summaryrefslogtreecommitdiffstats
path: root/src/tests
Commit message (Collapse)AuthorAgeFilesLines
...
* INTG_TESTS: Add one more test for filtered out users/groupsFabiano Fidêncio2017-06-051-0/+54
| | | | | | | | | | | | | | | | | | | | | | | The added test is quite simple and basically ensures that when some shortcut is taken in the cache_req_send() SSSD still filters out the already cached users/groups. The real situation the test tries to test is: - getent passwd 1002 - sleep(2) - getent passwd 1002 - getent group 2002 - sleep(2) - getent group 2002 (Considering entry_negative_timeout = 1 in [nss] section of sssd.conf). Related: https://pagure.io/SSSD/sssd/issue/3362 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TESTS: Add one config-check test caseMichal Židek2017-06-031-0/+12
| | | | | | | | Add test case with wrong subdomain section format, where the too many domains are used to identify the trusted domain instead of just the connected domain and the one trusted domain that is being configured. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sysdb: sysdb_get_certmap() allow empty certmapSumit Bose2017-06-011-4/+5
| | | | | | | | | Since sysdb_get_certmap() returns the user name hint information as well it should return a result even if there are no certmaps. Related to https://pagure.io/SSSD/sssd/issue/3395 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* PAM: send user name hint response when neededSumit Bose2017-06-011-14/+96
| | | | | | | | | | | If the PAM client didn't send a user name and promtusername is enable the PAM responder will tell pam_sss to ask for an optional user name as well. Resolves: https://pagure.io/SSSD/sssd/issue/3395 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* tests: fix test_pam_preauth_cert_no_logon_name()Sumit Bose2017-06-011-3/+7
| | | | | | | | Currently a name is provided for test_pam_preauth_cert_no_logon_name() so it is not a no-logon-name test. This patch removes the name and adds the now missing mocked reply manually. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* test_config_check: Fix few issuesLukas Slebodnik2017-06-011-4/+10
| | | | | | | | | | | | | | | | * enable few tests * malformed configuration file due to missing closing ']' * fix few expected failures * add few sections into whitelist test * crash in test if count of expected failures is different then real value [ RUN ] config_check_test_bad_subdom_option_name [rule/allowed_domain_options]: Attribute 'debug_leTYPOvel' is not allowed in section 'domain/A.test/B.A.test'. Check for typos. [rule/allowed_subdomain_options]: Attribute 'debug_leTYPOvel' is not allowed in section 'domain/A.test/B.A.test'. Check for typos. [ ERROR ] --- Test failed with exception: Segmentation fault(11) Reviewed-by: Michal Židek <mzidek@redhat.com>
* VALIDATORS: Detect inherit_from in normal domainMichal Židek2017-05-311-0/+22
| | | | | | | | | | | | This patch adds new sssd specific validator. In the future we can add more checks in it, but currently it only checks if the option inherit_from is used on normal domain and reports error if it is. Resolves: https://pagure.io/SSSD/sssd/issue/3356 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TESTS: Add unit tests for cfg validationMichal Židek2017-05-311-0/+268
| | | | | | Add infrastructure for unit tests for validators. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* TESTS: Fix pep8 errors in test_ts_cache.pyJakub Hrozek2017-05-291-2/+4
| | | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* TESTS: Fix pep8 errors in test_secrets.pyJakub Hrozek2017-05-291-1/+0
| | | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* TESTS: Fix pep8 errors in test_kcm.pyJakub Hrozek2017-05-291-3/+6
| | | | | Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* test_kcm: Remove commented codeJakub Hrozek2017-05-291-6/+0
| | | | | | | The bug is now tracked with: https://pagure.io/SSSD/sssd/issue/3413 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* BUILD: Fix build without sshLukas Slebodnik2017-05-251-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | cache_req_host_by_name_lookup should be used only by ssh responder. But we cannot rely on this fact and therefore we should return ERR_INTERNAL instead of EOK to catch mis-usage of the cache_req plugin autoreconf -if ./configure --without-ssh make check CCLD sssd_nss src/responder/common/cache_req/plugins/cache_req_host_by_name.o: In function `cache_req_host_by_name_lookup': src/responder/common/cache_req/plugins/cache_req_host_by_name.c:48: undefined reference to `sysdb_get_ssh_host' collect2: error: ld returned 1 exit status make: *** [Makefile:14285: sssd_nss] Error 1 src/tests/cmocka/test_utils-test_sss_ssh.o: In function `test_textual_public_key': src/tests/cmocka/test_sss_ssh.c:78: