|
 |
b01884 |
From 858859187a1353cbaa893642cc7b27f9f644b18b Mon Sep 17 00:00:00 2001
|
|
|
b01884 |
From: François Cami <fcami@redhat.com>
|
|
|
b01884 |
Date: Nov 23 2018 09:54:46 +0000
|
|
|
b01884 |
Subject: Add a shared-vault-retrieve test
|
|
|
b01884 |
|
|
|
b01884 |
|
|
|
b01884 |
Add a shared-vault-retrieve test when:
|
|
|
b01884 |
* master has KRA installed
|
|
|
b01884 |
* replica has no KRA
|
|
|
b01884 |
This currently fails because of issue#7691
|
|
|
b01884 |
|
|
|
b01884 |
Related-to: https://pagure.io/freeipa/issue/7691
|
|
|
b01884 |
Signed-off-by: François Cami <fcami@redhat.com>
|
|
|
b01884 |
Reviewed-By: Christian Heimes <cheimes@redhat.com>
|
|
|
b01884 |
|
|
|
b01884 |
---
|
|
|
b01884 |
|
|
|
b01884 |
diff --git a/ipatests/test_integration/test_vault.py b/ipatests/test_integration/test_vault.py
|
|
|
b01884 |
index ea2591b..e5b3ad1 100644
|
|
|
b01884 |
--- a/ipatests/test_integration/test_vault.py
|
|
|
b01884 |
+++ b/ipatests/test_integration/test_vault.py
|
|
|
b01884 |
@@ -20,14 +20,17 @@ class TestInstallKRA(IntegrationTest):
|
|
|
b01884 |
|
|
|
b01884 |
vault_password = "password"
|
|
|
b01884 |
vault_data = "SSBsb3ZlIENJIHRlc3RzCg=="
|
|
|
b01884 |
+ vault_user = "vault_user"
|
|
|
b01884 |
+ vault_user_password = "vault_user_password"
|
|
|
b01884 |
vault_name_master = "ci_test_vault_master"
|
|
|
b01884 |
vault_name_master2 = "ci_test_vault_master2"
|
|
|
b01884 |
vault_name_master3 = "ci_test_vault_master3"
|
|
|
b01884 |
vault_name_replica_without_KRA = "ci_test_vault_replica_without_kra"
|
|
|
b01884 |
+ shared_vault_name_replica_without_KRA = ("ci_test_shared"
|
|
|
b01884 |
+ "_vault_replica_without_kra")
|
|
|
b01884 |
vault_name_replica_with_KRA = "ci_test_vault_replica_with_kra"
|
|
|
b01884 |
vault_name_replica_KRA_uninstalled = "ci_test_vault_replica_KRA_uninstalled"
|
|
|
b01884 |
|
|
|
b01884 |
-
|
|
|
b01884 |
@classmethod
|
|
|
b01884 |
def install(cls, mh):
|
|
|
b01884 |
tasks.install_master(cls.master, setup_kra=True)
|
|
|
b01884 |
@@ -89,6 +92,66 @@ class TestInstallKRA(IntegrationTest):
|
|
|
b01884 |
|
|
|
b01884 |
self._retrieve_secret([self.vault_name_replica_without_KRA])
|
|
|
b01884 |
|
|
|
b01884 |
+ def test_create_and_retrieve_shared_vault_replica_without_kra(self):
|
|
|
b01884 |
+ # create vault
|
|
|
b01884 |
+ self.replicas[0].run_command([
|
|
|
b01884 |
+ "ipa", "vault-add",
|
|
|
b01884 |
+ self.shared_vault_name_replica_without_KRA,
|
|
|
b01884 |
+ "--shared",
|
|
|
b01884 |
+ "--type", "standard",
|
|
|
b01884 |
+ ])
|
|
|
b01884 |
+
|
|
|
b01884 |
+ # archive secret
|
|
|
b01884 |
+ self.replicas[0].run_command([
|
|
|
b01884 |
+ "ipa", "vault-archive",
|
|
|
b01884 |
+ self.shared_vault_name_replica_without_KRA,
|
|
|
b01884 |
+ "--shared",
|
|
|
b01884 |
+ "--data", self.vault_data,
|
|
|
b01884 |
+ ])
|
|
|
b01884 |
+ time.sleep(WAIT_AFTER_ARCHIVE)
|
|
|
b01884 |
+
|
|
|
b01884 |
+ # add non-admin user
|
|
|
b01884 |
+ self.replicas[0].run_command([
|
|
|
b01884 |
+ 'ipa', 'user-add', self.vault_user,
|
|
|
b01884 |
+ '--first', self.vault_user,
|
|
|
b01884 |
+ '--last', self.vault_user,
|
|
|
b01884 |
+ '--password'],
|
|
|
b01884 |
+ stdin_text=self.vault_user_password)
|
|
|
b01884 |
+
|
|
|
b01884 |
+ # add it to vault
|
|
|
b01884 |
+ self.replicas[0].run_command([
|
|
|
