add mysql database credentials

manifests/init.pp

@@ -11,7 +11,7 @@ class shibb_idp3(
   #   test:  idp-test.stanford.edu
   #   dev:   idp-dev.stanford.edu
   #
-  # $pool_hostname is the just the hostname (e.g., "idp-uat").
+  # $pool_hostname is just the hostname (e.g., "idp-uat").
   case $env {
     'prod': {
       $pool_fqdn     = 'idp.stanford.edu'

manifests/ldap.pp

@@ -62,6 +62,9 @@ class shibb_idp3::ldap (
   }
 
 
+  # We need to merge the ldap.properties file with a MySQL database
+  # credentials file.
+
   file { '/etc/shibboleth-idp/conf/ldap.properties':
     ensure  => present,
     content => template('shibb_idp3/etc/shibboleth-idp/conf/ldap.properties.erb'),
@@ -69,5 +72,41 @@ class shibb_idp3::ldap (
     require => Package['shibboleth-identity-provider'],
   }
 
+  $ldap_properties_template_file = '/etc/shibboleth-idp/conf/ldap.properties.template'
+  $ldap_properties_file          = '/etc/shibboleth-idp/conf/ldap.properties'
+  $mysql_credentials_file        = '/etc/shibboleth-idp/conf/mysql_credentials'
+
+  # (1)
+  file { $ldap_properties_template_file:
+    content => template('shibb_idp3/etc/shibboleth-idp/conf/ldap.properties.template.erb'),
+    require => Package['shibboleth-identity-provider'],
+  }
+
+  # (2)
+  case "${shibb_idp3::env}" {
+    'prod', 'uat', 'dev':  {
+      $mysql_credenitals_name = "db/its-idg/${shibb_idp3::pool_hostname}/s_shibboleth"
+    }
+    default: { fail("unknown environment ${shibb_idp3::env}") }
+  }
+
+  base::wallet { $mysql_credenitals_name:
+    type   => 'file',
+    path   => $mysql_credentials_file,
+    owner  => 'root',
+    group  => 'root',
+    mode   => '0640';
+  }
+
+  # (3)
+  exec { "generate-conf $ldap_properties_file":
+    command     => "generate-conf --template $ldap_properties_template_file --config $mysql_credentials_file --newfile $ldap_properties_file",
+    refreshonly => true,
+    subscribe   => [
+                    File[$ldap_properties_template_file],
+                    Base::Wallet[$mysql_credenitals_name],
+                    ]
+  }
+
 
 }

templates/etc/shibboleth-idp/conf/ldap.properties.erb → templates/etc/shibboleth-idp/conf/ldap.properties.template.erb

@@ -58,3 +58,8 @@ idp.attribute.resolver.LDAP.returnAttributes    = cn,homephone,mail
 #idp.pool.LDAP.idleTime                         = 600
 #idp.pool.LDAP.blockWaitTime                    = 3000
 #idp.pool.LDAP.failFastInitialize               = false
+
+# MySQL credentials go here (these values are merged from a wallet object
+# and managed by Puppet, so do not edit these values directly).
+idp.attribute.resolver.attrdb.user = %%DBUSER%%
+idp.attribute.resolver.attrdb.pass = %%DBPASS%%