Question: I have 80 nodes, 78 need to have a specific module, except for 2.

```
[root@puppetmaster puppet]# cat hiera.yaml
:backends:
    - yaml

:hierarchy:
    - environment/%{::environment}/%{::hostname}
    - environment/%{::environment}
    - common

:logger: console

:yaml:
    :datadir: '/etc/puppet/hieradata'
[root@puppetmaster puppet]# cat hieradata/common.yaml
---
classes:
  - ldap
  - motd
  - ntp
  - puppet-conf
[root@puppetmaster puppet]# cat hieradata/environment/tst/tst-01.yaml
---
classes:
  - puppet-update
  - public-keys
[root@puppetmaster puppet]#

```

I want **all** nodes to have the ldap module, except for the tst-01 and tst-02 server.

How do I exclude this module from these 2 servers?

A solution would be to use 80 .yaml-files for all nodes and add "- ldap" to 78 of these .yaml-files, but this seems poor design. It would be cleaner to exclude the modules from the inherited list.

Answer: 
You may wish to turn off SASL and use simple authentication with the "-x" option. For example, a search to find a particular user

```
ldapsearch -x -D "uid=search-user,ou=People,dc=example,dc=com" \
           -W -H ldap://ldap.example.com -b "ou=People,dc=example,dc=com" \
           -s sub 'uid=test-user'

```

Will find "test-user" by

* *-D* - Use bind user "search-user"
* *-W* - Prompt for password
* *-H* - URL of LDAP server. Non-SSL in this case; use "ldaps://" for SSL
* *-b* - The search base
* *-s* - Search scope - i.e. *base* for base of tree, *one* for on level down and *sub* for recursively searching down the tree (can take a while)
* Finally the search filter as a non-option argument. In this case we will search for the uid of "test-user"
Seems that I ask same question at: <https://stackoverflow.com/questions/27571558/how-was-authentication-built-on-ldap>

See <http://thecarlhall.wordpress.com/2011/01/04/ldap-authentication-authorization-dissected-and-digested/> :

* Get a connection to the LDAP server.
* Bind as the application user.
* Search for the DN (distinguished name) of the user to be authenticated.
* Bind as user to be authenticated using DN from step 3.

That may be summarized as (experiment in command line):

```
$ ldapsearch -x -h ldap.company.com -s sub -b 'dc=europe,dc=com' "uid=XYZ"
....
dn: uid=XYZ,dc=sales,dc=europe,dc=com
...
$ ldapsearch -W -h ldap.company.com -D 'uid=XYZ,dc=sales,dc=europe,dc=com' \
    -s sub -b 'dc=europe,dc=com' "uid=XYZ"

```