Commit Graph

402 Commits

Author SHA1 Message Date
Rob Crittenden
a92328452d Add plugin to manage service constraint delegations
Service Constraints are the delegation model used by
ipa-kdb to grant service A to obtain a TGT for a user
against service B.

https://fedorahosted.org/freeipa/ticket/3644

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-06-03 09:47:40 +00:00
Endi S. Dewata
fde21adcbd Added vault plugin.
A new plugin has been added to manage vaults. Test scripts have
also been added to verify the functionality.

https://fedorahosted.org/freeipa/ticket/3872

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-05-25 06:17:09 +00:00
Thierry Bordaz
51937cc571 User life cycle: Stage user Administrators permission/priviledge
Creation of stage user administrator

https://fedorahosted.org/freeipa/ticket/3813

Reviewed-By: David Kupka <dkupka@redhat.com>
2015-05-18 09:37:21 +02:00
Petr Vobornik
5fadee969c webui-ci: fix type error in host_tasks inicializations
host_tasks initializations were not modified along with pytest migration

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2015-05-12 12:47:45 +02:00
Lenka Ryznarova
b7af182546 Test Objectclass of postdetach group
Add regression test to check whether a post detach group has a full set of objectclass.
Add regression test to check whether group-add-member is successfull for a post detach group.

https://fedorahosted.org/freeipa/ticket/4909

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-05-07 16:05:54 +02:00
Petr Vobornik
a1ccdc33df webui-ci: do not open 2 browser windows
Reviewed-By: Milan Kubik <mkubik@redhat.com>
2015-05-07 10:45:48 +02:00
Gabe
d1a0474d18 Unsaved changes dialog internally inconsistent
https://fedorahosted.org/freeipa/ticket/4926

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-05-07 10:38:26 +02:00
Petr Viktorin
2cafb47ed7 Remove Editable DN and DN component classes
Make all DNs, RDNs and AVAs immutable.
Immutability makes reasoning about DN-handling code easier,
as value objects can't be changed once created.
Instead of mutable DNs, one can use a list (or even a generator)
of RDNs that's converted to a DN on output.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-04-23 11:34:39 +00:00
Jan Cholasta
db88498c95 ldap: Move schema handling from IPASimpleLDAPObject to LDAPClient
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Jan Cholasta
cbb112dd57 ldap: Use LDAPClient instead of IPASimpleLDAPObject in LDAPEntry
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Martin Babinsky
1bd099a114 do not install CA on replica during integration test if setup_ca=False
The patch fixes bug in the construction of ipa-replica-install arguments in
test_integration/tasks.install_replica. Due to this bug the replica
installation during certain integration tests involved CA setup even when
setup_ca was set to False.

Reviewed-By: Milan Kubik <mkubik@redhat.com>
2015-04-15 13:09:59 +02:00
Martin Babinsky
c8fae594df proper client host setup/teardown in forced client reenrollment integration test suite
Replace setUp()/tearDown() methods with a pytest.fixture for proper client
setup/teardown during test_forced_client_reenrollment

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Reviewed-By: Milan Kubik <mkubik@redhat.com>
2015-04-14 19:38:04 +02:00
Petr Vobornik
11bd9d96f1 performance: faster DN implementation
DN code was optimized to be faster if DNs are created from string. This is
the major use case, since most DNs come from LDAP.

With this patch, DN creation is almost 8-10x faster (with 30K-100K DNs).

Second mojor use case - deepcopy in LDAPEntry is about 20x faster - done by
custom __deepcopy__ function.

The major change is that DN is no longer internally composed  of RDNs and
AVAs but it rather keeps the data in open ldap format - the same as output
of str2dn function. Therefore, for immutable DNs, no other transformations
are required on instantiation.

The format is:

DN: [RDN, RDN,...]
RDN: [AVA, AVA,...]
AVA: ['utf-8 encoded str - attr', 'utf-8 encode str -value', FLAG]
FLAG: int

Further indexing of DN object constructs an RDN which is just an encapsulation
of the RDN part of open ldap representation. Indexing of RDN constructs AVA in
the same fashion.

Obtained EditableAVA, EditableRDN from EditableDN shares the respected lists
of the open ldap repr. so that the change of value or attr is reflected in
parent object.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-14 19:31:54 +02:00
Martin Basti
0a1a3d7312 DNSSEC CI tests
Tests:
* install master, replica, then instal DNSSEC on master
  * test if zone is signed (added on master)
  * test if zone is signed (added on replica)

* install master with DNSSEC, then install replica
  * test if root zone is signed
  * add zone, verify signatures using our root zone

https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Milan Kubik <mkubik@redhat.com>
2015-04-14 19:29:36 +02:00
Martin Basti
b92136cba2 Fix ldap2 shared connection
Since API is not singleton anymore, ldap2 connections should not be
shared by default.

https://fedorahosted.org/freeipa/ticket/4904

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-04-02 12:26:04 +00:00
Ales 'alich' Marecek
ca96ecbf40 Ipatests DNS SOA Record Maintenance
https://fedorahosted.org/freeipa/ticket/4746

Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-04-02 08:56:32 +00:00
Milan Kubik
59f024487e ipatests: port of p11helper test from github
Ported the github hosted [1] script to use pytest's abilities
and included it in ipatests/test_ipapython directory.

