Forge Home


Use LDAP for user login/authentication/authorisation/name resolution


10,677 latest version

3.8 quality score

Version information

  • 0.1.1 (latest)
  • 0.1.0
released Jan 31st 2013

Start using this module

  • r10k or Code Manager
  • Bolt
  • Manual installation
  • Direct download

Add this module to your Puppetfile:

mod 'erwbgy-pamldap', '0.1.1'
Learn more about managing modules with a Puppetfile

Add this module to your Bolt project:

bolt module add erwbgy-pamldap
Learn more about using this module with an existing project

Manually install this module globally with Puppet module tool:

puppet module install erwbgy-pamldap --version 0.1.1

Direct download is not typically how you would use a Puppet module to manage your infrastructure, but you may want to download the module in order to inspect the code.

Tags: auth, ldap, pam


erwbgy/pamldap — version 0.1.1 Jan 31st 2013


Configure a system to use LDAP for user authentication, authorisation and related name resolution.

Currently only tested on Redhat-like systems.


Include the pamldap module in your puppet configuration:

include pamldap

and add required hiera configuration - for example:

pamldap::base_dn: 'dc=example,dc=com'
pamldap::uris: [ 'ldap://', 'ldap://' ]

It can also be used as a parameterised class - for example:

class { 'pamldap':
  base_dn => 'dc=example,dc=com',
  uris    => [ 'ldap://', 'ldap://' ],


base_dn: LDAP base distinguished name used in user and group entries

uris: LDAP server connection details - a list of URIs in the format ldap:://[hostname]

Show user and group info from LDAP

Create userinfo and groupinfo aliases in ~/.bashrc:

$ vim ~/.bashrc
alias userinfo='perl -le "print join(qw(:),getpwnam(\$_)) foreach @ARGV"'
alias groupinfo='perl -le "print join(qw(:),getgrnam(\$_)) foreach @ARGV"'

Then you can query user and group information from LDAP that you would normally see in /etc/passwd and /etc/group:

$ groupinfo users
$ userinfo kburdis fbloggs
kburdis:x:500:100:::Keith Burdis:/home/kburdis:/bin/bash
fbloggs:x:501:100:::Fred Bloggs:/home/kburdis:/bin/bash

When run as root you will see information from LDAP that would normally be in /etc/shadow:

# userinfo kburdis fbloggs
kburdis:$6$oniRviiF...:500:100:::Keith Burdis:/home/kburdis:/bin/bash
fbloggs:$7$OghzqIlp...:501:100:::Fred Bloggs:/home/fbloggs:/bin/bash
# groupinfo sysadmins users


This is based on detailed documentation and setup by my colleague Neil McBennett. He did all the hard work, I just puppetised it.