cloud-mu 1.9.0.pre.beta

data/bin/mu-user-manage

@@ -0,0 +1,275 @@
+#!/usr/local/ruby-current/bin/ruby
+# Copyright:: Copyright (c) 2014 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require File.realpath(File.expand_path(File.dirname(__FILE__)+"/mu-load-config.rb"))
+# now we have our global config available as the read-only hash $MU_CFG
+
+require 'mu'
+require 'optimist'
+require 'simple-password-gen'
+require 'net/smtp'
+
+if Etc.getpwuid(Process.uid).name != "root"
+  MU.log "#{$0} can only be run as root", MU::ERR
+  exit 1
+end
+
+$opts = Optimist::options do
+  banner <<-EOS
+Listing users:
+#{$0}
+
+Show details for a specific user:
+#{$0} <username>
+
+Adding/modifying users:
+#{$0} [-a|-r] [-e <email>] [-n '<Real Name>'] [-i|-p <password>|-g] [-o <chef_org>] [-v <chef_org>] [-m <email>] [-l <chef_user>] <username>
+
+Deleting users:
+#{$0} [-i] -d <username>
+
+  EOS
+  opt :delete, "Delete the user and all of their Chef and filesystem artifacts.", :require => false, :default => false, :type => :boolean
+  opt :skipupload, "Do not upload Chef artifacts to new users' orgs for them. The user's dotfiles will be configured to do so automatically on their first interactive login.", :require => false, :default => false, :type => :boolean
+  opt :monitoring_alerts_to, "Send this user's monitoring alerts to an alternate address. Set to 'none' to disable monitoring alerts to this user.", :require => false, :type => :string
+  opt :name, "The user's real name. Required when creating a new user.", :require => false, :type => :string
+  opt :email, "The user's email address. Required when creating a new user.", :require => false, :type => :string
+  opt :admin, "Flag the user as a Mu admin. They will be granted sudo access to the 'mu' (root's) Chef organization.", :require => false, :type => :boolean
+  opt :revoke_admin, "Revoke the user's status as a Mu admin. Access to the 'mu' (root) Chef organization and sudoers will be removed.", :require => false, :type => :boolean
+  opt :orgs, "Add the user to the named Chef organization, in addition to their default org or orgs.", :require => false, :type => :strings
+  opt :remove_from_orgs, "Remove the user to the named Chef organization.", :require => false, :type => :strings
+  opt :password, "Set a specific password for this user.", :require => false, :type => :string
+  opt :generate_password, "Generate and set a random password for this user.", :require => false, :type => :boolean, :default => false
+  opt :link_to_chef_user, "Link to an existing Chef user. Chef's naming restrictions sometimes necessitate having a different account name than everything else. Also useful for linking a pre-existing Chef user to the rest of a Mu account.", :require => false, :type => :string
+  opt :interactive, "Interactive prompt to set a password.", :require => false, :type => :boolean
+  opt :scratchpad, "Use Mu's Scratchpad to securely share user passwords instead of printing the password directly to the terminal.", :require => false, :type => :boolean, :default => true
+  opt :notify_user, "Share the Scratchpad link for new passwords to users via email, instead of printing to the screen.", :require => false, :type => :boolean, :default => false
+  opt :force_uid, "Change a user's uid, or request a specific uid for a new user. Not valid for Active Directory.", :require => false, :type => :integer, :default => -1
+end
+
+def mailUser(to, subject, message)
+  from = "root@#{$MU_CFG['host_name']}"
+  fullmsg = <<MESSAGE_END
+From: Mu <#{from}>
+To: #{to}
+MIME-Version: 1.0
+Content-type: text/html
+Subject: #{subject}
+
+<br>
+<pre>#{message}</pre>
+MESSAGE_END
