Fedora 42 now ships PKI 11.7.0-5 and certmonger 0.79.21-1.
Update the vagrant image to 0.0.9 in order to pull the new versions.
Related: IDM-3437
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
- Tests to cover both root domain and subdomain users:
- Test that adding AD users/groups without the external group to
HBAC rules fails.
- Test HBAC rule denies SSH access for AD users.
- Test HBAC rule allows SSH access for AD users in external group.
- Test HBAC rule denies sudo access for AD users when rule doesn't
include them.
- Test HBAC rule allows sudo access for AD users in external group.
Related : https://pagure.io/freeipa/issue/9845
Signed-off-by: Anuja More <amore@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
- Add parametrized test for domain validation covering valid/invalid formats
- Add cross-domain discovery test showing --domain enables discovery when
client is in different domain than IPA domain
- Validate configuration in sssd.conf after successful automount setup
The new tests ensure --domain option works correctly and provides proper
hints for DNS discovery in cross-domain scenarios, reducing user friction
compared to requiring --server specification.
Related: https://pagure.io/freeipa/issue/9780
Signed-off-by: Anuja More <amore@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
32BitIdranges testuiste has been included in the
nightly prvi definitions.
Signed-off-by: Sudhir Menon <sumenon@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Fedora 42 is now officially available. Update the bind and
bind-dyndb-ldap packages to the latest versions
(bind-9.18.35-2.fc42, bind-dyndb-ldap-11.11-3.fc42)
by updating the vragrant image to 0.0.4
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Fedora 42 will be available soon and Fedora 40 will be EOL May 13 2025.
Start testing on fedora 41 and fedora 42.
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Francisco Trivino <ftrivino@redhat.com>
This way we have at least one gating test that calls
ipa trust-add.
Related: test_ipahealthcheck.py::TestIpaHealthCheckWithADtrust
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Add the test to the list of nightlies run against 389ds.
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
The test needs topology: *ad_master_1repl_1client
instead of topology: *master_1repl_1client
because it requires an AD server.
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Sudhir Menon <sumenon@redhat.com>
Now that fedora 41 is available and fedora 39 is approaching EOL,
adjust the test pipelines:
- fedora-previous now refers to f40
- fedora-latest now refers to f41
Gating tests will now run on fedora 41.
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
When token and associated certs are not being cleaned
up properly, the subsequent installation fails. Hence
Password file related scenarios moved out to new test class
so that it have fresh installation.
Signed-off-by: Mohammad Rizwan <myusuf@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
The test test_ipa_idrange_fix is installing IPA server as it sets
topology=line. Its test definition should not use a template
that pre-installs the IPA server (ipaserver preinstalls IPA server
but master_1repl does not).
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Sudhir Menon <sumenon@redhat.com>
The test is often failing on timeout. Add 15min to the test
definitions.
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Now that fedora 40 is available and fedora 38 is EOL, adjust the test
pipelines:
- fedora-previous now refers to f39
- fedora-latest now refers to f40
Gating tests will now run on fedora 40.
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Francisco Trivino <ftrivino@redhat.com>
batch(methods=Dict(), keeponly=list) will allow to execute batch of
commands and remove from the output everything but the attributes which
names were passed in the keeponly list.
This can be useful if you are only interested in getting names and
assigned random passwords, for example.
Fix batch API test in test_integration/test_idm_api.py and use it to
validate keeponly option.
Fixes: https://pagure.io/freeipa/issue/9583
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Do minimal validation of the Kerberos principal name when passing it to
kinit command line tool. Also pass it as the final argument to prevent
option injection.
Accepted Kerberos principals are:
- user names, using the following regexp
(username with optional @realm, no spaces or slashes in the name):
"(?!^[0-9]+$)^[a-zA-Z0-9_.][a-zA-Z0-9_.-]*[a-zA-Z0-9_.$-]?@?[a-zA-Z0-9.-]*$"
- service names (with slash in the name but no spaces). Validation of
the hostname is done. There is no validation of the service name.
The regular expression above also covers cases where a principal name
starts with '-'. This prevents option injection as well.
This fixes CVE-2024-1481
Fixes: https://pagure.io/freeipa/issue/9541
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Fedora 39 is now officically available. Update the test definitions:
- lastest now uses f39
- previous now uses f38
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Changes in ipa-tuura project are breaking the test
(removal of a script required for test preparation).
Disable the test until a solution is found in ipa-tuura.
Related: https://pagure.io/freeipa/issue/9476
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Antonio Torres <antorres@redhat.com>
Reviewed-By: Francisco Trivino <ftrivino@redhat.com>
Update the rawhide Vagrant box to 0.8.3
(built May 26 2023 using fedora-39)
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Fedora 38 is now available, move the testing pipelines to
- fedora 38 for the _latest definitions
- fedora 37 for the _previous definitions
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
The test test_ipahealthcheck.py::TestIpaHealthcheck frequently
hits its 90min timeout. Extend by 15min to allow completion.
Fixes: https://pagure.io/freeipa/issue/9362
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Anuja More <amore@redhat.com>
The test test_integration/test_acme.py times out frequently
and has a current timeout set to 2h, which is roughly
the average time for a successful run.
Increase by 15 minutes, so that even the tests requiring
packages update have enough time (for instance rawhide
run needs to update all the packages to the latest version).
Also create a separate job for the new test TestACMEPrune.
Fixes: https://pagure.io/freeipa/issue/9324
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Mohammad Rizwan <myusuf@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
This document showcases common usecases for the user to
interact with the PR-CI checker tool.
Signed-off-by: David Pascual <davherna@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
PRANAV THUBE
Anuja More
Florence Blanc-Renaud
Rob Crittenden
Sumedh Sidhaye
Alexander Bokovoy
Sudhir Menon
Antonio Torres
Mohammad Rizwan
Aleksandr Sharov
David Pascual