Implement an IPA Foreman smartproxy serverHEADmaster

This currently server supports only host and hostgroup commands for
retrieving, adding and deleting entries.

The incoming requests are completely unauthenticated and by default
requests must be local.

Utilize GSS-Proxy to manage the TGT.

Configuration information is in the ipa-smartproxy man page.

Design: http://www.freeipa.org/page/V3/Smart_Proxy

4 files changed, 447 insertions, 0 deletions

diff --git a/ipatests/test_smartproxy/resttest.py b/ipatests/test_smartproxy/resttest.py
new file mode 100644
index 00000000..dc355471
--- /dev/null
+++ b/ipatests/test_smartproxy/resttest.py
@@ -0,0 +1,170 @@
+# Authors:
+#   Rob Crittenden <rcritten@redhat.com>
+#
+# Copyright (C) 2014  Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+"""
+Base class for all REST tests
+"""
+
+import requests
+import json
+import nose
+from ipatests.util import assert_deepequal, Fuzzy
+from ipatests.test_xmlrpc.xmlrpc_test import fuzzy_uuid, fuzzy_password
+
+FQDN = 'localhost'
+PORT = 8090
+
+EXPECTED = """Expected %r to raise %s.
+  options = %r
+  output = %r"""
+
+UNEXPECTED = """Expected %r to raise %s, but caught different.
+  options = %r
+  %s: %s"""
+
+try:
+    response = requests.get(
+        'http://%s:%d/ipa/smartproxy/host/host.example.com' % (FQDN, PORT),
+        data={})
+    server_available = True
+except requests.ConnectionError:
+    server_available = False
+
+
+class REST_test(object):
+    """
+    Base class for all REST tests
+
+    A Declarative test suite is controlled by the ``tests`` and
+    ``cleanup`` class variables.
+
+    The ``tests`` is a list of dictionaries with the following keys:
+
+    ``desc``
+        A name/description of the test
+    ``command``
+        A (command, args, kwargs) triple specifying the command to run
+    ``expected``
+        Can be either an ``errors.PublicError`` instance, in which case
+        the command must fail with the given error; or the
+        expected result.
+        The result is checked with ``tests.util.assert_deepequal``.
+    ``extra_check`` (optional)
+        A checking function that is called with the response. It must
+        return true for the test to pass.
+
+    The ``cleanup`` is a list of (command, args, kwargs)
+    triples. These are commands get run both before and after tests,
+    and must not fail.
+    """
+
+    cleanup = tuple()
+    tests = tuple()
+
+    @classmethod
+    def setUpClass(cls):
+        if not server_available:
+            raise nose.SkipTest('%r: Server not available' %
+                                cls.__module__)
+
+    def cleanup_generate(self, stage):
+        for (i, request) in enumerate(self.cleanup):
+            func = lambda: self.run_cleanup(request)
+            func.description = '%s %s-cleanup[%d]: %r' % (
+                self.__class__.__name__, stage, i, request
+            )
+            yield (func,)
+
+    def make_request(self, method, uri, data=None):
+        request = method('http://%s:%d%s' % (FQDN, PORT, uri), data=data)
+        return request
+
+    def run_cleanup(self, request):
+        (uri, data) = request
+        try:
+            result = self.make_request(requests.delete, uri, data)
+            assert request.status_code in [401, 201, 200]
+        except Exception:
+            pass
+
+    def test_generator(self):
+        """
+        Iterate through tests.
+
+        nose reports each one as a separate test.
+        """
+
+        # Iterate through pre-cleanup:
+        for tup in self.cleanup_generate('pre'):
+            yield tup
+
+        # Iterate through the tests:
+        name = self.__class__.__name__
+        for (i, test) in enumerate(self.tests):
+            nice = '%s[%d]: %s: %s' % (
+                name, i, test['request'][0], test.get('desc', '')
+            )
+            func = lambda: self.check(nice, **test)
+            func.description = nice
+            yield (func,)
+
+        # Iterate through post-cleanup:
+        for tup in self.cleanup_generate('post'):
+            yield tup
+
+    def check(self, nice, desc, request, method, expected_status, expected):
+        (uri, data) = request
+        if isinstance(expected, Exception):
+            self.check_exception(nice, method, uri, data, expected)
+        else:
+            self.check_result(nice,
+                              method,
+                              uri,
+                              data,
+                              expected_status,
