Puppet Module For Centrify Express [Reloaded]

I've expanded on my previous simple Puppet module for Centrify Express based on the helpful advice I received from David McNeely at Centrify. This latest version of my module does not expose domain username or passwords. It requires you to pre-create them from a machine already running Centrify Express as a domain member.

You can pre-create the account just before you sign the puppet client's certificate.

sudo adjoin -w -P -u  -n  your.domain.net
sudo puppetca -s new-hostname.your.domain.net

Download the latest code from GitHub. puppet-centrify

git clone git://github.com/ninjix/puppet-centrifydc.git

The new version of the module has the following features:

• Installs the Centrify Express Ubuntu package
• Automatically attempts to join the machine to the domain after install the apt package
• Registers the machine name in Active Directory DNS
• Restricts logins on Ubuntu servers to the "Domain Admins" user group
• Allows additional logins for users and groups to be granted access

Note: Make sure you enable the Canonical partner repository.

deb http://archive.canonical.com/ubuntu lucid partner

Here are some examples of how you can configure your nodes using this module.

node    'deimos',
        'phobos' inherits default {

        $domain = "my.lab.net"
        include centrifydc
}

This is a basic method which provides the domain. The "Domain Admins" group will be granted access by default. You can set other defaults by editing the templates.

node    'callisto' inherits default {

        $domain = "my.lab.net"
        groups_allow = ["Astro Group","Physics Team"]

        include centrifydc
}

Example two allows members of the "Astro Group" and "Physics Team" domain groups to login in addition to members of the "Domain Admin" group.

node    'ganymede' inherits default {

        $domain = "my.lab.net"
        users_allow = ["carl.sagan"]
        groups_allow = ["Astro Group","Physics Team"]

        include centrifydc
}

The third example is similar to the second but also allows the user "carl.sagan" to login.