choria_aaasvc

Installs and configure the Choria centralised AAA service

Table of Contents

• choria_aaasvc
  • Description
  • Setup
    • What choria_aaasvc affects
    • Setup Requirements
    • Beginning with choria_aaasvc
  • Usage
    • Configure MCO client to use AAA svc
    • Configure AAA service to use a static list of users
  • Limitations
  • Development

Description

This module installs the Choria centralised AAA service, part of the choria orchestration system.

This service provides an alternative to the traditional certificate based AAA system provided in Choria and allows you to e.g. use your organization's SSO system to authenticate users.

For more background see the choria blog on this topic.

Setup

What choria_aaasvc affects

• The aaasvc package and it's configuration
• Files in the mcollective libdir.

Setup Requirements

You will need:

• An up-to-date choria deployment (choria >= 0.13.1)
• Three sets of certificates for use by aaasvc, as described in the aaasvc documentation

Beginning with choria_aaasvc

1. Add the choria_aaasvc and choria (from choria/choria) classes to a host
2. Provision the certificates on the host - this is currently not handled by the module and must be done out of band.
3. Run puppet on the host
4. Verify the aaasvc installation using the method described in the docs

Note: the host you install choria_aaasvc on must be able to access the choria release repo or another repo that has the aaasvc package.

Usage

Configure MCO client to use AAA svc

• Add the choria_aaasvc::client class
• Configure the MCO client to use the AAA service

plugin.choria.security.request_signer.url = http://localhost:8080/choria/v1/sign
plugin.choria.security.request_signer.token_environment = CHORIA_TOKEN
plugin.choria.security.request_signer.force = 1

Configure AAA service to use a static list of users

To configure the AAA service to use a static list of users, we need to configure it to use the userlist authenticator and configure the list of users.

To configure the userlist authenticator, ensure that the authenticator parameter is set to userlist (this is the default):

choria_aaasvc::config:
  authenticator: userlist

To configure the list of users, set the choria_aaasvc::user_config parameter. For example:

choria_aaasvc::user_config:
- username: puppetadmin
  password: "$2y$05$c4b/0WZ5WJ3nhSZPN9m8keCUPlCYtNOTkqU4fDNEPCUy1C9Pfqn2e"
  acls:
  - puppet.*
- username: admin
  password: "....."
  opa_policy_file: "/etc/choria/signer/common.rego"

For details on the syntax and contents of the user list file, see the aaasvc docs

Limitations

Only tested on CentOS 7, but should work on any RedHat derivative.

Development

See CONTRIBUTING.md.

Reference

Table of Contents

Classes

Public Classes

• choria_aaasvc: Installs, configures and manages the Choria AAA system
• choria_aaasvc::client: Configure an MCO client to interact with the Choria AAA svc

Private Classes

• choria_aaasvc::config: Configures the Choria Server
• choria_aaasvc::install: Installs the choria-aaasvc package
• choria_aaasvc::service: Manages the aaasvc service

Classes

choria_aaasvc

Installs, configures and manages the Choria AAA system

• See also https://github.com/choria-io/aaasvc

Examples

include choria_aaasvc

Parameters

The following parameters are available in the choria_aaasvc class.

config_file

Data type: Stdlib::Compat::Absolute_path

Absolute path to the main choria AAA configuration file

choria_config_file

Data type: Stdlib::Compat::Absolute_path

Absolute path to the AAA svc choria config file

config

Data type: Hash

The main configuration for AAA svc

choria_config

Data type: Hash

The choria side configuration for AAA svc

ensure

Data type: Enum['present', 'absent']

Add or remove the software

package_name

Data type: String

The package to install

service_name

Data type: String

Name of the choria AAA service

version

Data type: String

The version of Choria AAA to install

user_config

Data type: Array[Hash]

List of users to configure for the userlist authenticator.

userlist_file

Data type: Stdlib::Compat::Absolute_path

Absolute path to the file containing the list of users. Note that this is only used if using the userlist authenticator.

choria_aaasvc::client

Configure an MCO client to interact with the Choria AAA svc

Examples

include choria_aaasvc::client

Parameters

The following parameters are available in the choria_aaasvc::client class.

config

Data type: Hash

Changelog

All notable changes to this project will be documented in this file.

Release 0.2.0

Features

• Update default aaasvc version to 0.3.1.
• Support configuration of separate users file for the userlist authenticator
• Add more unit test coverage

Bugfixes

Known Issues

• All certificates and keys need to be provisioned by hand.

Release 0.1.1

Features

• Travis CI build integration with badge.
• Expand README to describe setup / getting started further.

Release 0.1.0

Features

• First working version with very basic setup of config.

Bugfixes

Known Issues

• All certificates and keys need to be provisioned by hand.