summaryrefslogtreecommitdiffstats
path: root/tests
Commit message (Collapse)AuthorAgeFilesLines
* Report to user if an LDAP error occursRob Crittenden2015-08-182-3/+146
| | | | | | | | | | | | | | | Catch LDAP errors and display them properly rather than just dumping the exception. Rename variable authed to authok. Add test for case where LDAP server is not started to confirm the user receives the error alert. https://fedorahosted.org/ipsilon/ticket/55 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Drop all the calls to .keys() when iterating on the keys of a dictPierre-Yves Chibon2015-08-113-4/+4
| | | | | | | | | | | | | | When browsing the keys of a dictionary, you can use the ``.keys()`` method but that is in fact only really useful if you want to store the list of keys first and act on them (like sorting them or so). If you just want to iterate through all the keys, no matter the order, then it is much much faster to just do: ``for key in dict`` Some stats about this can be found there: http://blog.pingoured.fr/index.php?post/2012/03/12/Python-notes-to-self Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr> Reviewed-by: Simo Sorce <simo@redhat.com>
* Refactor SP generation to simplify logout testingRob Crittenden2015-07-161-97/+110
| | | | | | | | | | | | | This adds the ability to quickly and easily add more SPs as needed to test more complex logout scenarios. Create five SP's, two of which support only HTTP-Redirect to ensure that logout works in a mixed environment. https://fedorahosted.org/ipsilon/ticket/59 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Replace some type(...) checks with isinstance(...)Patrick Uiterwijk2015-07-081-6/+6
| | | | | | | | This is needed because otherwise the pylint version in Fedora 22 will complain. Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add logout to pgdb, fix name in testsRob Crittenden2015-05-121-3/+23
| | | | | | | | | | Add a logout to the postgres test to ensure that sessions are updated properly on logout. Fix the name in the tests, it was test1. Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Use plugin-specific configuration, better expirationRob Crittenden2015-05-121-1/+1
| | | | | | | | | | | | | Use a SAML2 plugin specific option to specify the database uri for sessions. Use a much more robust method to find sessions that need expiration (thanks Patrick). https://fedorahosted.org/ipsilon/ticket/90 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Configure the SAML2 session database during installationRob Crittenden2015-05-121-1/+2
| | | | | | | https://fedorahosted.org/ipsilon/ticket/90 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add database schema versioningPatrick Uiterwijk2015-05-081-0/+1
| | | | | | | | | | With this skeleton code we can add upgrade code if we ever change the database schema. https://fedorahosted.org/ipsilon/ticket/56 Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Update Copyright header point to COPYING fileRob Crittenden2015-05-0816-177/+20
| | | | | | | | | | | | Point to a file containing the license rather than including it in every single source file. This will make it easier to manage the license in the future without another humongous commit. https://fedorahosted.org/ipsilon/ticket/126 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* pylint 1.4.3 version fixesSimo Sorce2015-05-071-1/+0
| | | | | | | | | | | | | | | | | | | Pylint 1.4.3 completely stopped recognizing the star-args condition. In order to avoid pylint error with > 1.4.3 stop caring for star-args and add cmdline option to ignore those errors completly so older pylint versions are happy too. Also fix type() vs isinstance() checks, isinstance is generally a more correct approach to check for classes. In some 'admin' files the type() -> isinstance() fix required to invert the order in which ComplexList and MappingList are checked as the latter is a subclass of ComplexList, so it needs to be checked first otherwise the check for isinstance(option, ComplexList) matches for both and the code stops functioning properly. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Pull the GSSAPI principal out of the userattrsRob Crittenden2015-05-071-2/+3
| | | | | | | | | | This was originally getting the principal from the user object itself which meant it was looking for it in the database. Look in the attributes instead which are stored in the user session. Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Enable Kerberos NameID testing in testnameidRob Crittenden2015-05-071-16/+50
| | | | | | | | | Since there is now an easy way to stand up a KDC in the tests go ahead and enable it so the Kerberos NameID can be tested. Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Configure a KDC, add test for GSSAPI/KerberosRob Crittenden2015-05-075-17/+411
| | | | | | | | | | | | | | | | | | | | | | Using nss_wrappers so we can control host names we can setup a KDC and test GSSAPI, including fallback to forms-based auth. This also means that fetch_page() needs to handle 401 a bit better, so it can re-try a failed authentication or fall back to forms-based auth. Note for posterity: if gss_localname() fails this is likely due to using the wrong krb5.conf in Apache, so pass in all environment variables. The KDC setup code was based heavily on the tests in the gssproxy project. https://fedorahosted.org/ipsilon/ticket/116 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Change references to authkrb plugin to authgssapiRob Crittenden2015-04-2811-11/+11
| | | | | | | | | With the switch to mod_auth_gssapi we aren't limited to only negotiated Kerberos so name the plugin to reflect this. https://fedorahosted.org/ipsilon/ticket/114 Signed-off-by: Rob Crittenden <rcritten@redhat.com>
