websms/freeipa
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Imported Upstream version 4.3.1

Browse Source
This commit is contained in:
Mario Fetka
2021-08-10 02:37:58 +02:00
parent a791de49a2
commit 2f177da8f2
2056 changed files with 421730 additions and 1668138 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
ipatests/test_cmdline/__init__.py
View File

@@ -1,7 +1,3 @@
#
# Copyright (C) 2015 FreeIPA Contributors see COPYING for license
#
import ipatests.util
ipatests.util.check_ipaclient_unittests()

6
ipatests/test_cmdline/cmdline.py
View File

@@ -21,11 +21,9 @@
Base class for all cmdline tests
"""
from __future__ import absolute_import
import nose
import distutils.spawn
import os
import unittest
from ipalib import api
from ipalib import errors
@@ -67,6 +65,6 @@ class cmdline_test(XMLRPC_test):
)
super(cmdline_test, cls).setup_class()
if not server_available:
raise unittest.SkipTest(
raise nose.SkipTest(
'Server not available: %r' % api.env.xmlrpc_uri
)

258
ipatests/test_cmdline/test_cli.py
View File

@@ -1,17 +1,14 @@
import contextlib
import os
import shlex
import subprocess
import sys
import tempfile
import unittest
import contextlib
import nose
import six
from six import StringIO
from ipatests import util
from ipatests.test_ipalib.test_x509 import goodcert_headers
from ipalib import api, errors
from ipapython.version import API_VERSION
import pytest
if six.PY3:
@@ -19,12 +16,8 @@ if six.PY3:
TEST_ZONE = u'zoneadd.%(domain)s' % api.env
HERE = os.path.abspath(os.path.dirname(__file__))
BASE_DIR = os.path.abspath(os.path.join(HERE, os.pardir, os.pardir))
@pytest.mark.tier0
@pytest.mark.needs_ipaapi
class TestCLIParsing(object):
"""Tests that commandlines are correctly parsed to Command keyword args
"""
@@ -41,11 +34,11 @@ class TestCLIParsing(object):
def run_command(self, command_name, **kw):
"""Run a command on the server"""
if not api.Backend.rpcclient.isconnected():
api.Backend.rpcclient.connect()
api.Backend.rpcclient.connect(fallback=False)
try:
api.Command[command_name](**kw)
except errors.NetworkError:
raise unittest.SkipTest('%r: Server not available: %r' %
raise nose.SkipTest('%r: Server not available: %r' %
(self.__module__, api.env.xmlrpc_uri))
@contextlib.contextmanager
@@ -59,22 +52,32 @@ class TestCLIParsing(object):
def test_ping(self):
self.check_command('ping', 'ping')
def test_plugins(self):
self.check_command('plugins', 'plugins')
def test_user_show(self):
self.check_command('user-show admin', 'user_show', uid=u'admin')
self.check_command('user-show admin', 'user_show',
uid=u'admin',
rights=False,
no_members=False,
raw=False,
all=False)
def test_user_show_underscore(self):
self.check_command('user_show admin', 'user_show', uid=u'admin')
self.check_command('user_show admin', 'user_show',
uid=u'admin',
rights=False,
no_members=False,
raw=False,
all=False)
def test_group_add(self):
self.check_command(
'group-add tgroup1 --desc="Test group"',
self.check_command('group-add tgroup1 --desc="Test group"',
'group_add',
cn=u'tgroup1',
description=u'Test group',
)
nonposix=False,
external=False,
no_members=False,
raw=False,
all=False)
def test_sudocmdgroup_add_member(self):
# Test CSV splitting is not done
@@ -84,67 +87,77 @@ class TestCLIParsing(object):
'sudocmdgroup_add_member',
cn=u'tcmdgroup1',
sudocmd=[u'ab,c', u'd'],
)
no_members=False,
raw=False,
all=False)
