summaryrefslogtreecommitdiffstats
path: root/src/tests
Commit message (Collapse)AuthorAgeFilesLines
...
* UTIL: Store UPN suffixes when creating a new subdomainJakub Hrozek2017-03-023-6/+6
| | | | | | | | | We used to store UPN suffixes pointer into the domain structure only if the domain changed, not when a new domain was created. As an effect, the enterprise principals flag was not enabled unless a domain changed, preventing logins with enterprise principals. Reviewed-by: Sumit Bose <sbose@redhat.com>
* cache_req: use own namespace for UPNsSumit Bose2017-03-022-3/+52
| | | | | | | | | | | | | If the UPN use the same domain name as the configured domain an unsuccessful lookup by name will already create an entry in the negative cache. If the lookup by UPN would use the same namespace the lookup will immediately be finished because there would already be an entry in the negative cache. Resolves: https://pagure.io/SSSD/sssd/issue/3313 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* authtok: fix tests on big-endianSumit Bose2017-02-281-4/+18
| | | | | | Related to https://pagure.io/SSSD/sssd/issue/3270 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* CONFDB: If no configuration file is provided, create a fallback configurationJakub Hrozek2017-02-281-0/+16
| | | | | | | | | | | | | | | This functionality is only enabled in case SSSD is configured with with --enable-files-domain. If not, the behaviour is as it used to -- SSSD returns an error, instructing the admin to create a configuration file. If the option is enabled, a very minimal confdb that only enables the NSS responder is created. The confdb later adds the implicit files domain. Resolves: https://pagure.io/SSSD/sssd/issue/2229 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* TESTS: Test the files domain autoconfigurationJakub Hrozek2017-02-271-0/+78
| | | | | | Adds tests that exercise the implicit files domain. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* TESTS: Enable the files domain for all integration testsJakub Hrozek2017-02-271-1/+9
| | | | | | | | This is done to make sure that enabling the files domain doesn't break existing functionality as well as making it possible to even that the implicit domain, since all integration tests use the same configuration. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* TESTS: Remove unused importJakub Hrozek2017-02-231-1/+0
| | | | Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* p11: return name of PKCS#11 module and key id to pam_sssSumit Bose2017-02-231-2/+31
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: forward Smartcard credentials to backendsSumit Bose2017-02-231-1/+15
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* authtok: enhance support for Smartcard auth blobsSumit Bose2017-02-231-4/+85
| | | | | | | | | The blobs contains beside the PIN the name of the PKCS#11 module and the token name where the certificate of the user was found and the key id. Those data will be used e.g. by the pkinit module to make sure them right certificate is used. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* PAM: use sentinel error code in PAM testsSumit Bose2017-02-231-1/+3
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* FILES: Fix reallocation logicJakub Hrozek2017-02-221-1/+65
| | | | | | | | | | | There were two bugs in the files provider reallocation logic: 1) the reallocated array was not NULL-terminated properly 2) talloc_get_size was used in place of talloc_array_length This bug could have resulted in a crash when the passwd or groups file contained more than FILES_REALLOC_CHUNK entries. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* check_duplicate: check name member before using itSumit Bose2017-02-221-0/+32
| | | | | | Resolves https://fedorahosted.org/sssd/ticket/3231 Reviewed-by: Petr Cech <pcech@redhat.com>
* intg: Fix python3 issuesLukas Slebodnik2017-02-173-8/+12
| | | | | | | | | | | | | | NamedTemporaryFile use the default mode 'w+b' and we tried to write strings. It is not a problem on python2 but failed on pyhton3 Python module ctypes directly uses C functions from libraries. C functions usually expect/returns "char *" when string is expected. But python3 uses unicode for string. Decoding returned bytes ("char *") to unicode strings simplify tests in python3. Otherwise we would need to convert bytes to string in each assertion. Reviewed-by: Martin Basti <mbasti@redhat.com>
* TESTS: Add files provider integration testsJakub Hrozek2017-02-154-0/+937
| | | | | | | | | | | | | | | | | | Implements integration tests for the files provider. In order to change entries in the nss-wrapped passwd and group files, this commit also implements a helper module that creates a new passwd and group file and moves it in place of the nss-wrapped files. We move the files instead of modifying them in-place in order to trigger similar inotify notifications as shadow-utils would. The unit test uses sleep on several places. This is suboptimal, but during testing especially on slow machines, it became apparent that sometimes the inotify message arrives later than the test would check for the changed entries. Therefore, the check would query the NSS responder even before the sss-files domain was invalidated. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TESTS: Add a module to call nss_sss's getgr* from testsJakub Hrozek2017-02-152-0/+89
| | | | | | | | Implements a python module that allows to load the nss_sss module and call functions that act like getgr* Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TESTS: Add a module to call nss_sss's getpw* from testsJakub Hrozek2017-02-152-0/+168
