On 04/21/2015 04:23 PM, Michal Židek wrote:
On 04/20/2015 07:15 PM, Nikolai Kondrashov wrote:
> On 03/19/2015 07:27 PM, Michal Židek wrote:
>> On 03/18/2015 03:48 PM, Nikolai Kondrashov wrote:
>>> On 03/18/2015 03:06 AM, Michal Židek wrote:
>>
>> I see. You mean to test results from getpwall.
>> We could do this:
>> Create simple asserts like
>> assert_get_user_by_uid and
>> assert_get_user_by_name
>> as described in my previous mail bellow. Than
>> create their getpwall ekvivalents like
>> assert_getpwall_uid
>> assert_getpwall_name
>>
>> These functions would have the same arguments as
>> the simpler asserts (not just one time, but as
>> a list).
>> In these functions we would first convert the list
>> returned by getpwall to a dictionary where the
>> uid (name) will be a key and the pwd structure a
>> value. Then we would iterate throught the list
>> of input values and for each UID (name) we
>> would check if the expected value is matching the
>> pwd structure (in the same way as the simple
>> asserts will do, so the matching part will be
>> reusable). The usage would be like this:
>>
>> uid_expval_list = [(2001, {"name"="user1"}),
>> (2002, {"name"="user2"})]
>>
>> assert_getpwall_uid(ldap_conn, uid_expval_list)
>>
>> Similiar would it be with the assert_getpwall_name.
>> Of course we could check for more than just correct
>> "name" attribute, but checking just the "name" attribute
>> should be possible (we would only test requested
>> parts of pwd structure). As you see, we do not
>> need to filter any root user if we do it this way
>> (yes the root will be there in the returned list
>> by getpwall but only names in the uid_expval_list
>> will be used).
>>
>> Anyway, I am OK if the getpwall part is done later
>> and for now only the simple asserts are implemented
>> and used in the sanity tests.
>
> This looks almost perfectly fine, but it accounts only for checking
> users that
> should be there, yet not for users that *shouldn't* be there. So, I
> think it
> is still better to explicitly remove that one root account and maybe have
> variations of assert_getpwall* which check for the absence of extra users.
>
I am not sure if this is good. getpwall can return a lot of
users we do not care about (root, ldap, ntp, abrt, etc.).
IMO we should simply ignore them and do not mention them
in any way in the code. I do not think the API provides
a way to ask for sssd managed users only, like in
getent -s sss passwd (correct me if I am wrong). I f there was
such option, then that would be what we would do, but if there
is not, I think ignoring the users is OK.
Yes, that would be true, if we were using the host's passwd and group
databases, but we're not. We're using nss_wrapper with our own dummy passwd
and group files, generated in src/tests/intg/Makefile.am and containing only
"root" entries.
I did that specifically to avoid clashes with host databases.
Nick