2009-09-30 09:24:25 -05:00
|
|
|
# Authors:
|
|
|
|
# Pavel Zuna <pzuna@redhat.com>
|
|
|
|
#
|
|
|
|
# Copyright (C) 2009 Red Hat
|
|
|
|
# see file 'COPYING' for use and warranty information
|
|
|
|
#
|
2010-12-09 06:59:11 -06:00
|
|
|
# This program is free software; you can redistribute it and/or modify
|
|
|
|
# it under the terms of the GNU General Public License as published by
|
|
|
|
# the Free Software Foundation, either version 3 of the License, or
|
|
|
|
# (at your option) any later version.
|
2009-09-30 09:24:25 -05:00
|
|
|
#
|
|
|
|
# This program is distributed in the hope that it will be useful,
|
|
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
# GNU General Public License for more details.
|
|
|
|
#
|
|
|
|
# You should have received a copy of the GNU General Public License
|
2010-12-09 06:59:11 -06:00
|
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
2009-09-30 09:24:25 -05:00
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
Test the `ipalib/plugins/hbacrule.py` module.
|
2009-09-30 09:24:25 -05:00
|
|
|
"""
|
|
|
|
|
2012-03-09 08:41:16 -06:00
|
|
|
from nose.tools import raises, assert_raises # pylint: disable=E0611
|
|
|
|
|
2015-07-31 03:15:01 -05:00
|
|
|
from ipatests.test_xmlrpc.xmlrpc_test import XMLRPC_test, assert_attr_equal
|
2009-09-30 09:24:25 -05:00
|
|
|
from ipalib import api
|
|
|
|
from ipalib import errors
|
|
|
|
|
|
|
|
class test_hbac(XMLRPC_test):
|
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
Test the `hbacrule` plugin.
|
2009-09-30 09:24:25 -05:00
|
|
|
"""
|
|
|
|
rule_name = u'testing_rule1234'
|
|
|
|
rule_type = u'allow'
|
|
|
|
rule_type_fail = u'value not allowed'
|
|
|
|
rule_service = u'ssh'
|
|
|
|
rule_time = u'absolute 20081010000000 ~ 20081015120000'
|
2009-11-18 09:39:12 -06:00
|
|
|
rule_time2 = u'absolute 20081010000000 ~ 20081016120000'
|
2009-09-30 09:24:25 -05:00
|
|
|
# wrong time, has 30th day in February in first date
|
|
|
|
rule_time_fail = u'absolute 20080230000000 ~ 20081015120000'
|
|
|
|
rule_desc = u'description'
|
|
|
|
rule_desc_mod = u'description modified'
|
|
|
|
|
2010-12-21 06:20:18 -06:00
|
|
|
test_user = u'hbacrule_test_user'
|
|
|
|
test_group = u'hbacrule_test_group'
|
2012-03-01 21:21:32 -06:00
|
|
|
test_host = u'hbacrule.testnetgroup'
|
2010-12-21 06:20:18 -06:00
|
|
|
test_hostgroup = u'hbacrule_test_hostgroup'
|
2010-05-14 16:28:51 -05:00
|
|
|
test_service = u'sshd'
|
2011-08-17 10:49:49 -05:00
|
|
|
test_host_external = u'notfound.example.com'
|
2009-09-30 09:24:25 -05:00
|
|
|
|
2012-03-27 08:15:20 -05:00
|
|
|
test_invalid_sourcehost = u'inv+alid#srchost.nonexist.com'
|
|
|
|
|
2010-12-21 06:20:18 -06:00
|
|
|
def test_0_hbacrule_add(self):
|
2009-09-30 09:24:25 -05:00
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
Test adding a new HBAC rule using `xmlrpc.hbacrule_add`.
|
2009-09-30 09:24:25 -05:00
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
ret = self.failsafe_add(api.Object.hbacrule,
|
2009-12-09 10:09:53 -06:00
|
|
|
self.rule_name,
|
|
|
|
accessruletype=self.rule_type,
|
|
|
|
description=self.rule_desc,
|
2009-09-30 09:24:25 -05:00
|
|
|
)
|
2009-12-09 10:09:53 -06:00
|
|
|
entry = ret['result']
|
|
|
|
assert_attr_equal(entry, 'cn', self.rule_name)
|
|
|
|
assert_attr_equal(entry, 'accessruletype', self.rule_type)
|
|
|
|
assert_attr_equal(entry, 'ipaenabledflag', 'TRUE')
|
|
|
|
assert_attr_equal(entry, 'description', self.rule_desc)
|
2009-09-30 09:24:25 -05:00
|
|
|
|
2012-03-09 08:41:16 -06:00
|
|
|
@raises(errors.DuplicateEntry)
|
2010-12-21 06:20:18 -06:00
|
|
|
def test_1_hbacrule_add(self):
|
2009-09-30 09:24:25 -05:00
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
Test adding an existing HBAC rule using `xmlrpc.hbacrule_add'.
