# salt.states.ldap

## Manage entries in an LDAP database

Added in version 2016.3.0.

The `states.ldap` state module allows you to manage LDAP entries and their attributes.

salt.states.ldap.managed(name, entries, connect_spec=None)

  Ensure the existence (or not) of LDAP entries and their attributes

  Example:

      ldapi:///:
        ldap.managed:
          - connect_spec:
              bind:
                method: sasl

          - entries:

            # make sure the entry doesn't exist
            - cn=foo,ou=users,dc=example,dc=com:
              - delete_others: True

            # make sure the entry exists with only the specified
            # attribute values
            - cn=admin,dc=example,dc=com:
              - delete_others: True
              - replace:
                  cn:
                    - admin
                  description:
                    - LDAP administrator
                  objectClass:
                    - simpleSecurityObject
                    - organizationalRole
                  userPassword:
                    - {{pillar.ldap_admin_password}}

            # make sure the entry exists, its olcRootDN attribute
            # has only the specified value, the olcRootDN attribute
            # doesn't exist, and all other attributes are ignored
            - 'olcDatabase={1}hdb,cn=config':
              - replace:
                  olcRootDN:
                    - cn=admin,dc=example,dc=com
                  # the admin entry has its own password attribute
                  olcRootPW: []

            # note the use of 'default'.  also note how you don't
            # have to use list syntax if there is only one attribute
            # value
            - cn=foo,ou=users,dc=example,dc=com:
              - delete_others: True
              - default:
                  userPassword: changeme
                  shadowLastChange: 0
                  # keep sshPublicKey if present, but don't create
                  # the attribute if it is missing
                  sshPublicKey: []
              - replace:
                  cn: foo
                  uid: foo
                  uidNumber: 1000
                  gidNumber: 1000
                  gecos: Foo Bar
                  givenName: Foo
                  sn: Bar
                  homeDirectory: /home/foo
                  loginShell: /bin/bash
                  objectClass:
                    - inetOrgPerson
                    - posixAccount
                    - top
                    - ldapPublicKey
                    - shadowAccount

  Parameters:

    - name -- The URL of the LDAP server. This is ignored if `connect_spec` is either a connection object or a dict with a `'url'` entry.

    - entries --

      A description of the desired state of zero or more LDAP entries.

      `entries` is an iterable of dicts. Each of these dict's keys are the distinguished names (DNs) of LDAP entries to manage. Each of these dicts is processed in order. A later dict can reference an LDAP entry that was already mentioned in an earlier dict, which makes it possible for later dicts to enhance or alter the desired state of an LDAP entry.

      The DNs are mapped to a description of the LDAP entry's desired state. These LDAP entry descriptions are themselves iterables of dicts. Each dict in the iterable is processed in order. They contain directives controlling the entry's state. The key names the directive type and the value is state information for the directive. The specific structure of the state information depends on the directive type.

      The structure of `entries` looks like this:

          [{dn1: [{directive1: directive1_state,
                   directive2: directive2_state},
                  {directive3: directive3_state}],
            dn2: [{directive4: directive4_state,
                   directive5: directive5_state}]},
           {dn3: [{directive6: directive6_state}]}]

      These are the directives:

      - `'delete_others'`

          Boolean indicating whether to delete attributes not mentioned in this dict or any of the other directive dicts for this DN. Defaults to `False`.

          If you don't want to delete an attribute if present, but you also don't want to add it if it is missing or modify it if it is present, you can use either the `'default'` directive or the `'add'` directive with an empty value list.

      - `'default'`

          A dict mapping an attribute name to an iterable of default values for that attribute. If the attribute already exists, it is left alone. If not, it is created using the given list of values.

          An empty value list is useful when you don't want to create an attribute if it is missing but you do want to preserve it if the `'delete_others'` key is `True`.

      - `'add'`

          Attribute values to add to the entry. This is a dict mapping an attribute name to an iterable of values to add.

          An empty value list is useful when you don't want to create an attribute if it is missing but you do want to preserve it if the `'delete_others'` key is `True`.

      - `'delete'`

          Attribute values to remove from the entry. This is a dict mapping an attribute name to an iterable of values to delete from the attribute. If the iterable is empty, all of the attribute's values are deleted.

      - `'replace'`

          Attributes to replace. This is a dict mapping an attribute name to an iterable of values. Any existing values for the attribute are deleted, then the given values are added. The iterable may be empty.

      In the above directives, the iterables of attribute values may instead be `None`, in which case an empty list is used, or a scalar such as a string or number, in which case a new list containing the scalar is used.

      Note that if all attribute values are removed from an entry, the entire entry is deleted.

    - connect_spec -- See the description of the `connect_spec` parameter of the `ldap3.connect` function in the `ldap3` execution module. If this is a dict and the `'url'` entry is not specified, the `'url'` entry is set to the value of the `name` parameter.

  Returns:

    A dict with the following keys:

    - `'name'`

        This is the same object passed to the `name` parameter.

    - `'changes'`

        This is a dict describing the changes made (or, in test mode, the changes that would have been attempted). If no changes were made (or no changes would have been attempted), then this dict is empty. Only successful changes are included.

        Each key is a DN of an entry that was changed (or would have been changed). Entries that were not changed (or would not have been changed) are not included. The value is a dict with two keys:

        - `'old'`

            The state of the entry before modification. If the entry did not previously exist, this key maps to `None`. Otherwise, the value is a dict mapping each of the old entry's attributes to a list of its values before any modifications were made. Unchanged attributes are excluded from this dict.

        - `'new'`

            The state of the entry after modification. If the entry was deleted, this key maps to `None`. Otherwise, the value is a dict mapping each of the entry's attributes to a list of its values after the modifications were made. Unchanged attributes are excluded from this dict.

        Example `'changes'` dict where a new entry was created with a single attribute containing two values:

            {'dn1': {'old': None,
                     'new': {'attr1': ['val1', 'val2']}}}

        Example `'changes'` dict where a new attribute was added to an existing entry:

            {'dn1': {'old': {},
                     'new': {'attr2': ['val3']}}}

    - `'result'`

        One of the following values:

        - `True` if no changes were necessary or if all changes were applied successfully.

        - `False` if at least one change was unable to be applied.

        - `None` if changes would be applied but it is in test mode.