summaryrefslogtreecommitdiffstats
path: root/ipatests
Commit message (Collapse)AuthorAgeFilesLines
* Store session cookie in a ccache optionccachesessSimo Sorce2017-03-091-0/+37
| | | | | | | | | Instead of using the kernel keyring, store the session cookie within the ccache. This way kdestroy will really wipe away all credentials. Ticket: https://pagure.io/freeipa/issue/6661 Signed-off-by: Simo Sorce <simo@redhat.com>
* tests: use --setup-kra in testsMartin Basti2017-03-081-7/+2
| | | | | | | | | | | | This will allow to test --setup-kra option together with ipa-server-install in install tests Separate installation using ipa-kra-install is already covered. https://pagure.io/freeipa/issue/6731 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Add SHA256 fingerprints for certsTomas Krizek2017-03-074-2/+11
| | | | | | | https://fedorahosted.org/freeipa/ticket/6701 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* test_csrgen: adjusted comparison test scripts for CSRGeneratorMichal Reznik2017-03-072-8/+10
| | | | | | | | | | | | | | | | | | Commit ada91c2 introduced changes in "csrgen/templates/openssl_base.tmpl" which broke the following 2 tests: test_CSRGenerator.test_userCert_OpenSSL test_CSRGenerator.test_caIPAserviceCert_OpenSSL The tests use files caIPAserviceCert_openssl.sh and userCert_openssl.sh as expected scripts in order to compare scripts generated by CSRGenerator. E.g. as other parameter was introduced we are now not checking with "if [[ $# -ne 2 ]]" but rather with if "[[ $# -lt 2 ]]". https://pagure.io/freeipa/issue/6724 Reviewed-By: Milan Kubik <mkubik@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Support for Certificate Identity MappingFlorence Blanc-Renaud2017-03-021-0/+20
| | | | | | | | | | See design http://www.freeipa.org/page/V4/Certificate_Identity_Mapping https://fedorahosted.org/freeipa/ticket/6542 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* Provide basic integration tests for built-in AD trust installerMartin Babinsky2017-03-012-5/+59
| | | | | | | | | | | A couple of tests were added to server/replica install integration suite to test AD trust install w/ various combinations of other optional components. https://fedorahosted.org/freeipa/ticket/6630 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove import nss from test_ldapChristian Heimes2017-03-011-2/+0
| | | | | | | | test_ldap just imported nss.nss to call nss_init_nodb(). It should be safe to remove the call. Let's see what CI has to say. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* test_config: fix fips_mode key in EnvTomas Krizek2017-03-011-2/+2
| | | | | | | | | Setting fips_mode to object would fail if ipaplatform.tasks module wasn't present. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Finish port to PyCA cryptographyChristian Heimes2017-03-011-2/+1
| | | | | | | | | | * add missing default_backend * unpad encrypted data * use cryptography's hashes and HMAC construct * remove hard dependency on python-nss from setup.py Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Migrate OTP import script to python-cryptographyNathaniel McCallum2017-03-011-62/+38
| | | | | | https://fedorahosted.org/freeipa/ticket/5192 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Tests: Basic coverage with tree root domainGanna Kaihorodova2017-03-011-1/+90
| | | | | | | | Extend existing legacy client tests to cover test cases with tree root domain. https://fedorahosted.org/freeipa/ticket/6489 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Moving ipaCert from HTTPD_ALIAS_DIRStanislav Laznicka2017-03-011-1/+1
| | | | | | | | | | | | | The "ipaCert" nicknamed certificate is not required to be in /var/lib/ipa/radb NSSDB anymore as we were keeping a copy of this file in a separate file anyway. Remove it from there and track only the file. Remove the IPA_RADB_DIR as well as it is not required anymore. https://fedorahosted.org/freeipa/ticket/5695 https://fedorahosted.org/freeipa/ticket/6680 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove md5_fingerprints from IPAStanislav Laznicka2017-02-234-10/+2
| | | | | | | | | | MD5 is a grandpa and FIPS does not like it at all. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* scripts, tests: explicitly set confdir in the rest of server codeJan Cholasta2017-02-222-2/+6
| | | | | | | | | | | Commit 1e6a204b4372bbbfb722a00370a5ce4e34406b9f added explicit confdir setting to api.bootstrap() calls of a randomly selected portion of server-side scripts and tests. This commit adds it to the rest of server-side code for consistency. https://fedorahosted.org/freeipa/ticket/6389 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* test_config: fix tests for env.fips_modeTomas Krizek2017-02-211-0/+1
| | | | | | | | | | Add optional key fips_mode to Env object in tests. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Add fix for ipa plugins commandAbhijeet Kasurde2017-02-171-0/+3
| | | | | | | | | | Fix adds count of plugins loaded to return dict Fixes https://fedorahosted.org/freeipa/ticket/6513 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Tests: search for disabled usersMartin Basti2017-02-171-0/+41
| | | | | | | | | Add tests for searching disabled/enabled users. XFAIL: newly created users has no 'nsaccountlock' attribute set and user-find doesn't return them as active users. This should be fixed. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Fix test, nested lists are no longer converted to nested tuplesChristian Heimes2017-02-151-1/+1
| | | | | Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Test: DNS nsupdate from dns-update-system-recordsMartin Basti2017-02-151-0/+25
| | | | | | | | | | Get nsupdate data from dns-update-system-records, remove system records and run nsupdate to verify that all system records were updated https://fedorahosted.org/freeipa/ticket/6585 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Explicitly pass down ccache names for connectionsSimo Sorce2017-02-151-13/+18
| | | | | | | | | | | | Instead of relying on side effects (setting the KRB5CCNAME env var), explicitly pass the ccache name to be used if it is not the default ccache. This fixes some tests that sometimes fail to work properly due to the wrong ccache being used. https://fedorahosted.org/freeipa/ticket/6543 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Separate RA cert store from the HTTP cert storeSimo Sorce2017-02-151-2/+2
| | | | | | | | | | | | | | | This is in preparation for separating out the user under which the ipa api framework runs as. This commit also removes certs.NSS_DIR to avoid confusion and replaces it where appropriate with the correct NSS DB directory, either the old HTTPD_ALIAS_DIR ot the RA DB IPA_RADB_DIR. In some cases its use is removed altogether as it was simply not necessary. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Configure HTTPD to work via Gss-ProxySimo Sorce2017-02-153-5/+5
| | | | | | | | https://fedorahosted.org/freeipa/ticket/4189 https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* test_StrEnum: use int as bad typeChristian Heimes2017-02-101-2/+2
| | | | | | | | bytes triggers a BytesWarning error. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* cryptography has deprecated serial in favor of serial_numberChristian Heimes2017-02-102-5/+5
| | | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Enable additional warnings (BytesWarning, DeprecationWarning)Christian Heimes2017-02-101-0/+1
| | | | | | | Closes: https://fedorahosted.org/freeipa/ticket/6631 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Print test env informationChristian Heimes2017-02-091-0/+11
| | | | | | | | Print api.env, uname, euid/egid, cwd and Python version when tests are run with -v (e.g. ipa-run-tests -v). Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* py3: test_ipaserver: fix BytesWarningsMartin Basti2017-02-081-5/+7
| | | | | | https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Tests: fix wait_for_replication taskMartin Basti2017-02-081-2/+9
| | | | | | | | | | DS changed a format of replication status attribute. Now it is with prefix "Error (x)" where x is the error code. Both formats were kept to allow tests run on older and new versions of DS. Reviewed-By: Milan Kubik <mkubik@redhat.com>
* tests: Add tests for kerberos principal aliases in stageuserDavid Kupka2017-02-072-1/+11
| | | | | | https://fedorahosted.org/freeipa/ticket/6623 Reviewed-By: Martin Basti <mbasti@redhat.com>
* tests: kerberos_principal_aliases: Deduplicate testsDavid Kupka2017-02-071-30/+32
| | | | | | https://fedorahosted.org/freeipa/ticket/6623 Reviewed-By: Martin Basti <mbasti@redhat.com>
* tests: Stageuser-{add,remove}-certDavid Kupka2017-02-071-0/+19
| | | | | | https://fedorahosted.org/freeipa/ticket/6623 Reviewed-By: Martin Basti <mbasti@redhat.com>
* tests: add-remove-cert: Use harcoded certificates instead of requesting themDavid Kupka2017-02-071-5/+81
| | | | | | | | | | | | | Requesting certificates for test purposes is not necessary as we allow to upload arbitrary certificate to the user, host or service. Also requesting certificate from dogtag takes some time and the test is slower for no good reason. More it's not posible to request certificate for stageuser even though it's possible to upload certificates to stageusers now. https://fedorahosted.org/freeipa/ticket/6623 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipatests: nested netgroups (intg)Petr Čech2017-02-071-0/+169
| | | | | | | | | | | Adds a test case for issue in SSSD that manifested in an inability to resolve nested membership in netgroups The test case tests for direct and indirect membership. https://fedorahosted.org/freeipa/ticket/6439 Reviewed-By: Martin Basti <mbasti@redhat.com>
* tests: add test for PEM certificate files with leading textJan Cholasta2017-02-061-0/+11
| | | | Reviewed-By: Christian Heimes <cheimes@redhat.com>
* py3: tests_xmlrpc: do not call str() on bytesMartin Basti2017-02-022-3/+3
| | | | | | | | | Calling str() on bytes causes undesired side effect: it adds prefix "b" to the result of conversion. The method decode() should be used instead. https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* tests: Add tests for CSR autogenerationBen Lipton2017-01-3111-0/+434
| | | | | | | | | This patch also contains some code changes to make the code easier to test and to make the tests pass. https://fedorahosted.org/freeipa/ticket/4899 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* User Tracker: Test to create user with minimal valuesGanna Kaihorodova2017-01-191-0/+13
| | | | | | | | | | Test to create user with minimal values, where uid is not specified https://fedorahosted.org/freeipa/ticket/6126 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Milan Kubik <mkubik@redhat.com> Reviewed-By: Lenka Doudova <ldoudova@redhat.com>
* User Tracker: creation of user with minimal valuesGanna Kaihorodova2017-01-191-11/+31
