Skip to content

Commit 8b0071c

Browse files
aborah-sudojakub-vavra-cz
aborah-sudo
authored and
jakub-vavra-cz
committed
Tests: Handle SELinux in proxy provider tests
Tests using nslcd fail under SELinux enforcing due to missing policies for test-only nss-pam-ldapd configuration. Add context manager to temporarily set permissive mode for affected tests. Reviewed-by: Jakub Vávra <jvavra@redhat.com>
1 parent 6afffac commit 8b0071c

File tree

1 file changed

+128
-122
lines changed

1 file changed

+128
-122
lines changed

‎src/tests/system/tests/test_proxy.py‎

Lines changed: 128 additions & 122 deletions
Original file line numberDiff line numberDiff line change
@@ -28,14 +28,15 @@ def test_proxy__lookup_and_authenticate_user_using_pam_ldap_and_nslcd(client: Cl
2828
2. User logged in.
2929
:customerscenario: True
3030
"""
31-
client.sssd.common.proxy("ldap", ["id", "auth", "chpass"], server_hostname=ldap.host.hostname)
32-
client.sssd.svc.restart("nslcd")
33-
client.sssd.restart()
34-
ou_users = ldap.ou("users").add()
35-
user = ldap.user("user-1", basedn=ou_users).add(uid=10001, gid=10001, password="Secret123")
31+
with client.host.selinux_permissive_for_test():
32+
client.sssd.common.proxy("ldap", ["id", "auth", "chpass"], server_hostname=ldap.host.hostname)
33+
client.sssd.svc.restart("nslcd")
34+
client.sssd.restart()
35+
ou_users = ldap.ou("users").add()
36+
user = ldap.user("user-1", basedn=ou_users).add(uid=10001, gid=10001, password="Secret123")
3637

37-
assert client.tools.id(user.name) is not None, "User not found!"
38-
assert client.auth.ssh.password(user.name, password="Secret123"), "User login failed!"
38+
assert client.tools.id(user.name) is not None, "User not found!"
39+
assert client.auth.ssh.password(user.name, password="Secret123"), "User login failed!"
3940

4041

4142
@pytest.mark.importance("low")
@@ -56,17 +57,18 @@ def test_proxy__lookup_user_using_pam_ldap_and_nslcd_with_proxy_fast_alias_enabl
5657
2. No error messages in log.
5758
:customerscenario: True
5859
"""
59-
client.sssd.common.proxy("ldap", ["id", "auth", "chpass"], server_hostname=ldap.host.hostname)
60-
client.sssd.domain["proxy_fast_alias"] = "True"
61-
client.sssd.svc.restart("nslcd")
62-
client.sssd.restart()
63-
ou_users = ldap.ou("users").add()
64-
user = ldap.user("user-1", basedn=ou_users).add(uid=10001, gid=10001, password="Secret123")
60+
with client.host.selinux_permissive_for_test():
61+
client.sssd.common.proxy("ldap", ["id", "auth", "chpass"], server_hostname=ldap.host.hostname)
62+
client.sssd.domain["proxy_fast_alias"] = "True"
63+
client.sssd.svc.restart("nslcd")
64+
client.sssd.restart()
65+
ou_users = ldap.ou("users").add()
66+
user = ldap.user("user-1", basedn=ou_users).add(uid=10001, gid=10001, password="Secret123")
6567

66-
assert client.tools.id(user.name) is not None, "User not found!"
68+
assert client.tools.id(user.name) is not None, "User not found!"
6769

68-
log = client.fs.read(client.sssd.logs.domain())
69-
assert "ldb_modify failed: [Invalid attribute syntax]" not in log, "'ldb_modify failed' message found in logs!"
70+
log = client.fs.read(client.sssd.logs.domain())
71+
assert "ldb_modify failed: [Invalid attribute syntax]" not in log, "'ldb_modify failed' message found in logs!"
7072

