>From b9336112923572691b71202c702ade3591f0b89e Mon Sep 17 00:00:00 2001 From: Nikolai Kondrashov Date: Wed, 23 Sep 2015 15:23:37 +0300 Subject: [PATCH] intg: Add basic user/group/membership change tests Add integration tests for basic user/group/membership addition and removal with LDAP. --- src/tests/intg/ldap_test.py | 202 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 202 insertions(+) diff --git a/src/tests/intg/ldap_test.py b/src/tests/intg/ldap_test.py index ea114dc..9209e88 100644 --- a/src/tests/intg/ldap_test.py +++ b/src/tests/intg/ldap_test.py @@ -69,6 +69,17 @@ def create_ldap_fixture(request, ldap_conn, ent_list): request.addfinalizer(teardown) +def create_ldap_cleanup(request, ldap_conn): + """Add teardown for removing all user/group LDAP entries""" + def teardown(): + for ou in ("Users", "Groups", "Netgroups", "Services", "Policies"): + for entry in ldap_conn.search_s("ou=" + ou + "," + LDAP_BASE_DN, + ldap.SCOPE_ONELEVEL, + attrlist=[]): + ldap_conn.delete_s(entry[0]) + request.addfinalizer(teardown) + + def create_conf_fixture(request, contents): """Generate sssd.conf and add teardown for removing it""" conf = open(config.CONF_PATH, "w") @@ -366,3 +377,194 @@ def test_refresh_after_cleanup_task(ldap_conn, refresh_after_cleanup_task): ent.assert_group_by_name( "group2", dict(mem=ent.contains_only("user1"))) + + +def format_interactive_conf(ldap_conn, bis): + """Format an SSSD configuration with all caches refreshing in 2 seconds""" + if bis: + schema_conf = unindent("""\ + ldap_schema = rfc2307bis + ldap_group_object_class = groupOfNames + """) + else: + schema_conf = unindent("""\ + ldap_schema = rfc2307 + """) + return unindent("""\ + [sssd] + debug_level = 0xffff + domains = LDAP + services = nss, pam + + [nss] + debug_level = 0xffff + memcache_timeout = 2 + enum_cache_timeout = 2 + entry_negative_timeout = 2 + + [pam] + debug_level = 0xffff + + [domain/LDAP] + ldap_auth_disable_tls_never_use_in_production = true + ldap_enumeration_refresh_timeout = 2 + ldap_purge_cache_timeout = 1 + debug_level = 0xffff + enumerate = true + {schema_conf} + id_provider = ldap + auth_provider = ldap + sudo_provider = ldap + ldap_uri = {ldap_conn.ds_inst.ldap_url} + ldap_search_base = {ldap_conn.ds_inst.base_dn} + entry_cache_timeout = 2 + """).format(**locals()) + + +@pytest.fixture +def blank_rfc2307(request, ldap_conn): + """Create blank RFC2307 directory fixture with interactive SSSD conf""" + create_ldap_cleanup(request, ldap_conn) + create_conf_fixture(request, format_interactive_conf(ldap_conn, False)) + create_sssd_fixture(request) + + +@pytest.fixture +def blank_rfc2307_bis(request, ldap_conn): + """Create blank RFC2307bis directory fixture with interactive SSSD conf""" + create_ldap_cleanup(request, ldap_conn) + create_conf_fixture(request, format_interactive_conf(ldap_conn, True)) + create_sssd_fixture(request) + + +@pytest.fixture +def user_and_group_rfc2307(request, ldap_conn): + """ + Create an RFC2307 directory fixture with interactive SSSD conf, + one user and one group + """ + ent_list = ldap_ent.List(LDAP_BASE_DN) + ent_list.add_user("user", 1001, 2000) + ent_list.add_group("group", 2001) + create_ldap_fixture(request, ldap_conn, ent_list) + create_conf_fixture(request, format_interactive_conf(ldap_conn, False)) + create_sssd_fixture(request) + return None + + +@pytest.fixture +def user_and_groups_rfc2307_bis(request, ldap_conn): + """ + Create an RFC2307bis directory fixture with interactive SSSD conf, + one user and two groups + """ + ent_list = ldap_ent.List(LDAP_BASE_DN) + ent_list.add_user("user", 1001, 2000) + ent_list.add_group_bis("group1", 2001) + ent_list.add_group_bis("group2", 2002) + create_ldap_fixture(request, ldap_conn, ent_list) + create_conf_fixture(request, format_interactive_conf(ldap_conn, True)) + create_sssd_fixture(request) + return None + + +def test_add_remove_user(ldap_conn, blank_rfc2307): + """Test