|
 |
ad1545 |
From 107e20a158c867a52eadb0d65982ce2f7f3ce699 Mon Sep 17 00:00:00 2001
|
|
|
ad1545 |
From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
|
|
|
ad1545 |
Date: Tue, 20 Nov 2018 17:05:30 +0100
|
|
|
ad1545 |
Subject: [PATCH] Add a shared-vault-retrieve test
|
|
|
ad1545 |
MIME-Version: 1.0
|
|
|
ad1545 |
Content-Type: text/plain; charset=UTF-8
|
|
|
ad1545 |
Content-Transfer-Encoding: 8bit
|
|
|
ad1545 |
|
|
|
ad1545 |
Add a shared-vault-retrieve test when:
|
|
|
ad1545 |
* master has KRA installed
|
|
|
ad1545 |
* replica has no KRA
|
|
|
ad1545 |
This currently fails because of issue#7691
|
|
|
ad1545 |
|
|
|
ad1545 |
Related-to: https://pagure.io/freeipa/issue/7691
|
|
|
ad1545 |
Signed-off-by: François Cami <fcami@redhat.com>
|
|
|
ad1545 |
Reviewed-By: Christian Heimes <cheimes@redhat.com>
|
|
|
ad1545 |
---
|
|
|
ad1545 |
ipatests/test_integration/test_vault.py | 65 ++++++++++++++++++++++++-
|
|
|
ad1545 |
1 file changed, 64 insertions(+), 1 deletion(-)
|
|
|
ad1545 |
|
|
|
ad1545 |
diff --git a/ipatests/test_integration/test_vault.py b/ipatests/test_integration/test_vault.py
|
|
|
ad1545 |
index 496ccb1bbdd06407e9b356ac210f639436312a22..c3465799ff933ae175684ade83b4bf276b921a96 100644
|
|
|
ad1545 |
--- a/ipatests/test_integration/test_vault.py
|
|
|
ad1545 |
+++ b/ipatests/test_integration/test_vault.py
|
|
|
ad1545 |
@@ -20,14 +20,17 @@ class TestInstallKRA(IntegrationTest):
|
|
|
ad1545 |
|
|
|
ad1545 |
vault_password = "password"
|
|
|
ad1545 |
vault_data = "SSBsb3ZlIENJIHRlc3RzCg=="
|
|
|
ad1545 |
+ vault_user = "vault_user"
|
|
|
ad1545 |
+ vault_user_password = "vault_user_password"
|
|
|
ad1545 |
vault_name_master = "ci_test_vault_master"
|
|
|
ad1545 |
vault_name_master2 = "ci_test_vault_master2"
|
|
|
ad1545 |
vault_name_master3 = "ci_test_vault_master3"
|
|
|
ad1545 |
vault_name_replica_without_KRA = "ci_test_vault_replica_without_kra"
|
|
|
ad1545 |
+ shared_vault_name_replica_without_KRA = ("ci_test_shared"
|
|
|
ad1545 |
+ "_vault_replica_without_kra")
|
|
|
ad1545 |
vault_name_replica_with_KRA = "ci_test_vault_replica_with_kra"
|
|
|
ad1545 |
vault_name_replica_KRA_uninstalled = "ci_test_vault_replica_KRA_uninstalled"
|
|
|
ad1545 |
|
|
|
ad1545 |
-
|
|
|
ad1545 |
@classmethod
|
|
|
ad1545 |
def install(cls, mh):
|
|
|
ad1545 |
tasks.install_master(cls.master, setup_kra=True)
|
|
|
ad1545 |
@@ -89,6 +92,66 @@ class TestInstallKRA(IntegrationTest):
|
|
|
ad1545 |
|
|
|
ad1545 |
self._retrieve_secret([self.vault_name_replica_without_KRA])
|
|
|
