auth.conf

# /etc/puppet/auth.conf

###
### Authenticated ACLs!
###

# Allow nodes to retrieve their own configuration.
path ~ ^/catalog/([^/]+)$
  method find
  allow $1

# Allow nodes to retrieve their own node definition.
path ~ ^/node/([^/]+)$
  method find
  allow $1

# Allow all nodes to access the certificates services.
path /certificate_revocation_list/ca
  method find
  allow *

# Allow all nodes to store their own reports.
path ~ ^/report/([^/]+)$
  method save
  allow $1

# Unconditionally allow access to all files services
# which means in practice that fileserver.conf will
# be used.
path /file
  allow *

###
### Unauthenticated ACL!
###

# Allow access to the master CA.
path /certificate/ca
  auth any
  method find
  allow *

path /certificate/
  auth any
  method find
  allow *

path /certificate_request
  auth any
  method find, save
  allow *

# Show the default policy.
path /
  auth any