+                              expected)
+
+    def check_exception(self, nice, method, uri, data, expected):
+        klass = expected.__class__
+        name = klass.__name__
+        try:
+            output = self.make_request(method, uri, data)
+        except StandardError, e:
+            pass
+        else:
+            raise AssertionError(
+                EXPECTED % (uri, name, method, data, output)
+            )
+        if not isinstance(e, klass):
+            raise AssertionError(
+                UNEXPECTED % (uri, name, method, data, e.__class__.__name__, e)
+            )
+
+    def check_result(self, nice, method, uri, data, expected_status, expected):
+        request = self.make_request(method, uri, data)
+        assert expected_status == request.status_code
+
+        if request.status_code in [200, 201]:
+            try:
+                data = json.loads(request.text)
+            except ValueError, e:
+                raise AssertionError(
+                    'Could not parse JSON: %s' % e
+                )
+            assert_deepequal(expected, data, nice)
diff --git a/ipatests/test_smartproxy/test_features.py b/ipatests/test_smartproxy/test_features.py
new file mode 100644
index 00000000..9c32c0c3
--- /dev/null
+++ b/ipatests/test_smartproxy/test_features.py
@@ -0,0 +1,35 @@
+# Authors:
+#   Rob Crittenden <rcritten@redhat.com>
+#
+# Copyright (C) 2014  Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from resttest import REST_test
+import requests
+
+class test_feature(REST_test):
+
+    tests = [
+
+        dict(
+            desc='Get supported features',
+            request=('/features', {}),
+            method=requests.get,
+            expected_status=200,
+            expected=[u'realm'],
+        ),
+
+    ]
diff --git a/ipatests/test_smartproxy/test_host.py b/ipatests/test_smartproxy/test_host.py
new file mode 100644
index 00000000..6dc90de5
--- /dev/null
+++ b/ipatests/test_smartproxy/test_host.py
@@ -0,0 +1,145 @@
+# Authors:
+#   Rob Crittenden <rcritten@redhat.com>
+#
+# Copyright (C) 2014  Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from ipalib import api
+from ipapython.dn import DN
+from resttest import REST_test, fuzzy_uuid, fuzzy_password
+from ipatests.test_xmlrpc import objectclasses
+import requests
+
+fqdn1 = u'testhost.example.com'
+dn1 = DN(('fqdn',fqdn1),('cn','computers'),('cn','accounts'),
+         api.env.basedn)
+fqdn2 = u'testhost2.example.com'
+dn2 = DN(('fqdn',fqdn2),('cn','computers'),('cn','accounts'),
+         api.env.basedn)
+
+class test_host(REST_test):
+
+    cleanup = [
+        ('/ipa/smartproxy/host/%s' % fqdn1, {}),
+        ('/ipa/smartproxy/host/%s' % fqdn2, {}),
+    ]
+
+    tests = [
+
+        dict(
+            desc='Get a non-existent host',
+            request=('/ipa/smartproxy/host/notfound', {}),
+            method=requests.get,
+            expected_status=404,
+            expected={},
+        ),
+
+        dict(
+            desc='Create a host',
+            request=('/ipa/smartproxy/host', {'hostname': fqdn1}),
+            method=requests.post,
+            expected_status=201,
+            expected=dict(
+                dn=dn1,
+                has_keytab=False,
+                krbprincipalname= [u'host/%s@%s' % (fqdn1, api.env.realm)],
+                objectclass=objectclasses.host,
+                fqdn=[fqdn1],
+                has_password=False,
+                ipauniqueid=[fuzzy_uuid],
+                managedby_host=[fqdn1],
+            ),
+        ),
+
+        dict(
+            desc='Get the host',
+            request=('/ipa/smartproxy/host/%s' % fqdn1, {}),
+            method=requests.get,
+            expected_status=200,
+            expected=dict(
+                dn=dn1,
+                has_keytab=False,
+                fqdn=[u'testhost.example.com'],
+                has_password=False,
+                managedby_host=[fqdn1],
+                krbprincipalname=[u'host/%s@%s' % (fqdn1, api.env.realm)],
+            ),
+        ),
+
+        dict(
+            desc='Add a duplicate host',
+            request=('/ipa/smartproxy/host', {'hostname': fqdn1}),
+            method=requests.post,
+            expected_status=400,
+            expected={},
+        ),
+
+        dict(
+            desc='Remove the host',
+            request=('/ipa/smartproxy/host/%s' % fqdn1, {}),
+            method=requests.delete,
+            expected_status=200,
+            expected=dict(failed=u''),
+        ),
+
+        dict(