def test_group_add_nonposix(self):
self.check_command(
'group-add tgroup1 --desc="Test group" --nonposix',
self.check_command('group-add tgroup1 --desc="Test group" --nonposix',
'group_add',
cn=u'tgroup1',
description=u'Test group',
nonposix=True,
)
external=False,
no_members=False,
raw=False,
all=False)
def test_group_add_gid(self):
self.check_command(
'group-add tgroup1 --desc="Test group" --gid=1234',
self.check_command('group-add tgroup1 --desc="Test group" --gid=1234',
'group_add',
cn=u'tgroup1',
description=u'Test group',
gidnumber=u'1234',
)
nonposix=False,
external=False,
no_members=False,
raw=False,
all=False)
def test_group_add_interactive(self):
with self.fake_stdin('Test group\n'):
self.check_command(
'group-add tgroup1', 'group_add',
self.check_command('group-add tgroup1', 'group_add',
cn=u'tgroup1',
)
nonposix=False,
external=False,
no_members=False,
raw=False,
all=False)
def test_dnsrecord_add(self):
self.check_command(
'dnsrecord-add %s ns --a-rec=1.2.3.4' % TEST_ZONE,
self.check_command('dnsrecord-add %s ns --a-rec=1.2.3.4' % TEST_ZONE,
'dnsrecord_add',
dnszoneidnsname=TEST_ZONE,
idnsname=u'ns',
arecord=u'1.2.3.4',
)
structured=False,
force=False,
raw=False,
all=False)
def test_dnsrecord_del_all(self):
try:
self.run_command('dnszone_add', idnsname=TEST_ZONE)
except errors.NotFound:
raise unittest.SkipTest('DNS is not configured')
raise nose.SkipTest('DNS is not configured')
try:
self.run_command('dnsrecord_add',
dnszoneidnsname=TEST_ZONE,
idnsname=u'ns', arecord=u'1.2.3.4', force=True)
with self.fake_stdin('yes\n'):
self.check_command(
'dnsrecord_del %s ns' % TEST_ZONE,
self.check_command('dnsrecord_del %s ns' % TEST_ZONE,
'dnsrecord_del',
dnszoneidnsname=TEST_ZONE,
idnsname=u'ns',
del_all=True,
)
structured=False)
with self.fake_stdin('YeS\n'):
self.check_command(
'dnsrecord_del %s ns' % TEST_ZONE,
self.check_command('dnsrecord_del %s ns' % TEST_ZONE,
'dnsrecord_del',
dnszoneidnsname=TEST_ZONE,
idnsname=u'ns',
del_all=True,
)
structured=False)
finally:
self.run_command('dnszone_del', idnsname=TEST_ZONE)
@@ -152,7 +165,7 @@ class TestCLIParsing(object):
try:
self.run_command('dnszone_add', idnsname=TEST_ZONE)
except errors.NotFound:
raise unittest.SkipTest('DNS is not configured')
raise nose.SkipTest('DNS is not configured')
try:
records = (u'1 1 E3B72BA346B90570EED94BE9334E34AA795CED23',
u'2 1 FD2693C1EFFC11A8D2BE57229212A04B45663791')
@@ -161,13 +174,13 @@ class TestCLIParsing(object):
dnszoneidnsname=TEST_ZONE, idnsname=u'ns',
sshfprecord=record)
with self.fake_stdin('no\nyes\nyes\n'):
self.check_command(
'dnsrecord_del %s ns' % TEST_ZONE,
self.check_command('dnsrecord_del %s ns' % TEST_ZONE,
'dnsrecord_del',
dnszoneidnsname=TEST_ZONE,
idnsname=u'ns',
del_all=False,
sshfprecord=records,
)
structured=False)
finally:
self.run_command('dnszone_del', idnsname=TEST_ZONE)
@@ -175,64 +188,55 @@ class TestCLIParsing(object):
sshfp_parts = (1, 1, u'E3B72BA346B90570EED94BE9334E34AA795CED23')
with self.fake_stdin('SSHFP\n%d\n%d\n%s' % sshfp_parts):
self.check_command(
'dnsrecord-add %s sshfp' % TEST_ZONE,
self.check_command('dnsrecord-add %s sshfp' % TEST_ZONE,
'dnsrecord_add',
dnszoneidnsname=TEST_ZONE,
idnsname=u'sshfp',
sshfp_part_fp_type=sshfp_parts[0],
sshfp_part_algorithm=sshfp_parts[1],
sshfp_part_fingerprint=sshfp_parts[2],
)
# test with lowercase record type
with self.fake_stdin('sshfp\n%d\n%d\n%s' % sshfp_parts):
