>From b9336112923572691b71202c702ade3591f0b89e Mon Sep 17 00:00:00 2001
From: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
Date: Wed, 23 Sep 2015 15:23:37 +0300
Subject: [PATCH] intg: Add basic user/group/membership change tests

Add integration tests for basic user/group/membership addition and
removal with LDAP.
---
 src/tests/intg/ldap_test.py | 202 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 202 insertions(+)

diff --git a/src/tests/intg/ldap_test.py b/src/tests/intg/ldap_test.py
index ea114dc..9209e88 100644
--- a/src/tests/intg/ldap_test.py
+++ b/src/tests/intg/ldap_test.py
@@ -69,6 +69,17 @@ def create_ldap_fixture(request, ldap_conn, ent_list):
     request.addfinalizer(teardown)
 
 
+def create_ldap_cleanup(request, ldap_conn):
+    """Add teardown for removing all user/group LDAP entries"""
+    def teardown():
+        for ou in ("Users", "Groups", "Netgroups", "Services", "Policies"):
+            for entry in ldap_conn.search_s("ou=" + ou + "," + LDAP_BASE_DN,
+                                            ldap.SCOPE_ONELEVEL,
+                                            attrlist=[]):
+                ldap_conn.delete_s(entry[0])
+    request.addfinalizer(teardown)
+
+
 def create_conf_fixture(request, contents):
     """Generate sssd.conf and add teardown for removing it"""
     conf = open(config.CONF_PATH, "w")
@@ -366,3 +377,194 @@ def test_refresh_after_cleanup_task(ldap_conn, refresh_after_cleanup_task):
     ent.assert_group_by_name(
         "group2",
         dict(mem=ent.contains_only("user1")))
+
+
+def format_interactive_conf(ldap_conn, bis):
+    """Format an SSSD configuration with all caches refreshing in 2 seconds"""
+    if bis:
+        schema_conf = unindent("""\
+            ldap_schema             = rfc2307bis
+            ldap_group_object_class = groupOfNames
+        """)
+    else:
+        schema_conf = unindent("""\
+            ldap_schema             = rfc2307
+        """)
+    return unindent("""\
+        [sssd]
+        debug_level             = 0xffff
+        domains                 = LDAP
+        services                = nss, pam
+
+        [nss]
+        debug_level             = 0xffff
+        memcache_timeout        = 2
+        enum_cache_timeout      = 2
+        entry_negative_timeout  = 2
+
+        [pam]
+        debug_level             = 0xffff
+
+        [domain/LDAP]
+        ldap_auth_disable_tls_never_use_in_production   = true
+        ldap_enumeration_refresh_timeout                = 2
+        ldap_purge_cache_timeout                        = 1
+        debug_level             = 0xffff
+        enumerate               = true
+        {schema_conf}
+        id_provider             = ldap
+        auth_provider           = ldap
+        sudo_provider           = ldap
+        ldap_uri                = {ldap_conn.ds_inst.ldap_url}
+        ldap_search_base        = {ldap_conn.ds_inst.base_dn}
+        entry_cache_timeout     = 2
+    """).format(**locals())
+
+
+@pytest.fixture
+def blank_rfc2307(request, ldap_conn):
+    """Create blank RFC2307 directory fixture with interactive SSSD conf"""
+    create_ldap_cleanup(request, ldap_conn)
+    create_conf_fixture(request, format_interactive_conf(ldap_conn, False))
+    create_sssd_fixture(request)
+
+
+@pytest.fixture
+def blank_rfc2307_bis(request, ldap_conn):
+    """Create blank RFC2307bis directory fixture with interactive SSSD conf"""
+    create_ldap_cleanup(request, ldap_conn)
+    create_conf_fixture(request, format_interactive_conf(ldap_conn, True))
+    create_sssd_fixture(request)
+
+
+@pytest.fixture
+def user_and_group_rfc2307(request, ldap_conn):
+    """
+    Create an RFC2307 directory fixture with interactive SSSD conf,
+    one user and one group
+    """
+    ent_list = ldap_ent.List(LDAP_BASE_DN)
+    ent_list.add_user("user", 1001, 2000)
+    ent_list.add_group("group", 2001)
+    create_ldap_fixture(request, ldap_conn, ent_list)
+    create_conf_fixture(request, format_interactive_conf(ldap_conn, False))
+    create_sssd_fixture(request)
+    return None
+
+
+@pytest.fixture
+def user_and_groups_rfc2307_bis(request, ldap_conn):
+    """
+    Create an RFC2307bis directory fixture with interactive SSSD conf,
+    one user and two groups
+    """
+    ent_list = ldap_ent.List(LDAP_BASE_DN)
+    ent_list.add_user("user", 1001, 2000)
+    ent_list.add_group_bis("group1", 2001)
+    ent_list.add_group_bis("group2", 2002)
+    create_ldap_fixture(request, ldap_conn, ent_list)
