Changes for PAM support needed on RHEL7/Centos7

Gemfile

@@ -1,25 +1,28 @@
-source 'https://rubygems.org'
+source ENV['GEM_SOURCE'] || "https://rubygems.org"
 
 group :unit_tests do
   gem 'rake',                    :require => false
   gem 'rspec-puppet',            :require => false
   gem 'puppetlabs_spec_helper',  :require => false
-  gem 'puppet-lint', '1.0.1',    :require => false
+  gem 'puppet-lint',             :require => false
   gem 'puppet-syntax',           :require => false
   gem 'metadata-json-lint',      :require => false
+  gem 'rspec-puppet-facts',      :require => false
 end
 
 group :development do
   gem 'simplecov',   :require => false
-  gem 'guard-rake',  :require => false
+#  gem 'guard-rake',  :require => false
+end
+
+if facterversion = ENV['FACTER_GEM_VERSION']
+  gem 'facter', facterversion, :require => false
+else
+  gem 'facter', :require => false
 end
 
 if puppetversion = ENV['PUPPET_GEM_VERSION']
   gem 'puppet', puppetversion, :require => false
-  if puppetversion == "~> 2.7.0"
-    gem 'hiera-puppet', :require => false
-    gem 'hiera', :require => false
-  end
 else
   gem 'puppet', :require => false
 end

Rakefile

@@ -8,28 +8,22 @@ exclude_paths = [
   "spec/**/*",
 ]
 
-PuppetLint.configuration.relative = true
-PuppetLint.configuration.fail_on_warnings
-PuppetLint.configuration.ignore_paths = exclude_paths
-PuppetLint.configuration.log_format = "%{path}:%{linenumber}:%{check}:%{KIND}:%{message}"
-PuppetLint.configuration.send('relative')
-PuppetLint.configuration.send('disable_80chars')
-PuppetLint.configuration.send('disable_class_inherits_from_params_class')
-PuppetSyntax.exclude_paths = exclude_paths
+Rake::Task[:lint].clear
+PuppetLint::RakeTask.new :lint do |config|
+  config.ignore_paths = exclude_paths
+  config.disable_checks = ['140chars']
+  config.fail_on_warnings = true
+end
 
 desc "Run acceptance tests"
 RSpec::Core::RakeTask.new(:acceptance) do |t|
   t.pattern = 'spec/acceptance'
 end
 
-task :metadata do
-  sh "metadata-json-lint metadata.json"
-end
-
 desc "Run syntax, lint, and spec tests."
 task :test => [
   :syntax,
   :lint,
-  :metadata,
+  :metadata_lint,
   :spec,
 ]

manifests/ca.pp

@@ -100,13 +100,13 @@
   $ssl_key_size = 1024,
   $ca_expire    = 3650,
   $key_expire   = 3650,
-  $key_cn       = '',
-  $key_name     = '',
-  $key_ou       = '',
+  $key_cn       = undef,
+  $key_name     = undef,
+  $key_ou       = undef,
   $tls_auth     = false,
 ) {
 
-  include openvpn
+  include ::openvpn
 
   $group_to_set = $group ? {
     false   => $openvpn::params::group,

manifests/client.pp

@@ -205,8 +205,8 @@
   $authuserpass         = false,
   $setenv               = {},
   $setenv_safe          = {},
-  $up                   = '',
-  $down                 = '',
+  $up                   = undef,
+  $down                 = undef,
   $tls_auth             = false,
   $x509_name            = undef,
   $sndbuf               = undef,
@@ -242,7 +242,7 @@
       warning("Custom expiry time ignored: only integer is accepted but ${expire} is given.")
     }
   } else {
-    $env_expire = ''
+    $env_expire = undef
   }
 
   exec { "generate certificate for ${name} in context of ${ca_name}":
@@ -349,80 +349,80 @@
   concat::fragment { "${etc_directory}/openvpn/${server}/download-configs/${name}.ovpn/client_config":
     target  => "${etc_directory}/openvpn/${server}/download-configs/${name}.ovpn",
     content => template('openvpn/client.erb'),
-    order   => '01'
+    order   => '01',
   }
 
   concat::fragment { "${etc_directory}/openvpn/${server}/download-configs/${name}.ovpn/ca_open_tag":
     target  => "${etc_directory}/openvpn/${server}/download-configs/${name}.ovpn",
     content => "# Authentication \n<ca>\n",
-    order   => '02'
+    order   => '02',
   }
 
   concat::fragment { "${etc_directory}/openvpn/${server}/download-configs/${name}.ovpn/ca":
     target => "${etc_directory}/openvpn/${server}/download-configs/${name}.ovpn",
     source => "${etc_directory}/openvpn/${server}/download-configs/${name}/keys/${name}/ca.crt",
-    order  => '03'
+    order  => '03',
   }
 
