puppetlabs/mcollective-actionpolicy-auth — pull request #6 by optiz0r (2014-10-22 22:20:49+00:00)
Title: Allow callerid to contain multiple entries

This patch adds support for multiple callerids in the policy files, just as the other fields (actions, facts, classes) can. This is useful because it allows bulk granting of permissions when using mcollective::actionpolicy::rule from puppetlabs-mcollective:

```
$admin_users = ['foo','bar']
mcollective::actionpolicy {
'default':
default => 'deny';
'nrpe':
default => 'deny';
}
mcollective::actionpolicy::rule {
'admins-allow-all':
agent => 'default',
callerid => join(prefix($admin_users, 'cert='), ' ');
'admins-allow-all-nrpe':
agent => 'nrpe',
callerid => join(prefix($admin_users, 'cert='), ' ');
'nrpe-nagios':
agent => 'nrpe',
callerid => 'cert=nagios';
}
```

This is especially useful when there are large numbers of admin users being managed by puppet (say ~10) since any `mcollective::actionpolicy::rule` added for an agent prevents the default policy being used and so the admins have to be explicitly re-added for each agent, rapidly bloating the size of the manifest and causing massive duplication of code.

Without this patch, the code for a single agent explodes like this:
```
mcollective::actionpolicy {
'default':
default => 'deny';

'nrpe':
default => 'deny'
}
mcollective::actionpolicy::rule {
'default-admin1':
agent => 'default',
callerid => 'cert=admin1';
'default-admin2':
agent => 'default',
callerid => 'cert=admin2';
# ...

'nrpe-nagios':
agent => 'nrpe',
callerid => 'cert=nagios';
'nrpe-admin1':
agent => 'nrpe',
callerid => 'cert=admin1';
'nrpe-admin2':
agent => 'nrpe',
callerid => 'cert=admin2';
# ...

}
```

Backward compatibility change? Certificates with spaces in the filename (if even supported) would be broken by this change.