user addition and removal are reflected by SSSD""" + e = ldap_ent.user(LDAP_BASE_DN, "user", 1001, 2000) + # Add the user + ent.assert_passwd(ent.contains_only()) + ldap_conn.add_s(*e) + ent.assert_passwd(ent.contains_only()) + time.sleep(3) + ent.assert_passwd(ent.contains_only(dict(name="user", uid=1001))) + # Remove the user + ldap_conn.delete_s(e[0]) + ent.assert_passwd(ent.contains_only(dict(name="user", uid=1001))) + time.sleep(3) + ent.assert_passwd(ent.contains_only()) + + +def test_add_remove_group(ldap_conn, blank_rfc2307): + """Test RFC2307 group addition and removal are reflected by SSSD""" + e = ldap_ent.group(LDAP_BASE_DN, "group", 2001) + # Add the group + ent.assert_group(ent.contains_only()) + ldap_conn.add_s(*e) + ent.assert_group(ent.contains_only()) + time.sleep(3) + ent.assert_group(ent.contains_only(dict(name="group", gid=2001))) + # Remove the group + ldap_conn.delete_s(e[0]) + ent.assert_group(ent.contains_only(dict(name="group", gid=2001))) + time.sleep(3) + ent.assert_group(ent.contains_only()) + + +def test_add_remove_group_bis(ldap_conn, blank_rfc2307_bis): + """Test RFC2307bis group addition and removal are reflected by SSSD""" + e = ldap_ent.group_bis(LDAP_BASE_DN, "group", 2001) + # Add the group + ent.assert_group(ent.contains_only()) + ldap_conn.add_s(*e) + ent.assert_group(ent.contains_only()) + time.sleep(3) + ent.assert_group(ent.contains_only(dict(name="group", gid=2001))) + # Remove the group + ldap_conn.delete_s(e[0]) + ent.assert_group(ent.contains_only(dict(name="group", gid=2001))) + time.sleep(3) + ent.assert_group(ent.contains_only()) + + +def test_add_remove_membership(ldap_conn, user_and_group_rfc2307): + """Test user membership addition and removal are reflected by SSSD""" + # Add user to group + ent.assert_group_by_name("group", dict(mem = ent.contains_only())) + ldap_conn.modify_s("cn=group,ou=Groups," + LDAP_BASE_DN, + [(ldap.MOD_REPLACE, "memberUid", "user")]) + ent.assert_group_by_name("group", dict(mem = ent.contains_only())) + time.sleep(3) + ent.assert_group_by_name("group", dict(mem = ent.contains_only("user"))) + # Remove user from group + ldap_conn.modify_s("cn=group,ou=Groups," + LDAP_BASE_DN, + [(ldap.MOD_DELETE, "memberUid", None)]) + ent.assert_group_by_name("group", dict(mem = ent.contains_only("user"))) + time.sleep(3) + ent.assert_group_by_name("group", dict(mem = ent.contains_only())) + + +def test_add_remove_membership_bis(ldap_conn, user_and_groups_rfc2307_bis): + """ + Test user and group membership addition and removal are reflected by SSSD, + with RFC2307bis schema + """ + # Add user to group1 + ent.assert_group_by_name("group1", dict(mem = ent.contains_only())) + ldap_conn.modify_s("cn=group1,ou=Groups," + LDAP_BASE_DN, + [(ldap.MOD_REPLACE, "member", + "uid=user,ou=Users," + LDAP_BASE_DN)]) + ent.assert_group_by_name("group1", dict(mem = ent.contains_only())) + time.sleep(3) + ent.assert_group_by_name("group1", dict(mem = ent.contains_only("user"))) + + # Add group1 to group2 + ldap_conn.modify_s("cn=group2,ou=Groups," + LDAP_BASE_DN, + [(ldap.MOD_REPLACE, "member", + "cn=group1,ou=Groups," + LDAP_BASE_DN)]) + ent.assert_group_by_name("group2", dict(mem = ent.contains_only())) + time.sleep(3) + ent.assert_group_by_name("group2", dict(mem = ent.contains_only("user"))) + + # Remove group1 from group2 + ldap_conn.modify_s("cn=group2,ou=Groups," + LDAP_BASE_DN, + [(ldap.MOD_DELETE, "member", None)]) + ent.assert_group_by_name("group2", dict(mem = ent.contains_only("user"))) + time.sleep(3) + ent.assert_group_by_name("group2", dict(mem = ent.contains_only())) + + # Remove user from group1 + ldap_conn.modify_s("cn=group1,ou=Groups," + LDAP_BASE_DN, + [(ldap.MOD_DELETE, "member", None)]) + ent.assert_group_by_name("group1", dict(mem = ent.contains_only("user"))) + time.sleep(3) + ent.assert_group_by_name("group1", dict(mem = ent.contains_only())) -- 2.5.1