   concat::fragment { "${etc_directory}/openvpn/${server}/download-configs/${name}.ovpn/ca_close_tag":
     target  => "${etc_directory}/openvpn/${server}/download-configs/${name}.ovpn",
     content => "</ca>\n",
-    order   => '04'
+    order   => '04',
   }
 
   concat::fragment { "${etc_directory}/openvpn/${server}/download-configs/${name}.ovpn/key_open_tag":
     target  => "${etc_directory}/openvpn/${server}/download-configs/${name}.ovpn",
     content => "<key>\n",
-    order   => '05'
+    order   => '05',
   }
 
   concat::fragment { "${etc_directory}/openvpn/${server}/download-configs/${name}.ovpn/key":
     target => "${etc_directory}/openvpn/${server}/download-configs/${name}.ovpn",
     source => "${etc_directory}/openvpn/${server}/download-configs/${name}/keys/${name}/${name}.key",
-    order  => '06'
+    order  => '06',
   }
 
   concat::fragment { "${etc_directory}/openvpn/${server}/download-configs/${name}.ovpn/key_close_tag":
     target  => "${etc_directory}/openvpn/${server}/download-configs/${name}.ovpn",
     content => "</key>\n",
-    order   => '07'
+    order   => '07',
   }
 
   concat::fragment { "${etc_directory}/openvpn/${server}/download-configs/${name}.ovpn/cert_open_tag":
     target  => "${etc_directory}/openvpn/${server}/download-configs/${name}.ovpn",
     content => "<cert>\n",
-    order   => '08'
+    order   => '08',
   }
 
   concat::fragment { "${etc_directory}/openvpn/${server}/download-configs/${name}.ovpn/cert":
     target => "${etc_directory}/openvpn/${server}/download-configs/${name}.ovpn",
     source => "${etc_directory}/openvpn/${server}/download-configs/${name}/keys/${name}/${name}.crt",
-    order  => '09'
+    order  => '09',
   }
 
   concat::fragment { "${etc_directory}/openvpn/${server}/download-configs/${name}.ovpn/cert_close_tag":
     target  => "${etc_directory}/openvpn/${server}/download-configs/${name}.ovpn",
     content => "</cert>\n",
-    order   => '10'
+    order   => '10',
   }
 
   if $tls_auth {
     concat::fragment { "/etc/openvpn/${server}/download-configs/${name}.ovpn/tls_auth_open_tag":
       target  => "${etc_directory}/openvpn/${server}/download-configs/${name}.ovpn",
       content => "<tls-auth>\n",
-      order   => '11'
+      order   => '11',
     }
 
     concat::fragment { "${etc_directory}/openvpn/${server}/download-configs/${name}.ovpn/tls_auth":
       target => "${etc_directory}/openvpn/${server}/download-configs/${name}.ovpn",
       source => "${etc_directory}/openvpn/${server}/download-configs/${name}/keys/${name}/ta.key",
-      order  => '12'
+      order  => '12',
     }
 
     concat::fragment { "${etc_directory}/openvpn/${server}/download-configs/${name}.ovpn/tls_auth_close_tag":
       target  => "${etc_directory}/openvpn/${server}/download-configs/${name}.ovpn",
       content => "</tls-auth>\nkey-direction 1\n",
-      order   => '13'
+      order   => '13',
     }
   }
 }

manifests/client_specific_config.pp

@@ -93,7 +93,7 @@
 
   file { "${::openvpn::params::etc_directory}/openvpn/${server}/client-configs/${name}":
     ensure  => $ensure,
-    content => template('openvpn/client_specific_config.erb')
+    content => template('openvpn/client_specific_config.erb'),
   }
 
 }

manifests/init.pp

@@ -15,7 +15,7 @@
 #   Hash of defaults for clients passed to openvpn::client defined type.
 #   Default: {} (hiera_hash)
 # [*clients*]
-#   Hash of clients passed to openvpn::client defined type. 
+#   Hash of clients passed to openvpn::client defined type.
 #   Default: {} (hiera_hash)
 # [*client_specific_config_defaults*]
 #   Hash of defaults for client specific configurations passed to
@@ -90,13 +90,13 @@
   validate_hash($server_defaults)
   validate_hash($servers)
 
-  class { 'openvpn::params': } ->
-  class { 'openvpn::install': } ->
-  class { 'openvpn::config': } ->
-  Class['openvpn']
+  class { '::openvpn::params': } ->
+  class { '::openvpn::install': } ->
+  class { '::openvpn::config': } ->
+  Class['::openvpn']
 
   if ! $::openvpn::params::systemd {
-    class { 'openvpn::service':
+    class { '::openvpn::service':
       subscribe => [Class['openvpn::config'], Class['openvpn::install'] ],
     }
     if empty($servers) {

manifests/params.pp

@@ -22,7 +22,6 @@
       $root_group          = 'root'
       $group               = 'nobody'
       $link_openssl_cnf    = true
-      $pam_module_path     = '/usr/lib64/openvpn/plugin/lib/openvpn-auth-pam.so'
       $easyrsa_source      = '/usr/share/easy-rsa/2.0'
       $namespecific_rclink = false
 
