All the patches from this thread were converted into github pull requests:

On 11/09/2016 04:43 PM, Milan Kubík wrote:
On 10/25/2016 10:24 AM, Oleg Fayans wrote:
Integration part of the tests is ready. 2 tests:

1. Adds a cert to idoverride of a windows user
2. sssd part - looks up user by his certificate using dbus-sssd

Second and third dbus call are executed as a string insted of as array
of strings because it just does not work otherwise. Some quote
escaping gets screwed probably, but the system returns "Error
org.freedesktop.DBus.Error.UnknownInterface: Unknown interface" if the
command is executed using the standard array-based approach

The run looks like this:

bash-4.3$ ipa-run-tests test_integration/ --pdb
WARNING: Couldn't write lextab module 'pycparser.lextab'. [Errno 13]
Permission denied: ''
WARNING: yacc table file version is out of date
WARNING: Couldn't create 'pycparser.yacctab'. [Errno 13] Permission
denied: ''
==================================== test session starts
platform linux2 -- Python 2.7.11, pytest-2.9.2, py-1.4.31, pluggy-0.3.1
rootdir: /usr/lib/python2.7/site-packages/ipatests, inifile: pytest.ini
plugins: sourceorder-0.5, multihost-1.0
collected 2 items

test_integration/ ..

================================ 2 passed in 948.44 seconds

On 10/21/2016 10:54 AM, Oleg Fayans wrote:
Added one more test, resolved the pep8 issues

On 10/19/2016 12:32 PM, Oleg Fayans wrote:
Hi Martin,

As you suggested, I've extended the
test_xmlrpc/ to contain basic tests for
in idoverrides.
The integration part still needs some polishing in the part related to
user lookup by cert

On 10/14/2016 03:57 PM, Martin Babinsky wrote:
On 10/14/2016 03:48 PM, Oleg Fayans wrote:
So, did I understand correctly, that there would be 2 patches: one
containing test for basic idoverrides functionality without
AD-integration, and the second one - with AD-integration and an sssd
check, correct?
I guess, the

might be a good candidate for the first one, I only have to change
filename to, right?

Oleg, we already have XMLRPC tests for idoverrides:


Is there any particular reason why not to extend them with add
cert/remove cert operations?

Even better, you can extend
`ipatests/test_xmlrpc/` suite by doing the
same set of tests on idoverrideuser objects.

Or am I missing something?

On 09/15/2016 10:32 AM, Martin Basti wrote:

On 15.09.2016 10:10, Oleg Fayans wrote:
Hi Martin,

The file was renamed. Did I understand correctly that for now we
leaving the test as is and are planning to extend it later?

I would like to have there SSSD check involved, please use what
recommends. No new test cases.

And this can be done by separate patch, I want to have API/CLI
certificate override tests for non-AD idview (extending current
tests I
posted in this thread)


On 09/15/2016 09:49 AM, Martin Basti wrote:

On 14.09.2016 18:53, Sumit Bose wrote:
On Wed, Sep 14, 2016 at 06:03:37PM +0200, Martin Basti wrote:

On 14.09.2016 17:53, Alexander Bokovoy wrote:
On Wed, 14 Sep 2016, Martin Basti wrote:

On 14.09.2016 17:41, Alexander Bokovoy wrote:
On Wed, 14 Sep 2016, Martin Basti wrote:
I still don't see the reason why AD trust is needed. Default
trust ID view is added just by ipa-adtrust-install, adding
trust is not needed for current implementation. You don't
need AD for this, IDviews is generic feature not just for
AD. Is that user configured on AD side?
You cannot add non-AD user to 'default trust view', so you
not be
able to set up certificates to ID override which does not

For non-'default trust view' you can add both IPA and AD
so using
some other view and then assign certificate for a ID
override in

Ok then, but anyway I would like to see API/CLI tests for this
feature with proper output validation.

How can be this tested with SSSD?
You need to log into the system with a certificate...
Is this possible from test? We are logged remotely as root, is
there any
cmdline util which allows us to test certificate against AD

You can use 'sss_ssh_authorizedkeys aduser@ad.domain' which
return the ssh key derived from the public key in the
should work for certificate stored in AD as well as for

You can also you the DBus lookup by certificate as described in




Thank you Alexander and Summit for hints.

Oleg I realized we don't have any other idviews integration tests

So I propose to rename test file you are adding to We
can add more testcases for idviews there later


Manage your subscription for the Freeipa-devel mailing list:
Contribute to FreeIPA:

Putting `config.ad_domains[0].ads[0]` to a class variable prevents other
classes from running without enough resources for the
TestCertsInIDOverrides class. Please do this kind of things in the
__init__ method.

As for the actual test run, me or Lenka will check that tomorrow.

Milan Kubik

Oleg Fayans
Quality Engineer
FreeIPA team

Manage your subscription for the Freeipa-devel mailing list:
Contribute to FreeIPA:

Reply via email to