URL: https://github.com/SSSD/sssd/pull/5892
Author: jakub-vavra-cz
 Title: #5892: Tests: Add a test for BZ2004406
Action: synchronized

To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/5892/head:pr5892
git checkout pr5892
From f68e905a5fb60c224bccdb15ab65dcbf08be3d57 Mon Sep 17 00:00:00 2001
From: Jakub Vavra <jva...@redhat.com>
Date: Fri, 26 Nov 2021 07:24:15 +0100
Subject: [PATCH] Tests: Add a test for BZ2004406

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2004406
Verifies: MR#5791
---
 src/tests/multihost/ipa/test_adtrust.py | 148 +++++++++++++++++++++++-
 1 file changed, 147 insertions(+), 1 deletion(-)

diff --git a/src/tests/multihost/ipa/test_adtrust.py b/src/tests/multihost/ipa/test_adtrust.py
index 3f2fc66c1b..7cc2d0ab46 100644
--- a/src/tests/multihost/ipa/test_adtrust.py
+++ b/src/tests/multihost/ipa/test_adtrust.py
@@ -6,13 +6,14 @@
 :upstream: yes
 """
 
+import random
 import re
 import time
 import pytest
 import paramiko
 from sssd.testlib.common.utils import sssdTools
 from sssd.testlib.common.utils import SSHClient
-
+from sssd.testlib.common.utils import ADOperations
 
