app_users.sls

# roles/app/users
#
# Set up users that require access to the app servers
# ATTENTION: This is only set up for CentOS 7 at the moment
#
# TODO:
#   - Do proper sanity checks
#   - Ideally, those checks all happen up front
#   - Support for CentOS 6
#   - Users should come from a group and not be a list

# FIXME: This really should be done via group, or barring that via pillar
{% set users_list = ['tcornett', 'dcarcamo', 'sroussell', 'ghamiter', 'lwhitehill', 'dmessick'] %}
{% for user in users_list %}

app users add {{ user }}:
  cmd.run:
    - name: realm permit {{ user }}@domain.com && sleep 1
    - unless: grep {{ user }} /etc/sssd/sssd.conf >/dev/null 2>&1
    - watch_in:
      - service: app users restart sssd

{% endfor %}

app users restart sssd:
  service.running:
    - name: sssd

# Now add all those people to the users group so they can sudo to the restart user
app users add to users group:
  group.present:
    - name: users
    - addusers:
      {%- for user in users_list %}
      - {{ user }}
      {%- endfor %}
    - require:
      - service: app users restart sssd