| | | | | | | | Implements a python module that allows to load the nss_sss module and simulate calling getpw* functions from tests. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TESTS: add a helper module with shared NSS constantsJakub Hrozek2017-02-154-33/+53
| | | | | | | | | Every module that reads the sssd_nss module directly copied around the same definition of NSS constants. This commit moves them into a single file to avoid code duplication. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TESTS: move helper fixtures to back up and restore a file to a utility moduleJakub Hrozek2017-02-153-14/+15
| | | | | | | | | | The fixtures will be useful for tests that set up and restore a user and group database. While it would be possible to import them already, the functions were previously used in a test and importing from a test seems a bit like a hack. Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* FILES: Add the files providerJakub Hrozek2017-02-151-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adds a new provider type "files". The provider watches the UNIX password and group databases for changes using inotify and propagates its contents to the sysdb. The files provider is only built on platforms that support the inotify interface, polling or loading the entries on-deman is not supported. During initialization, the files are loaded from the environment variables SSS_FILES_PASSWD and SSS_FILES_GROUP, defaulting to /etc/passwd and /etc/group respectively. Loading the files from environment variables is mostly implemented for tests that need to load nss_wrapped files. The files provider is a bit different from other provider types in the sense that it always enumerates full contents of the database. Therefore, the requests from Data Provider are always just replied to with success. Enumerating the contents is done in full at the moment, all users and all groups are removed and added anew. Modifying the passwd and group databses should be rare enough for this to be justified and we can optimize the code later. Since with large databases, the cache update might take a bit of time, we signal the responders to disable the files domain once we receive the inotify notification and re-enable the files domain after the update is finished. The idea is that the NSS configuration would still contain "files" after "sss" so that if the domain is disabled, libc would fall back to a direct "files" lookup. Resolves: https://fedorahosted.org/sssd/ticket/3262 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* UTIL: Add a generic inotify moduleJakub Hrozek2017-02-151-0/+582
| | | | | | | | | | | | | | Adds a reusable module for watching files using the Linux-specific inotify(7) interface. Adds the possibility to watch the file's parent directory as well to make it possible to watch moves into the directory and allow watching file that doesn't exist at the time the watch is created. This interface is needed to implement the files provider, so this commit is related to: https://fedorahosted.org/sssd/ticket/2228 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDER: A sbus interface to reset negatively cached users and groupsJakub Hrozek2017-02-151-0/+2
| | | | | | | | Adds two new responder sbus interface functions: ResetNegcacheUsers and ResetNegcacheGroups. These functions can be called by a Data Provider to signal to a responder that it should drop its negative cache. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* RESPONDER: Add a responder sbus interface to set domain stateJakub Hrozek2017-02-151-0/+12
| | | | | | | | | | Adds a generic responder s-bus interface that all responders implement. The interface currently contains methods that make it possible for a sssd domain to be marked as active or inconsistent by a back end. In the future, this commit will be superseded by sbus signals. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NEGCACHE: Add API to reset all users and groupsJakub Hrozek2017-02-151-0/+70
| | | | | | | | Adds a negative cache API to reset negatively cached users and groups. This will be used when the files back end finishes enumeration to make sure all results are available. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SUDO: Only store lowercased attribute value onceJakub Hrozek2017-02-101-0/+5
| | | | | | | | | | | | | | | | | | | The current code doesn't handle the situation where lowercasing the sudoUser attribute would yield the same value again. For example: sudoUser: TUSER sudoUser tuser would break. This patch switches to using the utility function sysdb_attrs_add_lower_case_string() which already checks for duplicates. Resolves: https://fedorahosted.org/sssd/ticket/3301 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* cache_req: add host by name searchPavel Březina2017-02-082-0/+35
| | | | Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* cache_req: move dp request to pluginPavel Březina2017-02-082-19/+40
| | | | | | | This will allow to use cache req even for object that do not use account request such as hosts. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sss_parse_inp_send: provide default_domain as parameterPavel Březina2017-02-082-5/+11
| | | | | | | | | | | It is not always desirable to consider default_domain from configuration but expect none instead. For example when we search host certificates. This is currently not used in this patch since host lookups parse name directly with sss_parse_name but it will be used in the next patch. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TESTS: Tests for sdap_search_initgr_user_in_batchPetr Čech2017-02-081-0/+540