+  Net::SMTP.start('localhost') do |smtp|
+    smtp.send_message(fullmsg, from, to)
+  end
+end
+
+def sendPassword(username, password, scratchpad: true, notify: true)
+  users = MU::Master::LDAP.findUsers
+  if scratchpad
+    scratchitem = MU::Master.storeScratchPadSecret("Mu password for user #{username}: #{password}")
+    url = "https://#{$MU_CFG['public_address']}/scratchpad/#{scratchitem}"
+    MU.log "Stored in scratchpad, public URL: #{url}", MU::NOTICE
+    if users[username]["mail"] and
+       users[username]["mail"].match(/^[A-Z0-9\._%\+\-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,6}$/i)
+      if notify
+        message = "Your Mu development credentials have been set.\nYou can access your new password ONCE by visiting the following url:\n\n<a href='#{url}'>#{url}</a>"
+        mailUser(users[username]["mail"], "Your Mu password password", message)
+        MU.log "Sent new password notification to #{users[username]["mail"]}."
+        MU.log "IMPORTANT: Be sure that your Mu Master is able to send mail (see /var/log/maillog)", MU::NOTICE
+      else
+        MU.log "Email notification disabled by default. Don't forget to share the Scratchpad URL with the user.", MU::WARN
+      end
+    else
+      MU.log "No email address found for #{username}, you will have to share the Scratchpad URL some other way.", MU::WARN
+    end
+  else
+# XXX skip this message if we read the password interactively
+    MU.log "Password for #{username}: #{password}", MU::NOTICE
+  end
+end
+
+
+Dir.mkdir($MU_CFG['datadir']+"/users", 0755) if !Dir.exist?($MU_CFG['datadir']+"/users")
+
+if $opts[:admin] and $opts[:revoke_admin]
+  MU.log "Cannot both add and revoke admin access", MU::ERR
+  Optimist::educate
+end
+if $opts[:password] and $opts[:generate_password]
+  MU.log "Cannot both specify a password and generate a password", MU::ERR
+  Optimist::educate
+end
+
+if $opts[:orgs] and $opts[:remove_from_orgs] and ($opts[:orgs] & $opts[:remove_from_orgs]).size > 0
+  MU.log "Cannot both add and remove from the same Chef org", MU::ERR
+  exit 1
+end
+
+$password = nil
+if $opts[:generate_password]
+  $password = MU.generateWindowsPassword
+elsif $opts[:password]
+  $password = $opts[:password]
+elsif $opts[:interactive]
+  STDOUT.print "Enter password for #{$username}: "
+  $password = STDIN.noecho(&:gets)
+  puts
+  MU.log "Note: If this password does not comply with complexity requirements, you may get an 'Unwilling to perform' response", MU::NOTICE
+end
+
+$cur_users = MU::Master.listUsers
+
+$opts.select { |opt| opt =~ /_given$/ }.size == 0
+
+if !ARGV[0] or ARGV[0].empty?
+  bail = false
+  $opts.each_key { |opt|
+    if $opts[opt] and !opt.to_s.match(/_given$/) and !["notify_user", "scratchpad", "force_uid"].include?(opt.to_s)
+      MU.log "Must specify a username with the '#{opt.to_s}' option", MU::ERR
+      bail = true
+    end
+  }
+  Optimist::educate if bail
+  MU::Master.printUsersToTerminal
+  exit 0
+elsif $opts.select { |opt| opt =~ /_given$/ }.size == 0
+  MU::Master.printUserDetails(ARGV[0])
+  exit 0
+end
+$username = ARGV[0]
+
+[:orgs, :remove_from_orgs].each { |org_field|
+  bail = false
+  if $opts[org_field]
+    $opts[org_field].each { |org|
+      if !org.match(/^[a-z_][a-z0-9_]{0,30}$/i)
+        MU.log "'#{org}' is not a valid Chef org name", MU::ERR
+        bail = true
+      end
+    }
+  end
+  exit 1 if bail
+}
+
+[:email, :monitoring_alerts_to].each { |email_field|
+  bail = false
+  if $opts[email_field] and !$opts[email_field].match(/^[A-Z0-9\._%\+\-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,6}$/i) and !(email_field == :monitoring_alerts_to and $opts[email_field] == "none")