self.check_command(
'dnsrecord-add %s sshfp' % TEST_ZONE,
'dnsrecord_add',
dnszoneidnsname=TEST_ZONE,
idnsname=u'sshfp',
sshfp_part_fp_type=sshfp_parts[0],
sshfp_part_algorithm=sshfp_parts[1],
sshfp_part_fingerprint=sshfp_parts[2],
)
structured=False,
raw=False,
all=False,
force=False)
# NOTE: when a DNS record part is passed via command line, it is not
# converted to its base type when transfered via wire
with self.fake_stdin('%d\n%s' % (sshfp_parts[1], sshfp_parts[2])):
self.check_command(
'dnsrecord-add %s sshfp --sshfp-algorithm=%d' % (
TEST_ZONE, sshfp_parts[0]),
self.check_command('dnsrecord-add %s sshfp '
'--sshfp-algorithm=%d' % (TEST_ZONE, sshfp_parts[0]),
'dnsrecord_add',
dnszoneidnsname=TEST_ZONE,
idnsname=u'sshfp',
sshfp_part_fp_type=sshfp_parts[0],
# passed via cmdline
sshfp_part_algorithm=unicode(sshfp_parts[1]),
sshfp_part_algorithm=unicode(sshfp_parts[1]), # passed via cmdline
sshfp_part_fingerprint=sshfp_parts[2],
)
structured=False,
raw=False,
all=False,
force=False)
with self.fake_stdin(sshfp_parts[2]):
self.check_command(
'dnsrecord-add %s sshfp --sshfp-algorithm=%d '
'--sshfp-fp-type=%d' % (
TEST_ZONE, sshfp_parts[0], sshfp_parts[1]),
self.check_command('dnsrecord-add %s sshfp '
'--sshfp-algorithm=%d --sshfp-fp-type=%d' % (
TEST_ZONE, sshfp_parts[0], sshfp_parts[1]),
'dnsrecord_add',
dnszoneidnsname=TEST_ZONE,
idnsname=u'sshfp',
# passed via cmdline
sshfp_part_fp_type=unicode(sshfp_parts[0]),
# passed via cmdline
sshfp_part_algorithm=unicode(sshfp_parts[1]),
sshfp_part_fp_type=unicode(sshfp_parts[0]), # passed via cmdline
sshfp_part_algorithm=unicode(sshfp_parts[1]), # passed via cmdline
sshfp_part_fingerprint=sshfp_parts[2],
)
structured=False,
raw=False,
all=False,
force=False)
def test_dnsrecord_del_comma(self):
try:
self.run_command(
'dnszone_add', idnsname=TEST_ZONE)
except errors.NotFound:
raise unittest.SkipTest('DNS is not configured')
raise nose.SkipTest('DNS is not configured')
try:
self.run_command(
'dnsrecord_add',
@@ -245,7 +249,9 @@ class TestCLIParsing(object):
'dnsrecord_del',
dnszoneidnsname=TEST_ZONE,
idnsname=u'test',
txtrecord=[u'"A pretty little problem," said Holmes.'])
del_all=False,
txtrecord=[u'"A pretty little problem," said Holmes.'],
structured=False)
finally:
self.run_command('dnszone_del', idnsname=TEST_ZONE)
@@ -263,6 +269,8 @@ class TestCLIParsing(object):
ipaidrangesize=u'1',
ipabaserid=5,
ipasecondarybaserid=500000,
all=False,
raw=False,
)
def test_with_command_line_options():
@@ -275,6 +283,8 @@ class TestCLIParsing(object):
ipaidrangesize=u'1',
ipabaserid=u'5',
ipasecondarybaserid=u'500000',
all=False,
raw=False,
)
def test_without_options():
@@ -284,6 +294,8 @@ class TestCLIParsing(object):
cn=u'range1',
ipabaseid=u'1',
ipaidrangesize=u'1',
all=False,
raw=False,
)
adtrust_dn = 'cn=ADTRUST,cn=%s,cn=masters,cn=ipa,cn=etc,%s' % \
@@ -313,97 +325,3 @@ class TestCLIParsing(object):
if not adtrust_is_enabled:
mockldap.del_entry(adtrust_dn)
def test_certfind(self):
with tempfile.NamedTemporaryFile() as f:
f.write(goodcert_headers)
f.flush()
self.check_command(
'cert_find --file={}'.format(f.name),
'cert_find',
file=goodcert_headers
)
def test_cli_fsencoding():
# https://pagure.io/freeipa/issue/5887
env = {
key: value for key, value in os.environ.items()
if not key.startswith(('LC_', 'LANG'))
}
env['LC_ALL'] = 'C'