| | | | | | | | | | | | This patch provides tests for core logic of sdap_search_initgr_user_in_batch() function. This function replaces old approach with sysdb_try_to_find_expected_dn() function. Resolves: https://fedorahosted.org/sssd/ticket/3230 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* TEST: create_multidom_test_ctx() extendingPetr Čech2017-02-085-16/+7
| | | | | | | | | | | | Function create_multidom_test_ctx() prepares test environment for multidomains. This patch enables setting of different params for each domain. Resolves: https://fedorahosted.org/sssd/ticket/3230 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com>
* SYSDB: Removing of sysdb_try_to_find_expected_dn()Petr Čech2017-02-081-104/+0
| | | | | | | | | | | | | | | | Currently in order to match multiple LDAP search results we use two different functions - we have sysdb_try_to_find_expected_dn() but also sdap_object_in_domain(). This patch removes sysdb_try_to_find_expected_dn() and add new sdap_search_initgr_user_in_batch() based on sdap_object_in_domain(). This function covers necessary logic. Resolves: https://fedorahosted.org/sssd/ticket/3230 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* TESTS: Add to IPA DN testJustin Stephenson2017-02-071-0/+7
| | | | | | | | | Add test to ensure conflict entries return ENOENT Resolves: https://fedorahosted.org/sssd/ticket/3288 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* SBUS: Add destructor data to sbus_connectionFabiano Fidêncio2017-01-231-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This additions has a very specific reason: unregister a service when it's shutdown. So far, we never had to do this kind of operation because the services were started during SSSD's startup when finished when SSSD finished. Now, with the socket-activation in place the game will be a little bit different as the services will have an idle timeout and will be able shut themselves down. In order to do it properly the monitor will need to "unregister" the service and there's no way to do that without adding this destructor data to the sbus_connection structure and introducing a new function to access it from the monitor (where we're going to set the destructor function to the sbus_connection for the socket-activated services). So far it's not being used anywhere as every function taking it as parameter is just receiving NULL, but it will be used in the follow up commits, by the monitor. Related: https://fedorahosted.org/sssd/ticket/3245 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sysdb-tests: Add test for sysdb_search_object_by_nameLukas Slebodnik2017-01-231-0/+116
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* sysdb-tests: Add test for sysdb_search_object_by_idLukas Slebodnik2017-01-231-0/+124
| | | | Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* libwbclient-sssd: wbcLookupSid() allow NULL argumentsSumit Bose2017-01-211-0/+122
| | | | | | | | | | | | Some caller might not be interested in some of the values wbcLookupSid() returns and just pass NULL. Currently 'net ads user info' does this because it is not interested in the domain. wbcLookupSid() should handle this gracefully. Resolves: https://fedorahosted.org/sssd/ticket/3273 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* intg: Return list for enumeration functionsLukas Slebodnik2017-01-161-2/+2
| | | | | | | | | | | | | | | | | | The documentation of get_passwd_list/get_group_list says that they return group/user database entry list. However, ther return class 'map' with python3 due to changes in high level function "map". Traceback (most recent call last): File "/dev/shm/sssd/src/tests/intg/ent_test.py", line 141, in test_assert_passwd_list ent.assert_passwd_list(ent.contains()) File "/dev/shm/sssd/src/tests/intg/ent.py", line 243, in assert_passwd_list assert not d, d AssertionError: not a list, <class 'map'> Reviewed-by: Martin Basti <mbasti@redhat.com>
* intg: Convert output of executed commands to stringsLukas Slebodnik2017-01-162-5/+6
| | | | | | | | We know that all our tested utilities (sssctl, sss_cache, sss_override) returns strings and not binary data. We can safely encode output to string (unicode) in python3 Reviewed-by: Martin Basti <mbasti@redhat.com>
* intg: Return strings from ctypes wrappersLukas Slebodnik2017-01-161-3/+4
| | | | | | | | | Python module ctypes directly uses C functions from libraries. C functions usually returns "char *" when string is expected. But python3 uses unicode for string. Encoding returned bytes ("char *") to unicode strings simplify tests in python3 Reviewed-by: Martin Basti <mbasti@redhat.com>
* intg: Use bytes as input in ctypesLukas Slebodnik2017-01-162-3/+3
| | | | | | | | Python module ctypes directly uses C functions and C functions expect "char *" as a string and not pointer to wide characters "wchar *". Reviewed-by: Martin Basti <mbasti@redhat.com>
* intg: Use bytes for value of attributes in ldifLukas Slebodnik2017-01-166-58/+64
| | | | | | | | Python3 version of ldap module require string for name of attribute but bytes for value of attribute. It was not a problem in python2 due to unicode changes in python3 Reviewed-by: Martin Basti <mbasti@redhat.com>
* intg: Fix creating of slapd configurationLukas Slebodnik2017-01-161-1/+1
