Commit Graph

234 Commits

Author SHA1 Message Date
Petr Vobornik
6d618853a4 webui-ci: decorate all webui tests with screenshot decorator
Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
2014-05-12 18:52:58 +02:00
Petr Vobornik
6a61378586 webui-ci: save screenshot on test failure
New decorator: ui_driver.screenshot created. It should be applied on test methods.

Screenshot is saved on each exception except SkipTest.

Configuration:
- add: `save_screenshots: True` to ~/.ipa/ui_test.conf to enable saving screenshots
- optionally add `screenshot_dir: /path/to/dir` to specify target directory
  otherwise screenshots are saved to current directory

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
2014-05-12 18:52:57 +02:00
Adam Misnyovszki
aa43732910 webui tests: range test extended
Range test extended with checking of disabled
field according to trust types.

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-12 13:35:56 +02:00
Adam Misnyovszki
5b12367ca8 webui tests: callback, assert_disabled feature added
Added a callback feature to webui tests,
to extend functionality. Also added
assert_disabled function to ui_driver, to
check if a field is disabled in the browser.

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-05-12 13:35:56 +02:00
Tomas Babej
491f431107 ipatests: Enable SSSD debugging on legacy clients with SSSD
Reviewed-By: Jakub Hrozek <jhrozek@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-05-09 13:57:04 +03:00
Tomas Babej
d98e06c314 ipatests: Setup SSSD debugging mode by default
Reviewed-By: Jakub Hrozek <jhrozek@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-05-09 13:57:04 +03:00
Tomas Babej
086d9f46dd ipatests: legacy clients: Do not use external hostnames for testing login to legacy clients from master
Reviewed-By: Jakub Hrozek <jhrozek@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-05-09 13:57:04 +03:00
Tomas Babej
5ce88a1f89 ipatests: Add Sudo integration test
Reviewed-By: Jakub Hrozek <jhrozek@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-05-09 13:57:04 +03:00
Thorsten Scherf
7646cb8e58 Fixed typo in ipa-test-task man page
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-05-06 13:44:53 +02:00
Tomas Babej
004071a246 ipatests: Add test for denying expired principals
Part of: https://fedorahosted.org/freeipa/ticket/3305

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Simo Sorce <simo@redhat.com>
2014-05-05 19:06:39 +03:00
Tomas Babej
473a9fd238 ipatests: Add coverage for setting krbPrincipalExpiration
Part of: https://fedorahosted.org/freeipa/ticket/3306

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-05-05 19:01:04 +03:00
Tomas Babej
4568a52953 ipatests: Fix formatting errors in test_user_plugin.py
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-05-05 19:01:04 +03:00
Tomas Babej
ecaf87c007 ipatests: Cover DateTime in test_parameters.py
Adds tests for newly added DateTime parameter, focusing on conversion
of accepted datetime formats.

Part of: https://fedorahosted.org/freeipa/ticket/3306

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-05-05 18:57:29 +03:00
Petr Vobornik
7eff8ad7dc webui-ci: adjust id range tests to new validator
Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
2014-05-05 17:50:53 +02:00
Petr Viktorin
c3d7e66291 ipalib.aci: Allow alternate "aci" keyword in ACIs
Dogtag adds some ACIs that use an alternate keyword:
    version 3.0; aci
instead of
    version 3.0; acl

Add support for this so the parser does not fail on these ACIs.

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-04-30 22:16:28 +02:00
Petr Viktorin
be6edef6e4 Move ACI tests to the testsuite
Make old debug code into regression tests for ACI parsing and output.

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-04-30 22:16:27 +02:00
Rob Crittenden
64dcb1ec76 Implement an IPA Foreman smartproxy server
This currently server supports only host and hostgroup commands for
retrieving, adding and deleting entries.

The incoming requests are completely unauthenticated and by default
requests must be local.

Utilize GSS-Proxy to manage the TGT.

Configuration information is in the ipa-smartproxy man page.

Design: http://www.freeipa.org/page/V3/Smart_Proxy

https://fedorahosted.org/freeipa/ticket/4128

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-04-30 21:57:27 +02:00
Petr Viktorin
edee79a32f test_ldap: Read a publicly accessible attribute when testing anonymous bind
The usercertificate attribute is slated to not be readable for
anonymous users. Use associateddomain in $SUFFIX instead.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-04-25 14:06:08 +02:00
Tomas Babej
01558a77df ipatests: Extend test suite for ID ranges
Add tests coverage for recently added ID range checks dependant
on the ID range types.