|
2009-09-30 09:24:25 -05:00
|
|
|
"""
|
2012-03-09 08:41:16 -06:00
|
|
|
api.Command['hbacrule_add'](
|
2009-09-30 09:24:25 -05:00
|
|
|
self.rule_name, accessruletype=self.rule_type
|
|
|
|
)
|
|
|
|
|
2010-12-21 06:20:18 -06:00
|
|
|
def test_2_hbacrule_show(self):
|
2009-09-30 09:24:25 -05:00
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
Test displaying a HBAC rule using `xmlrpc.hbacrule_show`.
|
2009-09-30 09:24:25 -05:00
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
entry = api.Command['hbacrule_show'](self.rule_name)['result']
|
2009-12-09 10:09:53 -06:00
|
|
|
assert_attr_equal(entry, 'cn', self.rule_name)
|
|
|
|
assert_attr_equal(entry, 'ipaenabledflag', 'TRUE')
|
|
|
|
assert_attr_equal(entry, 'description', self.rule_desc)
|
2009-09-30 09:24:25 -05:00
|
|
|
|
2010-12-21 06:20:18 -06:00
|
|
|
def test_3_hbacrule_mod(self):
|
2009-09-30 09:24:25 -05:00
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
Test modifying a HBAC rule using `xmlrpc.hbacrule_mod`.
|
2009-09-30 09:24:25 -05:00
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
ret = api.Command['hbacrule_mod'](
|
2009-09-30 09:24:25 -05:00
|
|
|
self.rule_name, description=self.rule_desc_mod
|
|
|
|
)
|
2009-12-09 10:09:53 -06:00
|
|
|
entry = ret['result']
|
|
|
|
assert_attr_equal(entry, 'description', self.rule_desc_mod)
|
2009-09-30 09:24:25 -05:00
|
|
|
|
2010-12-21 06:20:18 -06:00
|
|
|
# def test_4_hbacrule_add_accesstime(self):
|
2010-12-03 12:57:19 -06:00
|
|
|
# """
|
2010-12-21 06:20:18 -06:00
|
|
|
# Test adding access time to HBAC rule using `xmlrpc.hbacrule_add_accesstime`.
|
2010-12-03 12:57:19 -06:00
|
|
|
# """
|
|
|
|
# return
|
2010-12-21 06:20:18 -06:00
|
|
|
# ret = api.Command['hbacrule_add_accesstime'](
|
2010-12-03 12:57:19 -06:00
|
|
|
# self.rule_name, accesstime=self.rule_time2
|
|
|
|
# )
|
|
|
|
# entry = ret['result']
|
|
|
|
# assert_attr_equal(entry, 'accesstime', self.rule_time);
|
|
|
|
# assert_attr_equal(entry, 'accesstime', self.rule_time2);
|
2009-09-30 09:24:25 -05:00
|
|
|
|
2010-12-21 06:20:18 -06:00
|
|
|
# def test_5_hbacrule_add_accesstime(self):
|
2010-12-03 12:57:19 -06:00
|
|
|
# """
|
2010-12-21 06:20:18 -06:00
|
|
|
# Test adding invalid access time to HBAC rule using `xmlrpc.hbacrule_add_accesstime`.
|
2010-12-03 12:57:19 -06:00
|
|
|
# """
|
|
|
|
# try:
|
2010-12-21 06:20:18 -06:00
|
|
|
# api.Command['hbacrule_add_accesstime'](
|
2010-12-03 12:57:19 -06:00
|
|
|
# self.rule_name, accesstime=self.rule_time_fail
|
|
|
|
# )
|
|
|
|
# except errors.ValidationError:
|
|
|
|
# pass
|
|
|
|
# else:
|
|
|
|
# assert False
|
2009-09-30 09:24:25 -05:00
|
|
|
|
2010-12-21 06:20:18 -06:00
|
|
|
def test_6_hbacrule_find(self):
|
2009-09-30 09:24:25 -05:00
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
Test searching for HBAC rules using `xmlrpc.hbacrule_find`.
|
2009-09-30 09:24:25 -05:00
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
ret = api.Command['hbacrule_find'](
|
2012-03-14 10:33:41 -05:00
|
|
|
cn=self.rule_name, accessruletype=self.rule_type,
|
2009-09-30 09:24:25 -05:00
|
|
|
description=self.rule_desc_mod
|
|
|
|
)
|
2009-12-09 10:09:53 -06:00
|
|
|
assert ret['truncated'] is False
|
|
|
|
entries = ret['result']
|
|
|
|
assert_attr_equal(entries[0], 'cn', self.rule_name)
|
|
|
|
assert_attr_equal(entries[0], 'accessruletype', self.rule_type)
|
|
|
|
assert_attr_equal(entries[0], 'description', self.rule_desc_mod)
|
2009-09-30 09:24:25 -05:00
|
|
|
|
2010-12-21 06:20:18 -06:00
|
|
|
def test_7_hbacrule_init_testing_data(self):
|
2009-09-30 09:24:25 -05:00
|
|
|
"""
|
|
|
|
Initialize data for more HBAC plugin testing.