 @pytest.mark.usefixtures('setup_ipa_client')
 @pytest.mark.tier2
@@ -379,3 +380,148 @@ def test_nss_get_by_name_with_private_group(self, multihost):
         assert cmd_adm.returncode == 0, 'Something wrong with setup!'
         assert cmd_usr.returncode == 0, \
             f"pysss_nss_idmap.getsidbyname for {username} failed"
+
+    @staticmethod
+    def test_idview_override_group_default(multihost, create_aduser_group):
+        """
+        :title: IPA clients fail to resolve override group names in default
+        view
+        :id: 5ad7f363-9259-467c-a609-b8522359e5a6
+        :bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2004406
+        :description: Overriding both group names and ids in an idview for
+         group from AD results in error in sssd when running id command
+         for IPA user that was assigned to overridden AD group via his gid.
+        :setup:
+         1. Create group (group1) on AD.
+         2. Create IPA user with gid=<GID1>.
+        :steps:
+         1. ID views to override AD groupname and gid of group1 to <GID1> in
+          the 'Default Trust View'.
+         2. Run an "id" command for the user.
+        :expectedresults:
+          1. View with an override is created.
+          2. Id command succeeds, group override is visible, all groups are
+          properly resolved.
+        """
+        (_, adgroup) = create_aduser_group
+        run_id = f"{random.randint(9999, 999999)}"
+
+        domain = multihost.ad[0].domainname
+
+        ipauser = f"ipauser_{run_id}"
+
+        multihost.master[0].run_command(f"ipa user-add {ipauser} --first=Bob "
+                                        f"--last=Sad --gid=987654",
+                                        raiseonerr=False)
+
+        multihost.master[0].run_command("service ipa.service restart",
+                                        raiseonerr=False)
+        ipa_client = sssdTools(multihost.client[0])
+        ipa_client.clear_sssd_cache()
+
+        view = 'Default Trust View'
+
+        create_grp_override = f'ipa idoverridegroup-add "{view}" ' \
+                              f'{adgroup}@{domain} --group-name "borci" ' \
+                              f'--gid=987654'
+        multihost.master[0].run_command(create_grp_override, raiseonerr=False)
+
+        ipa_client.clear_sssd_cache()
+        time.sleep(5)
+
+        id_cmd = f'id {ipauser}'
+        cmd = multihost.client[0].run_command(id_cmd, raiseonerr=False)
+
+        # TEARDOWN
+        multihost.master[0].run_command(f"ipa user-del {ipauser} ",
+                                        raiseonerr=False)
+
+        ipa_client.clear_sssd_cache()
+        # Test result Evaluation
+        assert cmd.returncode == 0, f"User {ipauser} was not found."
+        assert f"borci@{domain}" in cmd.stdout_text,\
+            f"Group 1 {adgroup} name was not overridden/resolved."
+        assert "987654" in cmd.stdout_text, "Group id was not overridden."
+
+    @staticmethod
+    def test_idview_override_group_custom(multihost, create_aduser_group):
+        """
+        :title: IPA clients fail to resolve override group names in custom view
+        :id: 7a0dc871-fdad-4c07-9d07-a092baa83178
+        :bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2004406
+        :description: Overriding both user and group names and ids in
+          an idview for user and group from AD results in error in sssd
+          when running id command.
+        :setup:
+         1. Create user and group (group1) on AD.
+         2. Make AD user member of group1.
+         2. Create additional group (group2) on AD.
+        :steps:
+         1. ID views to override AD groupname and gid of group1.
+         2. ID views to override AD groupname and gid of group2.
+         3. ID view to override AD username, uid and gid (to gid of group2).
+         4. Run an "id" command for the override user.
+         client
+        :expectedresults:
+          1. View with an override is created.
+          2. View with an override is created.
+          3. User override is added to the view.
+          4. Id command succeeds, group override is visible, all groups are
+          properly resolved.
+        """
+        (aduser, adgroup) = create_aduser_group
+
+        adgroup2 = f"group2_{random.randint(9999, 999999)}"
+        ado = ADOperations(multihost.ad[0])
+        ado.create_ad_unix_group(adgroup2)
+        domain = multihost.ad[0].domainname
+
+        multihost.master[0].run_command("service ipa.service restart",
+                                        raiseonerr=False)
+        ipa_client = sssdTools(multihost.client[0])
+        ipa_client.clear_sssd_cache()
+
+        view = f'prygl_trust_view_{random.randint(9999, 999999)}'
+        create_view = f'ipa idview-add {view}'
+        multihost.master[0].run_command(create_view, raiseonerr=False)
+
+        create_grp_override = f'ipa idoverridegroup-add "{view}" ' \
+                              f'{adgroup}@{domain} --group-name "borci" ' \
+                              f'--gid=987654'
+        multihost.master[0].run_command(create_grp_override, raiseonerr=False)
+
+        create_grp2_override = f'ipa idoverridegroup-add "{view}" ' \
+                              f'{adgroup2}@{domain} --group-name "magori" ' \
+                              f'--gid=876543'
+        multihost.master[0].run_command(create_grp2_override, raiseonerr=False)
+
+        create_user_override = f'ipa idoverrideuser-add "{view}" ' \
+                               f'{aduser}@{domain} --login ferko ' \
+                               f'--uid=50001 --gidnumber=876543'
+        multihost.master[0].run_command(create_user_override, raiseonerr=False)
+
+        # Apply the view on client
+        apply_view = f"ipa idview-apply '{view}' " \
+                     f"--hosts={multihost.client[0].sys_hostname}"
+        multihost.master[0].run_command(apply_view, raiseonerr=False)
+        ipa_client.clear_sssd_cache()
+        time.sleep(5)
+
+        cmd = multihost.client[0].run_command(f'id ferko@{domain}',
+                                              raiseonerr=False)
+
+        # TEARDOWN
+        ado.delete_ad_user_group(adgroup2)
+        delete_id_view = f'ipa idview-del {view}'
+        multihost.master[0].run_command(delete_id_view)
+        ipa_client.clear_sssd_cache()
+        # Test result Evaluation
+        assert cmd.returncode == 0, f"User {aduser} was not found."
+        assert f"borci@{domain}" in cmd.stdout_text,\
+            f"Group 1 {adgroup} name was not overridden/resolved."
+        assert f"magori@{domain}" in cmd.stdout_text,\
+            f"Group 2 {adgroup2} name was not overridden/resolved."
+        assert "987654" in cmd.stdout_text, "Group 1 id was not overridden."
+        assert "876543" in cmd.stdout_text, "Group 2 id was not overridden."
+        assert f"domain users@{domain}" in cmd.stdout_text, \
+            "Group domain users is missing."
_______________________________________________
sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org
To unsubscribe send an email to sssd-devel-le...@lists.fedorahosted.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.org
Do not reply to spam on the list, report it: 
https://pagure.io/fedora-infrastructure

Reply via email to