env['PYTHONPATH'] = BASE_DIR
# override confdir so test always fails and does not depend on an
# existing installation.
env['IPA_CONFDIR'] = '/'
p = subprocess.Popen(
[sys.executable, '-m', 'ipaclient', 'help'],
stdout=subprocess.PIPE,
stderr=subprocess.PIPE,
env=env,
)
out, err = p.communicate()
assert p.returncode != 0, (out, err)
if sys.version_info >= (3, 7):
# Python 3.7+ has PEP 538: Legacy C Locale Coercion
assert b'IPA client is not configured' in err, (out, err)
else:
# Python 3.6 does not support UTF-8 fs encoding with non-UTF LC
assert b'System encoding must be UTF-8' in err, (out, err)
IPA_NOT_CONFIGURED = b'IPA is not configured on this system'
IPA_CLIENT_NOT_CONFIGURED = b'IPA client is not configured on this system'
@pytest.mark.needs_ipaapi
@pytest.mark.skipif(
os.geteuid() != 0 or os.path.isfile('/etc/ipa/default.conf'),
reason="Must have root privileges to run this test "
"and IPA must not be installed")
@pytest.mark.parametrize(
"args, retcode, output, error",
[
# Commands delivered by the client pkg
(['ipa'], 1, None, IPA_CLIENT_NOT_CONFIGURED),
(['ipa-certupdate'], 1, None, IPA_CLIENT_NOT_CONFIGURED),
(['ipa-client-automount'], 1, IPA_CLIENT_NOT_CONFIGURED, None),
# Commands delivered by the server pkg
(['ipa-adtrust-install'], 2, None, IPA_NOT_CONFIGURED),
(['ipa-advise'], 2, None, IPA_NOT_CONFIGURED),
(['ipa-backup'], 2, None, IPA_NOT_CONFIGURED),
(['ipa-cacert-manage'], 2, None, IPA_NOT_CONFIGURED),
(['ipa-ca-install'], 1, None,
b'IPA server is not configured on this system'),
(['ipa-compat-manage'], 2, None, IPA_NOT_CONFIGURED),
(['ipa-csreplica-manage'], 1, None, IPA_NOT_CONFIGURED),
(['ipactl', 'status'], 4, None, b'IPA is not configured'),
(['ipa-dns-install'], 2, None, IPA_NOT_CONFIGURED),
(['ipa-kra-install'], 2, None, IPA_NOT_CONFIGURED),
(['ipa-ldap-updater',
'/usr/share/ipa/updates/05-pre_upgrade_plugins.update'],
2, None, IPA_NOT_CONFIGURED),
(['ipa-managed-entries'], 2, None, IPA_NOT_CONFIGURED),
(['ipa-nis-manage'], 2, None, IPA_NOT_CONFIGURED),
(['ipa-pkinit-manage'], 2, None, IPA_NOT_CONFIGURED),
(['ipa-replica-manage', 'list'], 1, IPA_NOT_CONFIGURED, None),
(['ipa-server-certinstall'], 2, None, IPA_NOT_CONFIGURED),
(['ipa-server-upgrade'], 2, None, IPA_NOT_CONFIGURED),
(['ipa-winsync-migrate'], 1, None, IPA_NOT_CONFIGURED)
])
def test_command_ipa_not_installed(args, retcode, output, error):
"""
Test that the commands properly return that IPA client|server is not
configured on this system.
Launch the command specified in args.
Check that the exit code is as expected and that stdout and stderr
contain the expected strings.
