IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity
a1c690cc02
freeipa/tests/test_xmlrpc
History
Alexander Bokovoy dd296eec13 Add hbactest command. https://fedorahosted.org/freeipa/ticket/386 
HBAC rules control who can access what services on what hosts and from where.
You can use HBAC to control which users or groups on a source host can
access a service, or group of services, on a target host.

Since applying HBAC rules implies use of a production environment,
this plugin aims to provide simulation of HBAC rules evaluation without
having access to the production environment.

 Test user coming from source host to a service on a named host against
 existing enabled rules.

 ipa hbactest --user= --srchost= --host= --service=
              [--rules=rules-list] [--nodetail] [--enabled] [--disabled]

 --user, --srchost, --host, and --service are mandatory, others are optional.

 If --rules is specified simulate enabling of the specified rules and test
 the login of the user using only these rules.

 If --enabled is specified, all enabled HBAC rules will be added to simulation

 If --disabled is specified, all disabled HBAC rules will be added to simulation

 If --nodetail is specified, do not return information about rules matched/not matched.

 If both --rules and --enabled are specified, apply simulation to --rules _and_
 all IPA enabled rules.

 If no --rules specified, simulation is run against all IPA enabled rules.

EXAMPLES:

    1. Use all enabled HBAC rules in IPA database to simulate:
    $ ipa  hbactest --user=a1a --srchost=foo --host=bar --service=ssh
    --------------------
    Access granted: True
    --------------------
      notmatched: my-second-rule
      notmatched: my-third-rule
      notmatched: myrule
      matched: allow_all

    2. Disable detailed summary of how rules were applied:
    $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --nodetail
    --------------------
    Access granted: True
    --------------------

    3. Test explicitly specified HBAC rules:
    $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule
    ---------------------
    Access granted: False
    ---------------------
      notmatched: my-second-rule
      notmatched: myrule

    4. Use all enabled HBAC rules in IPA database + explicitly specified rules:
    $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule --enabled
    --------------------
    Access granted: True
    --------------------
      notmatched: my-second-rule
      notmatched: my-third-rule
      notmatched: myrule
      matched: allow_all

    5. Test all disabled HBAC rules in IPA database:
    $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --disabled
    ---------------------
    Access granted: False
    ---------------------
      notmatched: new-rule

    6. Test all disabled HBAC rules in IPA database + explicitly specified rules:
    $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --rules=my-second-rule,myrule --disabled
    ---------------------
    Access granted: False
    ---------------------
      notmatched: my-second-rule
      notmatched: my-third-rule
      notmatched: myrule

    7. Test all (enabled and disabled) HBAC rules in IPA database:
    $ ipa hbactest --user=a1a --srchost=foo --host=bar --service=ssh --enabled --disabled
    --------------------
    Access granted: True
    --------------------
      notmatched: my-second-rule
      notmatched: my-third-rule
      notmatched: myrule
      notmatched: new-rule
      matched: allow_all

Only rules existing in IPA database are tested. They may be in enabled or
disabled disabled state.

Specifying them through --rules option explicitly enables them only in
simulation run.

Specifying non-existing rules will not grant access and report non-existing
rules in output.
2011-07-28 18:01:44 -04:00
..
__init__.py Change FreeIPA license to GPLv3+ 2010-12-20 17:19:53 -05:00
objectclasses.py Optionally wait for 389-ds postop plugins to complete 2011-07-19 13:06:16 +02:00
test_attr.py Optionally wait for 389-ds postop plugins to complete 2011-07-19 13:06:16 +02:00
test_automount_plugin.py Don't leave dangling map if adding an indirect map fails 2011-07-27 00:02:28 -04:00
test_cert.py Change FreeIPA license to GPLv3+ 2010-12-20 17:19:53 -05:00
test_delegation_plugin.py Fix changing membergroup in a delegation. 2011-02-01 11:59:24 -05:00
test_dns_plugin.py Add new dnszone-find test 2011-07-18 09:50:23 +02:00
test_group_plugin.py Optionally wait for 389-ds postop plugins to complete 2011-07-19 13:06:16 +02:00
test_hbac_plugin.py Hide the HBAC access type attribute now that deny is deprecated. 2011-07-21 01:11:45 -04:00
test_hbacsvcgroup_plugin.py HBAC plugin inconsistent output 2011-02-16 10:39:16 -05:00
test_hbactest_plugin.py Add hbactest command. https://fedorahosted.org/freeipa/ticket/386 2011-07-28 18:01:44 -04:00
test_host_plugin.py Fix invalid issuer in unit tests 2011-07-27 20:56:16 -04:00
test_hostgroup_plugin.py Optionally wait for 389-ds postop plugins to complete 2011-07-19 13:06:16 +02:00
test_krbtpolicy.py Optionally wait for 389-ds postop plugins to complete 2011-07-19 13:06:16 +02:00
test_nesting.py Optionally wait for 389-ds postop plugins to complete 2011-07-19 13:06:16 +02:00
test_netgroup_plugin.py Optionally wait for 389-ds postop plugins to complete 2011-07-19 13:06:16 +02:00
test_passwd_plugin.py Display the entries that failed when deleting with --continue. 2011-01-10 10:32:10 -05:00
test_permission_plugin.py Permission rename test failing 2011-02-01 15:43:12 -05:00
test_privilege_plugin.py Rename permissions and privileges to be more readable. 2011-01-31 13:17:38 -05:00
test_pwpolicy.py Display the entries that failed when deleting with --continue. 2011-01-10 10:32:10 -05:00
test_replace.py Optionally wait for 389-ds postop plugins to complete 2011-07-19 13:06:16 +02:00
test_role_plugin.py Ticket 1485 - DN pairwise grouping 2011-07-21 00:29:38 -04:00
test_selfservice_plugin.py Change FreeIPA license to GPLv3+ 2010-12-20 17:19:53 -05:00
test_service_plugin.py Fix invalid issuer in unit tests 2011-07-27 20:56:16 -04:00
test_sudocmd_plugin.py Move sudo related data all under cn=sudo 2011-01-17 11:46:45 -05:00
test_sudocmdgroup_plugin.py Sudo command groups are not supposed to allow nesting. 2011-02-23 18:44:28 -05:00
test_sudorule_plugin.py With the external user/group management fixed, correct the unit tests. 2011-07-20 17:27:42 +02:00
test_user_plugin.py Optionally wait for 389-ds postop plugins to complete 2011-07-19 13:06:16 +02:00
xmlrpc_test.py Fix invalid issuer in unit tests 2011-07-27 20:56:16 -04:00