From 7564631587dcb2c87d61f126a01448cc7fe1c0fb Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Wed, 1 Jun 2016 16:47:48 +0200 Subject: [PATCH 13/14] TESTS: Add an integration test for the timestamps cache --- contrib/ci/deps.sh | 2 + src/external/intgcheck.m4 | 1 + src/tests/intg/Makefile.am | 2 + src/tests/intg/sssd_ldb.py | 84 ++++++ src/tests/intg/test_ts_cache.py | 589 ++++++++++++++++++++++++++++++++++++++++ 5 files changed, 678 insertions(+) create mode 100644 src/tests/intg/sssd_ldb.py create mode 100644 src/tests/intg/test_ts_cache.py diff --git a/contrib/ci/deps.sh b/contrib/ci/deps.sh index 4fc1d2d0b84825add4d02692a7e44d18311f300d..ce2702c008f7145155ac5b0680a883ed16509860 100644 --- a/contrib/ci/deps.sh +++ b/contrib/ci/deps.sh @@ -42,6 +42,7 @@ if [[ "$DISTRO_BRANCH" == -redhat-* ]]; then openldap-servers pytest python-ldap + pyldb rpm-build uid_wrapper ) @@ -112,6 +113,7 @@ if [[ "$DISTRO_BRANCH" == -debian-* ]]; then libuid-wrapper python-pytest python-ldap + python-ldb ldap-utils slapd systemtap-sdt-dev diff --git a/src/external/intgcheck.m4 b/src/external/intgcheck.m4 index 80d41b599829e6a0de36063d49f8d93a661d6e31..ac68b85dd3154beba00c63d0a99d0cce6ed550d8 100644 --- a/src/external/intgcheck.m4 +++ b/src/external/intgcheck.m4 @@ -28,5 +28,6 @@ AC_DEFUN([SSS_ENABLE_INTGCHECK_REQS], [ SSS_INTGCHECK_REQ([HAVE_PYTHON2], [python2]) SSS_INTGCHECK_REQ([HAVE_PYTEST], [pytest]) SSS_INTGCHECK_REQ([HAVE_PY2MOD_LDAP], [python-ldap]) + SSS_INTGCHECK_REQ([HAVE_PY2MOD_LDAP], [pyldb]) fi ]) diff --git a/src/tests/intg/Makefile.am b/src/tests/intg/Makefile.am index 7394997319142d581237ab8a37270bfd7bc974ca..d79f6424e0226f8b81d3a104877fa166bd885b42 100644 --- a/src/tests/intg/Makefile.am +++ b/src/tests/intg/Makefile.am @@ -1,6 +1,7 @@ dist_noinst_DATA = \ config.py.m4 \ sssd_id.py \ + sssd_ldb.py \ ds.py \ ds_openldap.py \ ent.py \ @@ -11,6 +12,7 @@ dist_noinst_DATA = \ test_local_domain.py \ util.py \ test_memory_cache.py \ + test_ts_cache.py \ $(NULL) config.py: config.py.m4 diff --git a/src/tests/intg/sssd_ldb.py b/src/tests/intg/sssd_ldb.py new file mode 100644 index 0000000000000000000000000000000000000000..bf5264b77880bbf4ae085f12ebf6b2e58c3e28df --- /dev/null +++ b/src/tests/intg/sssd_ldb.py @@ -0,0 +1,84 @@ +# +# SSSD integration test - access the ldb cache +# +# Copyright (c) 2016 Red Hat, Inc. +# +# This is free software; you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by +# the Free Software Foundation; version 2 only +# +# This program is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +# + +import os +import ldb +import config + + +class CacheType(object): + sysdb = 1 + timestamps = 2 + + +class TsCacheEntry(object): + user = 1 + group = 2 + + +class SssdLdb(object): + def __init__(self, domain_name): + self._domain_name = domain_name + self._sysdb = self._create_dbconn(CacheType.sysdb, + domain_name) + self._timestamps = self._create_dbconn(CacheType.timestamps, + domain_name) + + def _create_dbconn(self, cache_type, domain_name): + if cache_type == CacheType.sysdb: + db_path = os.path.join(config.DB_PATH, + "cache_%s.ldb" % domain_name) + elif cache_type == CacheType.timestamps: + db_path = os.path.join(config.DB_PATH, + "timestamps_%s.ldb" % domain_name) + else: + raise ValueError("Unknown cache type\n") + + pyldb = ldb.Ldb() + pyldb.connect(db_path) + return pyldb + + def _get_dbconn(self, cache_type): + dbconn = None + if cache_type == CacheType.sysdb: + dbconn = self._sysdb + elif cache_type == CacheType.timestamps: + dbconn = self._timestamps + return dbconn + + def _entry_basedn(self, entry_type): + if entry_type == TsCacheEntry.user: + rdn = "users" + elif entry_type == TsCacheEntry.group: + rdn = "groups" + else: + raise ValueError("Unknown entry type\n") + return "cn=%s,cn=%s,cn=sysdb" % (rdn, self._domain_name) + + def _basedn(self, name, entry_type): + return "name=%s,%s" % (name, self._entry_basedn(entry_type)) + + def get_entry_attr(self, cache_type, entry_type, name, attr): + dbconn = self._get_dbconn(cache_type) + basedn = self._basedn(name, entry_type) + + res = dbconn.search(base=basedn, scope=ldb.SCOPE_BASE, attrs=[attr]) + if res.count != 1: + return None + + return res.msgs[0].get(attr).get(0) diff --git a/src/tests/intg/test_ts_cache.py b/src/tests/intg/test_ts_cache.py new file mode 100644 index 0000000000000000000000000000000000000000..6497d36802aec332561e35b04ae8a47643f488de --- /dev/null +++ b/src/tests/intg/test_ts_cache.py @@ -0,0 +1,589 @@ +# +# LDAP integration test - test updating the sysdb and timestamp +# cache +# +# Copyright (c) 2016 Red Hat, Inc. +# +# This is free software; you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by +# the Free Software Foundation; version 2 only +# +# This program is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +# + +import os +import stat +import ent +import grp +import pwd +import config +import signal +import subprocess +import time +import ldap +import pytest +import ds_openldap +import ldap_ent +import sssd_ldb +import sssd_id +from util import unindent +from util import run_shell + +LDAP_BASE_DN = "dc=example,dc=com" + +SCHEMA_RFC2307 = "rfc2307" +SCHEMA_RFC2307_BIS = "rfc2307bis" + +TS_ATTRLIST = ("dataExpireTimestamp", "originalModifyTimestamp") + + +@pytest.fixture(scope="module") +def ds_inst(request): + """LDAP server instance fixture""" + ds_inst = ds_openldap.DSOpenLDAP( + config.PREFIX, 10389, LDAP_BASE_DN, + "cn=admin", "Secret123") + try: + ds_inst.setup() + except: + ds_inst.teardown() + raise + request.addfinalizer(lambda: ds_inst.teardown()) + return ds_inst + + +@pytest.fixture(scope="module") +def ldap_conn(request, ds_inst): + """LDAP server connection fixture""" + ldap_conn = ds_inst.bind() + ldap_conn.ds_inst = ds_inst + request.addfinalizer(lambda: ldap_conn.unbind_s()) + return ldap_conn + + +def create_ldap_fixture(request, ldap_conn, ent_list): + """Add LDAP entries and add teardown for removing them""" + for entry in ent_list: + ldap_conn.add_s(entry[0], entry[1]) + + def teardown(): + for entry in ent_list: + try: + ldap_conn.delete_s(entry[0]) + except ldap.NO_SUCH_OBJECT: + # if the test already removed an object, it's fine + # to not care in the teardown + pass + request.addfinalizer(teardown) + + +def create_conf_fixture(request, contents): + """Generate sssd.conf and add teardown for removing it""" + conf = open(config.CONF_PATH, "w") + conf.write(contents) + conf.close() + os.chmod(config.CONF_PATH, stat.S_IRUSR | stat.S_IWUSR) + request.addfinalizer(lambda: os.unlink(config.CONF_PATH)) + + +def stop_sssd(): + pid_file = open(config.PIDFILE_PATH, "r") + pid = int(pid_file.read()) + os.kill(pid, signal.SIGTERM) + while True: + try: + os.kill(pid, signal.SIGCONT) + except: + break + time.sleep(1) + + +def create_sssd_fixture(request): + """Start sssd and add teardown for stopping it and removing state""" + if subprocess.call(["sssd", "-D", "-f"]) != 0: + raise Exception("sssd start failed") + + def teardown(): + try: + stop_sssd() + except: + pass + for path in os.listdir(config.DB_PATH): + os.unlink(config.DB_PATH + "/" + path) + for path in os.listdir(config.MCACHE_PATH): + os.unlink(config.MCACHE_PATH + "/" + path) + request.addfinalizer(teardown) + + +def load_data_to_ldap(request, ldap_conn, schema): + ent_list = ldap_ent.List(ldap_conn.ds_inst.base_dn) + ent_list.add_user("user1", 1001, 2001) + ent_list.add_user("user11", 1011, 2001) + ent_list.add_user("user21", 1021, 2001) + + if schema == SCHEMA_RFC2307_BIS: + ent_list.add_group_bis("group1", 2001, ("user1", "user11", "user21")) + elif schema == SCHEMA_RFC2307: + ent_list.add_group("group1", 2001, ("user1", "user11", "user21")) + create_ldap_fixture(request, ldap_conn, ent_list) + + +def load_2307bis_data_to_ldap(request, ldap_conn): + return load_data_to_ldap(request, ldap_conn, SCHEMA_RFC2307_BIS) + + +def load_2307_data_to_ldap(request, ldap_conn): + return load_data_to_ldap(request, ldap_conn, SCHEMA_RFC2307) + + +@pytest.fixture +def setup_rfc2307bis(request, ldap_conn): + load_2307bis_data_to_ldap(request, ldap_conn) + + conf = unindent("""\ + [sssd] + domains = LDAP + services = nss + + [nss] + memcache_timeout = 1 + + [domain/LDAP] + ldap_schema = rfc2307bis + id_provider = ldap + auth_provider = ldap + sudo_provider = ldap + ldap_group_object_class = groupOfNames + ldap_uri = {ldap_conn.ds_inst.ldap_url} + ldap_search_base = {ldap_conn.ds_inst.base_dn} + """).format(**locals()) + create_conf_fixture(request, conf) + create_sssd_fixture(request) + return None + + +@pytest.fixture +def setup_rfc2307(request, ldap_conn): + load_2307_data_to_ldap(request, ldap_conn) + + conf = unindent("""\ + [sssd] + domains = LDAP + services = nss + + [nss] + memcache_timeout = 1 + + [domain/LDAP] + ldap_schema = rfc2307 + id_provider = ldap + auth_provider = ldap + sudo_provider = ldap + ldap_uri = {ldap_conn.ds_inst.ldap_url} + ldap_search_base = {ldap_conn.ds_inst.base_dn} + """).format(**locals()) + create_conf_fixture(request, conf) + create_sssd_fixture(request) + return None + + +@pytest.fixture +def ldb_examine(request): + ldb_conn = sssd_ldb.SssdLdb('LDAP') + return ldb_conn + + +def invalidate_group(name): + subprocess.call(["sss_cache", "-g", name]) + + +def invalidate_user(name): + subprocess.call(["sss_cache", "-u", name]) + + +def get_attrs(ldb_conn, type, name, attr_list): + sysdb_attrs = dict() + ts_attrs = dict() + + for attr in attr_list: + sysdb_attrs[attr] = ldb_conn.get_entry_attr( + sssd_ldb.CacheType.sysdb, + type, name, attr) + ts_attrs[attr] = ldb_conn.get_entry_attr( + sssd_ldb.CacheType.timestamps, + type, name, attr) + return (sysdb_attrs, ts_attrs) + + +def get_group_attrs(ldb_conn, name, attr_list): + return