7173

7274
@pytest.mark.importance("low")
@@ -90,40 +92,41 @@ def test_proxy__domain_separation_with_nslcd(client: Client, ldap: LDAP):
9092
3. Users are properly isolated between domains
9193
:customerscenario: False
9294
"""
93-
# Setup domains and users
94-
ou_domain1 = ldap.ou("domain1").add()
95-
user1 = ldap.user("user1", basedn=ou_domain1).add(uid=5000, gid=5000, password="Secret123")
96-
97-
ou_domain2 = ldap.ou("domain2").add()
98-
user2 = ldap.user("user2", basedn=ou_domain2).add(uid=5001, gid=5001, password="Secret123")
99-
100-
# Basic SSSD configuration (no domain separation needed here)
101-
client.sssd.common.proxy("ldap", ["id", "auth"], server_hostname=ldap.host.hostname)
102-
client.sssd.domain["use_fully_qualified_names"] = "True"
103-
client.sssd.svc.restart("nslcd")
104-
client.sssd.restart()
105-
106-
# Test domain1 configuration
107-
client.fs.append("/etc/nslcd.conf", "base ou=domain1,dc=ldap,dc=test\n", dedent=False)
108-
client.sssd.svc.restart("nslcd")
109-
110-
# Verify only domain1 user is visible
111-
assert client.tools.getent.passwd(f"{user1.name}@test") is not None
112-
assert client.tools.getent.passwd(f"{user2.name}@test") is None
113-
114-
# Test domain2 configuration
115-
client.sssd.svc.stop("nslcd")
116-
client.fs.sed(
117-
path="/etc/nslcd.conf",
118-
command="/base ou=domain1,dc=ldap,dc=test/c\\base ou=domain2,dc=ldap,dc=test",
119-
args=["-i"],
120-
)
121-
client.sssd.svc.restart("nslcd")
122-
client.sssd.restart(clean=True)
123-
124-
# Verify only domain2 user is visible
125-
assert client.tools.getent.passwd(f"{user2.name}@test") is not None
126-
assert client.tools.getent.passwd(f"{user1.name}@test") is None
95+
with client.host.selinux_permissive_for_test():
96+
# Setup domains and users
97+
ou_domain1 = ldap.ou("domain1").add()
98+
user1 = ldap.user("user1", basedn=ou_domain1).add(uid=5000, gid=5000, password="Secret123")
99+
100+
ou_domain2 = ldap.ou("domain2").add()
101+
user2 = ldap.user("user2", basedn=ou_domain2).add(uid=5001, gid=5001, password="Secret123")
102+
103+
# Basic SSSD configuration (no domain separation needed here)
104+
client.sssd.common.proxy("ldap", ["id", "auth"], server_hostname=ldap.host.hostname)
105+
client.sssd.domain["use_fully_qualified_names"] = "True"
106+
client.sssd.svc.restart("nslcd")
107+
client.sssd.restart()
108+
109+
# Test domain1 configuration
110+
client.fs.append("/etc/nslcd.conf", "base ou=domain1,dc=ldap,dc=test\n", dedent=False)
111+
client.sssd.svc.restart("nslcd")
112+
113+
# Verify only domain1 user is visible
114+
assert client.tools.getent.passwd(f"{user1.name}@test") is not None
115+
assert client.tools.getent.passwd(f"{user2.name}@test") is None
116+
117+
# Test domain2 configuration
118+
client.sssd.svc.stop("nslcd")
119+
client.fs.sed(
120+
path="/etc/nslcd.conf",
121+
command="/base ou=domain1,dc=ldap,dc=test/c\\base ou=domain2,dc=ldap,dc=test",
122+
args=["-i"],
123+
)
124+
client.sssd.svc.restart("nslcd")
125+
client.sssd.restart(clean=True)
126+
127+
# Verify only domain2 user is visible
128+
assert client.tools.getent.passwd(f"{user2.name}@test") is not None
129+
assert client.tools.getent.passwd(f"{user1.name}@test") is None
127130

128131

129132
@pytest.mark.importance("low")
@@ -146,25 +149,26 @@ def test_proxy__offline_authentication(client: Client, ldap: LDAP):
146149
3. Authentication continues to work in offline mode
147150
:customerscenario: False
148151
"""
149-
# Setup user
150-
ldap.user("testuser").add(uid=5000, gid=5000, password="Secret123")
152+
with client.host.selinux_permissive_for_test():
153+
# Setup user
154+
ldap.user("testuser").add(uid=5000, gid=5000, password="Secret123")
151155