| | | | | | | | | | | | | | | | | | | The python module subprocess expect bytes as an input. Traceback (most recent call last): File "src/tests/intg/test_ldap.py", line 51, in ds_inst ds_inst.setup() File "src/tests/intg/ds_openldap.py", line 201, in setup self._setup_config() File "src/tests/intg/ds_openldap.py", line 169, in _setup_config slapadd.communicate(config) File "/usr/lib64/python3.6/subprocess.py", line 821, in communicate self._stdin_write(input) File "/usr/lib64/python3.6/subprocess.py", line 776, in _stdin_write self.stdin.write(input) TypeError: a bytes-like object is required, not 'str' Reviewed-by: Martin Basti <mbasti@redhat.com>
* intg: Use bytes with hash functionLukas Slebodnik2017-01-161-2/+3
| | | | | | | | | | | | | | | | | | Python3 expects bytes as an input for hash function. We need to convert string to bytes before hashing Traceback (most recent call last): File "src/tests/intg/test_ldap.py", line 51, in ds_inst ds_inst.setup() File "src/tests/intg/ds_openldap.py", line 200, in setup self._setup_config() File "src/tests/intg/ds_openldap.py", line 76, in _setup_config admin_pw_hash = hash_password(self.admin_pw) File "src/tests/intg/ds_openldap.py", line 41, in hash_password hash = hashlib.sha1(password) TypeError: Unicode-objects must be encoded before hashing Reviewed-by: Martin Basti <mbasti@redhat.com>
* intg: Avoid using iteritems for dictionaryLukas Slebodnik2017-01-161-1/+1
| | | | | | | | | | | | | | | | Originally, Python items() built a real list of tuples and returned that. That could potentially take a lot of extra memory. Python iteritems() returned an iterator-generator. The original remains for backwards compatibility. One of Python 3’s changes is that items() now return iterators, and a list is never fully built. The iteritems() method is also gone, since items() in Python 3 works like viewitems() in Python2. But we do not have a lot of values in dictionary; so it does not worth to optimize returned list from "items()" on Python2 Reviewed-by: Martin Basti <mbasti@redhat.com>
* intg: Avoid using xrange in testsLukas Slebodnik2017-01-162-6/+6
| | | | | | | | | | | | | | In Python 2 range() returns a list, and xrange() returns an object that will only generate the items in the range when needed, saving memory. In Python 3, the range() function is gone, and xrange() has been renamed range(). We do not strictly require list or iterator in code therefore we can use range which is in poth version. And we do not use big ranges there so the memory overhead with list on python2 is not big. Reviewed-by: Martin Basti <mbasti@redhat.com>
* intg: Fix python2,3 urllibLukas Slebodnik2017-01-161-2/+6
| | | | | | | | The three modules urllib, urllib2 and urlparse has been reorganized into three new modules, urllib.request, urllib.parse and urllib.error. And urllib.quote was moved into urllib.parse. Reviewed-by: Martin Basti <mbasti@redhat.com>
* sssd_ldb.py: Remove a leftover debug messageLukas Slebodnik2017-01-161-1/+0
| | | | | | | | | | | | "print" is a function in python3. We can remove it because it is not important. Portable solution would be: from __future__ import print_function print (basedn) Reviewed-by: Martin Basti <mbasti@redhat.com>
* test_sssctl: Add an integration test for sssctl netgroup-showJakub Hrozek2017-01-101-0/+27
| | | | | | | Related: https://fedorahosted.org/sssd/ticket/3267 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* nss: make nss responder tests work with new codePavel Březina2016-12-193-63/+95
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There were few type of changes that were require for tests to work: 1) When calling "get by name" commands, a name is parsed with sss_parse_inp. Returned value is now mocked. 2) When calling "get by upn" commands, a name is parsed with sss_parse_inp and negative cache is not hit in the first run since cache_req knows it may be upn since it is not equal to any known domain. Returned value of sss_parse_inp is now mocked to return ERR_DOMAIN_NOT_FOUND and negative cache hits are checked to be 0. 3) Lookups by certificate or sid do not require name parsing so those have separate mock functions. 4) Sometime the test fail since different number of mocked functions is called due to changes in the code. Where possible, will_return_always() is used, otherwise number of mocked values was fixed. 5) In SID by name lookups, we set nss_test_ctx->tctx->done to false on the beggining of for cycle, since the code now contains tevent calls and withough it only a first request proceed into tevent_loop in test_ev_loop() because the first finished request sets it to true. Resolves: https://fedorahosted.org/sssd/ticket/3151 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* responders: unify usage of sss_cmd_send_empty and _errorPavel Březina2016-12-191-5/+23
| | | | | | | | | | | | | | | | | | | | | Originally sss_cmd_send_empty() called also sss_cmd_done() to send an empty reply packet to the cliant where as sss_cmd_send_error() did not invoke this call and required the caller to call it manually. For this reason, a possible error in users_find_by_cert_done() was not send to the caller. This patch unifies the usage of those two functions in a way that both of them only creates the reply packet but do not send it. Another sss_cmd_done() call is required to send the reply. Because sss_cmd_done() is now always called, unit tests needed to be changed to always mock a value for __wrap_sss_cmd_done. Resolves: https://fedorahosted.org/sssd/ticket/3151 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-02 09:58:09 +0000