|
|
|
|
"""
|
2009-12-09 10:09:53 -06:00
|
|
|
self.failsafe_add(api.Object.user,
|
|
|
|
self.test_user, givenname=u'first', sn=u'last'
|
|
|
|
)
|
|
|
|
self.failsafe_add(api.Object.group,
|
|
|
|
self.test_group, description=u'description'
|
|
|
|
)
|
|
|
|
self.failsafe_add(api.Object.host,
|
2010-07-22 13:16:22 -05:00
|
|
|
self.test_host, force=True
|
2009-12-09 10:09:53 -06:00
|
|
|
)
|
|
|
|
self.failsafe_add(api.Object.hostgroup,
|
2009-09-30 09:24:25 -05:00
|
|
|
self.test_hostgroup, description=u'description'
|
|
|
|
)
|
2010-05-14 16:28:51 -05:00
|
|
|
self.failsafe_add(api.Object.hbacsvc,
|
2012-03-14 10:33:41 -05:00
|
|
|
self.test_service, description=u'desc',
|
2010-05-14 16:28:51 -05:00
|
|
|
)
|
2009-09-30 09:24:25 -05:00
|
|
|
|
2010-12-21 06:20:18 -06:00
|
|
|
def test_8_hbacrule_add_user(self):
|
2009-09-30 09:24:25 -05:00
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
Test adding user and group to HBAC rule using `xmlrpc.hbacrule_add_user`.
|
2009-09-30 09:24:25 -05:00
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
ret = api.Command['hbacrule_add_user'](
|
2009-09-30 09:24:25 -05:00
|
|
|
self.rule_name, user=self.test_user, group=self.test_group
|
|
|
|
)
|
2009-12-09 10:09:53 -06:00
|
|
|
assert ret['completed'] == 2
|
|
|
|
failed = ret['failed']
|
2009-09-30 09:24:25 -05:00
|
|
|
assert 'memberuser' in failed
|
|
|
|
assert 'user' in failed['memberuser']
|
|
|
|
assert not failed['memberuser']['user']
|
|
|
|
assert 'group' in failed['memberuser']
|
|
|
|
assert not failed['memberuser']['group']
|
2009-12-09 10:09:53 -06:00
|
|
|
entry = ret['result']
|
2010-02-12 15:34:21 -06:00
|
|
|
assert_attr_equal(entry, 'memberuser_user', self.test_user)
|
|
|
|
assert_attr_equal(entry, 'memberuser_group', self.test_group)
|
2009-09-30 09:24:25 -05:00
|
|
|
|
2011-05-31 16:52:35 -05:00
|
|
|
def test_9_a_show_user(self):
|
|
|
|
"""
|
|
|
|
Test showing a user to verify HBAC rule membership
|
|
|
|
`xmlrpc.user_show`.
|
|
|
|
"""
|
|
|
|
ret = api.Command['user_show'](self.test_user, all=True)
|
|
|
|
entry = ret['result']
|
2011-07-15 16:18:42 -05:00
|
|
|
assert_attr_equal(entry, 'memberof_hbacrule', self.rule_name)
|
2011-05-31 16:52:35 -05:00
|
|
|
|
|
|
|
def test_9_b_show_group(self):
|
|
|
|
"""
|
|
|
|
Test showing a group to verify HBAC rule membership
|
|
|
|
`xmlrpc.group_show`.
|
|
|
|
"""
|
|
|
|
ret = api.Command['group_show'](self.test_group, all=True)
|
|
|
|
entry = ret['result']
|
2011-07-15 16:18:42 -05:00
|
|
|
assert_attr_equal(entry, 'memberof_hbacrule', self.rule_name)
|
2011-05-31 16:52:35 -05:00
|
|
|
|
2010-12-21 06:20:18 -06:00
|
|
|
def test_9_hbacrule_remove_user(self):
|
2009-09-30 09:24:25 -05:00
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
Test removing user and group from HBAC rule using `xmlrpc.hbacrule_remove_user'.
|
2009-09-30 09:24:25 -05:00
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
ret = api.Command['hbacrule_remove_user'](
|
2009-09-30 09:24:25 -05:00
|
|
|
self.rule_name, user=self.test_user, group=self.test_group
|
|
|
|
)
|
2009-12-09 10:09:53 -06:00
|
|
|
assert ret['completed'] == 2
|
|
|
|
failed = ret['failed']
|
2009-09-30 09:24:25 -05:00
|
|
|
assert 'memberuser' in failed
|
|
|
|
assert 'user' in failed['memberuser']
|
|
|
|
assert not failed['memberuser']['user']
|
|
|
|
assert 'group' in failed['memberuser']
|
|
|
|
assert not failed['memberuser']['group']
|
2009-12-09 10:09:53 -06:00
|
|
|
entry = ret['result']
|
2010-02-12 15:34:21 -06:00
|
|
|
assert 'memberuser_user' not in entry
|
|
|
|
assert 'memberuser_group' not in entry
|
2009-09-30 09:24:25 -05:00
|
|
|
|
2010-12-21 06:20:18 -06:00
|
|
|
def test_a_hbacrule_add_host(self):
|
2009-09-30 09:24:25 -05:00
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
Test adding host and hostgroup to HBAC rule using `xmlrpc.hbacrule_add_host`.