b01884 |
+ "ipa", "vault-add-member",
|
|
|
b01884 |
+ self.shared_vault_name_replica_without_KRA,
|
|
|
b01884 |
+ "--shared",
|
|
|
b01884 |
+ "--users", self.vault_user,
|
|
|
b01884 |
+ ])
|
|
|
b01884 |
+
|
|
|
b01884 |
+ self.replicas[0].run_command([
|
|
|
b01884 |
+ 'kdestroy', '-A'])
|
|
|
b01884 |
+
|
|
|
b01884 |
+ user_kinit = "%s\n%s\n%s\n" % (self.vault_user_password,
|
|
|
b01884 |
+ self.vault_user_password,
|
|
|
b01884 |
+ self.vault_user_password)
|
|
|
b01884 |
+
|
|
|
b01884 |
+ self.replicas[0].run_command([
|
|
|
b01884 |
+ 'kinit', self.vault_user],
|
|
|
b01884 |
+ stdin_text=user_kinit)
|
|
|
b01884 |
+
|
|
|
b01884 |
+ # TODO: possibly refactor with:
|
|
|
b01884 |
+ # self._retrieve_secret([self.vault_name_replica_without_KRA])
|
|
|
b01884 |
+
|
|
|
b01884 |
+ self.replicas[0].run_command([
|
|
|
b01884 |
+ "ipa", "vault-retrieve",
|
|
|
b01884 |
+ "--shared",
|
|
|
b01884 |
+ self.shared_vault_name_replica_without_KRA,
|
|
|
b01884 |
+ "--out=test.txt"])
|
|
|
b01884 |
+
|
|
|
b01884 |
+ self.replicas[0].run_command([
|
|
|
b01884 |
+ 'kdestroy', '-A'])
|
|
|
b01884 |
+
|
|
|
b01884 |
+ tasks.kinit_admin(self.replicas[0])
|
|
|
b01884 |
+
|
|
|
b01884 |
+
|
|
|
b01884 |
def test_create_and_retrieve_vault_replica_with_kra(self):
|
|
|
b01884 |
|
|
|
b01884 |
# install KRA on replica
|
|
|
b01884 |
|
|
|
b01884 |
From d57d97ea7f911e18ac75d532e19833c4efaafa96 Mon Sep 17 00:00:00 2001
|
|
|
b01884 |
From: François Cami <fcami@redhat.com>
|
|
|
b01884 |
Date: Nov 23 2018 09:54:46 +0000
|
|
|
b01884 |
Subject: Add a "Find enabled services" ACI in 20-aci.update so that all users can find IPA servers and services. ACI suggested by Christian Heimes.
|
|
|
b01884 |
|
|
|
b01884 |
|
|
|
b01884 |
Fixes: https://pagure.io/freeipa/issue/7691
|
|
|
b01884 |
Signed-off-by: François Cami <fcami@redhat.com>
|
|
|
b01884 |
Reviewed-By: Christian Heimes <cheimes@redhat.com>
|
|
|
b01884 |
|
|
|
b01884 |
---
|
|
|
b01884 |
|
|
|
b01884 |
diff --git a/install/updates/20-aci.update b/install/updates/20-aci.update
|
|
|
b01884 |
index 184749d..7650cb4 100644
|
|
|
b01884 |
--- a/install/updates/20-aci.update
|
|
|
b01884 |
+++ b/install/updates/20-aci.update
|
|
|
b01884 |
@@ -36,6 +36,10 @@ remove:aci:(targetfilter="(objectclass=nsContainer)")(version 3.0; acl "Deny rea
|
|
|
b01884 |
dn: cn=masters,cn=ipa,cn=etc,$SUFFIX
|
|
|
b01884 |
add:aci:(targetfilter="(objectclass=nsContainer)")(targetattr="objectclass || cn")(version 3.0; acl "Read access to masters"; allow(read, search, compare) userdn = "ldap:///all";)
|
|
|
b01884 |
|
|
|
b01884 |
+# Allow users to discover enabled services
|
|
|
b01884 |
+dn: cn=masters,cn=ipa,cn=etc,$SUFFIX
|
|
|
b01884 |
+add:aci:(targetfilter = "(ipaConfigString=enabledService)")(targetattrs = "ipaConfigString")(version 3.0; acl "Find enabled services"; allow(read, search, compare) userdn = "ldap:///all";)
|
|
|
b01884 |
+
|
|
|
b01884 |
# Allow hosts to read masters service configuration
|
|
|
b01884 |
dn: cn=masters,cn=ipa,cn=etc,$SUFFIX
|
|
|
b01884 |
add:aci:(targetfilter = "(objectclass=nsContainer)")(targetattr = "ipaConfigString")(version 3.0; acl "Allow hosts to read masters service configuration"; allow(read, search, compare) userdn = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX";)
|
|
|
b01884 |
|