Question: I have 80 nodes, 78 need to have a specific module, except for 2.

```
[root@puppetmaster puppet]# cat hiera.yaml
:backends:
    - yaml

:hierarchy:
    - environment/%{::environment}/%{::hostname}
    - environment/%{::environment}
    - common

:logger: console

:yaml:
    :datadir: '/etc/puppet/hieradata'
[root@puppetmaster puppet]# cat hieradata/common.yaml
---
classes:
  - ldap
  - motd
  - ntp
  - puppet-conf
[root@puppetmaster puppet]# cat hieradata/environment/tst/tst-01.yaml
---
classes:
  - puppet-update
  - public-keys
[root@puppetmaster puppet]#

```

I want **all** nodes to have the ldap module, except for the tst-01 and tst-02 server.

How do I exclude this module from these 2 servers?

A solution would be to use 80 .yaml-files for all nodes and add "- ldap" to 78 of these .yaml-files, but this seems poor design. It would be cleaner to exclude the modules from the inherited list.

Answer: 
You may wish to turn off SASL and use simple authentication with the "-x" option. For example, a search to find a particular user

```
ldapsearch -x -D "uid=search-user,ou=People,dc=example,dc=com" \
           -W -H ldap://ldap.example.com -b "ou=People,dc=example,dc=com" \
           -s sub 'uid=test-user'

```

Will find "test-user" by

* *-D* - Use bind user "search-user"
* *-W* - Prompt for password
* *-H* - URL of LDAP server. Non-SSL in this case; use "ldaps://" for SSL
* *-b* - The search base
* *-s* - Search scope - i.e. *base* for base of tree, *one* for on level down and *sub* for recursively searching down the tree (can take a while)
* Finally the search filter as a non-option argument. In this case we will search for the uid of "test-user"
Note, if you don't know your full bind DN, you can also just use your normal username or email with `-U`

```
ldapsearch -v -h contoso.com -U turiya.gouw@contoso.com -w 'MY_PASSWORD' -b 'DC=contoso,DC=com' '(objectClass=computer)'

```