|
2009-09-30 09:24:25 -05:00
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
ret = api.Command['hbacrule_add_host'](
|
2009-09-30 09:24:25 -05:00
|
|
|
self.rule_name, host=self.test_host, hostgroup=self.test_hostgroup
|
|
|
|
)
|
2009-12-09 10:09:53 -06:00
|
|
|
assert ret['completed'] == 2
|
|
|
|
failed = ret['failed']
|
2009-09-30 09:24:25 -05:00
|
|
|
assert 'memberhost' in failed
|
|
|
|
assert 'host' in failed['memberhost']
|
|
|
|
assert not failed['memberhost']['host']
|
|
|
|
assert 'hostgroup' in failed['memberhost']
|
|
|
|
assert not failed['memberhost']['hostgroup']
|
2009-12-09 10:09:53 -06:00
|
|
|
entry = ret['result']
|
2010-02-12 15:34:21 -06:00
|
|
|
assert_attr_equal(entry, 'memberhost_host', self.test_host)
|
|
|
|
assert_attr_equal(entry, 'memberhost_hostgroup', self.test_hostgroup)
|
2009-09-30 09:24:25 -05:00
|
|
|
|
2011-05-31 16:52:35 -05:00
|
|
|
def test_a_hbacrule_show_host(self):
|
|
|
|
"""
|
|
|
|
Test showing host to verify HBAC rule membership
|
|
|
|
`xmlrpc.host_show`.
|
|
|
|
"""
|
|
|
|
ret = api.Command['host_show'](self.test_host, all=True)
|
|
|
|
entry = ret['result']
|
2011-07-15 16:18:42 -05:00
|
|
|
assert_attr_equal(entry, 'memberof_hbacrule', self.rule_name)
|
2011-05-31 16:52:35 -05:00
|
|
|
|
|
|
|
def test_a_hbacrule_show_hostgroup(self):
|
|
|
|
"""
|
|
|
|
Test showing hostgroup to verify HBAC rule membership
|
|
|
|
`xmlrpc.hostgroup_show`.
|
|
|
|
"""
|
|
|
|
ret = api.Command['hostgroup_show'](self.test_hostgroup, all=True)
|
|
|
|
entry = ret['result']
|
2011-07-15 16:18:42 -05:00
|
|
|
assert_attr_equal(entry, 'memberof_hbacrule', self.rule_name)
|
2011-05-31 16:52:35 -05:00
|
|
|
|
2010-12-21 06:20:18 -06:00
|
|
|
def test_b_hbacrule_remove_host(self):
|
2009-09-30 09:24:25 -05:00
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
Test removing host and hostgroup from HBAC rule using `xmlrpc.hbacrule_remove_host`.
|
2009-09-30 09:24:25 -05:00
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
ret = api.Command['hbacrule_remove_host'](
|
2009-09-30 09:24:25 -05:00
|
|
|
self.rule_name, host=self.test_host, hostgroup=self.test_hostgroup
|
|
|
|
)
|
2009-12-09 10:09:53 -06:00
|
|
|
assert ret['completed'] == 2
|
|
|
|
failed = ret['failed']
|
2009-09-30 09:24:25 -05:00
|
|
|
assert 'memberhost' in failed
|
|
|
|
assert 'host' in failed['memberhost']
|
|
|
|
assert not failed['memberhost']['host']
|
|
|
|
assert 'hostgroup' in failed['memberhost']
|
|
|
|
assert not failed['memberhost']['hostgroup']
|
2009-12-09 10:09:53 -06:00
|
|
|
entry = ret['result']
|
2012-03-09 10:48:32 -06:00
|
|
|
assert 'memberhost_host' not in entry
|
|
|
|
assert 'memberhost_hostgroup' not in entry
|
2009-09-30 09:24:25 -05:00
|
|
|
|
2013-04-12 10:38:09 -05:00
|
|
|
@raises(errors.DeprecationError)
|
|
|
|
def test_a_hbacrule_add_sourcehost_deprecated(self):
|
2009-09-30 09:24:25 -05:00
|
|
|
"""
|
2013-04-12 10:38:09 -05:00
|
|
|
Test deprecated command hbacrule_add_sourcehost.
