Commit Graph

1061 Commits

Author SHA1 Message Date
Tomas Krizek
c45a989506
ipatests: fix circular import for collect_logs
Move collect_logs function from util to avoid a circular import.

Signed-off-by: Tomas Krizek <tkrizek@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
2017-11-13 13:49:51 +01:00
Christian Heimes
3ca77456ee
Py3: fix fetching of tar files
pytest_multihost does not support binary stdout stream yet,
https://pagure.io/python-pytest-multihost/issue/7 . Write logs to
temporary file and use host.get_file_content() to fetch them.

https://pagure.io/freeipa/issue/7131

Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Michal Reznik <mreznik@redhat.com>
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-11-10 13:18:47 +01:00
Abhijeet Kasurde
222cef1a4d
ipatests: Fix interactive prompt in ca_less tests
This fix adds additional prompt which was missing previously
in test_interactive_missing_ds_pkcs_password and
test_interactive_missing_http_pkcs_password under CA-less integration
testsuite.

Fixes: https://pagure.io/freeipa/issue/7182

Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
Reviewed-By: Michal Reznik <mreznik@redhat.com>
2017-11-10 08:05:21 +01:00
Aleksei Slaikovskii
905ab93c95 Prevent installation with single label domains
Adds validation to prevent user to install ipa with single label
domain.

https://pagure.io/freeipa/issue/7207

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2017-11-09 11:32:31 +01:00
Stanislav Laznicka
983234c91b
caless tests: decode cert bytes in debug log
Bytes would cause the logger to throw up while interpolating the
string.

Reviewed-By: Michal Reznik <mreznik@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2017-11-08 07:58:46 +01:00
Stanislav Laznicka
a3009b392a
caless tests: make debug log of certificates sensible
CA-less tests debug logging uses representation of a variable
containing the certificate object, which does not help very much.
Use the actual DER representation of the certificate on such places.

Reviewed-By: Michal Reznik <mreznik@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2017-11-08 07:58:46 +01:00
Michal Reznik
02c1d0e8e5
test_external_dns: add missing test cases
Add NTP, ipa-ca and ADTrust system records tests. Also test if
changes are being reflected when uninstalling a host.

The test cases are added as extension into test_dns_locations suite.

https://pagure.io/freeipa/issue/6091

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-11-07 10:17:17 +01:00
Michal Reznik
5e4f76b043
test_caless: open CA cert in binary mode
When running test_caless suite in py3 we need to open CA cert in
binary mode so we can provide bytes later for python-cryptography.

https://pagure.io/freeipa/issue/7131

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-11-06 16:53:14 +01:00
Michal Reznik
59e136e8ba
test_forced_client: decode get_file_contents() result
Decode get_file_contents() in order to not get bytes when running py3

https://pagure.io/freeipa/issue/7131

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-11-06 16:51:00 +01:00
Felipe Barreto
16da7c612e
Fix log capture when running pytests_multihosts commands
The pytests_plugins/integration/config.py::Config class
provides the get_logger method in order to customize the
default log of the plugin.

Previously, before commit 07229c8ff6,
the code was using ipa_log_manager, a custom log solution. After
moving to use the default python way, the log is not configured anymore.

This PR address it changing the level to DEBUG in order to capture
the output of pytest_multihosts commands.

As an example, when running `ipa-server-install`, you will be able
to see an output like this:
```
[[...].Host.master.cmd2] Checking DNS domain ipa.test, please wait ...
[[...].Host.master.cmd2]
[[...].Host.master.cmd2] The log file for this installation can be found in /var/log/ipaserver-install.log
[[...].Host.master.cmd2] ==============================================================================
[[...].Host.master.cmd2] This program will set up the FreeIPA Server.
[[...].Host.master.cmd2]
[[...].Host.master.cmd2] This includes:
[[...].Host.master.cmd2]   * Configure a stand-alone CA (dogtag) for certificate management
[[...].Host.master.cmd2]   * Configure the Network Time Daemon (ntpd)
[[...].Host.master.cmd2]   * Create and configure an instance of Directory Server
[[...].Host.master.cmd2]   * Create and configure a Kerberos Key Distribution Center (KDC)
```

Fixes: https://pagure.io/freeipa/issue/7186
Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-11-06 16:22:18 +01:00
Tomas Krizek
1d190092d3
ipatests: collect logs for external_ca test suite
Since test_external_ca isn't using the multihost framework,
logs collection has to be set up explicitly.