+    create_conf_fixture(request, format_interactive_conf(ldap_conn, True))
+    create_sssd_fixture(request)
+    return None
+
+
+def test_add_remove_user(ldap_conn, blank_rfc2307):
+    """Test user addition and removal are reflected by SSSD"""
+    e = ldap_ent.user(LDAP_BASE_DN, "user", 1001, 2000)
+    # Add the user
+    ent.assert_passwd(ent.contains_only())
+    ldap_conn.add_s(*e)
+    ent.assert_passwd(ent.contains_only())
+    time.sleep(3)
+    ent.assert_passwd(ent.contains_only(dict(name="user", uid=1001)))
+    # Remove the user
+    ldap_conn.delete_s(e[0])
+    ent.assert_passwd(ent.contains_only(dict(name="user", uid=1001)))
+    time.sleep(3)
+    ent.assert_passwd(ent.contains_only())
+
+
+def test_add_remove_group(ldap_conn, blank_rfc2307):
+    """Test RFC2307 group addition and removal are reflected by SSSD"""
+    e = ldap_ent.group(LDAP_BASE_DN, "group", 2001)
+    # Add the group
+    ent.assert_group(ent.contains_only())
+    ldap_conn.add_s(*e)
+    ent.assert_group(ent.contains_only())
+    time.sleep(3)
+    ent.assert_group(ent.contains_only(dict(name="group", gid=2001)))
+    # Remove the group
+    ldap_conn.delete_s(e[0])
+    ent.assert_group(ent.contains_only(dict(name="group", gid=2001)))
+    time.sleep(3)
+    ent.assert_group(ent.contains_only())
+
+
+def test_add_remove_group_bis(ldap_conn, blank_rfc2307_bis):
+    """Test RFC2307bis group addition and removal are reflected by SSSD"""
+    e = ldap_ent.group_bis(LDAP_BASE_DN, "group", 2001)
+    # Add the group
+    ent.assert_group(ent.contains_only())
+    ldap_conn.add_s(*e)
+    ent.assert_group(ent.contains_only())
+    time.sleep(3)
+    ent.assert_group(ent.contains_only(dict(name="group", gid=2001)))
+    # Remove the group
+    ldap_conn.delete_s(e[0])
+    ent.assert_group(ent.contains_only(dict(name="group", gid=2001)))
+    time.sleep(3)
+    ent.assert_group(ent.contains_only())
+
+
+def test_add_remove_membership(ldap_conn, user_and_group_rfc2307):
+    """Test user membership addition and removal are reflected by SSSD"""
+    # Add user to group
+    ent.assert_group_by_name("group", dict(mem = ent.contains_only()))
+    ldap_conn.modify_s("cn=group,ou=Groups," + LDAP_BASE_DN,
+                       [(ldap.MOD_REPLACE, "memberUid", "user")])
+    ent.assert_group_by_name("group", dict(mem = ent.contains_only()))
+    time.sleep(3)
+    ent.assert_group_by_name("group", dict(mem = ent.contains_only("user")))
+    # Remove user from group
+    ldap_conn.modify_s("cn=group,ou=Groups," + LDAP_BASE_DN,
+                       [(ldap.MOD_DELETE, "memberUid", None)])
+    ent.assert_group_by_name("group", dict(mem = ent.contains_only("user")))
+    time.sleep(3)
+    ent.assert_group_by_name("group", dict(mem = ent.contains_only()))
+
+
+def test_add_remove_membership_bis(ldap_conn, user_and_groups_rfc2307_bis):
+    """
+    Test user and group membership addition and removal are reflected by SSSD,
+    with RFC2307bis schema
+    """
+    # Add user to group1
+    ent.assert_group_by_name("group1", dict(mem = ent.contains_only()))
+    ldap_conn.modify_s("cn=group1,ou=Groups," + LDAP_BASE_DN,
+                       [(ldap.MOD_REPLACE, "member",
+                         "uid=user,ou=Users," + LDAP_BASE_DN)])
+    ent.assert_group_by_name("group1", dict(mem = ent.contains_only()))
+    time.sleep(3)
+    ent.assert_group_by_name("group1", dict(mem = ent.contains_only("user")))
+
+    # Add group1 to group2
+    ldap_conn.modify_s("cn=group2,ou=Groups," + LDAP_BASE_DN,
+                       [(ldap.MOD_REPLACE, "member",
+                         "cn=group1,ou=Groups," + LDAP_BASE_DN)])
+    ent.assert_group_by_name("group2", dict(mem = ent.contains_only()))
+    time.sleep(3)
+    ent.assert_group_by_name("group2", dict(mem = ent.contains_only("user")))
+
+    # Remove group1 from group2
+    ldap_conn.modify_s("cn=group2,ou=Groups," + LDAP_BASE_DN,
+                       [(ldap.MOD_DELETE, "member", None)])
+    ent.assert_group_by_name("group2", dict(mem = ent.contains_only("user")))
+    time.sleep(3)
+    ent.assert_group_by_name("group2", dict(mem = ent.contains_only()))
+
+    # Remove user from group1
+    ldap_conn.modify_s("cn=group1,ou=Groups," + LDAP_BASE_DN,
+                       [(ldap.MOD_DELETE, "member", None)])
+    ent.assert_group_by_name("group1", dict(mem = ent.contains_only("user")))
+    time.sleep(3)
+    ent.assert_group_by_name("group1", dict(mem = ent.contains_only()))
-- 
2.5.1