+    MU.log "'#{$opts[email_field]}' is not a valid email address", MU::ERR
+    bail = true
+  end
+  exit 1 if bail
+}
+
+if $opts[:name] and !$opts[:name].match(/ /)
+  MU.log "'name' field must consist of at least two words (saw '#{$opts[:name]}')", MU::ERR
+  exit 1
+end
+
+if $opts[:link_to_chef_user] and !MU::Master::Chef.getUser($opts[:link_to_chef_user])
+  MU.log "Requested link to Chef user '#{$opts[:link_to_chef_user]}', but that user doesn't exist", MU::ERR
+  exit 1
+end
+
+# Delete an existing account
+if $opts[:delete]
+  bail = false
+  $opts.each_key { |opt|
+    if !["delete", "scratchpad", "notify_user"].include?(opt.to_s) and
+        $opts[opt] and !opt.to_s.match(/_given$/)
+      MU.log "Ignoring extraneous option '#{opt.to_s}' in delete", MU::WARN
+    end
+  }
+  exit 1 if bail
+
+  MU::Master.deleteUser($username)
+
+else
+  create = false
+  if !$cur_users.has_key?($username)
+    $cur_users[$username] = {} if !$cur_users.has_key?($username)
+    create = true
+  end
+
+  $cur_users[$username]['realname'] = $opts[:name] if $opts[:name]
+  $cur_users[$username]['email'] = $opts[:email] if $opts[:email]
+  $cur_users[$username]['admin'] = true if $opts[:admin]
+  $cur_users[$username]['admin'] = false if $opts[:revoke_admin]
+  if $opts[:link_to_chef_user]
+    $cur_users[$username]['chef_user'] = $opts[:link_to_chef_user].dup
+  else
+    $cur_users[$username]['chef_user'] = $username.dup
+  end
+
+  # Validate for modifying an existing account
+  if !create
+    bail = false
+    if !$cur_users[$username].has_key?("email") and !$opts[:email]
+      MU.log "#{$username} does not have an email address set in LDAP, must supply one with -e to modify this account.", MU::ERR
+      bail = true
+    end
+    if !$cur_users[$username].has_key?("realname") and !$opts[:name]
+      MU.log "#{$username} does not have a display name set in LDAP, must supply one with -n to modify this account.", MU::ERR
+      bail = true
+    end
+    exit 1 if bail
+
+  # Validate for creating a new account
+  else
+    bail = false
+
+    if !$opts[:email]
+      MU.log "#{$username} does not have an email address set in LDAP, must supply one with -e.", MU::ERR
+      bail = true
+    end
+    if !$opts[:name]
+      MU.log "#{$username} does not have a display name set in LDAP, must supply one with -n.", MU::ERR
+      bail = true
+    end
+    if $password.nil?
+      $password = MU.generateWindowsPassword
+      MU.log "Creating a new account but no password supplied, invoking -g (generate) behavior.", MU::NOTICE
+    end
+    exit 1 if bail
+  end
+
+  if !MU::Master.manageUser(
+      $username,
+      chef_username: $cur_users[$username]['chef_user'],
+      name: $cur_users[$username]['realname'],
+      email: $cur_users[$username]['email'],
+      admin: $cur_users[$username]['admin'],
+      password: $password,
+      change_uid: $opts[:force_uid],
+      orgs: $opts[:orgs],
+      remove_orgs: $opts[:remove_from_orgs]
+    )
+    exit 1
+  end
+  if create and !$opts[:skipupload]
+    home = Etc.getpwnam($username).dir
+    MU.log "Uploading Chef artifacts to the new '#{$username}' organization. This may take a while.", MU::NOTICE
+    %x{/bin/su - #{$username} -c "#{$MU_CFG['installdir']}/bin/mu-upload-chef-artifacts -n 2>&1 > /dev/null && touch #{home}/.first_chef_upload"}
+  end
+end
+if $password
+  if $opts[:notify_user] or $opts[:scratchpad]
+    sendPassword($username, $password, scratchpad: $opts[:scratchpad], notify: $opts[:notify_user])
+  elsif $opts[:generate_password]
+    MU.log "Generated password for #{$username}: #{$password}", MU::NOTICE
+  end
+end
+
+MU::Master.printUsersToTerminal