Part of: https://fedorahosted.org/freeipa/ticket/4137

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-04-23 13:19:57 +02:00
Petr Viktorin
d28d37ebdb test_integration.host: Export the hostname to dict as string
Our tests do strict type-checking, using unicode string causes failures.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-04-22 12:55:35 +02:00
Jan Cholasta
9814b272af Keep original name when setting attribute in LDAPEntry.
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-04-18 14:59:21 +02:00
Jan Cholasta
a8dd7aa337 Use raw attribute values in command result when --raw is specified.
For backward compatibility, the values are converted to unicode, unless the
attribute is binary or the conversion fails.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-04-18 14:59:20 +02:00
Jan Cholasta
8b6dc819d5 Support API version-specific RPC marshalling.
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-04-18 14:59:20 +02:00
Jan Cholasta
4314d02fbf Allow primary keys to use different type than unicode.
Also return list of primary keys instead of a single unicode CSV value from
LDAPDelete-based commands.

This introduces a new capability 'primary_key_types' for backward
compatibility with old clients.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-04-18 14:59:20 +02:00
Tomas Babej
f74ab3cba2 ipatests: Fix incorrect UID/GID reference for subdomain users and groups
In legacy client integration test, the test cases that query information
from subdomain about subdomain users and group expected subdomain
users and groups to have the UIDs/GIDs as users and groups in the root
domain.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-04-17 16:31:11 +02:00
Tomas Babej
49a59d1292 ipatests: Allow using FQDN with trailing dot as final hostname
When creating a BaseHost instance, the machine's hostname was
reconfigured to have the same shortname prepended the domain name
of the domain where it was defined.

However, it makes sense in certain use cases to define hosts
that have hostnames other than belonging directly in the domain
they were defined in.

Treat input hostnames with trailing dots as static FQDNs that
will not be changed by the name of the domain they were defined in.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-04-17 16:31:11 +02:00
Tomas Babej
24aa0a91e5 ipatests: tasks: Accept extra arguments when installing client
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-04-17 16:31:11 +02:00
Tomas Babej
ceca0b5591 ipatests: Fix apache semaphores prior to installing IPA server
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-04-17 16:31:11 +02:00
Adam Misnyovszki
f85fe1e851 CI - test_forced_client_reenrollment stability fix
fixes FreeIPA Jenkins CI test freeipa-integration-forced_client_reenrollment-f19

https://fedorahosted.org/freeipa/ticket/4298

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-04-17 16:31:11 +02:00
Petr Viktorin
b53f2d28fd Add managed read permissions to krbtpolicy
Unlike other objects, the ticket policy is stored in different
subtrees: global policy in cn=kerberos and per-user policy in
cn=users,cn=accounts.
Add two permissions, one for each location.

Also, modify tests so that adding new permissions in cn=users
doesn't cause failures.

Part of the work for: https://fedorahosted.org/freeipa/ticket/3566
2014-04-16 16:10:43 +02:00
Petr Vobornik
466e32f9ec webui-ci: adapt to new login screen
https://fedorahosted.org/freeipa/ticket/3903

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
2014-04-15 12:41:54 +02:00
Petr Viktorin
3deb76cf17 Fix expected output in permission tests
There is now a second permission affecting krbMinPwdLife.
Add it to expected output.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-04-15 09:45:40 +02:00
Petr Viktorin
db85ea32c1 test_realmdomains_plugin: Add default ACI to expected output
Since realmdomains is only one entry, _show with --all will return
the ACI on it. Add it to expected output.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-04-11 12:45:14 +02:00
Petr Viktorin
85b8d8d5ae CA-less tests: Use sequential certificate serial numbers
When serial numbers were generated with $RANDOM, there
could be collisions.
Use sequential numbers instead.

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
2014-04-10 12:05:26 +02:00
Adam Misnyovszki
8b91d9a6e8 automember rebuild nowait feature added
automember-rebuild uses asynchronous 389 task, and returned
success even if the task didn't run. this patch fixes this
issue adding a --nowait parameter to 'ipa automember-rebuild',
defaulting to False, thus when the script runs without it,
it waits for the 'nstaskexitcode' attribute, which means
the task has finished. Old usage can be enabled using --nowait,
and returns the DN of the task for further polling.
New tests added also.