[1]: https://github.com/spacekpe/freeipa-pkcs11/blob/master/python/run.py

https://fedorahosted.org/freeipa/ticket/4829

Signed-off-by: Martin Basti <mbasti@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-04-02 08:51:27 +00:00
Martin Basti
c3d441ae03 Server Upgrade: remove --test option
As --test option is not used for developing, and it is not recommended
to test if upgrade will pass, this path removes it copmletely.

https://fedorahosted.org/freeipa/ticket/3448

Reviewed-By: David Kupka <dkupka@redhat.com>
2015-03-19 12:48:41 +01:00
Jan Cholasta
2db741e847 ipalib: Allow multiple API instances
Merged the Registrar class into the Registry class. Plugins are now
registered globally instead of in ipalib.api and are instantiated per-API
instance. Different set of plugin base classes can be used in each API
instance.

https://fedorahosted.org/freeipa/ticket/3090

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-03-05 11:01:36 +01:00
Gabe
ae4ee6b533 ipatests: Add tests for valid and invalid ipa-advise
- Add test for invalid run of the ipa-advise command
- Add tests for valid runs of the ipa-advise command

https://fedorahosted.org/freeipa/ticket/4029

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-02-26 20:57:49 +01:00
Tomas Babej
a34ff7f6c1 ipatests: Add coverage for adding and removing sshpubkeys in ID overrides
Adds xmlrpc tests for:
  - Adding a user ID override with sshpubkey
  - Modifying a user ID override to contain sshpubkey
  - Removing a sshpubkey value from a user ID override

https://fedorahosted.org/freeipa/ticket/4868

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2015-02-19 17:03:06 +01:00
Petr Vobornik
25f5ee0cb6 ipatests: add missing ssh object classes to idoverrideuser
Reviewed-By: Martin Kosek <mkosek@redhat.com>
2015-02-19 17:03:06 +01:00
Tomas Babej
f83b4fe330 ipatests: Fix incorrect assumptions in idviews tests
https://fedorahosted.org/freeipa/ticket/4839

Reviewed-By: David Kupka <dkupka@redhat.com>
2015-01-26 13:01:33 +01:00
Tomas Babej
3341d31ec7 ipatests: Fix old command references in the ID views tests
Make sure only new API command versions are referenced.

https://fedorahosted.org/freeipa/ticket/4839

Reviewed-By: David Kupka <dkupka@redhat.com>
2015-01-26 13:01:33 +01:00
Tomas Babej
a294f10d06 ipatests: Add coverage for referential integrity plugin applied on ipaAssignedIDView
This adds a test case which makes sure that referential integrity
plugin does not leave any trailing references for ipaAssignedIDView
attribute on hosts, if the ID view being referenced has been deleted.

https://fedorahosted.org/freeipa/ticket/4839

Reviewed-By: David Kupka <dkupka@redhat.com>
2015-01-26 13:01:33 +01:00
Martin Basti
9af8fa9dd5 DNS tests: warning if forward zone is inactive
Ticket: https://fedorahosted.org/freeipa/ticket/4721
Reviewed-By: Petr Spacek <pspacek@redhat.com>
2015-01-15 13:21:47 +01:00
Tomas Babej
5416652f6f ipatests: Make descriptions sorted according to the order of the tests
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-01-14 11:55:01 +01:00
Petr Viktorin
07545569ec test_host_plugin: Use HostTracker fixtures
The racker object "remembers" expected state across several tests,
so only changes (rather than all expected state) need to be specified
in each test. Also, the tracker fixture will make it easy to use hosts
in other test modules.

This change makes the tests independent; any permutation of any subset
of these tests should now pass.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-01-14 11:40:28 +01:00
Petr Viktorin
8add23d401 test_host_plugin: Split tests into independent classes
Any of the classes may be run alone.

In classes not marked @ordered, individual tests are independent.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-01-14 11:40:28 +01:00
Petr Viktorin
4d9112b5c6 test_host_plugin: Convert tests to imperative style
This has several advantages:
- Tests other than run-command/check-response can be added easily
- Tracebacks are meaningful (which means we'll be able to remove a lot of
  test name/description/location tracking code)
- Individual tests can be selected/deselected using normal pytest mechanisms
  (but for isolated tests, more changes will be needed)

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-01-14 11:40:28 +01:00
Petr Viktorin
61c4ecccc1 Run pylint on tests
Drop support for pylint < 1.0

Enable ignoring unknown attributes on modules (both nose and pytest
use advanced techniques, support for which only made it to pylint
recently)

Fix some bugs revealed by pylint

Do minor refactoring or add pylint:disable directives where the
linter complains.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-01-14 11:40:28 +01:00
Martin Basti
92feba2223 New test cases for Forward_zones
https://fedorahosted.org/freeipa/ticket/4750