data/cookbooks/awscli/LICENSE

@@ -0,0 +1,37 @@
+Through accessing, reading, or utilizing this software in any manner whatsoever
+or through any means whatsoever, whether the access, reading or use is either
+solely looking at this software or this software has been integrated into any
+derivative work, the party accessing,  reading, or utilizing the software
+directly or indirectly agrees to abide by the following license. 
+
+The eGlobalTech Cloud Automation Platform is the Copyright (c) 2014 of Global
+Tech Inc. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+this list of conditions and the following disclaimer in the documentation
+and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its contributors
+may be used to endorse or promote products derived from this software without
+specific prior written permission.
+
+Global Tech, Inc. is the co-owner of any derivative works created with this
+software. 
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+

data/cookbooks/awscli/README.md

@@ -0,0 +1,58 @@
+awscli
+======
+
+Installs and configures the awscli command-line tool [(the new one, supporting all AWS services)][1]
+
+Configuring
+===========
+
+You can control when the awscli tool will be installed during the chef run, either
+in the compile stage or in the converge stage.
+
+The attribute `[:awscli][:compile_time]` defaults to `false`, meaning the awscli
+will be installed during converge time. It can be set to `true` to install at compile time.
+Do this if you need to use the awscli in your recipes during compile time (for example, to list
+the EBS attachments of the current instance).
+
+This cookbook will optionally configure the awscli tool. If your instance has an IAM
+Role then the awscli will pick up that role's credentials automatically from the instance
+metadata, so you may not need to configure the access keys. You might still want to configure the
+default region.
+
+The following attributes are optional and are not specified by default. If present these 
+will be used configure the awscli:
+
+    [:awscli][:config_profiles]       - a hash of configuration profiles
+    [:awscli][:config_profiles]<profile_key> - the name of the profile
+    [:awscli][:config_profiles][<profile_key>]<option_name> = <option_value> - config options
+    
+For example, to configure the default profile, specify the following:
+
+    'awscli': {
+      'config_profiles': {
+        'default' : {
+          'region'               : 'us-east-1',
+          'aws_acces_key_id'     : 'SOMESECRET',
+          'aws_secret_access_key : 'ANOTHERSECRET'
+        }
+      }
+    }
+    
+The keys and values inside the profile_key hash are placed directly into the awscli config file.
+Use this mechanism to specify additional configuration (such as output style) and additional profiles.
+    
+Using
+=====
+
+If you use the awscli in your recipes, you may want to make use of the
+library provided by this cookbook, InstanceMetadata. It provides a method
+`wait_for_instance_IAM_metadata_to_be_available` which you may call before attempting
+to use the awscli with credentials from the instance's IAM role.
+
+Here's why: When you are running on an instance with an IAM role, the IAM credentials
+are not ready until some time after the instance boots. Calling the awscli before the IAM
+credentials are ready will fail.
+
+If you specify AWS credentials in the config file, then you won't need to worry about this.
+
+[1]: http://aws.amazon.com/cli/

data/cookbooks/awscli/attributes/default.rb

@@ -0,0 +1 @@
+default['awscli']['compile_time'] = false

data/cookbooks/awscli/libraries/instance_metadata.rb

@@ -0,0 +1,21 @@
+module InstanceMetadata
+
+  @metadata_ready = false
+
+  def self.wait_for_instance_IAM_metadata_to_be_available()
+    unless @metadata_ready
+      loop do
+        wget = Mixlib::ShellOut.new("wget -q -O - 'http://169.254.169.254/latest/meta-data/iam/info/'").run_command
+        if wget.exitstatus && wget.stdout.length > 1
+          Chef::Log.info("Instance IAM metadata is available.")
+          @metadata_ready = true
+          break
+        else
+          Chef::Log.debug("Waiting 2 more seconds for instance IAM metadata to be available...")
+          sleep 2
+        end
+      end
+    end
+  end
+
+end