@@ -31,16 +30,19 @@
         $additional_packages = ['easy-rsa']
         $ldap_auth_plugin_location = undef
         $systemd = true
+        $pam_module_path = '/usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so'
       # Redhat/Centos == 6.0
       } elsif(versioncmp($::operatingsystemrelease, '6.0') >= 0) and $::operatingsystem != 'Amazon' {
-        $additional_packages = ['easy-rsa','openvpn-auth-ldap']
+        $additional_packages = ['easy-rsa', 'openvpn-auth-ldap']
         $ldap_auth_plugin_location = '/usr/lib64/openvpn/plugin/lib/openvpn-auth-ldap.so'
         $systemd = false
+        $pam_module_path = '/usr/lib64/openvpn/plugin/lib/openvpn-auth-pam.so'
       # Redhat/Centos < 6.0
       } else {
         $additional_packages = ['easy-rsa']
         $ldap_auth_plugin_location = undef
         $systemd = false
+        $pam_module_path = '/usr/lib64/openvpn/plugin/lib/openvpn-auth-pam.so'
       }
     }
     'Debian': { # Debian/Ubuntu

manifests/server.pp

@@ -439,15 +439,15 @@
   $port                      = '1194',
   $portshare                 = undef,
   $proto                     = 'tcp',
-  $status_version            = '',
+  $status_version            = undef,
   $status_log                = "/var/log/openvpn/${name}-status.log",
-  $server                    = '',
-  $server_ipv6               = '',
-  $server_bridge             = '',
+  $server                    = undef,
+  $server_ipv6               = undef,
+  $server_bridge             = undef,
   $push                      = [],
   $route                     = [],
   $route_ipv6                = [],
-  $keepalive                 = '',
+  $keepalive                 = undef,
   $fragment                  = false,
   $ssl_key_size              = 1024,
   $topology                  = 'net30',
@@ -459,32 +459,32 @@
   $management                = false,
   $management_ip             = 'localhost',
   $management_port           = 7505,
-  $up                        = '',
-  $down                      = '',
+  $up                        = undef,
+  $down                      = undef,
   $username_as_common_name   = false,
   $client_cert_not_required  = false,
   $ldap_enabled              = false,
-  $ldap_server               = '',
-  $ldap_binddn               = '',
-  $ldap_bindpass             = '',
-  $ldap_u_basedn             = '',
-  $ldap_g_basedn             = '',
+  $ldap_server               = undef,
+  $ldap_binddn               = undef,
+  $ldap_bindpass             = undef,
+  $ldap_u_basedn             = undef,
+  $ldap_g_basedn             = undef,
   $ldap_gmember              = false,
-  $ldap_u_filter             = '',
-  $ldap_g_filter             = '',
-  $ldap_memberatr            = '',
+  $ldap_u_filter             = undef,
+  $ldap_g_filter             = undef,
+  $ldap_memberatr            = undef,
   $ldap_tls_enable           = false,
-  $ldap_tls_ca_cert_file     = '',
-  $ldap_tls_ca_cert_dir      = '',
-  $ldap_tls_client_cert_file = '',
-  $ldap_tls_client_key_file  = '',
+  $ldap_tls_ca_cert_file     = undef,
+  $ldap_tls_ca_cert_dir      = undef,
+  $ldap_tls_client_cert_file = undef,
+  $ldap_tls_client_key_file  = undef,
   $ca_expire                 = 3650,
   $key_expire                = 3650,
-  $key_cn                    = '',
-  $key_name                  = '',
-  $key_ou                    = '',
-  $verb                      = '',
-  $cipher                    = '',
+  $key_cn                    = undef,
+  $key_name                  = undef,
+  $key_ou                    = undef,
+  $verb                      = undef,
+  $cipher                    = undef,
   $tls_cipher                = undef,
   $persist_key               = false,
   $persist_tun               = false,
@@ -511,8 +511,8 @@
   $custom_options            = {},
 ) {
 
-  include openvpn
-  Class['openvpn::install'] ->
+  include ::openvpn
+  Class['::openvpn::install'] ->
   Openvpn::Server[$name]
 
   if $::openvpn::params::systemd and $::openvpn::params::namespecific_rclink {
@@ -679,9 +679,11 @@
   }
 
   if $ldap_enabled == true {
+    validate_string($ldap_server)
+
     file {
       "${etc_directory}/openvpn/${name}/auth/ldap.conf":
-        ensure  => present,
+        ensure  => file,
         owner   => root,
         mode    => '0400',
         content => template('openvpn/ldap.erb'),