init.sls.jinja

{% set id = salt['grains.get']('id') %}
{% if not id in salt['pillar.get']('rbgusers:blacklist', []) %}
{% for user in salt['pillar.get']('rbgusers:absent-users') %}
user-absent-{{ user }}:
  user.absent:
  - name: {{ user }}
{% endfor %}
{% endif %}
{% for user in salt['pillar.get']('rbgusers:present-users') %}
user-present-{{ user.username }}:
  user.present:
  - name: {{ user.username }}
  - fullname: {{ user.realname }}
  - uid: {{ user.uid }}
  - gid: {{ user.gid }}
  - groups: {{ user.groups }}
  - password: {{ salt['regex.filter'](id, user.access, ('mask','password'), "'*'") }}
{% endfor %}
{% for key in salt['cp.list_master'](prefix='rbgusers/sshkeys/') %}
{% set keyname = key.split('/')[2].replace('@', '.').split('.') %}
sshkey-present-{{ keyname[0] }}@{{ keyname[1] }}:
  ssh_auth.present:
  - user: {{ keyname[0] }}
  - source: salt://{{ key }}
  - require:
    - user: {{ keyname[0] }}
{% endfor %}

rbgusers.pillar.yaml

rbgusers:
  present-users:
    - username: erlacher
      realname: Lukas Erlacher
      uid: 31524
      gid: 20909
      groups: [ root, adm ]
      access:
        - mask: ^sun|dbsystem
          password: $1$XXX
        - mask: ^(vm|at)rbg
          password: $6$XXX
        - mask: .*
          password: $6$XXXX

regex.py

import re, sys

match = re.match
search = re.search
replace = re.sub

def filter(text, values, keys, default):
  print >> sys.stderr, "Text:", text, "Values:", values, "Keys:", keys, "Default:", default
  print >> sys.stderr, "Values[0]:", values[0]
  for value in values:
    print >> sys.stderr, "Value:", value
    print >> sys.stderr, "Value[keys[0]]:", value[keys[0]]
    if match(value[keys[0]], text) is not None:
      return value[keys[1]]
  return default