ad1545 |
|
|
|
ad1545 |
+ def test_create_and_retrieve_shared_vault_replica_without_kra(self):
|
|
|
ad1545 |
+ # create vault
|
|
|
ad1545 |
+ self.replicas[0].run_command([
|
|
|
ad1545 |
+ "ipa", "vault-add",
|
|
|
ad1545 |
+ self.shared_vault_name_replica_without_KRA,
|
|
|
ad1545 |
+ "--shared",
|
|
|
ad1545 |
+ "--type", "standard",
|
|
|
ad1545 |
+ ])
|
|
|
ad1545 |
+
|
|
|
ad1545 |
+ # archive secret
|
|
|
ad1545 |
+ self.replicas[0].run_command([
|
|
|
ad1545 |
+ "ipa", "vault-archive",
|
|
|
ad1545 |
+ self.shared_vault_name_replica_without_KRA,
|
|
|
ad1545 |
+ "--shared",
|
|
|
ad1545 |
+ "--data", self.vault_data,
|
|
|
ad1545 |
+ ])
|
|
|
ad1545 |
+ time.sleep(WAIT_AFTER_ARCHIVE)
|
|
|
ad1545 |
+
|
|
|
ad1545 |
+ # add non-admin user
|
|
|
ad1545 |
+ self.replicas[0].run_command([
|
|
|
ad1545 |
+ 'ipa', 'user-add', self.vault_user,
|
|
|
ad1545 |
+ '--first', self.vault_user,
|
|
|
ad1545 |
+ '--last', self.vault_user,
|
|
|
ad1545 |
+ '--password'],
|
|
|
ad1545 |
+ stdin_text=self.vault_user_password)
|
|
|
ad1545 |
+
|
|
|
ad1545 |
+ # add it to vault
|
|
|
ad1545 |
+ self.replicas[0].run_command([
|
|
|
ad1545 |
+ "ipa", "vault-add-member",
|
|
|
ad1545 |
+ self.shared_vault_name_replica_without_KRA,
|
|
|
ad1545 |
+ "--shared",
|
|
|
ad1545 |
+ "--users", self.vault_user,
|
|
|
ad1545 |
+ ])
|
|
|
ad1545 |
+
|
|
|
ad1545 |
+ self.replicas[0].run_command([
|
|
|
ad1545 |
+ 'kdestroy', '-A'])
|
|
|
ad1545 |
+
|
|
|
ad1545 |
+ user_kinit = "%s\n%s\n%s\n" % (self.vault_user_password,
|
|
|
ad1545 |
+ self.vault_user_password,
|
|
|
ad1545 |
+ self.vault_user_password)
|
|
|
ad1545 |
+
|
|
|
ad1545 |
+ self.replicas[0].run_command([
|
|
|
ad1545 |
+ 'kinit', self.vault_user],
|
|
|
ad1545 |
+ stdin_text=user_kinit)
|
|
|
ad1545 |
+
|
|
|
ad1545 |
+ # TODO: possibly refactor with:
|
|
|
ad1545 |
+ # self._retrieve_secret([self.vault_name_replica_without_KRA])
|
|
|
ad1545 |
+
|
|
|
ad1545 |
+ self.replicas[0].run_command([
|
|
|
ad1545 |
+ "ipa", "vault-retrieve",
|
|
|
ad1545 |
+ "--shared",
|
|
|
ad1545 |
+ self.shared_vault_name_replica_without_KRA,
|
|
|
ad1545 |
+ "--out=test.txt"])
|
|
|
ad1545 |
+
|
|
|
ad1545 |
+ self.replicas[0].run_command([
|
|
|
ad1545 |
+ 'kdestroy', '-A'])
|
|
|
ad1545 |
+
|
|
|
ad1545 |
+ tasks.kinit_admin(self.replicas[0])
|
|
|
ad1545 |
+
|
|
|
ad1545 |
+
|
|
|
ad1545 |
def test_create_and_retrieve_vault_replica_with_kra(self):
|
|
|
ad1545 |
|
|
|
ad1545 |
# install KRA on replica
|
|
|
ad1545 |
--
|
|
|
ad1545 |
2.17.2
|
|
|
ad1545 |
|