|
2009-09-30 09:24:25 -05:00
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
ret = api.Command['hbacrule_add_sourcehost'](
|
2009-09-30 09:24:25 -05:00
|
|
|
self.rule_name, host=self.test_host, hostgroup=self.test_hostgroup
|
|
|
|
)
|
2012-03-27 08:15:20 -05:00
|
|
|
|
2010-12-21 06:20:18 -06:00
|
|
|
def test_a_hbacrule_add_service(self):
|
2010-05-14 16:28:51 -05:00
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
Test adding service to HBAC rule using `xmlrpc.hbacrule_add_service`.
|
2010-05-14 16:28:51 -05:00
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
ret = api.Command['hbacrule_add_service'](
|
2010-05-14 16:28:51 -05:00
|
|
|
self.rule_name, hbacsvc=self.test_service
|
|
|
|
)
|
|
|
|
assert ret['completed'] == 1
|
|
|
|
failed = ret['failed']
|
|
|
|
assert 'memberservice' in failed
|
|
|
|
assert 'hbacsvc' in failed['memberservice']
|
|
|
|
assert not failed['memberservice']['hbacsvc']
|
|
|
|
entry = ret['result']
|
2010-10-04 16:45:40 -05:00
|
|
|
assert_attr_equal(entry, 'memberservice_hbacsvc', self.test_service)
|
2010-05-14 16:28:51 -05:00
|
|
|
|
2010-12-21 06:20:18 -06:00
|
|
|
def test_a_hbacrule_remove_service(self):
|
2010-05-14 16:28:51 -05:00
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
Test removing service to HBAC rule using `xmlrpc.hbacrule_remove_service`.
|
2010-05-14 16:28:51 -05:00
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
ret = api.Command['hbacrule_remove_service'](
|
2010-05-14 16:28:51 -05:00
|
|
|
self.rule_name, hbacsvc=self.test_service
|
|
|
|
)
|
|
|
|
assert ret['completed'] == 1
|
|
|
|
failed = ret['failed']
|
|
|
|
assert 'memberservice' in failed
|
|
|
|
assert 'hbacsvc' in failed['memberservice']
|
|
|
|
assert not failed['memberservice']['hbacsvc']
|
|
|
|
entry = ret['result']
|
|
|
|
assert 'memberservice service' not in entry
|
|
|
|
|
2013-04-12 10:38:09 -05:00
|
|
|
@raises(errors.DeprecationError)
|
|
|
|
def test_b_hbacrule_remove_sourcehost_deprecated(self):
|
2009-09-30 09:24:25 -05:00
|
|
|
"""
|
2013-04-12 10:38:09 -05:00
|
|
|
Test deprecated command hbacrule_remove_sourcehost.
|
2009-09-30 09:24:25 -05:00
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
ret = api.Command['hbacrule_remove_sourcehost'](
|
2009-09-30 09:24:25 -05:00
|
|
|
self.rule_name, host=self.test_host, hostgroup=self.test_hostgroup
|
|
|
|
)
|
2011-08-17 10:49:49 -05:00
|
|
|
|
2012-04-30 06:29:08 -05:00
|
|
|
@raises(errors.ValidationError)
|
|
|
|
def test_c_hbacrule_mod_invalid_external_setattr(self):
|
|
|
|
"""
|
|
|
|
Test adding the same external host using `xmlrpc.hbacrule_add_host`.
|
|
|
|
"""
|
|
|
|
ret = api.Command['hbacrule_mod'](
|
|
|
|
self.rule_name, setattr=self.test_invalid_sourcehost
|
|
|
|
)
|
|
|
|
|
2010-12-21 06:20:18 -06:00
|
|
|
def test_d_hbacrule_disable(self):
|
2009-09-30 09:24:25 -05:00
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
Test disabling HBAC rule using `xmlrpc.hbacrule_disable`.
|
2009-09-30 09:24:25 -05:00
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
assert api.Command['hbacrule_disable'](self.rule_name)['result'] is True
|
|
|
|
entry = api.Command['hbacrule_show'](self.rule_name)['result']
|
2009-12-09 10:09:53 -06:00
|
|
|
# FIXME: Should this be 'disabled' or 'FALSE'?
|
|
|
|
assert_attr_equal(entry, 'ipaenabledflag', 'FALSE')
|
2009-09-30 09:24:25 -05:00
|
|
|
|
2010-12-21 06:20:18 -06:00
|
|
|
def test_e_hbacrule_enabled(self):
|
2009-09-30 09:24:25 -05:00
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
Test enabling HBAC rule using `xmlrpc.hbacrule_enable`.