Signed-off-by: Tomas Krizek <tkrizek@redhat.com>
Reviewed-By: Felipe Barreto <fbarreto@redhat.com>
2017-11-06 14:05:25 +01:00
Stanislav Laznicka
4cc9451271 x509: remove subject_base() function
The x509.subject_base() function is only used in tests. During
the recent certificate refactoring, we had to get rid of the
ipalib.x509 import from the module scope so that there were no
circular dependecies and add it exactly to this funcion which
is not used in the production code.

Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2017-11-01 07:55:04 +01:00
Stanislav Laznicka
c9265a7b05 x509: remove the strip_header() function
We don't need the strip_header() function, to load an unknown
x509 certificate, load_unknown_x509_certificate() should be used.

Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2017-11-01 07:55:04 +01:00
Stanislav Laznicka
71a8026496
py3: pass raw entries to LDIFWriter
LDIFWriter.unparse() expects the scalar values of the attributes
of the entries to be bytes as it applies a byte regular expression
to check whether to base64-encode the values or not. Previously,
we were passing the scalar attribute values as strings which
was breaking the LDIFWriter.unparse() exectution.

https://pagure.io/freeipa/issue/7131

Reviewed-By: Felipe Barreto <fbarreto@redhat.com>
2017-10-26 12:43:47 +02:00
Stanislav Laznicka
0d7daf0495 Remove pkcs10 module contents
This removes pkcs10 module contents and adds a warning message
about its future removal.

https://pagure.io/freeipa/issue/7131
2017-10-25 09:46:41 +02:00
Stanislav Laznicka
f350b5698a Add tests for CertificateSigningRequest
https://pagure.io/freeipa/issue/7131
2017-10-25 09:44:37 +02:00
Tomas Krizek
be6f1a67cb
ipatests: set default 389-ds log level to 0
During integration tests, the log level of 8192 (replication debugging)
was excessive and made reading 389-ds logs very hard without providing
any useful information.

Part of: https://pagure.io/freeipa/issue/7162
Signed-off-by: Tomas Krizek <tkrizek@redhat.com>
Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2017-10-23 18:13:36 +02:00
Felipe Barreto
be66eadb62
Fixing tox and pylint errors
Fixing import errors introduced by commits
icac3475a0454b730d6e5b2093c2e63d395acd387 and
0b7d9c5.

https://pagure.io/freeipa/issue/7132

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-10-23 18:11:30 +02:00
Christian Heimes
b29db07c3b Use os.path.isfile() and isdir()
Replace custom file_exists() and dir_exists() functions with proper
functions from Python's stdlib.

The change also gets rid of pylint's invalid bad-python3-import error,
https://github.com/PyCQA/pylint/issues/1565

Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-10-20 12:27:19 +02:00
Petr Čech
3a0410267f ipatests: Fix on logs collection
If the function `install_kra` or `install_ca` fails
on call `host.run_command(command, raiseonerr=raiseonerr)`
then the logs are not collected.

This situation is not optimal because we need to see what happend
during the debbuging the tests.

So, this patch solves this situation and it adds try--finally
construction.

https://pagure.io/freeipa/issue/7214

Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
2017-10-18 17:01:53 +02:00
Abhijeet Kasurde
c8dbd0cfbe
tests: correct usage of hostname in logger in tasks
This fix adds correct usage of host.hostname in logger.

