salt user management

srv-pillar-top.sls.yaml

base:
  '*':
    # account details are available everywhere
    - users.accounts
    # ops group data
    - users.ops
    # individual users on a given machine
    - users.nodeusers

  'web*':
    # server group data
    - users.server

srv-pillar-users-accounts.sls.yaml

accounts:
  joe:
    id: 2100
    pwhash: 2sd0f8s9s0df89s.
    key: l23kj4l2kj342l4kj24lk23j423l4kj234l2k3j42lk4j24l2k3j42l4kj2l42kj4lzkx,xmxlz
  frank:
    id: 3100
    pwhash: 2sd0f8s9s0df89s.
    key: sldfkjsldkfjl2k3jl2k3j4l2k34jl2kjlkcjlxkxxljklkwdjdlskjdfdklj
  mark:
    id: 3101
    pwhash: 2sd0f8s9s0df89s.
    key: sldfkjsldkfjl2k3jl2k3j4l2k34jl2kjlkcjlxkxxljklkwdjdlskjdfdklj
  ethan:
    id: 3102
    pwhash: 2sd0f8s9s0df89s.
    key: sldfkjsldkfjl2k3jl2k3j4l2k34jl2kjlkcjlxkxxljklkwdjdlskjdfdklj
  user2:
    id: 3103
    pwhash: 2sd0f8s9s0df89s.
    key: sldfkjsldkfjl2k3jl2k3j4l2k34jl2kjlkcjlxkxxljklkwdjdlskjdfdklj

srv-pillar-users-nodeusers.sls.yaml

# machine to account mapping
user:
  node:
    # on host1 add ethan
    host1.example.com
      - ethan
    # host2 add frank
    host2.example.com:
      - frank

srv-pillar-users-ops.sls.yaml

# file that ties accounts to a group for ops

group.ops:
  - ethan
  - frank

srv-pillar-users-server.sls.yaml

# file that ties accounts to a group for server

group.server:
  - joe
  - frank

srv-salt-top.sls.yaml

base:
  '*':
    # ops should be on all machines
    - users.ops
    # individual users on a given machine
    - users.nodeusers
  'web*':
    # add users in server group to web*
    - users.server

srv-salt-users-nodeusers.sls.yaml

# support creating individual user accounts (and ssh_auth) on a given machine

{% set node_user_list = 'user:node:{0}'.format(grains['id']) %}

{% if salt['config.get'](node_user_list, []) %}
  {%  for user in salt['config.get'](node_user_list, []) %}
  {{ user }}:
    user.present:
      - uid: {{ salt['config.get']('accounts:{0}:id'.format(user), '-1') }}
      - password: {{ salt['config.get']('accounts:{0}:pwhash'.format(user), '\'!!\'') }}
    ssh_auth.present:
      - user: {{ user }}
      - name: {{ salt['config.get']('accounts:{0}:key'.format(user), 'key') }}
      - enc: {{ salt['config.get']('accounts:{0}:enc'.format(user), 'rsa') }}
  {% endfor %}
{% endif %}

srv-salt-users-ops.sls.yaml

# ops group state target

{% set group = 'ops' %}
{% include "users/templ.sls" %}

srv-salt-users-server.sls.yaml

#  /srv/salt/users/server.sls

{% set group = 'server' %}
{% include "users/templ.sls" %}

srv-salt-users-templ.sls.yaml

# main template for user creation and ssh_auth handing

{%  for user in salt['config.get']('group.{0}'.format(group)) %}
{{ user }}:
  user.present:
    - uid: {{ salt['config.get']('accounts:{0}:id'.format(user), '-1') }}
    - password: {{ salt['config.get']('accounts:{0}:pwhash'.format(user), '\'!!\'') }}
  ssh_auth.present:
    - user: {{ user }}
    - name: {{ salt['config.get']('accounts:{0}:key'.format(user), 'key') }}
    - enc: {{ salt['config.get']('accounts:{0}:enc'.format(user), 'rsa') }}
{% endfor %}

The above files define an ops and server group, define the user's details, define the states that create users for ops and server, and the for loop processing of those datas.

The top two files tie data and state to the appropriate servers

Finally, support with nodeusers.sls under pillar and salt to map individual users to a given node, instead of a group to a target. See srv-salt-users-nodeusers.sls.yaml and srv-pillar-users-nodeusers.sls.yaml