freeipa.git/ipatests/pytest_ipa/integration, branch fix_ber_scanf

ipatests: modify run_command to allow specify successful return codes

2019-09-06T10:11:04+00:00

Reviewed-By: Michal Polovka 
Reviewed-By: Alexander Bokovoy

ipatests: add utility functions related to using and managing user accounts

2019-09-06T10:11:04+00:00

Reviewed-By: Michal Polovka 
Reviewed-By: Alexander Bokovoy

ipatests: allow to pass additional options for clients installation

2019-09-06T10:11:04+00:00

Reviewed-By: Michal Polovka 
Reviewed-By: Alexander Bokovoy

Test external CA with DNS name constraints

2019-08-06T10:39:46+00:00

Verify that FreeIPA can be installed with an external CA that has a name
constraints extension.

Signed-off-by: Christian Heimes 
Reviewed-By: Fraser Tweedale 
Reviewed-By: Alexander Bokovoy

ipatests: Add tests for interactive chronyd config

2019-07-31T12:21:37+00:00

Add interactive configuration tests for
ipa-server-install and ipa-client-install
FreeIPA server as it is now is unable to
configure NTP interactively for replica
installations.

Resolves: https://pagure.io/freeipa/issue/7908
Reviewed-By: Michal Polovka 
Reviewed-By: Rob Crittenden

ipatests: Update test tasks for client to be interactive

2019-07-31T12:21:37+00:00

Related: https://pagure.io/freeipa/issue/7908
Reviewed-By: Michal Polovka 
Reviewed-By: Rob Crittenden

ipatests: rename config_replica_resolvconf_with_master_data()

2019-07-30T21:42:54+00:00

config_replica_resolvconf_with_master_data() is not replica specific.
Rename to config_host_resolvconf_with_master_data() as it is not tied
to any role (master, replica, client).

Signed-off-by: François Cami 
Reviewed-By: Sergey Orlov 
Reviewed-By: Rob Crittenden

ipatests: new test for trust with partially unreachable AD topology

2019-07-15T12:35:51+00:00

Establishing trust with partially unavailable AD hosts require usage
of --server option. The new test checks that both commands trust-add
and trust-fetch-domains properly use this option and also that
trust-add correctly passes the server value when imlicitly invoking
trust-fetch-domains.

Relates to: https://pagure.io/freeipa/issue/7895.

Reviewed-By: Tibor Dudlak

Make use of `named` well-known service

2019-06-25T13:33:06+00:00

The systemd unit name of `named`(which is actually used) is platform-dependent:
debian - bind9-pkcs11.service
fedora - named-pkcs11.service
redhat - named-pkcs11.service

Other systems may have their own name of `bind` service.
But the default one (`named-pkcs11`) is assumed in many tests.
Of course, these tests fail on such platforms.

This can be easily fixed.
All platforms define well-knownservice `named`, which is linked to
the actually utilized one.

Fixes: https://pagure.io/freeipa/issue/7990
Signed-off-by: Stanislav Levin 
Reviewed-By: Christian Heimes 
Reviewed-By: Rob Crittenden

ipatests: allow to relax security of LDAP connection from controller to IPA host

2019-06-05T12:45:57+00:00

The Host.ldap_connect() method uses LDAPClient from ipapython package.
In a3934a21 we started to use secure connection from tests controller to
ipa server. And also 5be9341f changed the LDAPClient.simple_bind method
to forbid password based authentiction over insecure connection.
This makes it imposible to establish ldap connection in some test
configurations where hostnames known to ipa server do not match ones known
to tests controller (i.e. when host.hostname != host.external_hostname)
because TLS certificate is issued for host.hostname and test controller
tries to verify it against host.external_hostname.

A sublass of LDAPClient is provided which allows to skip certificate check.

Fixes: https://pagure.io/freeipa/issue/7960
Reviewed-By: Florence Blanc-Renaud