freeipa.git/ipatests/test_cmdline, branch fix_ber_scanf

Fix wrong use of identity operation

2019-09-04T08:30:07+00:00

Strings should not be compared with the identity operation 'is' or
'is not'.

Fixes: https://pagure.io/freeipa/issue/8057
Signed-off-by: Christian Heimes 
Reviewed-By: Florence Blanc-Renaud

Fix expected return code in tests when server is uninstalled

2019-06-07T09:24:45+00:00

It is likely that these were fixed by the original change
b96906156be37a7b29ee74423b82f04070c84e22 but was uncaught because
these tests are not executed in CI because the server is configured.

https://pagure.io/freeipa/issue/7836

Signed-off-by: Rob Crittenden 
Reviewed-By: Florence Blanc-Renaud

ipa-pwd-extop: do not remove MagicRegen mod, replace it

2019-05-28T06:55:51+00:00

In 2012, ldbm backend in 389-ds started checking entry modification
after running betxnpreop plugins by comparing a number of modifications
before and after. If that number didn't change, it is considered that
plugins didn't modify the list.

ipa-pwd-extop actually removed and re-added modification to ipaNTHash if
it contained 'MagicRegen' value. This did not work since commit
https://pagure.io/389-ds-base/c/6c17ec56076d34540929acbcf2f3e65534060a43
but we were lucky nothing in FreeIPA code actually relied on that except
some code paths in ipasam Samba passdb driver. However, Samba didn't
reach the point where the code was triggered -- until now.

With support to run Samba as a domain member in IPA domain, that code
path is triggered for Kerberos service principals of domain members
(cifs/client.example.test, ...) and NT hash extraction from Kerberos
keys does not work.

Fix ipa-pwd-extop to follow recommendations in
https://pagure.io/389-ds-base/issue/387#comment-120145 and
https://pagure.io/389-ds-base/issue/50369#comment-570696

Fixes: https://pagure.io/freeipa/issue/7953
Reviewed-By: Christian Heimes

test_ipagetkeytab: test retrieval of explicit encryption types

2019-05-28T06:55:51+00:00

In order to test a fix for https://pagure.io/freeipa/issue/7953,
we need to create a keytab with a particular encryption type
(arcfour-hmac) and attempt to request generation of ipaNTHash attribute
from Kerberos keys in LDAP.

Add a test case that performs this operation.

Related: https://pagure.io/freeipa/issue/7953
Reviewed-By: Christian Heimes

test_ipagetkeytab: factor out DM password reader

2019-05-28T06:55:51+00:00

Related: https://pagure.io/freeipa/issue/7953
Reviewed-By: Christian Heimes

test_ipagetkeytab: allow testing LDAP connection beyond bind operation

2019-05-28T06:55:51+00:00

Convert use_keytab() function into a context manager to allow additional
operations to be done as part of the test. Also pass proper credentials
cache file to the backend while connecting to LDAP so that right creds
are in use.

This is required to perform actual tests for use of the retrieved keys.

Related: https://pagure.io/freeipa/issue/7953
Reviewed-By: Christian Heimes

Test: add new tests for ipa-crlgen-manage

2019-03-14T08:39:55+00:00

Add new integration tests for the new command ipa-crlgen-manage,
and test_cmdline tests.

Related to: https://pagure.io/freeipa/issue/5803

Reviewed-By: Rob Crittenden 
Reviewed-By: Francois Cami

ipa-getkeytab: resolve symlink

2019-01-30T07:06:02+00:00

Resolve one level of symbolic links to support a dangling symlink as
keytab target. To prevent symlink attacks, only resolve symlink when the
symlink is owned by the current effective user and group, or by root.

Fixes: https://pagure.io/freeipa/issue/4607
Signed-off-by: Christian Heimes 
Reviewed-By: Rob Crittenden 
Reviewed-By: Alexander Bokovoy

Address inconsistent-return-statements

2018-11-13T12:37:58+00:00

Pylint warns about inconsistent return statements when some paths of a
function return None implicitly. Make all implicit returns either
explicit or raise a proper exception.

See: https://pagure.io/freeipa/issue/7758
Signed-off-by: Christian Heimes 
Reviewed-By: Alexander Bokovoy

Fix test_cli_fsencoding on Python 3.7, take 2

2018-11-08T15:03:21+00:00

0a5a7bdef7c300cb8f8a8128ce6cf5b115683cbe introduced another problem. The
test is now failing on systems without a full IPA client or server
installation. Use IPA_CONFDIR env var to override location of
default.conf, so that the command always fails.

Signed-off-by: Christian Heimes 
Reviewed-By: Serhii Tsymbaliuk