From 90704a6017f7c539e3c1fed038ed247763619380 Mon Sep 17 00:00:00 2001 From: Jacob Liberman Date: Thu, 1 Jun 2017 09:33:21 -0500 Subject: Add conditional for setting authlogin_nsswitch_use_ldap selboolean If selinux is enabled the authlogin_nsswitch_use_ldap Boolean must be enabled. This setting allows LDAP communications to the confined LDAP/server port. This change includes a conditional for enabling this Boolean only when selinux is in use. Change-Id: If985f2434d28fcd33198929bf61f2a3a82e601fe Closes-Bug: #1695002 --- manifests/profile/base/keystone.pp | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'manifests/profile/base/keystone.pp') diff --git a/manifests/profile/base/keystone.pp b/manifests/profile/base/keystone.pp index 72a7bc9..c7eea14 100644 --- a/manifests/profile/base/keystone.pp +++ b/manifests/profile/base/keystone.pp @@ -222,6 +222,12 @@ class tripleo::profile::base::keystone ( if $ldap_backend_enable { validate_hash($ldap_backends_config) + if !str2bool($::selinux) { + selboolean { 'authlogin_nsswitch_use_ldap': + value => on, + persistent => true, + } + } create_resources('::keystone::ldap_backend', $ldap_backends_config, { create_domain_entry => $manage_domain, }) -- cgit 1.2.3-korg