Fixes: https://pagure.io/freeipa/issue/7190

Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2017-10-18 12:13:55 +02:00
Felipe Barreto
3822120077 Fixing param-{find,show} and output-{find,show} commands
Now, the criteria option is working for both commands
and the commands are able to handle with wrong input values.

https://pagure.io/freeipa/issue/7134

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
2017-10-17 13:42:11 +02:00
David Kupka
53abf0105b
tests: Add LDAP URI to ldappasswd explicitly
Tests should always rely on api.env.* values when possible.
Without this running the tests remotely can result in errors such
as ldap{search,modify,passwd} attempting to connect to the
wrong URI and failing.

https://fedorahosted.org/freeipa/ticket/6622

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2017-10-13 17:03:23 +02:00
Michal Reznik
a2a6cf381e tests: add host zone with overlap
This patch is mainly for test_forced_client_reenrolment suite
where when we are not in control of our client DNS we create an
overlap zone in order to get the host records updated. This also
sets resolv.conf before every ipa-client-install to the ipa master.

https://pagure.io/freeipa/issue/7124

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Milan Kubik <mkubik@redhat.com>
2017-10-11 13:06:57 +02:00
Michal Reznik
3b5e979334 tests_py3: decode get_file_contents() result
When running tests in python3 we get bytes object instead of
bytestring from get_file_contents() and when passing it to
run_command() we later fail on concatenation in shell_quote().

https://pagure.io/freeipa/issue/7131

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2017-10-06 09:22:37 +02:00
Stanislav Laznicka
af1b8513ab Remove the message attribute from exceptions
This is causing python2 tests print ugly warnings about the
deprecation of the `message` attribute in python2.6.

https://pagure.io/freeipa/issue/7131

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2017-10-06 09:19:46 +02:00
Michal Reznik
f2b32759b9 test_caless: add caless to external CA test
Add caless to external CA test as the suite is currently
missing one.

https://pagure.io/freeipa/issue/7155

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-10-04 10:18:11 +02:00
Fraser Tweedale
d43cf35cca Add tests for external CA profile specifiers
Part of: https://pagure.io/freeipa/issue/6858

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2017-10-04 10:09:18 +02:00
Michal Reznik
7902fc9a06 test_external_ca: switch to python-cryptography
Switch external CA generation from certutil to python-cryptography
as this way of handling the certificates should be more readable,
maintainable and extendable (e.g. extensions handling).

Also as external CA is now a separate module we can import it and
use elsewhere.

https://pagure.io/freeipa/issue/7154

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
2017-09-27 11:51:20 +02:00
Fraser Tweedale
ee87b66bd3
py3: fix pkcs7 file processing
https://pagure.io/freeipa/issue/7131

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2017-09-22 11:57:15 +02:00
Alexander Bokovoy
8661611d3e OTP import: support hash names with HMAC- prefix
Refactor convertHashName() method to accept hash names prefixed with
HMAC- or any other prefix. Extending the method should be easier in
future.

Add tests proposed by Rob Crittenden to make sure we don't regress
with expected behavior of convertHashName().

Fixes https://pagure.io/freeipa/issue/7146

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2017-09-18 11:37:31 +02:00
Stanislav Laznicka
c8161fc40c certmap testing: fix wrong cert construction
`bytes` instances have no `.format()`, we can simply base64 decode
the certificate and load it as DER instead.

https://pagure.io/freeipa/issue/7131

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2017-09-14 14:06:09 +02:00
Stanislav Laznicka
fab589d7f5 pylint: disable __hash__ for some classes
pylint requires all classes implementing __eq__ to also implement
__hash__. We disable hashing for the classes that miss the ability,
should they ever be required to use it, it can be implemented then.

https://pagure.io/freeipa/issue/6874

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2017-09-08 15:42:07 +02:00
Stanislav Laznicka
f2701f3a0b pylint: make unsupported-assignment-operation check local
unsupported-assignment-operation is useful at times, make it only
local, not global.

https://pagure.io/freeipa/issue/6874

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2017-09-08 15:42:07 +02:00
Florence Blanc-Renaud
a077c705fe
Fix ipa config-mod --ca-renewal-master
commit bddb90f38a added the support for
multivalued server attributes (for pkinit_server_server), but this
introduced an API change where the setter and getter of ServerAttribute
are expecting list of values.

