optional => true results in reconfig each time.

[traylenator]

Versions:

• augeasproviders_pam 2.1.0
• augeasproviders_core 2.1.2

The following configuration:

pam{'Add pam_afs_session to ssh stack':
  ensure    => 'present',
  service   => 'sshd',
  type      => 'session',
  optional  => true,
  control   => 'optional',
  module    => 'pam_afs_session.so',       
  position  => 'before module postlogin',
  arguments => ['always_aklog', 'debug'],
}

adds a line which looks correct to me:

-session optional pam_afs_session.so always_aklog debug

In particular the - prefix is added for the optional => true.

Subsequent runs of puppet result in:

Notice: /Stage[main]/Afs::Config/Pam[Add pam_afs_session to ssh stack]/optional: optional changed 'false' to 'true' (corrective)

the line itself is unchanged , augtool output.

/files/etc/pam.d/sshd/14
/files/etc/pam.d/sshd/14/optional
/files/etc/pam.d/sshd/14/type = "session"
/files/etc/pam.d/sshd/14/control = "optional"
/files/etc/pam.d/sshd/14/module = "pam_afs_session.so"
/files/etc/pam.d/sshd/14/argument[1] = "always_aklog"
/files/etc/pam.d/sshd/14/argument[2] = "debug"

[KoenDierckx]

We have the same issue
Anyone know what causes this ?

[KoenDierckx]

I think the main cause is inside augeas.rb, inside the getter for optional, on line 132
When the /optional path is not there, the match is empty, so it will return true, meaning this is optional, while it should return false, this is not optional (and the other way around)
So adding a NOT before transforming into a string and symbol seems to be needed
define_aug_method(:optional) do |aug, resource| #aug.match("$resource/optional").empty?.to_s.to_sym (!aug.match("$resource/optional").empty?).to_s.to_sym end

BUT, after fixing the getter, you might run into a bug with the assignment function
define_aug_method!(:optional=) do |aug, resource, value| if resource[:optional] == :true if aug.match("$resource/optional").empty? aug.clear("$resource/optional") end else aug.rm("$resource/optional") end end

It works going from optional => true to optional=> false
So the else case, that does the aug.rm($resource/optional) is ok

But it fails when you try to go from optional => false to optional=> true
Normally the aug.clear("$resource/optional") should create a new path with an empty value, but it fails for me

`
Debug: Puppet::Type::Pam::ProviderAugeas: Save failure details:
/augeas/files/etc/pam.d/test/error/path = /files/etc/pam.d/test/files/etc/pam.d/test/1
/augeas/files/etc/pam.d/test/error/lens = /opt/puppetlabs/puppet/share/augeas/lenses/dist/pam.aug:63.21-.51:
/augeas/files/etc/pam.d/test/error/message = Failed to match tree under /files/etc/pam.d/test/1

 { "type" = "account" }
 { "control" = "required" }
 { "module" = "test.so" }
 { "optional" }

with pattern

{ /optional/ }?
{ /type/ = /auth|session|account|password/ }
{ /control/ = /\\[[^]\n#]*\\]|[A-Za-z]+/ }
{ /module/ = /([^\t\n #\\]|\\\\.)+/ }
{ /argument/ = /\\[[^]\n#]+\\]|[^\t\n #[\\][^\t\n #\\]*/ }*
({ /#comment/ = /[^\t\n\r ].*[^\t\n\r ]|[^\t\n\r ]/ }
  | ())

`

perhaps someone more experienced with augeas and this module can investigate this further ??
@raphink @bastelfreak ?