"""
p = subprocess.Popen(args, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
out, err = p.communicate()
assert retcode == p.returncode
if output:
assert output in out
if error:
assert error in err

38
ipatests/test_cmdline/test_help.py
View File

@@ -18,24 +18,20 @@
#
import sys
import os
import shutil
import errno
import contextlib
from nose.tools import assert_raises # pylint: disable=E0611
import six
from six import StringIO
from ipalib import api, errors
from ipaserver.plugins.user import user_add
from ipalib.plugins.user import user_add
import pytest
if six.PY3:
unicode = str
pytestmark = pytest.mark.needs_ipaapi
@pytest.mark.tier0
class CLITestContext(object):
"""Context manager that replaces stdout & stderr, and catches SystemExit
@@ -66,8 +62,6 @@ class CLITestContext(object):
return False
self.exception = exc_value
return True
else:
return None
def test_ipa_help():
@@ -78,27 +72,6 @@ def test_ipa_help():
assert ctx.stderr == ''
def test_ipa_help_without_cache():
"""Test `ipa help` without schema cache"""
cache_dir = os.path.expanduser('~/.cache/ipa/schema/')
backup_dir = os.path.expanduser('~/.cache/ipa/schema.bak/')
shutil.rmtree(backup_dir, ignore_errors=True)
if os.path.isdir(cache_dir):
os.rename(cache_dir, backup_dir)
try:
with CLITestContext() as ctx:
return_value = api.Backend.cli.run(['help'])
assert return_value == 0
assert ctx.stderr == ''
finally:
shutil.rmtree(cache_dir, ignore_errors=True)
try:
os.rename(backup_dir, cache_dir)
except OSError as e:
if e.errno != errno.ENOENT:
raise
def test_ipa_without_arguments():
"""Test that `ipa` errors out, and prints the help to stderr"""
with CLITestContext(exception=SystemExit) as ctx:
@@ -143,7 +116,7 @@ def test_command_help():
assert h_ctx.stderr == ''
assert h_ctx.stdout == help_ctx.stdout
assert unicode(user_add.doc) in help_ctx.stdout
assert unicode(user_add.__doc__) in help_ctx.stdout
def test_ambiguous_command_or_topic():
@@ -163,7 +136,6 @@ def test_ambiguous_command_or_topic():
assert h_ctx.stdout != help_ctx.stdout
def test_multiline_description():
"""Test that all of a multi-line command description appears in output
"""
@@ -171,6 +143,6 @@ def test_multiline_description():
assert '\n\n' in unicode(api.Command.trust_add.doc).strip()
with CLITestContext(exception=SystemExit) as help_ctx:
api.Backend.cli.run(['trust-add', '-h'])
return_value = api.Backend.cli.run(['trust-add', '-h'])
assert unicode(api.Command.trust_add.doc).strip() in help_ctx.stdout

299
ipatests/test_cmdline/test_ipagetkeytab.py
View File

@@ -20,21 +20,20 @@
Test `ipa-getkeytab`
"""
from __future__ import absolute_import
import os
import shutil
import tempfile
import gssapi
import nose
import pytest
from ipalib import api
from ipaplatform.paths import paths
from ipalib import errors
from ipapython import ipautil, ipaldap
from ipaserver.plugins.ldap2 import ldap2
from ipapython.dn import DN
from ipatests.test_cmdline.cmdline import cmdline_test
from ipatests.test_xmlrpc.tracker import host_plugin, service_plugin
def use_keytab(principal, keytab):
try:
@@ -56,272 +55,104 @@ def use_keytab(principal, keytab):
shutil.rmtree(tmpdir)
@pytest.fixture(scope='class')
def test_host(request):
host_tracker = host_plugin.HostTracker(u'test-host')
return host_tracker.make_fixture(request)
@pytest.fixture(scope='class')
def test_service(request, test_host):