+            desc='Create a host with a random password',
+            request=('/ipa/smartproxy/host', {'hostname': fqdn1, 'random': True}),
+            method=requests.post,
+            expected_status=201,
+            expected=dict(
+                dn=dn1,
+                has_keytab=False,
+                objectclass=[u'ipasshhost', u'ipaSshGroupOfPubKeys',
+                             u'ieee802device', u'ipaobject',
+                             u'nshost', u'ipahost', u'pkiuser',
+                             u'ipaservice', u'top',],
+                fqdn=[fqdn1],
+                has_password=True,
+                ipauniqueid=[fuzzy_uuid],
+                randompassword=fuzzy_password,
+                managedby_host=[fqdn1],
+            ),
+        ),
+
+        dict(
+            desc='Create a host with a fixed password',
+            request=('/ipa/smartproxy/host', {'hostname': fqdn2, 'password': 'Secret123'}),
+            method=requests.post,
+            expected_status=201,
+            expected=dict(
+                dn=dn2,
+                has_keytab=False,
+                objectclass=[u'ipasshhost', u'ipaSshGroupOfPubKeys',
+                             u'ieee802device', u'ipaobject',
+                             u'nshost', u'ipahost', u'pkiuser',
+                             u'ipaservice', u'top',],
+                fqdn=[fqdn2],
+                has_password=True,
+                ipauniqueid=[fuzzy_uuid],
+                managedby_host=[fqdn2],
+            ),
+        ),
+
+        dict(
+            desc='Remove a non-existent host',
+            request=('/ipa/smartproxy/host/notfound', {}),
+            method=requests.delete,
+            expected_status=404,
+            expected={},
+        ),
+
+    ]
diff --git a/ipatests/test_smartproxy/test_hostgroup.py b/ipatests/test_smartproxy/test_hostgroup.py
new file mode 100644
index 00000000..ec2daab5
--- /dev/null
+++ b/ipatests/test_smartproxy/test_hostgroup.py
@@ -0,0 +1,97 @@
+# Authors:
+#   Rob Crittenden <rcritten@redhat.com>
+#
+# Copyright (C) 2014  Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from ipalib import api
+from ipapython.dn import DN
+from resttest import REST_test, fuzzy_uuid
+from ipatests.test_xmlrpc import objectclasses
+import requests
+
+hostgroup1 = u'testhostgroup'
+dn1 = DN(('cn', hostgroup1),('cn','hostgroups'),('cn','accounts'),
+         api.env.basedn)
+
+class test_hostgroup(REST_test):
+
+    cleanup = [
+        ('/ipa/smartproxy/hostgroup/%s' % hostgroup1, {}),
+    ]
+
+    tests = [
+
+        dict(
+            desc='Get a non-existent hostgroup',
+            request=('/ipa/smartproxy/hostgroup/notfound', {}),
+            method=requests.get,
+            expected_status=404,
+            expected={},
+        ),
+
+        dict(
+            desc='Create a hostgroup',
+            request=('/ipa/smartproxy/hostgroup', {'name': hostgroup1, 'description': u'test'}),
+            method=requests.post,
+            expected_status=201,
+            expected=dict(
+                dn=dn1,
+                cn=[hostgroup1],
+                objectclass=objectclasses.hostgroup,
+                description=[u'test'],
+                mepmanagedentry=[DN(('cn',hostgroup1),('cn','ng'),('cn','alt'),
+                                        api.env.basedn)],
+                ipauniqueid=[fuzzy_uuid],
+            ),
+        ),
+
+        dict(
+            desc='Get the hostgroup',
+            request=('/ipa/smartproxy/hostgroup/%s' % hostgroup1, {}),
+            method=requests.get,
+            expected_status=200,
+            expected=dict(
+                dn=dn1,
+                cn=[u'testhostgroup'],
+                description=[u'test'],
+            ),
+        ),
+
+        dict(
+            desc='Add a duplicate hostgroup',
+            request=('/ipa/smartproxy/hostgroup', {'name': hostgroup1, 'description': u'test'}),
+            method=requests.post,
+            expected_status=400,
+            expected={},
+        ),
+
+        dict(
+            desc='Remove the hostgroup',
+            request=('/ipa/smartproxy/hostgroup/%s' % hostgroup1, {}),
+            method=requests.delete,
+            expected_status=200,
+            expected=dict(failed=u''),
+        ),
+
+        dict(
+            desc='Remove a non-existent hostgroup',
+            request=('/ipa/smartproxy/hostgroup/%s' % hostgroup1, {}),
+            method=requests.delete,
+            expected_status=404,
+            expected={},
+        ),
+    ]