{% set user_pillars = salt.pillar.get('users',['unix']) %}

{% for user, user_data in user_pillars.items() %}

{% if 'account_type' in user_data %}

  {% if user_data.account_type == 'ldap' %}

    {% set derived_group = 'users' %}
    {% set derived_gid = 100 %}

  {% endif %} # ldap

{% else %}

  {% set derived_group = user_data.name %}
  {% set derived_gid = user_data.gid %}

user_{{user_data.name}}:

  {% if 'gid' in user_data %}

  group.present:
    - name: {{user_data.name}}
    - gid: {{user_data.gid}}

  {% endif %} # gid

  user.present:
    - name: {{user_data.name}}
    - fullname: {{user_data.fullname}}
    {% if 'shadow' in user_data %}
    - password: {{user_data.shadow}}
    {% endif %}
    {% if 'shell' in user_data %}
    - shell: {{user_data.shell}}
    {% endif %}
    - uid: {{user_data.uid}}
    - gid: {{derived_gid}}

    {% if 'gid' in user_data %}
    - require:
      - group: user_{{user_data.name}}
    {% endif %} # gid

{% endif %} # account_type

{% if 'groups' in user_data %}
{% for group in user_data.groups %}

auth_group_{{group}}_{{user_data.name}}:
  group.present:
    - name: {{group}}
    - require:
      - service: sssd
      - file: /etc/nsswitch.conf
    - addusers:
      - {{ user_data.name }}

{% endfor %} # groups
{% endif %} # groups

user_{{user_data.name}}_homedir:
  file.directory:
    - name: /home/{{user_data.name}}
    - user: {{user_data.name}}
    - group: {{derived_group}}
    - mode: 0751
    - makedirs: true
    - require:
      - service: sssd
      - file: /etc/nsswitch.conf

user_{{user_data.name}}_sshdir:
  file.directory:
    - name: /home/{{user_data.name}}/.ssh
    - user: {{user_data.name}}
    - group: {{derived_group}}
    - mode: 0700
    - require:
      - service: sssd
      - file: /etc/nsswitch.conf

{% if 'email' in user_data %}

user_{{user_data.name}}_forward:
  file.append:
    - name: /home/{{user_data.name}}/.forward
    - text: {{user_data.email}}
    - require:
      - service: sssd
      - file: /etc/nsswitch.conf

{% endif %} # email

{% if 'authkey' in user_data %}

user_{{user_data.name}}_authkeys:
  ssh_auth.present:
    - user: {{user_data.name}}
    - name: {{user_data.authkey}}
    - require:
      - service: sssd
      - file: /etc/nsswitch.conf

{% endif %} # authkey

{% if 'sshpub' in user_data %}

user_{{user_data.name}}_sshpub:
  file.managed:
    - name: /home/{{user_data.name}}/.ssh/id_rsa.pub
    - user: {{user_data.name}}
    - group: {{derived_group}}
    - mode: 0600
    - contents_pillar: users:{{user}}:sshpub
    - require:
      - service: sssd
      - file: /etc/nsswitch.conf

{% endif %} # sshpub

{% if 'sshpriv' in user_data %}

user_{{user_data.name}}_sshpriv:
  file.managed:
    - name: /home/{{user_data.name}}/.ssh/id_rsa
    - user: {{user_data.name}}
    - group: {{derived_group}}
    - mode: 0600
    - contents_pillar: users:{{user}}:sshpriv
    - require:
      - service: sssd
      - file: /etc/nsswitch.conf

{% endif %} # sshpriv

{% endfor %}