|
2009-09-30 09:24:25 -05:00
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
assert api.Command['hbacrule_enable'](self.rule_name)['result'] is True
|
2009-09-30 09:24:25 -05:00
|
|
|
# check it's really enabled
|
2010-12-21 06:20:18 -06:00
|
|
|
entry = api.Command['hbacrule_show'](self.rule_name)['result']
|
2009-12-09 10:09:53 -06:00
|
|
|
# FIXME: Should this be 'enabled' or 'TRUE'?
|
|
|
|
assert_attr_equal(entry, 'ipaenabledflag', 'TRUE')
|
2009-09-30 09:24:25 -05:00
|
|
|
|
2012-04-10 06:44:21 -05:00
|
|
|
def test_ea_hbacrule_disable_setattr(self):
|
|
|
|
"""
|
|
|
|
Test disabling HBAC rule using setattr
|
|
|
|
"""
|
|
|
|
command_result = api.Command['hbacrule_mod'](
|
|
|
|
self.rule_name, setattr=u'ipaenabledflag=false')
|
|
|
|
assert command_result['result']['ipaenabledflag'] == (u'FALSE',)
|
|
|
|
entry = api.Command['hbacrule_show'](self.rule_name)['result']
|
|
|
|
assert_attr_equal(entry, 'ipaenabledflag', 'FALSE')
|
|
|
|
|
|
|
|
def test_eb_hbacrule_enable_setattr(self):
|
|
|
|
"""
|
|
|
|
Test enabling HBAC rule using setattr
|
|
|
|
"""
|
|
|
|
command_result = api.Command['hbacrule_mod'](
|
|
|
|
self.rule_name, setattr=u'ipaenabledflag=1')
|
|
|
|
assert command_result['result']['ipaenabledflag'] == (u'TRUE',)
|
|
|
|
# check it's really enabled
|
|
|
|
entry = api.Command['hbacrule_show'](self.rule_name)['result']
|
|
|
|
assert_attr_equal(entry, 'ipaenabledflag', 'TRUE')
|
|
|
|
|
2012-03-09 08:41:16 -06:00
|
|
|
@raises(errors.MutuallyExclusiveError)
|
2010-12-21 06:20:18 -06:00
|
|
|
def test_f_hbacrule_exclusiveuser(self):
|
2009-09-30 09:24:25 -05:00
|
|
|
"""
|
2010-09-15 08:20:14 -05:00
|
|
|
Test adding a user to an HBAC rule when usercat='all'
|
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
api.Command['hbacrule_mod'](self.rule_name, usercategory=u'all')
|
2010-09-15 08:20:14 -05:00
|
|
|
try:
|
2012-03-14 10:33:41 -05:00
|
|
|
api.Command['hbacrule_add_user'](self.rule_name, user=u'admin')
|
2012-03-09 08:41:16 -06:00
|
|
|
finally:
|
|
|
|
api.Command['hbacrule_mod'](self.rule_name, usercategory=u'')
|
2010-09-15 08:20:14 -05:00
|
|
|
|
2012-03-09 08:41:16 -06:00
|
|
|
@raises(errors.MutuallyExclusiveError)
|
2010-12-21 06:20:18 -06:00
|
|
|
def test_g_hbacrule_exclusiveuser(self):
|
2010-09-15 08:20:14 -05:00
|
|
|
"""
|
|
|
|
Test setting usercat='all' in an HBAC rule when there are users
|
|
|
|
"""
|
2012-03-23 14:09:54 -05:00
|
|
|
api.Command['hbacrule_add_user'](self.rule_name, user=u'admin')
|
2010-09-15 08:20:14 -05:00
|
|
|
try:
|
2010-12-21 06:20:18 -06:00
|
|
|
api.Command['hbacrule_mod'](self.rule_name, usercategory=u'all')
|
2010-09-15 08:20:14 -05:00
|
|
|
finally:
|
2012-03-23 14:09:54 -05:00
|
|
|
api.Command['hbacrule_remove_user'](self.rule_name, user=u'admin')
|
2010-09-15 08:20:14 -05:00
|
|
|
|
2012-03-09 08:41:16 -06:00
|
|
|
@raises(errors.MutuallyExclusiveError)
|
2010-12-21 06:20:18 -06:00
|
|
|
def test_h_hbacrule_exclusivehost(self):
|
2010-09-15 08:20:14 -05:00
|
|
|
"""
|
|
|
|
Test adding a host to an HBAC rule when hostcat='all'
|
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
api.Command['hbacrule_mod'](self.rule_name, hostcategory=u'all')
|
2010-09-15 08:20:14 -05:00
|
|
|
try:
|
2010-12-21 06:20:18 -06:00
|
|
|
api.Command['hbacrule_add_host'](self.rule_name, host=self.test_host)
|
2012-03-09 08:41:16 -06:00
|
|
|
finally:
|
|
|
|
api.Command['hbacrule_mod'](self.rule_name, hostcategory=u'')
|
2010-09-15 08:20:14 -05:00
|
|
|
|
2012-03-09 08:41:16 -06:00
|
|
|
@raises(errors.MutuallyExclusiveError)
|
2010-12-21 06:20:18 -06:00
|
|
|
def test_i_hbacrule_exclusivehost(self):
|
2010-09-15 08:20:14 -05:00
|
|
|
"""
|
|
|
|
Test setting hostcat='all' in an HBAC rule when there are hosts
|