* Insert a small timeout before reporting the test successfulPatrick Uiterwijk2015-04-281-0/+3
| | | | | | | | | | This is so the OS gets enough time to clean up all of the sockets used during the execution of the test. Without this, sometimes a "port already in use" error will fail the next test. Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Add OpenID test suitePatrick Uiterwijk2015-04-284-6/+328
| | | | | | | | | | | This tests core OpenID and the Attribute Exchange, Simple Registration and Teams extensions. Using a small wsgi tool because mod_auth_openid does not support all extensions. Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Close database sesssionsPatrick Uiterwijk2015-04-152-0/+15
| | | | | | | | | | This will close any opened database sessions at the end of the request. https://fedorahosted.org/ipsilon/ticket/110 Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Add test for per-SP allowed and mapping attributesRob Crittenden2015-04-102-0/+405
| | | | | | | | | | | | This buidls up a specific global mapping and allowed attributes then creates an SP-specific configuration which differs enough to confirm that it is in fact overriding the default. It finishes by removing the per-SP configuration and ensuring that it falls back to the IdP-default. https://fedorahosted.org/ipsilon/ticket/25 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Validate SP names for admin pages and RESTNathan Kinder2015-04-011-0/+35
| | | | | | | | | | | | | | | | | | We were previously only validating the SP name in the admin pages for SP creation and update. The REST API would allow a SP to be created with an invalid name, which would break the ability to manage that SP in the admin pages. This patch moves the SP name validation logic out of the admin page code and centralizes it in the provider creation code. This ensures that validation will occur regardless of the interface that is used. In addition, a helper method is added to allow the admin page to check if a name is valid during update operations. https://fedorahosted.org/ipsilon/ticket/102 Signed-off-by: Nathan Kinder <nkinder@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Allow SP registration from ipsilon-client-installNathan Kinder2015-04-011-8/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This optionally allows a SAML SP to be registered with the IDP when running ipsilon-client-install. To register an SP, the following options are used: --saml-idp-url (Ipsilon IDP URL) --saml-sp-name (Name to register the SP as) --admin-user (Ipsilon admin user) --admin-password (Ipsilon admin password file) If the --saml-idp-url option is set, we attempt to register the SP. The --saml-sp-name option is required if you are registering a SP. The --admin-user already defaults to admin, so it only needs to be specified if your admin user has a different username. If the --admin-password option is not specified, we prompt for the password. The --saml-idp-metadata was previously required, but this option is redundant if the new --saml-idp-url option is specified and you are not using a local copy of the IDP metadata. You can now just use the --saml-idp-url option, and we build the metadata URL from it. This helps to minimize the number of required options when you are registering an SP during installation. https://fedorahosted.org/ipsilon/ticket/101 Signed-off-by: Nathan Kinder <nkinder@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* IdP-initiated logout for current userRob Crittenden2015-04-011-0/+77
| | | | | | | | | | | | | | Perform Single Logout for the current user when a logout is initiated in the IdP. A fake initial session is created. In the current logout code the initial logout requestor holds the final redirect URL. In this case it redirects back to the root IdP page. https://fedorahosted.org/ipsilon/ticket/87 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Nathan Kinder <nkinder@redhat.com>
* Add options to explicitly set database uris during installPatrick Uiterwijk2015-03-302-1/+2
| | | | | | | | | Also offer the option to set the OpenID database URI during install https://fedorahosted.org/ipsilon/ticket/17 Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com> Reviewed-by: Rob Crittenden <rcritten@redhat.com>
* Add tests for Name ID functionalityRob Crittenden2015-03-243-1/+355
| | | | | | | | | | | | Some Name ID formats are not implemented so are expected to fail. Kerberos is implemented but the test is done using form authentication so no Kerberos principal is available so authentication is denied. https://fedorahosted.org/ipsilon/ticket/27 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Implement urn:oasis:names:tc:SAML:2.0:nameid-format:persistentRob Crittenden2015-03-231-1/+5
| | | | | | | | | | This also makes persistent the default NameID format when generating metadata. https://fedorahosted.org/ipsilon/ticket/27 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add LDAP testSimo Sorce2015-03-234-0/+239
| | | | | | | | This finally tests the LDAP login/info plugins as well as the special "groups" attribute. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add negative authentication testSimo Sorce2015-03-171-0/+10
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Nathan Kinder <nkinder@redhat.com>
* Fix some pylint warnings in logout test about shadowing variables.Rob Crittenden2015-03-161-3/+4
| | | | | Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Nathan Kinder <nkinder@redhat.com>
* Add test for multi-SP logoutRob Crittenden2015-03-162-1/+119