152-
# Configure SSSD with credential caching
153-
client.sssd.common.proxy("ldap", ["id", "auth"], server_hostname=ldap.host.hostname)
154-
client.sssd.domain["cache_credentials"] = "True"
155-
client.sssd.restart()
156+
# Configure SSSD with credential caching
157+
client.sssd.common.proxy("ldap", ["id", "auth"], server_hostname=ldap.host.hostname)
158+
client.sssd.domain["cache_credentials"] = "True"
159+
client.sssd.restart()
156160

157-
# Initial online authentication
158-
assert client.auth.ssh.password("testuser", password="Secret123"), "Online auth failed"
161+
# Initial online authentication
162+
assert client.auth.ssh.password("testuser", password="Secret123"), "Online auth failed"
159163

160-
# Stop nslcd to simulate offline mode
161-
client.sssd.svc.stop("nslcd")
164+
# Stop nslcd to simulate offline mode
165+
client.sssd.svc.stop("nslcd")
162166

163-
# Verify offline authentication
164-
assert client.auth.ssh.password("testuser", password="Secret123"), "Offline auth failed"
167+
# Verify offline authentication
168+
assert client.auth.ssh.password("testuser", password="Secret123"), "Offline auth failed"
165169

166-
# Start nslcd
167-
client.sssd.svc.start("nslcd")
170+
# Start nslcd
171+
client.sssd.svc.start("nslcd")
168172

169173

170174
@pytest.mark.importance("low")
@@ -199,39 +203,40 @@ def test_proxy__case_preserving_handling(client: Client, ldap: LDAP):
199203
2. Authentication should succeed for all case variants
200204
:customerscenario: False
201205
"""
202-
# Setup
203-
ou_users = ldap.ou("users").add()
204-
ldap.user("TestUser", basedn=ou_users).add(uid=5003, gid=5003, password="Secret123", home="/home/TestUser")
205-
206-
# Configure SSSD with proxy provider
207-
client.sssd.common.proxy("ldap", ["id", "auth"], server_hostname=ldap.host.hostname)
208-
client.sssd.domain["case_sensitive"] = "Preserving"
209-
client.sssd.svc.restart("nslcd")
210-
client.sssd.restart()
211-
212-
client.fs.append(
213-
"/etc/nslcd.conf",
214-
"base dc=ldap,dc=test\n"
215-
"ignorecase yes\n"
216-
"validnames /^[a-z0-9._@$()]([a-z0-9._@$() ~-]*[a-z:0-9._@$()~-])?$/i\n",
217-
dedent=False,
218-
)
219-
client.sssd.svc.restart("nslcd")
220-
client.sssd.restart()
221-
222-
# Step 2: Test case preserving lookups
223-
# All variants should match but preserve original case in output
224-
for username in ["testuser", "TESTUSER", "TestUser"]:
225-
client.sssd.restart(clean=True)
226-
result = client.tools.getent.passwd(username)
227-
assert result is not None, f"User lookup failed for {username}"
228-
assert result.name == "TestUser", f"Username case not preserved for {username}"
229-
assert result.home == "/home/TestUser", f"Incorrect home directory for {username}"
230-
231-
# Step 3: Verify authentication with different case variants
232-
for username in ["testuser", "TESTUSER", "TestUser"]:
233-
client.sssd.restart(clean=True)
234-
assert client.auth.ssh.password(username, password="Secret123"), f"Authentication failed for {username}"
206+
with client.host.selinux_permissive_for_test():
207+
# Setup
208+
ou_users = ldap.ou("users").add()
209+
ldap.user("TestUser", basedn=ou_users).add(uid=5003, gid=5003, password="Secret123", home="/home/TestUser")
210+
211+
# Configure SSSD with proxy provider
212+
client.sssd.common.proxy("ldap", ["id", "auth"], server_hostname=ldap.host.hostname)
213+
client.sssd.domain["case_sensitive"] = "Preserving"
214+
client.sssd.svc.restart("nslcd")
215+
client.sssd.restart()
216+
217+
client.fs.append(
218+
"/etc/nslcd.conf",
219+
"base dc=ldap,dc=test\n"
220+
"ignorecase yes\n"
221+
"validnames /^[a-z0-9._@$()]([a-z0-9._@$() ~-]*[a-z:0-9._@$()~-])?$/i\n",
222+
dedent=False,
223+
)
224+
client.sssd.svc.restart("nslcd")
225+
client.sssd.restart()
226+
227+
# Step 2: Test case preserving lookups
228+
# All variants should match but preserve original case in output
229+
for username in ["testuser", "TESTUSER", "TestUser"]:
230+
client.sssd.restart(clean=True)
231+
result = client.tools.getent.passwd(username)
232+
assert result is not None, f"User lookup failed for {username}"
233+
assert result.name == "TestUser", f"Username case not preserved for {username}"
234+
assert result.home == "/home/TestUser", f"Incorrect home directory for {username}"
235+
236+
# Step 3: Verify authentication with different case variants
237+
for username in ["testuser", "TESTUSER", "TestUser"]:
238+
client.sssd.restart(clean=True)
239+
assert client.auth.ssh.password(username, password="Secret123"), f"Authentication failed for {username}"
235240

