From de2032487c73151e13812db78866ddd85d0f541c Mon Sep 17 00:00:00 2001

From: Rob Crittenden <rcritten@redhat.com>

Date: Mon, 28 Jun 2021 16:43:11 -0400

Subject: [PATCH] Allow for HIDDEN_SERVICE when checking ADTRUST service

If the host is a trust controller then the ADTRUST service

must be enabled. This is defined as both ENABLED_SERVICE and

HIDDEN_SERVICE.

https://github.com/freeipa/freeipa-healthcheck/issues/217

Signed-off-by: Rob Crittenden <rcritten@redhat.com>

---

 src/ipahealthcheck/ipa/trust.py |  6 ++--

 tests/test_ipa_trust.py         | 54 ++++++++++++++++++---------------

 2 files changed, 33 insertions(+), 27 deletions(-)

diff --git a/src/ipahealthcheck/ipa/trust.py b/src/ipahealthcheck/ipa/trust.py

index 162a64c..27a2c86 100644

--- a/src/ipahealthcheck/ipa/trust.py

+++ b/src/ipahealthcheck/ipa/trust.py

@@ -23,9 +23,9 @@ except ImportError:

     # be skipped

     pass

 try:

-    from ipaserver.masters import ENABLED_SERVICE

+    from ipaserver.masters import ENABLED_SERVICE, HIDDEN_SERVICE

 except ImportError:

-    from ipaserver.install.service import ENABLED_SERVICE

+    from ipaserver.install.service import ENABLED_SERVICE, HIDDEN_SERVICE

 try:

     from ipapython.ipaldap import realm_to_serverid

 except ImportError:

@@ -476,7 +476,7 @@ class IPATrustControllerServiceCheck(IPAPlugin):

             configs = entry.get('ipaconfigstring', [])

             enabled = False

             for config in configs:

-                if config == ENABLED_SERVICE:

+                if config in [ENABLED_SERVICE, HIDDEN_SERVICE]:

                     enabled = True

                     break

diff --git a/tests/test_ipa_trust.py b/tests/test_ipa_trust.py

index 5eca9b5..c314b70 100644

--- a/tests/test_ipa_trust.py

+++ b/tests/test_ipa_trust.py

@@ -28,6 +28,11 @@ from ipahealthcheck.ipa.trust import (IPATrustAgentCheck,

 from ipalib import errors

 from ipapython.dn import DN

 from ipapython.ipaldap import LDAPClient, LDAPEntry

+try:

+    from ipaserver.masters import ENABLED_SERVICE, HIDDEN_SERVICE

+except ImportError:

+    from ipaserver.install.service import ENABLED_SERVICE, HIDDEN_SERVICE

+

 try:

     from ipapython.ipaldap import realm_to_serverid

@@ -795,31 +800,32 @@ class TestControllerService(BaseTest):

         # Zero because the call was skipped altogether

         assert len(self.results) == 0

-    def test_principal_ok(self):

+    def test_service_enabled(self):

         service_dn = DN(('cn', 'ADTRUST'))

-        attrs = {

-            'ipaconfigstring': ['enabledService'],

-        }

-        fake_conn = LDAPClient('ldap://localhost', no_schema=True)

-        ldapentry = LDAPEntry(fake_conn, service_dn)

-        for attr, values in attrs.items():

-            ldapentry[attr] = values

-

-        framework = object()

-        registry.initialize(framework, config.Config)

-        registry.trust_controller = True

-        f = IPATrustControllerServiceCheck(registry)

-

-        f.conn = mock_ldap(ldapentry)

-        self.results = capture_results(f)

-

-        assert len(self.results) == 1

-

-        result = self.results.results[0]

-        assert result.result == constants.SUCCESS

-        assert result.source == 'ipahealthcheck.ipa.trust'

-        assert result.check == 'IPATrustControllerServiceCheck'

-        assert result.kw.get('key') == 'ADTRUST'

+        for type in [ENABLED_SERVICE, HIDDEN_SERVICE]:

+            attrs = {

+                'ipaconfigstring': [type],

+            }

+            fake_conn = LDAPClient('ldap://localhost', no_schema=True)

+            ldapentry = LDAPEntry(fake_conn, service_dn)

+            for attr, values in attrs.items():

+                ldapentry[attr] = values

+

+            framework = object()

+            registry.initialize(framework, config.Config)

+            registry.trust_controller = True

+            f = IPATrustControllerServiceCheck(registry)

+

+            f.conn = mock_ldap(ldapentry)

+            self.results = capture_results(f)

+

+            assert len(self.results) == 1

+

+            result = self.results.results[0]

+            assert result.result == constants.SUCCESS

+            assert result.source == 'ipahealthcheck.ipa.trust'

+            assert result.check == 'IPATrustControllerServiceCheck'

+            assert result.kw.get('key') == 'ADTRUST'

     def test_principal_fail(self):

         service_dn = DN(('cn', 'ADTRUST'))

-- 

2.31.1