[SSSD] [PATCH] Add integration tests

Nikolai Kondrashov Nikolai.Kondrashov at redhat.com
Tue Apr 21 13:32:16 UTC 2015


On 04/21/2015 04:23 PM, Michal Židek wrote:
> On 04/20/2015 07:15 PM, Nikolai Kondrashov wrote:
>> On 03/19/2015 07:27 PM, Michal Židek wrote:
>>> On 03/18/2015 03:48 PM, Nikolai Kondrashov wrote:
>>>> On 03/18/2015 03:06 AM, Michal Židek wrote:
>>>
>>> I see. You mean to test results from getpwall.
>>> We could do this:
>>> Create simple asserts like
>>> assert_get_user_by_uid and
>>> assert_get_user_by_name
>>> as described in my previous mail bellow. Than
>>> create their getpwall ekvivalents like
>>> assert_getpwall_uid
>>> assert_getpwall_name
>>>
>>> These functions would have the same arguments as
>>> the simpler asserts (not just one time, but as
>>> a list).
>>> In these functions we would first convert the list
>>> returned by getpwall to a dictionary where the
>>> uid (name) will be a key and the pwd structure a
>>> value. Then we would iterate throught the list
>>> of input values and for each UID (name) we
>>> would check if the expected value is matching the
>>> pwd structure (in the same way as the simple
>>> asserts will do, so the matching part will be
>>> reusable). The usage would be like this:
>>>
>>> uid_expval_list = [(2001, {"name"="user1"}),
>>>                     (2002, {"name"="user2"})]
>>>
>>> assert_getpwall_uid(ldap_conn, uid_expval_list)
>>>
>>> Similiar would it be with the assert_getpwall_name.
>>> Of course we could check for more than just correct
>>> "name" attribute, but checking just the "name" attribute
>>> should be possible (we would only test requested
>>> parts of pwd structure). As you see, we do not
>>> need to filter any root user if we do it this way
>>> (yes the root will be there in the returned list
>>> by getpwall but only names in the uid_expval_list
>>> will be used).
>>>
>>> Anyway, I am OK if the getpwall part is done later
>>> and for now only the simple asserts are implemented
>>> and used in the sanity tests.
>>
>> This looks almost perfectly fine, but it accounts only for checking
>> users that
>> should be there, yet not for users that *shouldn't* be there. So, I
>> think it
>> is still better to explicitly remove that one root account and maybe have
>> variations of assert_getpwall* which check for the absence of extra users.
>>
>
> I am not sure if this is good. getpwall can return a lot of
> users we do not care about (root, ldap, ntp, abrt, etc.).
> IMO we should simply ignore them and do not mention them
> in any way in the code. I do not think the API provides
> a way to ask for sssd managed users only, like in
> getent -s sss passwd (correct me if I am wrong). I f there was
> such option, then that would be what we would do, but if there
> is not, I think ignoring the users is OK.

Yes, that would be true, if we were using the host's passwd and group
databases, but we're not. We're using nss_wrapper with our own dummy passwd
and group files, generated in src/tests/intg/Makefile.am and containing only
"root" entries.

I did that specifically to avoid clashes with host databases.

Nick



More information about the sssd-devel mailing list