Defaults        secure_path=\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification

root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges

%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command

%sudo   ALL=(ALL:ALL) ALL

#Domain Admins

%$domain\\\\$sudogroup        ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on #include directives:

#includedir /etc/sudoers.d

"

  file { '/etc/sudoers' :

    ensure => present,

    owner => root,

    group => root,

    mode => '0440',

    content => "$sudofile"

  }

  exec { 'join':

    command => "/usr/local/bin/join-domain.sh $ldapbindaccount $ldapbindpassword",

    require => Class['pbis::install'],

    unless => "/bin/echo $(/usr/bin/domainjoin-cli query)|/bin/grep $domain",

  }

}