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
api.Command['hbacrule_add_host'](self.rule_name, host=self.test_host)
|
2010-09-15 08:20:14 -05:00
|
|
|
try:
|
2010-12-21 06:20:18 -06:00
|
|
|
api.Command['hbacrule_mod'](self.rule_name, hostcategory=u'all')
|
2010-09-15 08:20:14 -05:00
|
|
|
finally:
|
2010-12-21 06:20:18 -06:00
|
|
|
api.Command['hbacrule_remove_host'](self.rule_name, host=self.test_host)
|
2010-09-15 08:20:14 -05:00
|
|
|
|
2012-03-09 08:41:16 -06:00
|
|
|
@raises(errors.MutuallyExclusiveError)
|
2010-12-21 06:20:18 -06:00
|
|
|
def test_j_hbacrule_exclusiveservice(self):
|
2010-09-15 08:20:14 -05:00
|
|
|
"""
|
|
|
|
Test adding a service to an HBAC rule when servicecat='all'
|
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
api.Command['hbacrule_mod'](self.rule_name, servicecategory=u'all')
|
2010-09-15 08:20:14 -05:00
|
|
|
try:
|
2012-03-09 08:41:16 -06:00
|
|
|
api.Command['hbacrule_add_service'](self.rule_name, hbacsvc=self.test_service)
|
|
|
|
finally:
|
|
|
|
api.Command['hbacrule_mod'](self.rule_name, servicecategory=u'')
|
2010-09-15 08:20:14 -05:00
|
|
|
|
2012-03-09 08:41:16 -06:00
|
|
|
@raises(errors.MutuallyExclusiveError)
|
2010-12-21 06:20:18 -06:00
|
|
|
def test_k_hbacrule_exclusiveservice(self):
|
2010-09-15 08:20:14 -05:00
|
|
|
"""
|
|
|
|
Test setting servicecat='all' in an HBAC rule when there are services
|
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
api.Command['hbacrule_add_service'](self.rule_name, hbacsvc=self.test_service)
|
2010-09-15 08:20:14 -05:00
|
|
|
try:
|
2010-12-21 06:20:18 -06:00
|
|
|
api.Command['hbacrule_mod'](self.rule_name, servicecategory=u'all')
|
2010-09-15 08:20:14 -05:00
|
|
|
finally:
|
2010-12-21 06:20:18 -06:00
|
|
|
api.Command['hbacrule_remove_service'](self.rule_name, hbacsvc=self.test_service)
|
2010-09-15 08:20:14 -05:00
|
|
|
|
2012-03-09 08:41:16 -06:00
|
|
|
@raises(errors.ValidationError)
|
2011-07-06 16:45:53 -05:00
|
|
|
def test_l_hbacrule_add(self):
|
|
|
|
"""
|
|
|
|
Test adding a new HBAC rule with a deny type.
|
|
|
|
"""
|
2012-03-09 08:41:16 -06:00
|
|
|
api.Command['hbacrule_add'](
|
|
|
|
u'denyrule',
|
|
|
|
accessruletype=u'deny',
|
|
|
|
description=self.rule_desc,
|
|
|
|
)
|
2011-07-06 16:45:53 -05:00
|
|
|
|
2012-03-09 08:41:16 -06:00
|
|
|
@raises(errors.ValidationError)
|
2011-07-06 16:45:53 -05:00
|
|
|
def test_m_hbacrule_add(self):
|
|
|
|
"""
|
|
|
|
Test changing an HBAC rule to the deny type
|
|
|
|
"""
|
2012-03-09 08:41:16 -06:00
|
|
|
api.Command['hbacrule_mod'](
|
|
|
|
self.rule_name,
|
|
|
|
accessruletype=u'deny',
|
|
|
|
)
|
|
|
|
|
Expand Referential Integrity checks
Many attributes in IPA (e.g. manager, memberuser, managedby, ...)
are used to store DNs of linked objects in IPA (users, hosts, sudo
commands, etc.). However, when the linked objects is deleted or
renamed, the attribute pointing to it stays with the objects and
thus may create a dangling link causing issues in client software
reading the data.
Directory Server has a plugin to enforce referential integrity (RI)
by checking DEL and MODRDN operations and updating affected links.
It was already used for manager and secretary attributes and
should be expanded for the missing attributes to avoid dangling
links.
As a prerequisite, all attributes checked for RI must have pres
and eq indexes to avoid performance issues. Thus, the following
indexes are added:
* manager (pres index only)
* secretary (pres index only)
* memberHost
* memberUser
* sourcehost
* memberservice
* managedby
* memberallowcmd
* memberdenycmd
* ipasudorunas
* ipasudorunasgroup
Referential Integrity plugin is updated to enforce RI for all these
attributes. Unit tests covering RI checks for all these attributes
were added as well.