data/cookbooks/awscli/metadata.rb

@@ -0,0 +1,20 @@
+name 'awscli'
+maintainer 'Shlomo Swidler'
+maintainer_email 'shlomo.swidler@orchestratus.com'
+license 'BSD-3-Clause'
+description 'Installs the AWS command line tools'
+long_description IO.read(File.join(File.dirname(__FILE__), 'README.md'))
+source_url 'https://github.com/cloudamatic/mu'
+issues_url 'https://github.com/cloudamatic/mu/issues'
+chef_version '>= 12.1' if respond_to?(:chef_version)
+version '0.2.1'
+
+# Mod by rpc to depend on epel recipe.
+
+recipe "default", "Install AWS CLI tools"
+
+%w{redhat centos fedora amazon scientific debian ubuntu}.each do |plat|
+  supports plat
+end
+
+#depends    'mu-utility::epel'

data/cookbooks/awscli/recipes/default.rb

@@ -0,0 +1,56 @@
+# installs Amazon's awscli tools
+# mod by rpc to include epel
+
+case node['platform']
+  when 'debian', 'ubuntu'
+    file = "/usr/local/bin/aws"
+    cmd = "apt-get install -y python-pip && pip install awscli"
+  when 'redhat', 'centos', 'fedora', 'amazon', 'scientific'
+    # must include epel for centos.  For now do in roles until we fix egt-get-cookbooks.sh
+    #include_recipe "mu-utility::epel"
+    file = "/usr/bin/aws"
+    cmd = "yum -y install python-pip && pip install awscli"
+end
+r = execute "install awscli" do
+  command cmd
+  not_if { ::File.exists?(file) }
+  if node['awscli']['compile_time']
+    action :nothing
+  end
+end
+if node['awscli']['compile_time']
+  r.run_action(:run)
+end
+
+if node['awscli']['config_profiles']
+  config_file="/root/.aws/config"
+
+  r = directory ::File.dirname(config_file) do
+    recursive true
+    owner 'root'
+    group 'root'
+    mode 00700
+    not_if { ::File.exists?(::File.dirname(config_file)) }
+    if node['awscli']['compile_time']
+      action :nothing
+    end
+  end
+  if node['awscli']['compile_time']
+    r.run_action(:create)
+  end
+
+  r = template config_file do
+    mode 00600
+    owner 'root'
+    group 'root'
+    source 'config.erb'
+    not_if { ::File.exists?(config_file) }
+    if node['awscli']['compile_time']
+      action :nothing
+    end
+  end
+  if node['awscli']['compile_time']
+    r.run_action(:create)
+  end
+
+end

data/cookbooks/awscli/templates/default/config.erb

@@ -0,0 +1,18 @@
+# Configuration for the awscli tool
+
+<% default_profile = node['awscli']['config_profiles']['default']
+   unless default_profile.nil? %>
+[default]
+    <% default_profile.each do |key, value| %>
+<%= key %> = <%= value %>
+    <% end
+       end %>
+
+<% node['awscli']['config_profiles'].each do |profile, options|
+  next if profile=='default' %>
+[profile <%= profile %>]
+    <% options.each do |key, value| %>
+<%= key %> = <%= value %>
+    <% end %>
+
+<% end %>

data/cookbooks/mu-activedirectory/CHANGELOG.md

@@ -0,0 +1,13 @@
+mu-activedirectory CHANGELOG
+==========================
+
+This file is used to list changes made in each version of the mu-activedirectory cookbook.
+
+0.1.0
+-----
+- [your_name] - Initial release of mu-activedirectory
+
+- - -
+Check the [Markdown Syntax Guide](http://daringfireball.net/projects/markdown/syntax) for help with Markdown.
+
+The [Github Flavored Markdown page](http://github.github.com/github-flavored-markdown/) describes the differences between markdown on github and standard markdown.

data/cookbooks/mu-activedirectory/LICENSE

@@ -0,0 +1,37 @@
+Through accessing, reading, or utilizing this software in any manner whatsoever
+or through any means whatsoever, whether the access, reading or use is either
+solely looking at this software or this software has been integrated into any
+derivative work, the party accessing,  reading, or utilizing the software
+directly or indirectly agrees to abide by the following license. 
+
+The eGlobalTech Cloud Automation Platform is the Copyright (c) 2014 of Global
+Tech Inc. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+this list of conditions and the following disclaimer in the documentation
+and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its contributors
+may be used to endorse or promote products derived from this software without
+specific prior written permission.
+
+Global Tech, Inc. is the co-owner of any derivative works created with this
+software. 
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+

