Better groups

files/ldap-ssh-key.sh

@@ -4,6 +4,6 @@ ldapsearch -H "ldap://{{ldap_host}}" \
   -D "{{ldap_bind_dn}}" \
   -w "{{ldap_bind_password}}" \
   -b "ou=People,{{ldap_base_dn}}" \
-  "(&(uid=$1)(|(memberof=cn=host_access,ou=Groups,{{ldap_base_dn}})(memberof=cn=host_{{current_host}}_access,ou=Groups,{{ldap_base_dn}})))" \
+  "(&(uid=$1)(|{{#ldap_access_groups}}(memberof={{.}},ou=Groups,{{ldap_base_dn}}){{/ldap_access_groups}}))" \
   '*' | sed -n '/^ /{H;d};/sshPublicKey:/x;$g;s/\n *//g;s/sshPublicKey: //gp'
   

files/sssd.conf.mo

@@ -21,12 +21,12 @@ ldap_sudo_search_base = {{ldap_base_dn}}
 # Filter for sudo access: global host_admin OR host-specific admin
 ldap_sudo_full_refresh_interval = 900
 ldap_sudo_smart_refresh_interval = 300
-ldap_sudo_search_filter = (|(memberOf=cn=host_admin,ou=groups,dc=theta42,dc=com)(memberOf=cn=host_{hostname}_admin,ou=groups,dc=theta42,dc=com))
+ldap_sudo_search_filter = (|(memberOf=cn={{location}}host_admin,ou=groups,dc=theta42,dc=com)(memberOf=cn={{location}}host_{hostname}_admin,ou=groups,dc=theta42,dc=com))
 
 # Access control: only allow users in host_access or host_{hostname}_access
 access_provider = ldap
 ldap_access_order = filter
-ldap_access_filter = (|(memberof=cn=host_access,ou=groups,{{ldap_base_dn}})(memberof=cn=host_{{current_host}}_access,ou=groups,{{ldap_base_dn}}))
+ldap_access_filter = (|(memberof=cn={{location}}host_access,ou=groups,{{ldap_base_dn}})(memberof=cn={{location}}host_{{current_host}}_access,ou=groups,{{ldap_base_dn}}))
 
 # Mapping
 ldap_user_search_base = ou=people,{{ldap_base_dn}}

files/sudo-ldap.conf

@@ -6,4 +6,4 @@ BINDPW {{ldap_bind_password}}
 
 sudoers_base {{ldap_base_dn}}
 
-SUDOERS_SEARCH_FILTER (|(memberof=cn=host_admin,ou=Groups,{{ldap_base_dn}})(memberof=cn=host_{{current_host}}_admin,ou=Groups,{{ldap_base_dn}}))
+SUDOERS_SEARCH_FILTER (|{{#ldap_sudo_groups}}(memberof={{.}},ou=Groups,{{ldap_base_dn}}){{/ldap_sudo_groups}})