saltstack/salt — pull request #11324 by cachedout (2014-03-18 17:40:13+00:00)
Title: Eauth group support

This provides initial support for eauth groups for the PAM provider *only*.

There is no support for LDAP, etc. Providers other than PAM should simply no-op if a ```groups``` function is not found.

The syntax for adding a group in a master configuration files is as follows:

```
my_group%:
- '*':
- test.echo
```
(Note the trailing '%', which indicates a group definition.)

The above block indicates that any user returned by PAM which is a member of the ```my_group``` group on the system should be authorized for the ```test.echo``` function on all minions in *addition* to all functions granted to her by explicit user permission in the master configuration file for the given provider.