puppetlabs/puppet — pull request #628 by barttenbrinke (2012-04-05 13:11:33+00:00)
Title: Added unless_uid option to User Resource management.

Currently there are only two options for user management: purge => true or purge => false.
Purge true works great if all your apps are deployed via puppet, but when you have a mix of puppet system uids and application uids, you are forced to turn purge off.
This has the undesired side-effect that users that are managed through puppet will never revoked for the servers that have purge disabled.

At our company Devops deploys the servers & frameworks using Puppet so that Devs can take over and deploy applications on their own.
Each of these application runs under its own uid. For this reason we have to run with purge => false, which is something we don't want.

The only option available to alter this behavior is "unless_system_user => true", but this just protects users with a UID < 500 and that is not where I want to have my application UIDs.
In order to fix this properly, I've added an extra option to puppet: unless_uid.

You van specify specific Uids here or even Ranges of UIDS. Uids that match these ranges will not be purged, even though purge => true.

This way Puppet still automatically revokes access to the servers for Devs and Devops that are removed, while allowing Devs to deploy their own application application.

Example:

class users::resources {
resources { 'user':
purge => true,
unless_system_user => true,
unless_uid => [10_000..20_000];
}
}

Unless_uid accepts Integers, Ranges or Arrays with both.
I also added specs for both the old and the new check_user behavior, as the old behaviour was not specced.