IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2026-09-03 20:52:56 -05:00
Code Issues Packages Projects Releases Wiki Activity

ipatest: add an integration test for samba upgrade

Browse Source 
When a trust was establish pre samba 4.23, the trust domain object
could contain ipanttrustattributes = 40 (LSA_TRUST_ATTRIBUTE_WITHIN_FOREST)
and winbind would fail to restart after an upgrade to samba 4.23.

Add a test simulating the situation and calling ipa-server-upgrade

Related: https://pagure.io/freeipa/issue/9892
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
This commit is contained in:
Florence Blanc-Renaud
2025-12-09 12:33:34 +01:00
parent 6f0cd075e5
commit c03f7eb2b9
1 changed files with 33 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ipatests/test_integration/test_trust.py
+33
View File
@@ -1009,6 +1009,39 @@ class TestTrust(BaseTestTrust):
tasks.unconfigure_windows_dns_for_trust(self.ad, self.master)
tasks.unconfigure_dns_for_trust(self.master, self.ad)
def test_upgrade_within_forest(self):
"""
Simulate an upgrade from a trust established with samba pre 4.23
With older samba version, the trust domain object had
ipanttrustattributes: 8
corresponding to LSA_TRUST_ATTRIBUTE_WITHIN_FOREST
and this breaks ipa-upgrade (winbind fails to restart)
"""
tasks.configure_dns_for_trust(self.master, self.ad)
tasks.configure_windows_dns_for_trust(self.ad, self.master)
tasks.establish_trust_with_ad(
self.master, self.ad_domain,
extra_args=['--range-type', 'ipa-ad-trust'])
conn = self.master.ldap_connect()
trust_dn = DN("cn={},cn=ad,cn=trusts,{}".format(
self.ad.domain.name, self.master.domain.basedn
))
entry = conn.get_entry(trust_dn)
# set the trust attributes to LSA_TRUST_ATTRIBUTE_WITHIN_FOREST
entry.single_value['ipanttrustattributes'] = '40'
conn.update_entry(entry)
self.master.run_command(['ipa-server-upgrade'])
self.master.run_command(['ipactl', 'restart'])
# cleanup for next test
self.remove_trust(self.ad)
tasks.unconfigure_windows_dns_for_trust(self.ad, self.master)
tasks.unconfigure_dns_for_trust(self.master, self.ad)
def test_server_option_with_unreachable_ad(self):
"""
Check trust can be established with partially unreachable AD topology