Rob Crittenden 19d5b3b621 Return a copy of cached entries, only with requested attributes ... Some plugins, notably dns, modifies a returned entry in order to compare it to the user-provided info (e.g. dnsrecord-del). This modification was done on the cached entry directly rather than a copy which caused unexpected results, mostly EmptyResult because the cached entry was changed directly so the next get_entry returned the same modified entry. In addition, on a hit in the LDAP cache the entire cached entry was returned regardless of what attributes were requested. The automember condition add/remove calls only request the inclusive/exclusive rule attributes and loop over the returned values to look for duplicates. This was failing because the queried entry contains attributes that the candidate entry does not contain. The automember code is: old_entry = ldap.get_entry(dn, [attr]) for regex in old_entry.keys(): if not isinstance(entry_attrs[regex], (list, tuple)): old_entry, returned from the cache, contained objectclass, cn, description, etc. which don't exist in the candidate entry so entry_attrs[regex] threw a KeyError. To return a copy of the entry and requested attributes on a search HIT. Also be more careful when storing the attributes in the cache entry. The returned attributes may not match the requested. So store the attributes we actually have. This issue was exposed by Ansible which maintains a larger and longer-lived cache because commands are executed in the server context one after another, giving the cache a chance to build up. Adjust the expected test results as well. In test_get_testuser() the first request asks for all attributes (default) so ensure that is successful since a user_add gets all attributes in the post_callback. Next request a subset of the attributes which is also a hit and confirm that only those requested were returned. https://pagure.io/freeipa/issue/8897 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Stanislav Levin <slev@altlinux.org> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>		2021-06-29 14:55:50 +03:00
..
__init__.py	Make an ipa-tests package	2013-06-17 19:22:50 +02:00
test_certdb.py	ipatests: Update NSSDatabase DBM test on non-DBM-capable installs	2021-01-29 18:06:15 +01:00
test_cookie.py	handle Y2038 in timestamp to datetime conversions	2020-06-25 09:18:02 +03:00
test_directivesetter.py	Add option to remove lines from a file	2019-04-02 19:35:38 +02:00
test_dn.py	pytest: Migrate unittest/nose to Pytest fixtures	2020-02-12 18:08:32 +02:00
test_dnsutil.py	Remove invalid test case for DNS SRV priority	2021-01-09 16:41:03 +01:00
test_ipautil.py	Add helper for poll/sleep loops with timeout	2020-09-30 09:52:08 +02:00
test_ipavalidate.py	pytest: Migrate unittest/nose to Pytest fixtures	2020-02-12 18:08:32 +02:00
test_kerberos.py	Sprinkle raw strings across the code base	2018-09-27 10:23:03 +02:00
test_keyring.py	ipatests: Skip keyring tests on containerized platforms	2020-08-07 17:49:31 +03:00
test_ldap_cache.py	Return a copy of cached entries, only with requested attributes	2021-06-29 14:55:50 +03:00
test_session_storage.py	pytest: Migrate xunit-style setups to Pytest fixtures	2020-02-12 18:08:32 +02:00
test_ssh.py	ipatests: add test for multiple permitopen entries in SSH keys	2021-03-29 10:06:07 +03:00