Merge fae6d2bff1 into 1a46975212

sudoers/files/sudoers

@@ -1,3 +1,4 @@
+{% from "sudoers/map.jinja" import ad_group_maps with context %}
 {%- if (not included) %}
   {%- set sudoers = pillar.get('sudoers', {}) %}
   {%- if grains['os_family'] == 'Debian' %}
@@ -94,6 +95,13 @@ Runas_Alias {{ name }} = {{ ",".join(runas) }}
 %{{ group }} {{ spec }}
   {%- endfor %}
 {%- endfor %}
+{%- for unix_group in ad_groups %}
+  {%- if unix_group in ad_group_maps.keys() %}
+%{{ unix_group }} {{ ad_group_maps[unix_group] }}
+  {%- else %}
+%{{ unix_group }} {{ ad_group_maps['default'] }}
+  {%- endif %}
+{%- endfor %}
 
 {% if includedir %}
 ## Read drop-in files from /etc/sudoers.d

sudoers/init.sls

@@ -1,5 +1,8 @@
 {% from "sudoers/map.jinja" import sudoers with context %}
 
+# our list of plos core active directory groups
+{%- set ad_groups = salt['pillar.get']('group_map:core').keys() %}
+
 sudo:
   pkg.installed:
     - name: {{ sudoers.pkg }}
@@ -14,5 +17,6 @@ sudo:
     - check_cmd: {{ sudoers.get('execprefix', '/usr/sbin') }}/visudo -c -f
     - context:
         included: False
+        ad_groups: {{ ad_groups }}
     - require:
       - pkg: sudo

sudoers/map.jinja

@@ -14,4 +14,16 @@
                 'includedir': '/usr/local/etc/sudoers.d',
                 'execprefix': '/usr/local/sbin',
                 'group': 'wheel'},
-}, merge=salt['pillar.get']('sudoers:lookup')) %}
+}, merge=salt['pillar.get']('sudoers:lookup', None)) %}
+
+# our plos active directory core groups sudoers permissions, filtered by environment
+{% set ad_group_maps = salt['grains.filter_by']({
+    'default': { 'default': 'ALL = (root) NOEXEC:NOPASSWD: SUPPORT' },
+    'vagrant': { 'default': 'ALL = (ALL:ALL) NOPASSWD: ALL' },
+    'dev':     { 'default': 'ALL = (ALL:ALL) NOPASSWD: ALL' },
+    'qa':      { 'default': 'ALL = (root) NOEXEC:NOPASSWD: SUPPORT',
+                 'plosqa': 'ALL = (root) NOPASSWD: ALL' },
+    },
+    grain='environment',
+    merge=salt['pillar.get']('group_maps:lookup', None))
+%}