https://fedorahosted.org/freeipa/ticket/4239

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-04-09 13:45:32 +02:00
Adam Misnyovszki
2b171d273f CA-less tests generate failure
CA-less test suite always generate failures when installing
revoked certificates. This is a known issue, described in
https://fedorahosted.org/freeipa/ticket/4270 , this fix skips
these tests, outputting a warning for the later ticket.

https://fedorahosted.org/freeipa/ticket/4271

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-04-08 14:10:28 +02:00
Tomas Babej
50a6316d16 ipatests: tasks: Wait 2 seconds after restart of SSSD when clearing the cache
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-04-04 12:07:00 +02:00
Tomas Babej
6dcf2400be ipatests: legacy_clients: Relax regex checks
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-04-04 12:07:00 +02:00
Tomas Babej
517ac41524 ipatests: legacy_clients: Use hostname instead of external hostname for AD subdomain
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-04-04 12:07:00 +02:00
Tomas Babej
81b5adee80 ipatests: Make sure that remnants of PKI are removed
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-04-04 12:07:00 +02:00
Adam Misnyovszki
0f626a9cc8 Extending user plugin with inetOrgPerson fields
According to http://tools.ietf.org/html/rfc2798 ipa client
and web ui extended with inetOrgPerson fields:
- employeenumber
- employeetype
- preferredlanguage
- departmentnumber

carlicenseplate is now multivalued

https://fedorahosted.org/freeipa/ticket/4165

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2014-03-28 12:38:50 +01:00
Petr Vobornik
06a7a1b3cb webui: replace IPA.command usage with rpc.command
Replace all IPA.command, IPA.batch_command and IPA.concurrent_command usages
by equivalents from rpc module.

Reviewed-By: Adam Misnyovszki <amisnyov@redhat.com>
2014-03-27 14:54:08 +01:00
Tomas Babej
f9ebd47f93 ipatests: Do not depend on the case of the attributes when testing ID ranges
In test_trust.py, several tests did case sensitive search on the output of
the ipa idrange-show command. This could cause false negatives.

Part of: https://fedorahosted.org/freeipa/ticket/4267

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-03-26 12:57:29 +01:00
Jan Cholasta
d5e35f92a5 Update pkcs10 module functions to always load CSRs and allow selecting format.
This change makes the pkcs10 module more consistent with the x509 module.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-03-25 16:54:55 +01:00
Petr Viktorin
1df9b5836a Allow modifying permissions with ":" in the name
The ":" character will be reserved for default permissions, so that
users cannot create a permission with a name that will later be
added as a default.

Allow the ":" character modifying/deleting permissions*, but not
when creating them. Also do not allow the new name to contain ":"
when renaming.

(* modify/delete have unrelated restrictions on managed permissions)

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-03-25 14:18:12 +01:00
Petr Viktorin
d0e83dbccf test_permission_plugin: Fix tests that make too broad assumptions
The test that searches with a limit of 1 assumes a specific order
LDAP returns entries in. Future patches will change this order.
Do not check the specific entry returned.

The test that searched for --bindtype assumed that no anonymous
permissions exist in a clean install. Again, this will be changed
in future patches.
Add a name to the bindtype test, and add a negatitive test to
verify the filtering works.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-03-25 14:18:12 +01:00
Petr Viktorin
4f302f6500 Allow indexing API object types by class
This allows code like:
    from ipalib.plugins.dns import dnszone_mod

    api.Command[dnszone_mod]

This form should be preferred when getting specific objects
because it ensures that the appropriate plugin is imported.

https://fedorahosted.org/freeipa/ticket/4185

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-03-25 14:18:12 +01:00
Petr Viktorin
3dcad00b94 permission plugin: Do not add the ipapermissionv2 for output
As with the flags, the objectclass should be returned as it is
on the entry.

https://fedorahosted.org/freeipa/ticket/4257

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-03-24 15:44:23 +01:00
Petr Vobornik
7872b92050 webui-ci: fix test_rebuild_membership_hosts on server without DNS
Host adder dialog differs on installations with and without DNS.
Previous test used values for adding hosts which were suitable only for IPA servers installed with DNS.

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-03-24 15:04:46 +01:00
Tomas Babej
8c8cc8b614 ipatests: test_trust: Change expected home directories for posix users
Information from the AD about the home directories is not leveraged at
all, but is generated from the username and domain. Fix the assumptions
in the tests.

Also changes 'Subdomain Test User' to 'Subdomaintest User' to be more
consistent.

https://fedorahosted.org/freeipa/ticket/4184

Reviewed-By: Jakub Hrozek <jhrozek@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-03-24 09:51:52 +01:00