service_tracker = service_plugin.ServiceTracker(u'srv', test_host.name)
test_host.ensure_exists()
return service_tracker.make_fixture(request)
@pytest.mark.needs_ipaapi
class KeytabRetrievalTest(cmdline_test):
"""
Base class for keytab retrieval tests
"""
command = "ipa-getkeytab"
keytabname = None
@classmethod
def setup_class(cls):
super(KeytabRetrievalTest, cls).setup_class()
keytabfd, keytabname = tempfile.mkstemp()
os.close(keytabfd)
os.unlink(keytabname)
cls.keytabname = keytabname
@classmethod
def teardown_class(cls):
super(KeytabRetrievalTest, cls).teardown_class()
try:
os.unlink(cls.keytabname)
except OSError:
pass
def run_ipagetkeytab(self, service_principal, args=tuple(),
raiseonerr=False):
new_args = [self.command,
"-p", service_principal,
"-k", self.keytabname]
if not args:
new_args.extend(['-s', api.env.host])
else:
new_args.extend(list(args))
return ipautil.run(
new_args,
stdin=None,
raiseonerr=raiseonerr,
capture_error=True)
def assert_success(self, *args, **kwargs):
result = self.run_ipagetkeytab(*args, **kwargs)
expected = 'Keytab successfully retrieved and stored in: %s\n' % (
self.keytabname)
assert expected in result.error_output, (
'Success message not in output:\n%s' % result.error_output)
def assert_failure(self, retcode, message, *args, **kwargs):
result = self.run_ipagetkeytab(*args, **kwargs)
err = result.error_output
assert message in err
rc = result.returncode
assert rc == retcode
@pytest.mark.tier0
class test_ipagetkeytab(KeytabRetrievalTest):
class test_ipagetkeytab(cmdline_test):
"""
Test `ipa-getkeytab`.
"""
command = "ipa-getkeytab"
keytabname = None
host_fqdn = u'ipatest.%s' % api.env.domain
service_princ = u'test/%s@%s' % (host_fqdn, api.env.realm)
[keytabfd, keytabname] = tempfile.mkstemp()
os.close(keytabfd)
def test_1_run(self, test_service):
def test_0_setup(self):
"""
Create a host to test against.
"""
# Create the service
try:
api.Command['host_add'](self.host_fqdn, force=True)
except errors.DuplicateEntry:
# it already exists, no problem
pass
def test_1_run(self):
"""
Create a keytab with `ipa-getkeytab` for a non-existent service.
"""
test_service.ensure_missing()
result = self.run_ipagetkeytab(test_service.name)
new_args = [self.command,
"-s", api.env.host,
"-p", "test/notfound.example.com",
"-k", self.keytabname,
]
result = ipautil.run(new_args, stdin=None, raiseonerr=False,
capture_error=True)
err = result.error_output
assert 'Failed to parse result: PrincipalName not found.\n' in err, err
rc = result.returncode
assert rc > 0, rc
def test_2_run(self, test_service):
def test_2_run(self):
"""
Create a keytab with `ipa-getkeytab` for an existing service.
"""
test_service.ensure_exists()
# Create the service
try:
api.Command['service_add'](self.service_princ, force=True)
except errors.DuplicateEntry:
# it already exists, no problem
pass
self.assert_success(test_service.name, raiseonerr=True)
os.unlink(self.keytabname)
new_args = [self.command,
"-s", api.env.host,
"-p", self.service_princ,
"-k", self.keytabname,
]
try:
result = ipautil.run(new_args, None, capture_error=True)
expected = 'Keytab successfully retrieved and stored in: %s\n' % (
self.keytabname)
assert expected in result.error_output, (
'Success message not in output:\n%s' % result.error_output)
except ipautil.CalledProcessError as e:
assert (False)
def test_3_use(self, test_service):
def test_3_use(self):
"""
Try to use the service keytab.
