#
# Configure NSS and PAM to use LDAP directory
#
editfiles:
	
    debian.installation.!standalone.!roaming::

        { /etc/nsswitch.conf

	  LocateLineMatching "# Example configuration of GNU Name Service Switch functionality."
          IncrementPointer   "3"

	  BeginGroupIfNoSuchLine "passwd:         files ldap"
	    HashCommentLinesStarting "passwd:"
            InsertLine "passwd:         files ldap"
          EndGroup

	  BeginGroupIfNoSuchLine "group:          files ldap"
	    HashCommentLinesStarting "group:"
            InsertLine "group:          files ldap"
          EndGroup

          # Fetching shadow from LDAP is useful for expiring accounts.
          BeginGroupIfNoSuchLine "shadow:         files ldap"
            HashCommentLinesStarting "shadow:"
            InsertLine "shadow:         files ldap"
          EndGroup

	  BeginGroupIfNoSuchLine "netgroup:       files ldap"
            HashCommentLinesStarting "netgroup:"
            InsertLine "netgroup:       files ldap"
          EndGroup

	  BeginGroupIfNoSuchLine "automount:      files ldap"
            HashCommentLinesStarting "automount:"
            InsertLine "automount:      files ldap"
          EndGroup

	  BeginGroupIfNoSuchLine "sudoers:        files ldap"
            HashCommentLinesStarting "sudoers:"
            InsertLine "sudoers:        files ldap"
          EndGroup
        }

    debian.installation.!standalone::

#	## Avoid showing the GOsa template as user:
#    	{ /etc/nslcd.conf
#          AppendIfNoSuchLine "filter passwd (&(objectClass=posixAccount)(!(objectClass=gosaUserTemplate)))"
#        }

	{ /etc/ldap/ldap.conf
          BeginGroupIfNoLineMatching "^HOST .*"
            AppendIfNoSuchLine "HOST $(ldapserver)"
          EndGroup

	  # needed for sudo-ldap:
          BeginGroupIfNoLineMatching "^sudoers_base .*"
            AppendIfNoSuchLine "sudoers_base ou=sudoers,$(ldapbase)"
          EndGroup

          # Insert the base-dn, to simplify searching the LDAP and reduce
          # typing :-) [barbarossa 2004-07-01]
          BeginGroupIfNoLineMatching "^BASE .*"
            AppendIfNoSuchLine "BASE $(ldapbase)"
          EndGroup

          # We want to use the downloaded LDAP SSL certificate to verify the
          # connection to the server, and disable the code to not check
          # certificates, see bug #1211.
          BeginGroupIfNoLineMatching "^TLS_REQCERT .*"
            AppendIfNoSuchLine "TLS_REQCERT demand"
          EndGroup
          AppendIfNoSuchLine "TLS_CACERT /etc/ldap/ssl/ldap-server-pubkey.pem"
	}

	{ /etc/nslcd.conf
          AppendIfNoSuchLine "tls_cacertfile /etc/ldap/ssl/ldap-server-pubkey.pem"
	}

shellcommands:
    debian.installation.roaming::
        "/usr/share/debian-edu-config/tools/setup-roaming"

    # Workaround for bug #591773 in nslcd
    # FIXME Check if nslcd still pull in libpam-ldapd (bug #591773)
    debian.installation.!standalone::
        "/usr/bin/apt-get purge -y libpam-ldapd"

    # Avoid multicast dns on stationary machines
    debian.installation.!standalone.!roaming::
        "/usr/bin/apt-get purge -y libnss-mdns"

    # Avoid Network Manager GUI client stationary machines.  The users
    # can not change the config anyway.
    debian.installation.!standalone.!roaming::
        "/usr/bin/apt-get purge -y plasma-widget-networkmanagement"

    # Avoid packages pulled in by cifs-utils (winbind being a Recommends) and
    # winbind (libpam-winbind and libnss-winbind will be purged along
    # with winbind).
    # FIXME Check if cifs-utils still pull in libpam-winbind (bug #706434).
    debian.installation::
        "/usr/bin/apt-get purge -y winbind"
