|
 |
1079a7 |
From 2e70535f74e7d9dd76e728eca1119ce522fd138a Mon Sep 17 00:00:00 2001
|
|
|
1079a7 |
From: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
1079a7 |
Date: Tue, 15 Mar 2022 11:39:46 +0200
|
|
|
1079a7 |
Subject: [PATCH] test_krbtpolicy: skip SPAKE-related tests in FIPS mode
|
|
|
1079a7 |
|
|
|
1079a7 |
SPAKE is based on the crypto primitives which are not FIPS compliant
|
|
|
1079a7 |
yet. This means that in FIPS mode use of 'hardened' authentication
|
|
|
1079a7 |
indicator is not possible. Skip corresponding tests in FIPS mode.
|
|
|
1079a7 |
|
|
|
1079a7 |
Related: https://pagure.io/freeipa/issue/9119
|
|
|
1079a7 |
|
|
|
1079a7 |
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
1079a7 |
Reviewed-By: Francisco Trivino <ftrivino@redhat.com>
|
|
|
1079a7 |
---
|
|
|
1079a7 |
ipatests/test_integration/test_krbtpolicy.py | 6 ++++++
|
|
|
1079a7 |
1 file changed, 6 insertions(+)
|
|
|
1079a7 |
|
|
|
1079a7 |
diff --git a/ipatests/test_integration/test_krbtpolicy.py b/ipatests/test_integration/test_krbtpolicy.py
|
|
|
1079a7 |
index 9489fbc97b7836aecf491b57627f254d4849eb56..eae16247bdfb195c1d91209cf2d11eac4c25018f 100644
|
|
|
1079a7 |
--- a/ipatests/test_integration/test_krbtpolicy.py
|
|
|
1079a7 |
+++ b/ipatests/test_integration/test_krbtpolicy.py
|
|
|
1079a7 |
@@ -105,6 +105,9 @@ class TestPWPolicy(IntegrationTest):
|
|
|
1079a7 |
|
|
|
1079a7 |
def test_krbtpolicy_password_and_hardended(self):
|
|
|
1079a7 |
"""Test a pwd and hardened kerberos ticket policy with 10min tickets"""
|
|
|
1079a7 |
+ if self.master.is_fips_mode:
|
|
|
1079a7 |
+ pytest.skip("SPAKE pre-auth is not compatible with FIPS mode")
|
|
|
1079a7 |
+
|
|
|
1079a7 |
master = self.master
|
|
|
1079a7 |
master.run_command(['ipa', 'user-mod', USER1,
|
|
|
1079a7 |
'--user-auth-type', 'password',
|
|
|
1079a7 |
@@ -133,6 +136,9 @@ class TestPWPolicy(IntegrationTest):
|
|
|
1079a7 |
|
|
|
1079a7 |
def test_krbtpolicy_hardended(self):
|
|
|
1079a7 |
"""Test a hardened kerberos ticket policy with 30min tickets"""
|
|
|
1079a7 |
+ if self.master.is_fips_mode:
|
|
|
1079a7 |
+ pytest.skip("SPAKE pre-auth is not compatible with FIPS mode")
|
|
|
1079a7 |
+
|
|
|
1079a7 |
master = self.master
|
|
|
1079a7 |
master.run_command(['ipa', 'user-mod', USER1,
|
|
|
1079a7 |
'--user-auth-type', 'hardened'])
|
|
|
1079a7 |
--
|
|
|
1079a7 |
2.34.1
|
|
|
1079a7 |
|