Note: this update will only fix RI on one master as RI plugin does
not check replicated operations.
https://fedorahosted.org/freeipa/ticket/2866
2012-09-12 03:00:35 -05:00
|
|
|
def test_n_hbacrule_links(self):
|
|
|
|
"""
|
|
|
|
Test adding various links to HBAC rule
|
|
|
|
"""
|
|
|
|
api.Command['hbacrule_add_service'](
|
|
|
|
self.rule_name, hbacsvc=self.test_service
|
|
|
|
)
|
|
|
|
|
|
|
|
entry = api.Command['hbacrule_show'](self.rule_name)['result']
|
|
|
|
assert_attr_equal(entry, 'cn', self.rule_name)
|
|
|
|
assert_attr_equal(entry, 'memberservice_hbacsvc', self.test_service)
|
|
|
|
|
2012-03-09 08:41:16 -06:00
|
|
|
def test_y_hbacrule_zap_testing_data(self):
|
|
|
|
"""
|
|
|
|
Clear data for HBAC plugin testing.
|
|
|
|
"""
|
|
|
|
api.Command['hbacrule_remove_host'](self.rule_name, host=self.test_host)
|
|
|
|
api.Command['hbacrule_remove_host'](self.rule_name, hostgroup=self.test_hostgroup)
|
|
|
|
api.Command['user_del'](self.test_user)
|
|
|
|
api.Command['group_del'](self.test_group)
|
|
|
|
api.Command['host_del'](self.test_host)
|
|
|
|
api.Command['hostgroup_del'](self.test_hostgroup)
|
|
|
|
api.Command['hbacsvc_del'](self.test_service)
|
2011-07-06 16:45:53 -05:00
|
|
|
|
Expand Referential Integrity checks
Many attributes in IPA (e.g. manager, memberuser, managedby, ...)
are used to store DNs of linked objects in IPA (users, hosts, sudo
commands, etc.). However, when the linked objects is deleted or
renamed, the attribute pointing to it stays with the objects and
thus may create a dangling link causing issues in client software
reading the data.
Directory Server has a plugin to enforce referential integrity (RI)
by checking DEL and MODRDN operations and updating affected links.
It was already used for manager and secretary attributes and
should be expanded for the missing attributes to avoid dangling
links.
As a prerequisite, all attributes checked for RI must have pres
and eq indexes to avoid performance issues. Thus, the following
indexes are added:
* manager (pres index only)
* secretary (pres index only)
* memberHost
* memberUser
* sourcehost
* memberservice
* managedby
* memberallowcmd
* memberdenycmd
* ipasudorunas
* ipasudorunasgroup
Referential Integrity plugin is updated to enforce RI for all these
attributes. Unit tests covering RI checks for all these attributes
were added as well.
Note: this update will only fix RI on one master as RI plugin does
not check replicated operations.
https://fedorahosted.org/freeipa/ticket/2866
2012-09-12 03:00:35 -05:00
|
|
|
def test_k_2_sudorule_referential_integrity(self):
|
|
|
|
"""
|
|
|
|
Test that links in HBAC rule were removed by referential integrity plugin
|
|
|
|
"""
|
|
|
|
entry = api.Command['hbacrule_show'](self.rule_name)['result']
|
|
|
|
assert_attr_equal(entry, 'cn', self.rule_name)
|
|
|
|
assert 'sourcehost_host' not in entry
|
|
|
|
assert 'sourcehost_hostgroup' not in entry
|
|
|
|
assert 'memberservice_hbacsvc' not in entry
|
|
|
|
|
2010-12-21 06:20:18 -06:00
|
|
|
def test_z_hbacrule_del(self):
|
2010-09-15 08:20:14 -05:00
|
|
|
"""
|
2010-12-21 06:20:18 -06:00
|
|
|
Test deleting a HBAC rule using `xmlrpc.hbacrule_del`.
|
2009-09-30 09:24:25 -05:00
|
|
|
"""
|
2011-01-07 10:17:55 -06:00
|
|
|
api.Command['hbacrule_del'](self.rule_name)
|
2009-09-30 09:24:25 -05:00
|
|
|
# verify that it's gone
|
2012-03-09 08:41:16 -06:00
|
|
|
with assert_raises(errors.NotFound):
|
2010-12-21 06:20:18 -06:00
|
|
|
api.Command['hbacrule_show'](self.rule_name)
|
2013-04-12 10:38:09 -05:00
|
|
|
|
|
|
|
@raises(errors.ValidationError)
|
|
|
|
def test_zz_hbacrule_add_with_deprecated_option(self):
|
|
|
|
"""
|
|
|
|
Test using a deprecated command option 'sourcehostcategory' with 'hbacrule_add'.
|
|
|
|
"""
|
|
|
|
api.Command['hbacrule_add'](
|
|
|
|
self.rule_name, sourcehostcategory=u'all'
|
|
|
|
)
|