236241

237242
@pytest.mark.importance("low")
@@ -260,28 +265,29 @@ def test_proxy__case_insensitive_handling(client: Client, ldap: LDAP):
260265
3. Authentication succeeds for all case variants
261266
:customerscenario: False
262267
"""
263-
# Setup
264-
ou_users = ldap.ou("users").add()
265-
ldap.user("TestUser", basedn=ou_users).add(uid=1000, gid=1000, password="Secret123")
266-
267-
# Configure SSSD with proxy provider and case_sensitive=false
268-
client.sssd.common.proxy("ldap", ["id", "auth"], server_hostname=ldap.host.hostname)
269-
client.sssd.domain["case_sensitive"] = "false"
270-
271-
# Configure nslcd for case insensitive matching
272-
client.fs.append("/etc/nslcd.conf", "ignorecase yes\n", dedent=False)
273-
274-
client.sssd.svc.restart("nslcd")
275-
client.sssd.restart()
276-
277-
# Step 2: Test case normalization
278-
for username in ["testuser", "TESTUSER", "TestUser"]:
279-
client.sssd.restart(clean=True)
280-
result = client.tools.getent.passwd(username)
281-
assert result is not None, f"User lookup failed for {username}"
282-
assert result.name == "testuser", f"Username not normalized to lowercase for {username}"
283-
284-
# Step 3: Verify authentication with different case variants
285-
for username in ["testuser", "TESTUSER", "TestUser"]:
286-
client.sssd.restart(clean=True)
287-
assert client.auth.ssh.password(username, password="Secret123"), f"Authentication failed for {username}"
268+
with client.host.selinux_permissive_for_test():
269+
# Setup
270+
ou_users = ldap.ou("users").add()
271+
ldap.user("TestUser", basedn=ou_users).add(uid=1000, gid=1000, password="Secret123")
272+
273+
# Configure SSSD with proxy provider and case_sensitive=false
274+
client.sssd.common.proxy("ldap", ["id", "auth"], server_hostname=ldap.host.hostname)
275+
client.sssd.domain["case_sensitive"] = "false"
276+
277+
# Configure nslcd for case insensitive matching
278+
client.fs.append("/etc/nslcd.conf", "ignorecase yes\n", dedent=False)
279+
280+
client.sssd.svc.restart("nslcd")
281+
client.sssd.restart()
282+
283+
# Step 2: Test case normalization
284+
for username in ["testuser", "TESTUSER", "TestUser"]:
285+
client.sssd.restart(clean=True)
286+
result = client.tools.getent.passwd(username)
287+
assert result is not None, f"User lookup failed for {username}"
288+
assert result.name == "testuser", f"Username not normalized to lowercase for {username}"
289+
290+
# Step 3: Verify authentication with different case variants
291+
for username in ["testuser", "TESTUSER", "TestUser"]:
292+
client.sssd.restart(clean=True)
293+
assert client.auth.ssh.password(username, password="Secret123"), f"Authentication failed for {username}"

0 commit comments

Comments
 (0)