"""
use_keytab(test_service.name, self.keytabname)
use_keytab(self.service_princ, self.keytabname)
def test_4_disable(self, test_service):
def test_4_disable(self):
"""
Disable a kerberos principal
"""
retrieve_cmd = test_service.make_retrieve_command()
result = retrieve_cmd()
# Verify that it has a principal key
assert result[u'result'][u'has_keytab']
entry = api.Command['service_show'](self.service_princ)['result']
assert(entry['has_keytab'] == True)
# Disable it
disable_cmd = test_service.make_disable_command()
disable_cmd()
api.Command['service_disable'](self.service_princ)
# Verify that it looks disabled
result = retrieve_cmd()
assert not result[u'result'][u'has_keytab']
entry = api.Command['service_show'](self.service_princ)['result']
assert(entry['has_keytab'] == False)
def test_5_use_disabled(self, test_service):
def test_5_use_disabled(self):
"""
Try to use the disabled keytab
"""
try:
use_keytab(test_service.name, self.keytabname)
use_keytab(self.service_princ, self.keytabname)
except Exception as errmsg:
assert('Unable to bind to LDAP. Error initializing principal' in str(errmsg))
class TestBindMethods(KeytabRetrievalTest):
"""
Class that tests '-c'/'-H'/'-Y' flags
"""
dm_password = None
ca_cert = None
@classmethod
def setup_class(cls):
super(TestBindMethods, cls).setup_class()
dmpw_file = os.path.join(api.env.dot_ipa, '.dmpw')
if not os.path.isfile(dmpw_file):
pytest.skip('{} file required for this test'.format(dmpw_file))
with open(dmpw_file, 'r') as f:
cls.dm_password = f.read().strip()
tempfd, temp_ca_cert = tempfile.mkstemp()
os.close(tempfd)
shutil.copy(os.path.join(paths.IPA_CA_CRT), temp_ca_cert)
cls.ca_cert = temp_ca_cert
@classmethod
def teardown_class(cls):
super(TestBindMethods, cls).teardown_class()
try:
os.unlink(cls.ca_cert)
except OSError:
pass
def check_ldapi(self):
if not api.env.ldap_uri.startswith('ldapi://'):
pytest.skip("LDAP URI not pointing to LDAPI socket")
def test_retrieval_with_dm_creds(self, test_service):
test_service.ensure_exists()
self.assert_success(
test_service.name,
args=[
'-D', "cn=Directory Manager",
'-w', self.dm_password,
'-s', api.env.host])
def test_retrieval_using_plain_ldap(self, test_service):
test_service.ensure_exists()
ldap_uri = 'ldap://{}'.format(api.env.host)
self.assert_success(
test_service.name,
args=[
'-D', "cn=Directory Manager",
'-w', self.dm_password,
'-H', ldap_uri])
@pytest.mark.skipif(os.geteuid() != 0,
reason="Must have root privileges to run this test")
def test_retrieval_using_ldapi_external(self, test_service):
test_service.ensure_exists()
self.check_ldapi()
self.assert_success(
test_service.name,
args=[
'-Y',
'EXTERNAL',
'-H', api.env.ldap_uri])
def test_retrieval_using_ldap_gssapi(self, test_service):
test_service.ensure_exists()
self.check_ldapi()
self.assert_success(
test_service.name,
args=[
'-Y',
'GSSAPI',
'-H', api.env.ldap_uri])
def test_retrieval_using_ldaps_ca_cert(self, test_service):
test_service.ensure_exists()
self.assert_success(
test_service.name,
args=[
'-D', "cn=Directory Manager",
'-w', self.dm_password,
'-H', 'ldaps://{}'.format(api.env.host),
'--cacert', self.ca_cert])
def test_ldap_uri_server_raises_error(self, test_service):
test_service.ensure_exists()
self.assert_failure(
2,
"Cannot specify server and LDAP uri simultaneously",
test_service.name,
args=[
'-H', 'ldaps://{}'.format(api.env.host),
'-s', api.env.host],
raiseonerr=False)
def test_invalid_mech_raises_error(self, test_service):
test_service.ensure_exists()
self.assert_failure(
2,
"Invalid SASL bind mechanism",
test_service.name,
args=[
'-H', 'ldaps://{}'.format(api.env.host),
'-Y', 'BOGUS'],
raiseonerr=False)
def test_mech_bind_dn_raises_error(self, test_service):
test_service.ensure_exists()
self.assert_failure(
2,
"Cannot specify both SASL mechanism and bind DN simultaneously",
test_service.name,
args=[
'-D', "cn=Directory Manager",
'-w', self.dm_password,
'-H', 'ldaps://{}'.format(api.env.host),
'-Y', 'EXTERNAL'],
raiseonerr=False)
def test_9_cleanup(self):
"""
Clean up test data
"""
# First create the host that will use this policy
os.unlink(self.keytabname)
api.Command['host_del'](self.host_fqdn)