ramackri commented on PR #1106: URL: https://github.com/apache/ranger/pull/1106#issuecomment-5062293758
## Testing summary (ramackri) Tested branch `RANGER-5690-1` in an isolated worktree. ### Unit tests ```bash mvn test -pl unixauthservice mvn test -pl unixauthclient ``` | Module | Result | |--------|--------| | `unixauthservice` | **37/37 pass** (18 `LoginAttemptTrackerTest`, 9 `TestPasswordValidator`, 10 `TestUnixAuthenticationService`) | | `unixauthclient` | **32/32 pass** | ### E2E (real `UnixAuthenticationService.startService()`) Used an aligned `UnixAuthE2eServer` harness with **PR #1106 production defaults** (8-arg `LoginAttemptTracker`, `accountFanoutEnabled=true`, threshold=3, base delay=200ms, max=2000ms) and mock shell validators — no Docker stack or native `credValidator.uexe` required. | Scenario | Result | |----------|--------| | **Per-IP lockout** (threshold=3) | ✅ Attempts 1–3 → `FAILED: Authentication failed.`; attempts 4–5 → `FAILED: Too many attempts. Try again later.` (validator not invoked after lockout) | | **Enumeration masking + success clears counter** | ✅ `nobody`/wrong → generic fail; `gooduser`/good → `OK`; subsequent failure does not inherit prior lockout state | | **Single-IP retries — no account fan-out delay** (maxFailedAttempts=100) | ✅ 5 attempts from one IP, all ~30–50ms; no progressive delay | | **Multi-IP account fan-out delay** | ⏭ Skipped on macOS without loopback aliases (`127.0.0.2+`); covered by `LoginAttemptTrackerTest` unit tests (`fanout_distinctIpsAcrossThresholdTriggerDelay`, `fanout_delayScalesLinearlyBeforeCap`, `fanout_concurrentFailuresFromManyIpsAreThreadSafe`, etc.) | **Sample lockout output:** ``` ATTEMPT_1 elapsed_ms=1620 response=FAILED: Authentication failed. ATTEMPT_2 elapsed_ms=30 response=FAILED: Authentication failed. ATTEMPT_3 elapsed_ms=24 response=FAILED: Authentication failed. ATTEMPT_4 elapsed_ms=0 response=FAILED: Too many attempts. Try again later. ATTEMPT_5 elapsed_ms=11 response=FAILED: Too many attempts. Try again later. ``` ### Notes - Pre-existing logback warning during tests (`ZoneRulesException: Unknown time-zone ID: yyyy-MM-dd` in rolling policy) — does not affect test results. - Per-IP lockout, generic failure responses, and account fan-out behavior all look correct from my side. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
