Import Upstream version 4.12.4

ipatests/test_integration/test_server_del.py

@@ -3,6 +3,7 @@
 #
 
 from itertools import permutations
+import pytest
 
 from ipatests.test_integration.base import IntegrationTest
 from ipatests.pytest_ipa.integration import tasks
@@ -44,6 +45,26 @@ def check_master_removal(host, hostname_to_remove,
         returncode=2
     )
 
+    # Only run the pki command if there is a CA installed on the machine
+    result = host.run_command(
+        [
+            'ipa',
+            'server-role-find',
+            '--server', host.hostname,
+            '--status', 'enabled',
+            '--role', 'CA server',
+        ],
+        raiseonerr=False,
+    )
+
+    if result.returncode == 0:
+        host.run_command(['pki', 'client', 'init', '--force'])
+        result = host.run_command(
+            ['pki', 'securitydomain-host-find'],
+            stdin_text='y\n',
+        ).stdout_text
+        assert hostname_to_remove not in result
+
 
 def check_removal_disconnects_topology(
         host, hostname_to_remove,
@@ -62,12 +83,11 @@ def check_removal_disconnects_topology(
         )
     }
 
-    for suffix in err_messages_by_suffix:
+    for suffix, err_str in err_messages_by_suffix.items():
         if suffix in affected_suffixes:
-            tasks.assert_error(
-                result, err_messages_by_suffix[suffix], returncode=1)
+            tasks.assert_error(result, err_str, returncode=1)
         else:
-            assert err_messages_by_suffix[suffix] not in result.stderr_text
+            assert err_str not in result.stderr_text
 
 
 class ServerDelBase(IntegrationTest):
@@ -236,6 +256,11 @@ class TestLastServices(ServerDelBase):
     domain_level = DOMAIN_LEVEL_1
     topology = 'line'
 
+    @pytest.fixture
+    def restart_ipa(self):
+        yield
+        self.master.run_command(['ipactl', 'start'])
+
     @classmethod
     def install(cls, mh):
         tasks.install_topo(
@@ -302,6 +327,21 @@ class TestLastServices(ServerDelBase):
             1
         )
 
+    def test_removal_of_server_raises_error_about_last_kra(self, restart_ipa):
+        """
+        test that removal of server fails on the last KRA
+
+        We shut it down to verify that it can be removed if it failed.
+        """
+        tasks.install_kra(self.master)
+        self.master.run_command(['ipactl', 'stop'])
+        tasks.assert_error(
+            tasks.run_server_del(self.replicas[0], self.master.hostname),
+            "Deleting this server is not allowed as it would leave your "
+            "installation without a KRA.",
+            1
+        )
+
     def test_forced_removal_of_master(self):
         """
         Tests that we can still force remove the master using