| | | | | | | | | | | | Fix provide possibility to create user-add test with minimal values, where uid is not specified, to provide better coverage. Also provide check for non-empty unicode string for attributes required in init method https://fedorahosted.org/freeipa/ticket/6126 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Milan Kubik <mkubik@redhat.com> Reviewed-By: Lenka Doudova <ldoudova@redhat.com>
* Stage User: Test to create stage user with minimal valuesGanna Kaihorodova2017-01-191-0/+11
| | | | | | | | | Test to create stage user with minimal values, where uid is not specified https://fedorahosted.org/freeipa/ticket/6448 Reviewed-By: Lenka Doudova <ldoudova@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Tests: Stage User Tracker implementationGanna Kaihorodova2017-01-191-8/+30
| | | | | | | | | | | Fix provide possibility of creation stage user with minimal values, with uid not specified and check for non-empty unicode string for attributes requested in init method https://fedorahosted.org/freeipa/ticket/6448 Reviewed-By: Lenka Doudova <ldoudova@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Tests: Add tree root domain role in legacy client testsGanna Kaihorodova2017-01-181-3/+3
| | | | | | | | | Legacy client tests inherits test cases from trust tests, that have role for tree root domain. That role was missing in legacy client tests. https://fedorahosted.org/freeipa/ticket/6600 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* pytest: set rules to find test files and functionsChristian Heimes2017-01-121-6/+10
| | | | | | | | | 1e06a5195bafe0224d77371987f2509f5508ca2f removed pytest.ini. Without the ini file, pytest 3.x has suboptimal settings and no longer picks up all test functions and test files. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Milan Kubik <mkubik@redhat.com>
* Generate sha256 ssh pubkey fingerprints for hostsStanislav Laznicka2017-01-125-5/+5
| | | | | | | | Replace md5 with sha256 for host ssh pubkey fingerprints https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Use pytest conftest.py and drop pytest.iniChristian Heimes2017-01-054-29/+84
| | | | | | | | | | | | | | Let's replace some ugly hacks with proper pytest conftest.py hooks. Test initialization of ipalib.api is now handled in pytest_cmdline_main(). Pytest plugins, markers and ignores are also moved into conftest.py. Additional guards make it possible to run tests without ipaserver installed. I added confcutdir to ensure that pytest does not leave our project space. Pytest used pytest.ini or setup.py before but pytest.ini is gone. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Milan Kubik <mkubik@redhat.com>
* Catch ValueError raised by pytest.config.getoption()Christian Heimes2017-01-052-3/+5
| | | | | | pytest.config.getoption() can raise ValueError for unknown options, too. Reviewed-By: Milan Kubik <mkubik@redhat.com>
* Remove "Request Certificate with SubjectAltName" permissionFraser Tweedale2016-12-211-1/+1
| | | | | | | | | | | | | | | | | | subjectAltName is required or relevant in most certificate use cases (esp. TLS, where carrying DNS name in Subject DN CN attribute is deprecated). Therefore it does not really make sense to have a special permission for this, over and above "request certificate" permission. Furthermore, we already do rigorously validate SAN contents again the subject principal, and the permission is waived for self-service requests or if the operator is a host principal. So remove the permission, the associated virtual operation, and the associated code in cert_request. Fixes: https://fedorahosted.org/freeipa/ticket/6526 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Remove named-pkcs11 workarounds from DNSSEC tests.Petr Spacek2016-12-191-82/+0
| | | | | | | | | | As far as I can tell the tests are passing for some time in Jenkins so maybe a bug in some underlying component was fixed. Let's remove workarounds to make tests actually test real setups. https://fedorahosted.org/freeipa/ticket/5348 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add a basic test suite for `kadmin.local` interfaceMartin Babinsky2016-12-161-0/+125
| | | | | | | | | | This small integration suite tests some basic operations using kadmin.local interface on services in both kerberos and services subtree. https://fedorahosted.org/freeipa/ticket/6561 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* tests: Expect krbpwdpolicyreference in result of {host,service}-{find,show} ↵David Kupka2016-12-144-2/+58
| | | | | | | | | | | --all Result of {host,service}-{find,show} commands with option '--all' always contains krbpwpolicyreference attributes. https://fedorahosted.org/freeipa/ticket/6561 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Add options to write lightweight CA cert or chain to fileFraser Tweedale2016-12-122-7/+41
| | | | | | | | | | | | | | Administrators need a way to retrieve the certificate or certificate chain of an IPA-managed lightweight CA. Add params to the `ca' object for carrying the CA certificate and chain (as multiple DER values). Add the `--chain' flag for including the chain in the result (chain is also included with `--all'). Add the `--certificate-out' option for writing the certificate to a file (or the chain, if `--chain' was given). Fixes: https://fedorahosted.org/freeipa/ticket/6178 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-01 13:25:34 +0000