| | | | | | | | | | | Create an additional SP, log into one, fetch the other and the client is now logged into both. Log out of the first one and the client is logged out of both. https://fedorahosted.org/ipsilon/ticket/58 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Nathan Kinder <nkinder@redhat.com>
* Set MALLOC_CHECK_ and MALLOC_PERTURB_ to catch memory problemsRob Crittenden2015-03-161-0/+3
| | | | | | | | | MALLOC_CHECK_ set to 3 should abort if a memory problem is found. MALLOC_PERTURB_ should catch any usage of freed memory. Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Nathan Kinder <nkinder@redhat.com>
* Enable Apache access log and core dump in testsRob Crittenden2015-03-161-0/+7
| | | | | Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Nathan Kinder <nkinder@redhat.com>
* Add test for REST Service Provider GET and POSTRob Crittenden2015-02-272-9/+300
| | | | | | | | | | | | | | | | Provision two Service Providers then test: - We can fetch a blank list of SPs - Add an SP via the admin interface - We get list of all SPs and that is it - Add an SP via POST - We get list of all SPs and now there are two - We get a specific SP and confirm we got the right one. https://fedorahosted.org/ipsilon/ticket/26 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Break out getting SP metadata into a separate test helperRob Crittenden2015-02-271-3/+8
| | | | | | | | | This allows us to get the metadata for creation via REST POST https://fedorahosted.org/ipsilon/ticket/26 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Avoid attrs test flakines, stop using info_nssSimo Sorce2015-02-241-4/+2
| | | | | | | | | authtest already sets the fullname attribute, just use that one instead of relying on nss which, on test systems may have a completely empty gecos field, which makes the test fail. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Change attrs test to check for fullnameSimo Sorce2015-02-241-7/+3
| | | | | | | | We are not going to return 'extras' by default, and the only nss attribute mapped to the 'userdata' space is the gecos (as 'fullname') Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Test for Single Logout ServiceRob Crittenden2015-02-131-0/+176
| | | | | | | https://fedorahosted.org/ipsilon/ticket/24 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* Add test to check file based configuration worksSimo Sorce2014-11-121-0/+179
| | | | | | | | | This is a stripped down version of test1 that manually stored the configuration of the IDP as well as the SP metadata in the admin.conf file, and then check thatthe SP can be successfully used. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add simple SqlSession implementationSimo Sorce2014-11-122-1/+3
| | | | | | | | This allows us to store session data in the DB. This way session data can be shared by multiple servers behind a balancer. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add test to check a real database (pgsql) worksSimo Sorce2014-11-122-0/+178
| | | | | | | | | | | | | | Change config template to e able to set up ipsilon with an extrenal database. For the easy install the database server must have 3 datbases configured, and named exactly: admincondif, userprefs, transactions If different names are required manual instalation will be necessary. Database URLs (including credentials) can be set using the new option named --database-url Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Fix lp-test target compaintsSimo Sorce2014-10-271-2/+0
| | | | | | | This was making make test fail even though make tests was working Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Remove useless log fileSimo Sorce2014-10-241-18/+0
| | | | | | | | Tests do not log into this log file, so remove it for now, it just clutters the tests dir without reason. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Remove unused dependencySimo Sorce2014-10-061-3/+1
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Test transactions code with full redirect loginSimo Sorce2014-09-241-0/+140
| | | | | Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Add test that checks attrs are properly returnedSimo Sorce2014-09-241-0/+161
| | | | | | | Uses the info_nss module to source attirbutes from the system user Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Handle the presence of additional form fieldsSimo Sorce2014-09-241-3/+10
| | | | | | | | For exampe hidden fields which must be preserved and POSTed back to the action url. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Patrick Uiterwijk <puiterwijk@redhat.com>
* Change test executables into modulesSimo Sorce2014-06-174-222/+259
| | | | | | | Create a common tests framework and convert tests into modules loaded at runtime using the ipsilon plugin framework. Signed-off-by: Simo Sorce <simo@redhat.com>
* Fix warningSimo Sorce2014-06-171-1/+1
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* Strenghten default Security options in IDPSimo Sorce2014-06-171-1/+1
| | | | | | | | Always deny access to the IDP if not using SSL by default. Always turn on secure/httponly cookies by default. Add a switch to disable all security options for testing. Signed-off-by: Simo Sorce <simo@redhat.com>
* Move parsing code into helpers moduleSimo Sorce2014-06-153-226/+258
| | | | | | This way common test actions can be easily reused by multiple tests. Signed-off-by: Simo Sorce <simo@redhat.com>
* Add server install option to turn on debuggingSimo Sorce2014-06-061-0/+1
| | | | | | | Use this in the testsuite so we can get meaningful output in the logs when something fails. Signed-off-by: Simo Sorce <simo@redhat.com>
* Print more info about the steps being performedSimo Sorce2014-06-061-0/+3
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
generated by cgit (git 2.34.1) at 2025-07-01 21:21:53 +0000