NSS attribute mapping

manifests/client.pp

@@ -65,6 +65,14 @@
 #    Search base for the shadow database. *base* will be appended.
 #    *Optional* (defaults to false)
 #
+#  [nss_map_objectclass]
+#    Hash with nss objectclass mappings.
+#    *Optional* (defaults to nothing)
+#
+#  [nss_map_attribute]
+#    Hash with nss attributes mappings.
+#    *Optional* (defaults to nothing)
+#
 #  [pam]
 #    If enabled (pam => true) enables pam module, which will
 #    be setup to use pam_ldap, to enable authentication.
@@ -178,10 +186,12 @@
   $ssl            = false,
   $ssl_cert       = false,
 
-  $nsswitch   = false,
-  $nss_passwd = false,
-  $nss_group  = false,
-  $nss_shadow = false,
+  $nsswitch            = false,
+  $nss_passwd          = false,
+  $nss_group           = false,
+  $nss_shadow          = false,
+  $nss_map_objectclass = false,
+  $nss_map_attribute   = false,
 
   $pam            = false,
   $pam_att_login  = 'uid',

templates/etc/openldap/ldap.conf.erb

@@ -19,12 +19,16 @@ bindpw <%= @bindpw %>
 <% end -%>
 
 <% if @nsswitch == true then -%>
-# DNs in groups
-#nss_schema         rfc2307bis
-#nss_map_attribute  uniquemember member
-#nss_map_attribute memberuid    member
-#nss_getgrent_skipmembers yes
-
+<% if @nss_map_objectclass != false -%>
+<% @nss_map_objectclass.each_pair do |local, remote| -%>
+nss_map_objectclass <%= local -%> <%= remote %>
+<%- end -%>
+<%- end -%>
+<% if @nss_map_attribute != false -%>
+<% @nss_map_attribute.each_pair do |local, remote| -%>
+nss_map_attribute <%= local -%> <%= remote %>
+<%- end -%>
+<%- end -%>
 nss_base_passwd <%= @nss_passwd %>,<%= @base %>?sub
 nss_base_shadow <%= @nss_shadow %>,<%= @base %>?sub
 nss_base_group  <%= @nss_group  %>,<%= @base %>?one