data/cookbooks/mu-activedirectory/README.md

@@ -0,0 +1,6 @@
+mu-activedirectory Cookbook
+=========================
+
+This Cookbook manages Windows Active Directory nodes, and binding of nodes to active directories.
+
+TODO: Improve Readme.md

data/cookbooks/mu-activedirectory/attributes/default.rb

@@ -0,0 +1,98 @@
+default['ad']['samba_include_file'] = "smb_extra.conf"
+default['ad']['samba_conf_dir'] = "/etc/samba"
+default['ad']['netbios_name'] = "cloudamatic"
+default['ad']['dns_name'] = "ad.cloudamatic.com"
+default['ad']['site_name'] = "AZ1"
+default['ad']['dn_dc_ou'] = "Domain Controllers"
+default['ad']['dn_domain_cmpnt'] = "dc=ad,dc=cloudamatic,dc=com"
+default['ad']['computer_ou'] = nil
+default['ad']['domain_controller_names'] = []
+default['ad']['computer_name'] = nil
+default['ad']['homedir'] = "/home/%u"
+
+# This is done in Mu.
+# node[:deployment][:servers].each_pair { |node_class, nodes|
+# nodes.each_pair { |name, data|
+# if name == Chef::Config[:node_name]
+# my_subnet_id = data['subnet_id']
+# if node['ad'][:domain_controller_names].empty?
+# if data['mu_windows_name']
+# default['ad'][:computer_name] = data['mu_windows_name']
+# default['ad'][:node_class] = node_class
+# end
+# end
+# end
+# } rescue NoMethodError
+# } rescue NoMethodError
+
+default['ad']['sites'] = []
+if !node['deployment']['vpcs'].empty?
+  vpc = node['deployment']['vpcs'][node['deployment']['vpcs'].keys.first]
+  vpc['subnets'].each_pair { |name, data|
+    default['ad']['sites'] << {
+        :name => data['name'],
+        :ip_block => data['ip_block']
+    }
+  }
+end rescue NoMethodError
+
+default['ad']['ntds_static_port'] = 50152
+default['ad']['ntfrs_static_port'] = 50154
+default['ad']['dfsr_static_port'] = 50156
+default['ad']['netlogon_static_port'] = 50158
+
+default['windows_admin_username'] = "Administrator"
+# Credentials for joining an Active Directory domain should be stored in a Chef
+# Vault structured like so:
+# {
+#   "username": "join_domain_user",
+#   "password": "join_domain_password"
+# }
+
+begin
+  default['ad']['admin_auth'] = {
+      :vault          => node['ad']['domain_admin_vault'],
+      :item           => node['ad']['domain_admin_item'],
+      :password_field => node['ad']['domain_admin_password_field'],
+      :username_field => node['ad']['domain_admin_username_field']
+  }
+rescue NoMethodError => e
+  default['ad']['admin_auth'] = {
+      :vault => "activedirectory",
+      :item => "domain_admin",
+      :password_field => "password",
+      :username_field => "username"
+  }
+end
+
+begin
+  default['ad']['join_auth'] = {
+      :vault          => node['ad']['domain_join_vault'],
+      :item           => node['ad']['domain_join_item'],
+      :password_field => node['ad']['domain_join_password_field'],
+      :username_field => node['ad']['domain_join_username_field']
+  }
+rescue NoMethodError => e
+  default['ad']['join_auth'] = {
+      :vault => "activedirectory",
+      :item => "join_domain",
+      :password_field => "password",
+      :username_field => "username"
+  }
+end
+
+default['ad']['dc_ips'] = []
+if node['ad']['dc_ips'].empty?
+  resolver = Resolv::DNS.new
+  node['ad']['dcs'].each { |dc|
+    if dc.match(/^\d+\.\d+\.\d+\.\d+$/)
+      default['ad']['dc_ips'] << dc
+    else
+      begin
+        default['ad']['dc_ips'] << resolver.getaddress(dc).to_s
+      rescue Resolv::ResolvError => e
+        Chef::Log.warn ("Couldn't resolve domain controller #{dc}!")
+      end
+    end
+  } rescue NoMethodError
+end