get_attrs(ldb_conn, sssd_ldb.TsCacheEntry.group, name, attr_list) + + +def get_user_attrs(ldb_conn, name, attr_list): + return get_attrs(ldb_conn, sssd_ldb.TsCacheEntry.user, name, attr_list) + + +def assert_same_attrval(adict1, adict2, attr_name): + assert adict1.get(attr_name) is not None and \ + adict1.get(attr_name) == adict2.get(attr_name) + + +def assert_diff_attrval(adict1, adict2, attr_name): + assert adict1.get(attr_name) is not None and \ + adict1.get(attr_name) != adict2.get(attr_name) + + +def prime_cache_group(ldb_conn, name, members): + ent.assert_group_by_name( + name, + dict(mem=ent.contains_only(*members))) + sysdb_attrs, ts_attrs = get_group_attrs(ldb_conn, name, TS_ATTRLIST) + assert_same_attrval(sysdb_attrs, ts_attrs, "dataExpireTimestamp") + assert_same_attrval(sysdb_attrs, ts_attrs, "originalModifyTimestamp") + + # just to force different stamps and make sure memcache is gone + time.sleep(1) + invalidate_group(name) + + return sysdb_attrs, ts_attrs + + +def prime_cache_user(ldb_conn, name, primary_gid): + # calling initgroups would add the initgExpire timestamp attribute and make sure + # that sss_cache doesn't add it with a value of 1, triggering a sysdb update + (res, errno, gids) = sssd_id.call_sssd_initgroups(name, primary_gid) + assert res == sssd_id.NssReturnCode.SUCCESS + + sysdb_attrs, ts_attrs = get_user_attrs(ldb_conn, name, TS_ATTRLIST) + assert_same_attrval(sysdb_attrs, ts_attrs, "dataExpireTimestamp") + assert_same_attrval(sysdb_attrs, ts_attrs, "originalModifyTimestamp") + + # just to force different stamps and make sure memcache is gone + time.sleep(1) + invalidate_user(name) + + return sysdb_attrs, ts_attrs + + +def test_group_2307bis_update_same_modstamp(ldap_conn, + ldb_examine, + setup_rfc2307bis): + """ + Test that a group update with the same modifyTimestamp does not trigger + sysdb cache update + """ + ldb_conn = ldb_examine + old_sysdb_attrs, old_ts_attrs = prime_cache_group( + ldb_conn, "group1", + ("user1", "user11", "user21")) + + ent.assert_group_by_name( + "group1", + dict(mem=ent.contains_only("user1", "user11", "user21"))) + sysdb_attrs, ts_attrs = get_group_attrs(ldb_conn, "group1", TS_ATTRLIST) + + assert_same_attrval(sysdb_attrs, old_sysdb_attrs, "dataExpireTimestamp") + assert_same_attrval(sysdb_attrs, old_sysdb_attrs, "originalModifyTimestamp") + + assert_diff_attrval(ts_attrs, old_ts_attrs, "dataExpireTimestamp") + assert_same_attrval(ts_attrs, old_ts_attrs, "originalModifyTimestamp") + + +def test_group_2307bis_update_same_attrs(ldap_conn, + ldb_examine, + setup_rfc2307bis): + """ + Test that a group update with a different modifyTimestamp but the same + attrs does not trigger sysdb cache update + """ + ldb_conn = ldb_examine + old_sysdb_attrs, old_ts_attrs = prime_cache_group( + ldb_conn, "group1", + ("user1", "user11", "user21")) + + # modify an argument we don't save to the cache. This will bump the + # modifyTimestamp attribute, but the attributes themselves will be the same + # from sssd's point of view + ldap_conn.modify_s("cn=group1,ou=Groups," + ldap_conn.ds_inst.base_dn, + [(ldap.MOD_ADD, "description", "group one")]) + # wait for slapd to change its database + time.sleep(1) + + ent.assert_group_by_name( + "group1", + dict(mem=ent.contains_only("user1", "user11", "user21"))) + sysdb_attrs, ts_attrs = get_group_attrs(ldb_conn, "group1", TS_ATTRLIST) + + assert_same_attrval(sysdb_attrs, old_sysdb_attrs, "dataExpireTimestamp") + assert_same_attrval(sysdb_attrs, old_sysdb_attrs, "originalModifyTimestamp") + + assert_diff_attrval(ts_attrs, old_ts_attrs, "dataExpireTimestamp") + assert_diff_attrval(ts_attrs, old_ts_attrs, "originalModifyTimestamp") + + +def test_group_2307bis_update_diff_attrs(ldap_conn, + ldb_examine, + setup_rfc2307bis): + """ + Test that a group update with different attribute triggers cache update + """ + ldb_conn = ldb_examine + old_sysdb_attrs, old_ts_attrs = prime_cache_group( + ldb_conn, "group1", + ("user1", "user11", "user21")) + + ldap_conn.modify_s("cn=group1,ou=Groups," + ldap_conn.ds_inst.base_dn, + [(ldap.MOD_DELETE, "member", + "uid=user1,ou=Users," + ldap_conn.ds_inst.base_dn)]) + # wait for slapd to change its database + time.sleep(1) + + ent.assert_group_by_name( + "group1", + dict(mem=ent.contains_only("user11", "user21"))) + sysdb_attrs, ts_attrs = get_group_attrs(ldb_conn, "group1", TS_ATTRLIST) + + assert_diff_attrval(sysdb_attrs, old_sysdb_attrs, "dataExpireTimestamp") + assert_diff_attrval(sysdb_attrs, old_sysdb_attrs, "originalModifyTimestamp") + + assert_diff_attrval(ts_attrs, old_ts_attrs, "dataExpireTimestamp") + assert_diff_attrval(ts_attrs, old_ts_attrs, "originalModifyTimestamp") + + +def test_group_2307bis_delete_group(ldap_conn, + ldb_examine, + setup_rfc2307bis): + """ + Test that deleting a group removes it from both caches + """ + ldb_conn = ldb_examine + old_sysdb_attrs, old_ts_attrs = prime_cache_group( + ldb_conn, "group1", + ("user1", "user11", "user21")) + + e = ldap_ent.group_bis(ldap_conn.ds_inst.base_dn, "group1", 2001) + ldap_conn.delete_s(e[0]) + # wait for slapd to change its database + time.sleep(1) + + with pytest.raises(KeyError): + grp.getgrnam("group1") + + sysdb_attrs, ts_attrs = get_group_attrs(ldb_conn, "group1", TS_ATTRLIST) + assert sysdb_attrs.get("dataExpireTimestamp") is None + assert sysdb_attrs.get("originalModifyTimestamp") is None + assert ts_attrs.get("dataExpireTimestamp") is None + assert ts_attrs.get("originalModifyTimestamp") is None + + +def test_group_2307_update_same_modstamp(ldap_conn, + ldb_examine, + setup_rfc2307): + """ + Test that a group update with the same modifyTimestamp does not trigger + sysdb cache update + """ + ldb_conn = ldb_examine + old_sysdb_attrs, old_ts_attrs = prime_cache_group( + ldb_conn, "group1", + ("user1", "user11", "user21")) + + ent.assert_group_by_name( + "group1", + dict(mem=ent.contains_only("user1", "user11", "user21"))) + sysdb_attrs, ts_attrs = get_group_attrs(ldb_conn, "group1", TS_ATTRLIST) + + assert_same_attrval(sysdb_attrs, old_sysdb_attrs, "dataExpireTimestamp") + assert_same_attrval(sysdb_attrs, old_sysdb_attrs, "originalModifyTimestamp") + + assert_diff_attrval(ts_attrs, old_ts_attrs, "dataExpireTimestamp") + assert_same_attrval(ts_attrs, old_ts_attrs, "originalModifyTimestamp") + + +def test_group_2307_update_same_attrs(ldap_conn, + ldb_examine, + setup_rfc2307): + """ + Test that a group update with a different