Passwords are shown in the output in case of a failure for a server or client install

[lofic]

The command in

exec { "client_install_${::fqdn}":
command   => $client_install_cmd,

is shown. Including principal and password.

logoutput is not helping here because this is the input, not the output.

[mattock]

I think the only way around this is to avoid passing a password in the first place. There are other ways to join a node to FreeIPA I recall, but I think those were more orchestration-oriented ("do something on IPA server, then do something on the node to join"). This could be fairly easily handled by a Puppet Bolt plan.

What we've done sometimes is limit the privileges of the user used to enroll new hosts:

• https://www.puppeteers.net/blog/joining-nodes-to-freeipa-using-a-non-admin-user/

This seems to work and is better security-vise, even if not perfect.