Mcollective action policy modification
Mcollective has a pluggable authorisation system, by specifying the authorisation in a file the access to an agent can be controlled. The default actionpolicy provided checks the uid of the user accessing the agent https://github.com/puppetlabs/mcollective-plugins/tree/master/simplerpc_authorization/action_policy/ .
In a setup with many nodes this doesn't make sense. Since its a pluggable system it can be modified to suit appropriately. By configuring the security plugin psk to send the username instead of the uid and with little modification the action policy plugin can be made to check for the user group, which makes more sense.
Add the following configuration in the client
plugin.psk.callertype=user
The action policy needs to be changed as follows
https://github.com/pandian912/Mcollective/tree/master/util
def self.check_policy(auth, rpccaller, actions, facts, classes, request)
# If we have a wildcard caller or the caller matches our policy line
# then continue else skip this policy line
logger = Log.instance
rc=request.caller
rca=rc.split('=')[1]
gr=`id -gn #{rca}`
group="group=" << gr
group=group.strip
logger.debug("Request received from #{rc} belongs to primary group #{gr} checking the entry #{group}")
if (rpccaller != "*") && (rpccaller != group)
return false
end
In a similar way the code can be modified to check for groups or username or gid or uid.
A sample policy file is also included in the github