undefined reference to `sss_ssh_format_pubkey' src/tests/cmocka/test_sss_ssh.c:82: undefined reference to `sss_ssh_format_pubkey' src/tests/cmocka/test_sss_ssh.c:86: undefined reference to `sss_ssh_format_pubkey' src/tests/cmocka/test_sss_ssh.c:89: undefined reference to `sss_ssh_format_pubkey' src/tests/cmocka/test_sss_ssh.c:92: undefined reference to `sss_ssh_format_pubkey' src/tests/cmocka/test_utils-test_sss_ssh.o:src/tests/cmocka/test_sss_ssh.c:95: more undefined references to `sss_ssh_format_pubkey' follow collect2: error: ld returned 1 exit status Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* TESTS: Add a test for parallel execution of klistJakub Hrozek2017-05-242-1/+27
| | | | | | | | | | | Integration test for: https://pagure.io/SSSD/sssd/issue/3372 With https://pagure.io/SSSD/sssd/issue/3372 still broken, the unit test wold fail because one of the concurrent klist commands would trigger a race condition in the KCM queue code, crashing the KCM responder. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* INTG: Do not use configure time option enable-files-domainLukas Slebodnik2017-05-231-0/+2
| | | | | | | | The implicit_files was started with each test even though was not required. Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* pam: properly support UPN logon namesSumit Bose2017-05-231-1/+78
| | | | | | | | | | | | | | | | Many logon applications like /bin/login or sshd canonicalize the user name before they call pam_start() and hence the UPN is not seen by SSSD's pam responder. But some like e.g. gdm don't and authentication might fail if a UPN is used. The reason is that currently the already parsed short name of the user was used in the cache_req and hence the cache_req was not able to fall back to the UPN lookup code. This patch uses the name originally provided by the user as input to allow the fallback to the UPN lookup. Resolves https://pagure.io/SSSD/sssd/issue/3240 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* sss_nss_getlistbycert: return results from multiple domainsSumit Bose2017-05-101-10/+23
| | | | | | | | | | Currently only the results from one domain were returned although all domains were searched and the results were available. Unit tests are updated to cover this case as well. Resolves https://pagure.io/SSSD/sssd/issue/3393 Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* test_ldap.py: Add test for filter_{users,groups}Lukas Slebodnik2017-05-101-0/+96
| | | | | | | | | Related: https://pagure.io/SSSD/sssd/issue/3362 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NSS/TESTS: Improve non-fqnames testsFabiano Fidêncio2017-04-261-15/+30
| | | | | | | | | | | | | | | | | | | | | | With the changes that are about to happen we have to have the subdomain's fqnames flag set by the time we populate the cr_domains list (as it actually occurs with the real code), as this list may set its own fqnames flag based on the subdomain's fqnames flag. Currently the flag is set to false only when running the tests itself so the cr_domains list doesn't get populate properly (although it still works with the current code). For the changes that are comming, let's introduce a new setup function that ensures that the subdomain's fqnames flag is set up in the right time. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* minor typo fixesRené Genz2017-04-191-1/+1
| | | | | | | Merges: https://pagure.io/SSSD/sssd/pull-request/3374 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Justin Stephenson <jstephen@redhat.com>
* libsss_certmap: Accept certificate with data before headerDavid Kupka2017-04-031-0/+16
| | | | | | | | | | | | | According to RFC 7468 parser must not fail when some data are present before the encapsulation boundary. sss_cert_pem_to_der didn't respect this and refused valid input. Changing it's code to first locate the certificate header fixes the issue. Resolves: https://pagure.io/SSSD/sssd/issue/3354 Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* ci: do not build secrets on rhel6Pavel Březina2017-03-301-0/+4
| | | | | | | We require newer libcurl version than is available on rhel6. We don't ship secrets responder in rhel6 so we just disable its build. Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* tcurl test: add support for client certificatePavel Březina2017-03-301-0/+13
| | | | | Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* tcurl test: allow to set custom headersPavel Březina2017-03-301-2/+9
| | | | | Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* tcurl: add support for http basic authPavel Březina2017-03-301-0/+14
| | | | | Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* tcurl test: add support for tls settingsPavel Březina2017-03-301-0/+19
| | | | | Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* tcurl test: add support for raw outputPavel Březina2017-03-301-0/+9
| | | | | Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* tcurl test: refactor so new options can be added more easilyPavel Březina2017-03-301-125/+209
| | | | | | | Just to make the tool a little bit nicer and more flexible. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* tcurl: add support for ssl and raw outputPavel Březina2017-03-301-20/+21
| | | | | | | | | | | | | | At first, this patch separates curl_easy handle from the multi-handle processing and makes it encapsulated in custom tcurl_request structure. This allows us to separate protocol initialization from its asynchonous logic which gives us the ability to set different options for each request without over-extending the parameter list. In this patch we implement options for peer verification for TLS-enabled protocols and to return response with body and headers together. Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* KCM: Fix off-by-one error in secrets key parsingJakub Hrozek2017-03-301-0/+75
| | | | | | | | | | | | | | | When parsing the secrets key, the code tried to protect against malformed keys or keys that are too short, but it did an error - the UUID stringified form is 36 bytes long, so the UUID_STR_SIZE is 37 because UUID_STR_SIZE accounts for the null terminator. But the code, that was trying to assert that there are two characters after the UUID string (separator and at least a single character for the name) didn't take the NULL terminator (which strlen() doesn't return) into account and ended up rejecting all ccaches whose name is only a single character. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* SYSDB: Allow storing non-POSIX usersJakub Hrozek2017-03-301-0/+56
| | | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 We already do the same for groups. If the user does not have UID number set but does have the POSIX: false attribute set, then we save the user with zero UID and the non-POSIX flag. Reviewed-by: Sumit Bose <sbose@redhat.com>
* PAM: Add application servicesJakub Hrozek2017-03-301-4/+163
| | | | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 Adds a new PAM responder option 'pam_app_services'. This option can hold a list of PAM services that are allowed to contact the application non-POSIX domains. These services are NOT allowed to contact any of the POSIX domains. Reviewed-by: Sumit Bose <sbose@redhat.com>
* CACHE_REQ: Domain type selection in cache_reqJakub Hrozek2017-03-301-11/+51
| | | | | | | | | | | | | | | | | | | | Related to: https://pagure.io/SSSD/sssd/issue/3310 Adds a new enumeration cache_req_dom_type. It is a tri-state that allows the caller to select which domains can be contacted - either only POSIX, only application domains or any type. Not all plugins of cache_req have the new parameter added -- only those that are usable/useful in a non-POSIX environment. For example, it makes no sense to allow the selection for calls by ID because those are inherently POSIX-specific. Also, services or netgroups are supported only coming from POSIX domains. At the moment, the patch should not change any behaviour as all calls default to contacting POSIX domains only. Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* CACHE_REQ: Make use of domainResolutionOrderFabiano Fidêncio2017-03-294-0/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | domainResolutionOrder has been introduced in the previous commits and allows the admin to set up a specific order which the domains will be resolved during a lookup and with this patch we can take advantage of this. In order to have it working a new structure has been added (struct domain_resolution_order) to the responder context and will be used by the cache_req to perform the lookups based on this list. As the ipaDomainResolutionOrder may be set globally on IPA or per View, SSSD does respect the following precedence order: View > Globally. The way the list is built is quite simple, basically having the domains present on ipaDomainResolutionOrder as the first domains (in that specific order) and then appending the remaining domains to this list. The final result is a completely flat list with all the domains respecting the specified order (it's important to remember that the domains not specified won't follow any specific order, they're just "random" based on the domains list present in the responder context. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SYSDB/TESTS: Add tests for the domain's resolution order methodsFabiano Fidêncio2017-03-291-0/+190