When a SingleValuedServerAttribute is used, we need to convert one elem
into a list containing this elem and vice-versa, so that the ipa config-mod
and ipa config_show APIs are not modified.

https://pagure.io/freeipa/issue/7120

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
2017-09-05 14:13:46 +02:00
Nathaniel McCallum
bc05ab9922
ipa-otptoken-import: Make PBKDF2 refer to the pkcs5 namespace
For some unknown reason, when I wrote the ipa-otptoken-import script
I used bad input data which had the PBKDF2 parameters in the wrong
XML namespace. I have corrected this input data to match RFC 6030.

https://pagure.io/freeipa/issue/7035

Signed-off-by: Nathaniel McCallum <npmccallum@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-09-01 10:50:34 +02:00
Tomas Krizek
4028f1aebb
ipatests: collect log after ipa-ca-install
Make sure logs are collected after calling ipa-ca-install command.

Related: https://pagure.io/freeipa/issue/7060

Signed-off-by: Tomas Krizek <tkrizek@redhat.com>
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-08-31 13:41:27 +02:00
David Kupka
bda3dd722b
tests: certmap: Add test for user-{add,remove}-certmap
https://pagure.io/freeipa/issue/7105

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2017-08-18 11:40:21 +02:00
David Kupka
7bce62d5d4
tests: tracker: Add CertmapdataMixin tracker
https://pagure.io/freeipa/issue/7105

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2017-08-18 11:40:21 +02:00
David Kupka
e574f5d65e
tests: certmap: Add test for certmapconfig-{mod,show}
https://pagure.io/freeipa/issue/7105

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2017-08-18 11:40:21 +02:00
David Kupka
0ccde44501
tests: tracker: Add CertmapconfigTracker to tests certmapconfig-* commands
https://pagure.io/freeipa/issue/7105

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2017-08-18 11:40:21 +02:00
David Kupka
eabd397154
tests: certmap: Test permissions for certmap
https://pagure.io/freeipa/issue/7105

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2017-08-18 11:40:21 +02:00
David Kupka
c6a43ffcad
tests: certmap: Add basic tests for certmaprule commands
https://pagure.io/freeipa/issue/7105

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2017-08-18 11:40:21 +02:00
David Kupka
aee200816e
tests: tracker: Add CertmapTracker for testing certmap-* commands
https://pagure.io/freeipa/issue/7105

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2017-08-18 11:40:21 +02:00
David Kupka
3113bfb0cf
tests: tracker: Add ConfigurationTracker to test *config-{mod,show} commands
https://pagure.io/freeipa/issue/7105

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2017-08-18 11:40:21 +02:00
David Kupka
7b015a2e76
tests: tracker: Add EnableTracker to test *-{enable,disable} commands
https://pagure.io/freeipa/issue/7105

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2017-08-18 11:40:21 +02:00
David Kupka
ac7712c93e
tests: tracker: Split Tracker into one-purpose Trackers
There are multiple types of entries and objects accessible in API and not all
of them have the same set methods. Spliting Tracker into multiple trackers
should reflect this better.

https://pagure.io/freeipa/issue/7105

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2017-08-18 11:40:21 +02:00
Michal Reznik
a3c99367bf
test_caless: add SAN dNSName extensions for wildcard tests
It may happen that FQDN does not match with the domain mapped to
the host. In this case we add wildcard for both domains.

https://pagure.io/freeipa/issue/7100

Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
2017-08-11 13:53:44 +02:00
Abhijeet Kasurde
8d3924dc98
Vault testcase improvement
* Collect logs for install KRA

Related: https://pagure.io/freeipa/issue/7098

Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-08-11 12:13:21 +02:00
Michal Reznik
1ff356241c
test_caless: add replica ca-less to ca-full test (master caless)
Add replica ca-less to ca-full test when master stays caless. Cover
Pagure issue: https://pagure.io/freeipa/issue/6226

https://pagure.io/freeipa/issue/7086

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
2017-08-11 12:04:32 +02:00