modifyTimestamp but the same + attrs does not trigger sysdb cache update + """ + ldb_conn = ldb_examine + old_sysdb_attrs, old_ts_attrs = prime_cache_group( + ldb_conn, "group1", + ("user1", "user11", "user21")) + + # modify an argument we don't save to the cache. This will bump the + # modifyTimestamp attribute, but the attributes themselves will be the same + # from sssd's point of view + ldap_conn.modify_s("cn=group1,ou=Groups," + ldap_conn.ds_inst.base_dn, + [(ldap.MOD_ADD, "description", "group one")]) + # wait for slapd to change its database + time.sleep(1) + + ent.assert_group_by_name( + "group1", + dict(mem=ent.contains_only("user1", "user11", "user21"))) + sysdb_attrs, ts_attrs = get_group_attrs(ldb_conn, "group1", TS_ATTRLIST) + + assert_same_attrval(sysdb_attrs, old_sysdb_attrs, "dataExpireTimestamp") + assert_same_attrval(sysdb_attrs, old_sysdb_attrs, "originalModifyTimestamp") + + assert_diff_attrval(ts_attrs, old_ts_attrs, "dataExpireTimestamp") + assert_diff_attrval(ts_attrs, old_ts_attrs, "originalModifyTimestamp") + + +def test_group_2307_update_diff_attrs(ldap_conn, + ldb_examine, + setup_rfc2307): + """ + Test that a group update with different attribute triggers cache update + """ + ldb_conn = ldb_examine + old_sysdb_attrs, old_ts_attrs = prime_cache_group( + ldb_conn, "group1", + ("user1", "user11", "user21")) + + ldap_conn.modify_s("cn=group1,ou=Groups," + ldap_conn.ds_inst.base_dn, + [(ldap.MOD_DELETE, "memberUid", "user1")]) + # wait for slapd to change its database + time.sleep(1) + + ent.assert_group_by_name( + "group1", + dict(mem=ent.contains_only("user11", "user21"))) + sysdb_attrs, ts_attrs = get_group_attrs(ldb_conn, "group1", TS_ATTRLIST) + + assert_diff_attrval(sysdb_attrs, old_sysdb_attrs, "dataExpireTimestamp") + assert_diff_attrval(sysdb_attrs, old_sysdb_attrs, "originalModifyTimestamp") + + assert_diff_attrval(ts_attrs, old_ts_attrs, "dataExpireTimestamp") + assert_diff_attrval(ts_attrs, old_ts_attrs, "originalModifyTimestamp") + + +def test_group_2307_delete_group(ldap_conn, + ldb_examine, + setup_rfc2307): + """ + Test that deleting a group removes it from both caches + """ + ldb_conn = ldb_examine + old_sysdb_attrs, old_ts_attrs = prime_cache_group( + ldb_conn, "group1", + ("user1", "user11", "user21")) + + e = ldap_ent.group_bis(ldap_conn.ds_inst.base_dn, "group1", 2001) + ldap_conn.delete_s(e[0]) + # wait for slapd to change its database + time.sleep(1) + + with pytest.raises(KeyError): + grp.getgrnam("group1") + + sysdb_attrs, ts_attrs = get_group_attrs(ldb_conn, "group1", TS_ATTRLIST) + assert sysdb_attrs.get("dataExpireTimestamp") is None + assert sysdb_attrs.get("originalModifyTimestamp") is None + assert ts_attrs.get("dataExpireTimestamp") is None + assert ts_attrs.get("originalModifyTimestamp") is None + + +def test_user_update_same_modstamp(ldap_conn, + ldb_examine, + setup_rfc2307bis): + """ + Test that a user update with the same modifyTimestamp does not trigger + sysdb cache update + """ + ldb_conn = ldb_examine + old_sysdb_attrs, old_ts_attrs = prime_cache_user(ldb_conn, "user1", 2001) + + ent.assert_passwd_by_name("user1", dict(name="user1")) + + sysdb_attrs, ts_attrs = get_user_attrs(ldb_conn, "user1", TS_ATTRLIST) + assert_same_attrval(sysdb_attrs, old_sysdb_attrs, "dataExpireTimestamp") + assert_same_attrval(sysdb_attrs, old_sysdb_attrs, "originalModifyTimestamp") + + assert_diff_attrval(ts_attrs, old_ts_attrs, "dataExpireTimestamp") + assert_same_attrval(ts_attrs, old_ts_attrs, "originalModifyTimestamp") + + +def test_user_update_same_attrs(ldap_conn, + ldb_examine, + setup_rfc2307bis): + """ + Test that a user update with the same modifyTimestamp does not trigger + sysdb cache update + """ + ldb_conn = ldb_examine + old_sysdb_attrs, old_ts_attrs = prime_cache_user(ldb_conn, "user1", 2001) + + # modify an argument we don't save to the cache. This will bump the + # modifyTimestamp attribute, but the attributes themselves will be the same + # from sssd's point of view + ldap_conn.modify_s("uid=user1,ou=Users," + ldap_conn.ds_inst.base_dn, + [(ldap.MOD_ADD, "description", "user one")]) + # wait for slapd to change its database + time.sleep(1) + + ent.assert_passwd_by_name("user1", dict(name="user1")) + sysdb_attrs, ts_attrs = get_user_attrs(ldb_conn, "user1", TS_ATTRLIST) + assert_same_attrval(sysdb_attrs, old_sysdb_attrs, "dataExpireTimestamp") + assert_same_attrval(sysdb_attrs, old_sysdb_attrs, "originalModifyTimestamp") + + assert_diff_attrval(ts_attrs, old_ts_attrs, "dataExpireTimestamp") + assert_diff_attrval(ts_attrs, old_ts_attrs, "originalModifyTimestamp") + + +def test_user_update_diff_attrs(ldap_conn, + ldb_examine, + setup_rfc2307bis): + """ + Test that a user update with the same modifyTimestamp does not trigger + sysdb cache update + """ + ldb_conn = ldb_examine + old_sysdb_attrs, old_ts_attrs = prime_cache_user(ldb_conn, "user1", 2001) + + # modify an argument we don't save to the cache. This will bump the + # modifyTimestamp attribute, but the attributes themselves will be the same + # from sssd's point of view + ldap_conn.modify_s("uid=user1,ou=Users," + ldap_conn.ds_inst.base_dn, + [(ldap.MOD_REPLACE, "loginShell", "/bin/zsh")]) + # wait for slapd to change its database + time.sleep(1) + + ent.assert_passwd_by_name("user1", dict(name="user1")) + sysdb_attrs, ts_attrs = get_user_attrs(ldb_conn, "user1", TS_ATTRLIST) + assert_diff_attrval(sysdb_attrs, old_sysdb_attrs, "dataExpireTimestamp") + assert_diff_attrval(sysdb_attrs, old_sysdb_attrs, "originalModifyTimestamp") + + assert_diff_attrval(ts_attrs, old_ts_attrs, "dataExpireTimestamp") + assert_diff_attrval(ts_attrs, old_ts_attrs, "originalModifyTimestamp") + +def test_user_2307bis_delete_user(ldap_conn, + ldb_examine, + setup_rfc2307bis): + """ + Test that deleting a user removes it from both caches + """ + ldb_conn = ldb_examine + old_sysdb_attrs, old_ts_attrs = prime_cache_user(ldb_conn, "user1", 2001) + + e = ldap_ent.user(ldap_conn.ds_inst.base_dn, "user1", 1001, 2001) + + ldap_conn.delete_s(e[0]) + # wait for slapd to change its database + time.sleep(1) + + with pytest.raises(KeyError): + pwd.getpwnam("user1") + sysdb_attrs, ts_attrs = get_user_attrs(ldb_conn, "user1", TS_ATTRLIST) + assert sysdb_attrs.get("dataExpireTimestamp") is None + assert sysdb_attrs.get("originalModifyTimestamp") is None + assert ts_attrs.get("dataExpireTimestamp") is None + assert ts_attrs.get("originalModifyTimestamp") is None -- 2.4.11