| | | | | | | | | | | | | | Introduce a new and small set of tests for these new helper methods that are going to be used in different parts of the code in the follow-up patches. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NSS/TESTS: Include searches for non-fqnames members of a subdomainFabiano Fidêncio2017-03-291-37/+213
| | | | | | | | | | | | | Let's extend the NSS tests in order to also test looking up users, from a subdomain, by their short names (non fully qualified names). Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NSS/TESTS: Improve setup/teardown for subdomains testsFabiano Fidêncio2017-03-291-32/+150
| | | | | | | | | | | | | | This patch basically makes the getgrnam_members_subdom(), getgrnam_mix_dom(), getgrnam_mix_dom_fqdn() and getgrnam_mix_subdom() more independent of each other. Related: https://pagure.io/SSSD/sssd/issue/3001 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* NSS/TESTS: Fix subdomains attributionPavel Březina2017-03-291-1/+1
| | | | | | | | | | Related: https://pagure.io/SSSD/sssd/issue/3001 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Sumit Bose <sbose@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>
* SUBDOMAINS: Allow use_fully_qualified_names for subdomainsMichal Židek2017-03-295-23/+26
| | | | | | | | | | Allow option use_fully_qualified_names in subdomain section. This option was recently added to subdomain_inherit. Resolves: https://pagure.io/SSSD/sssd/issue/3337 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
* intg: Remove bashism from intgcheck-prepareLukas Slebodnik2017-03-291-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | env variable UID is not defined in all shells (eg. dash) We also need to move invocation of "id -u" before nss_wraper is enabled otherwise we would get root instead of real user. =================================== FAILURES =================================== ________________________ test_kcm_mem_init_list_destroy ________________________ Traceback (most recent call last): File "/home/build/sssd/src/tests/intg/test_kcm.py", line 198, in test_kcm_mem_init_list_destroy kcm_init_list_destroy(testenv) File "/home/build/sssd/src/tests/intg/test_kcm.py", line 183, in kcm_init_list_destroy exp_ccname = testenv.ccname() File "/home/build/sssd/src/tests/intg/test_kcm.py", line 45, in ccname my_uid = self.my_uid() File "/home/build/sssd/src/tests/intg/test_kcm.py", line 41, in my_uid return int(s_myuid) ValueError: invalid literal for int() with base 10: '' And we already use different approach in top level Makefile.am 3488) $(INTGCHECK_CONFIGURE_FLAGS) \ 3489) CFLAGS="$$CFLAGS $(AM_CFLAGS) -DKCM_PEER_UID=$$(id -u)"; \ 3490) $(MAKE) $(AM_MAKEFLAGS) ; \ Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* KCM: Queue requests by the same UIDJakub Hrozek2017-03-271-0/+365
| | | | | | | | | In order to avoid race conditions, we queue requests towards the KCM responder coming from the same client UID. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* KCM: Store ccaches in secretsJakub Hrozek2017-03-272-23/+343
| | | | | | | | Adds a new KCM responder ccache back end that forwards all requests to sssd-secrets. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* TCURL: Support HTTP POST for creating containersJakub Hrozek2017-03-272-0/+33
| | | | | | | | The curl integration must allow us to create containers, therefore we also add support of the POST HTTP request type. Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* TESTS: Add integration tests for the KCM responderJakub Hrozek2017-03-274-0/+696
| | | | | | Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* UTIL: Fix a typo in the tcurl test toolJakub Hrozek2017-03-271-2/+2
| | | | | Reviewed-by: Michal Židek <mzidek@redhat.com> Reviewed-by: Simo Sorce <simo@redhat.com>
* nss-idmap: add sss_nss_getlistbycert()Sumit Bose2017-03-231-0/+158
| | | | | | | | | This patch adds a getlistbycert() call to libsss_nss_idmap to make it on par with InfoPipe. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
* sysdb: add certmap related callsSumit Bose2017-03-231-0/+260
| | | | | | | | | | Add sysdb calls to write and read data for the certificate mapping library to the cache. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sss_cert_derb64_to_ldap_filter: add sss_certmap supportSumit Bose2017-03-231-2/+2
| | | | | | | | | | Use certificate mapping library if available to lookup a user by certificate in LDAP. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* LDAP: always store the certificate from the requestSumit Bose2017-03-233-6/+6
| | | | | | | | | | Store the certificate used to lookup a user as mapped attribute in the cached user object. Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
* sysdb: add sysdb_attrs_copy()Sumit Bose2017-03-231-0/+87
| | | | | | | Related to https://pagure.io/SSSD/sssd/issue/3050 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-04 08:35:58 +0000