|
 |
7e1b55 |
From 25a4acf3ad5964eacddbcb83ddf9f84432968918 Mon Sep 17 00:00:00 2001
|
|
|
7e1b55 |
From: Anuja More <amore@redhat.com>
|
|
|
7e1b55 |
Date: Thu, 22 Jul 2021 14:55:50 +0530
|
|
|
7e1b55 |
Subject: [PATCH] ipatests: Test for OTP when the LDAP connection timed out.
|
|
|
7e1b55 |
|
|
|
7e1b55 |
Test to verify that when the idle timeout is exceeded (30s idle,
|
|
|
7e1b55 |
60s sleep) then the ipa-otpd process should exit without error.
|
|
|
7e1b55 |
|
|
|
7e1b55 |
Related : https://pagure.io/freeipa/issue/6587
|
|
|
7e1b55 |
|
|
|
7e1b55 |
Signed-off-by: Anuja More <amore@redhat.com>
|
|
|
7e1b55 |
Reviewed-By: Mohammad Rizwan <myusuf@redhat.com>
|
|
|
7e1b55 |
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
|
|
|
7e1b55 |
---
|
|
|
7e1b55 |
ipatests/test_integration/test_otp.py | 56 +++++++++++++++++++++++++++
|
|
|
7e1b55 |
1 file changed, 56 insertions(+)
|
|
|
7e1b55 |
|
|
|
7e1b55 |
diff --git a/ipatests/test_integration/test_otp.py b/ipatests/test_integration/test_otp.py
|
|
|
7e1b55 |
index b2e65af1b..fd55898ca 100644
|
|
|
7e1b55 |
--- a/ipatests/test_integration/test_otp.py
|
|
|
7e1b55 |
+++ b/ipatests/test_integration/test_otp.py
|
|
|
7e1b55 |
@@ -20,6 +20,7 @@ from cryptography.hazmat.primitives.twofactor.totp import TOTP
|
|
|
7e1b55 |
from ipatests.test_integration.base import IntegrationTest
|
|
|
7e1b55 |
from ipaplatform.paths import paths
|
|
|
7e1b55 |
from ipatests.pytest_ipa.integration import tasks
|
|
|
7e1b55 |
+from ipapython.dn import DN
|
|
|
7e1b55 |
|
|
|
7e1b55 |
|
|
|
7e1b55 |
PASSWORD = "DummyPassword123"
|
|
|
7e1b55 |
@@ -309,3 +310,58 @@ class TestOTPToken(IntegrationTest):
|
|
|
7e1b55 |
master.run_command(['ipa', 'user-del', USER2])
|
|
|
7e1b55 |
self.master.run_command(['semanage', 'login', '-D'])
|
|
|
7e1b55 |
sssd_conf_backup.restore()
|
|
|
7e1b55 |
+
|
|
|
7e1b55 |
+ @pytest.fixture
|
|
|
7e1b55 |
+ def setup_otp_nsslapd(self):
|
|
|
7e1b55 |
+ # setting nsslapd-idletimeout
|
|
|
7e1b55 |
+ new_limit = 30
|
|
|
7e1b55 |
+ conn = self.master.ldap_connect()
|
|
|
7e1b55 |
+ dn = DN(('cn', 'config'))
|
|
|
7e1b55 |
+ entry = conn.get_entry(dn) # pylint: disable=no-member
|
|
|
7e1b55 |
+ orig_limit = entry.single_value.get('nsslapd-idletimeout')
|
|
|
7e1b55 |
+ ldap_query = textwrap.dedent("""
|
|
|
7e1b55 |
+ dn: cn=config
|
|
|
7e1b55 |
+ changetype: modify
|
|
|
7e1b55 |
+ replace: nsslapd-idletimeout
|
|
|
7e1b55 |
+ nsslapd-idletimeout: {limit}
|
|
|
7e1b55 |
+ """)
|
|
|
7e1b55 |
+ tasks.ldapmodify_dm(self.master, ldap_query.format(limit=new_limit))
|
|
|
7e1b55 |
+ # Be sure no services are running and failed units
|
|
|
7e1b55 |
+ self.master.run_command(['killall', 'ipa-otpd'], raiseonerr=False)
|
|
|
7e1b55 |
+ check_services = self.master.run_command(
|
|
|
7e1b55 |
+ ['systemctl', 'list-units', '--state=failed']
|
|
|
7e1b55 |
+ )
|
|
|
7e1b55 |
+ assert "0 loaded units listed" in check_services.stdout_text
|
|
|
7e1b55 |
+ assert "ipa-otpd" not in check_services.stdout_text
|
|
|
7e1b55 |
+ yield
|
|
|
7e1b55 |
+ # cleanup
|
|
|
7e1b55 |
+ tasks.ldapmodify_dm(self.master, ldap_query.format(limit=orig_limit))
|
|
|
7e1b55 |
+
|
|
|
7e1b55 |
+ def test_check_otpd_after_idle_timeout(self, setup_otp_nsslapd):
|
|
|
7e1b55 |
+ """Test for OTP when the LDAP connection timed out.
|
|
|
7e1b55 |
+
|
|
|
7e1b55 |
+ Test for : https://pagure.io/freeipa/issue/6587
|
|
|
7e1b55 |
+
|
|
|
7e1b55 |
+ ipa-otpd was exiting with failure when LDAP connection timed out.
|
|
|
7e1b55 |
+ Test to verify that when the nsslapd-idletimeout is exceeded (30s idle,
|
|
|
7e1b55 |
+ 60s sleep) then the ipa-otpd process should exit without error.
|
|
|
7e1b55 |
+ """
|
|
|
7e1b55 |
+ since = time.strftime('%H:%M:%S')
|
|
|
7e1b55 |
+ tasks.kinit_admin(self.master)
|
|
|
7e1b55 |
+ otpuid, totp = add_otptoken(self.master, USER, otptype="totp")
|
|
|
7e1b55 |
+ try:
|
|
|
7e1b55 |
+ # kinit with OTP auth
|
|
|
7e1b55 |
+ otpvalue = totp.generate(int(time.time())).decode("ascii")
|
|
|
7e1b55 |
+ kinit_otp(self.master, USER, password=PASSWORD, otp=otpvalue)
|
|
|
7e1b55 |
+ time.sleep(60)
|
|
|
7e1b55 |
+ failed_services = self.master.run_command(
|
|
|
7e1b55 |
+ ['systemctl', 'list-units', '--state=failed']
|
|
|
7e1b55 |
+ )
|
|
|
7e1b55 |
+ assert "ipa-otpd" not in failed_services.stdout_text
|
|
|
7e1b55 |
+ cmd_jornalctl = self.master.run_command(
|
|
|
7e1b55 |
+ ['journalctl', '--since={}'.format(since)]
|
|
|
7e1b55 |
+ )
|
|
|
7e1b55 |
+ regex = r".*ipa-otpd@.*\sSucceeded"
|
|
|
7e1b55 |
+ assert re.search(regex, cmd_jornalctl.stdout_text)
|
|
|
7e1b55 |
+ finally:
|
|
|
7e1b55 |
+ del_otptoken(self.master, otpuid)
|
|
|
7e1b55 |
--
|
|
|
7e1b55 |
2.31.1
|
|
|
7e1b55 |
|