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2015-01-13 14:34:47 +01:00
Martin Basti
6a0934f584 DNS tests: separate current forward zone tests
Ticket: https://fedorahosted.org/freeipa/ticket/4750
Reviewed-By: Martin Kosek <mkosek@redhat.com>
2015-01-13 14:34:47 +01:00
Petr Viktorin
bc5b13c3da ipatests: Use pytest-sourceorder
The plugin to run tests within a class in the order they're defined
in the source was split into a separate project.
Use this project instead of a FreeIPA-specific copy.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-12-17 15:37:56 +01:00
Petr Viktorin
1e27fcc3b1 ipatests: Use pytest-beakerlib
The plugin for BeakerLib integration was split into a separate project.
If BeakerLib integration is desired, python-pytest-beakerlib shoule be
installed separately.
The IPA-specific beakerlib integration only sets up logging to BeakerLib,
if the plugin is active.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-12-17 15:37:56 +01:00
Tomas Babej
b7e58ce746 ipatests: Refactor and fix docstrings in integration pytest plugin
https://fedorahosted.org/freeipa/ticket/4809

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-12-16 12:20:44 +01:00
Tomas Babej
ad01a6b5c5 ipatests: Set the correct number of required clients for IntegrationTest
Remove the copy-pate error that used number of required replicas instead.

https://fedorahosted.org/freeipa/ticket/4809

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-12-16 12:20:44 +01:00
Tomas Babej
3507bcd3df ipatests: Invoke class install methods properly with respect to pytest-multihost
Multihost object was is not passed to the install method in the super construction.
This fixes setup errors in AD Trust, Forced client reenrollment, CALess and Sudo
tests.

https://fedorahosted.org/freeipa/ticket/4809

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-12-16 12:20:44 +01:00
Petr Viktorin
a97d61df04 test_integration: Parametrize test instead of using a generator
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-12-11 07:04:58 +01:00
Petr Viktorin
d9ab11a232 test_integration: Use collect_log from the host, not the testing class
The testing class no longer has this method.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-12-11 07:04:58 +01:00
Petr Viktorin
74f7d67fd5 test_integration: Use python-pytest-multihost
The core integration testing functionality was split into a separate
project. Use this project, and configure it for FreeIPA.

The "mh" (multihost) fixture is made available for integration tests.

Configuration based on environment variables is moved into a separate
module, to ease eventual deprecation.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-12-11 07:04:58 +01:00
Petr Vobornik
026c9eca09 add --hosts and --hostgroup options to allow/retrieve keytab methods
`--hosts` and `--hostgroup` options added to:
* service-allow-create-keytab
* service-allow-retrieve-keytab
* service-disallow-create-keytab
* service-disallow-retrieve-keytab
* host-allow-create-keytab
* host-allow-retrieve-keytab
* host-disallow-create-keytab
* host-disallow-retrieve-keytab

in order to allow hosts to retrieve keytab of their services or related hosts as described on http://www.freeipa.org/page/V4/Keytab_Retrieval design page

https://fedorahosted.org/freeipa/ticket/4777

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-12-03 11:34:10 +00:00
Petr Viktorin
4e99663379 Ignore ipap11helper/setup.py in doctests
Pytest imports all modules when running doctests.
The setup.py runs code on import, and raises an exception,
depending on globa connand-line arguments, so it needs to be ignored.

Also, pytest dislikes multiple top-level modules with the same name
("setup" in this case). Again ignoring is the way to go.
2014-11-26 13:14:20 +01:00
Tomas Babej
792ff0c0c4 Re-initialize NSS database after otptoken plugin tests
OTP token tests do not properly reinitialize the NSS db, thus
making subsequent xmlrpc tests fail on SSL cert validation.

Make sure NSS db is re-initalized in the teardown method.

https://fedorahosted.org/freeipa/ticket/4748

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-11-26 13:06:35 +01:00
David Kupka
56ca47d535 Fix error message for nonexistent members and add tests.
https://fedorahosted.org/freeipa/ticket/4643

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-11-24 16:04:57 +01:00
Petr Vobornik
f70d859b39 webui: use domain name instead of domain SID in idrange adder dialog
It's more user friendly. Almost nobody remembers SIDs.

https://fedorahosted.org/freeipa/ticket/4661

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-11-24 14:43:09 +01:00
Petr Viktorin
d42c26c542 test_integration: Adjust tests for pytest
- Customize install() instead of setup_class()
- Use pytest parametrization instead of test generators

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-11-21 12:14:44 +01:00
Petr Viktorin
29c28786e3 Integration tests: Port the BeakerLib plugin and log collection to pytest
Move the IPA-specific log collection out of the Beakerlib plugin.
Add the --logfile-dir option to tests and ipa-test-task, so that logs
can be collected even if BeakerLib is not used.

https://fedorahosted.org/freeipa/ticket/4610

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-11-21 12:14:44 +01:00
Petr Viktorin
0ad5c57f62 Switch integration testing config to a fixture
The hack of storing the config on the class is left in;
it would be too much work for too little gain at this time.

https://fedorahosted.org/freeipa/ticket/4610

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-11-21 12:14:44 +01:00
Petr Viktorin
eaad0a9ced Switch ipa-run-tests to pytest
https://fedorahosted.org/freeipa/ticket/4610

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-11-21 12:14:44 +01:00