[SSSD] [PATCH] Add integration tests

Michal Židek mzidek at redhat.com
Tue Apr 21 13:59:29 UTC 2015


On 04/21/2015 03:32 PM, Nikolai Kondrashov wrote:
> On 04/21/2015 04:23 PM, Michal Židek wrote:
>> On 04/20/2015 07:15 PM, Nikolai Kondrashov wrote:
>>> On 03/19/2015 07:27 PM, Michal Židek wrote:
>>>> On 03/18/2015 03:48 PM, Nikolai Kondrashov wrote:
>>>>> On 03/18/2015 03:06 AM, Michal Židek wrote:
>>>>
>>>> I see. You mean to test results from getpwall.
>>>> We could do this:
>>>> Create simple asserts like
>>>> assert_get_user_by_uid and
>>>> assert_get_user_by_name
>>>> as described in my previous mail bellow. Than
>>>> create their getpwall ekvivalents like
>>>> assert_getpwall_uid
>>>> assert_getpwall_name
>>>>
>>>> These functions would have the same arguments as
>>>> the simpler asserts (not just one time, but as
>>>> a list).
>>>> In these functions we would first convert the list
>>>> returned by getpwall to a dictionary where the
>>>> uid (name) will be a key and the pwd structure a
>>>> value. Then we would iterate throught the list
>>>> of input values and for each UID (name) we
>>>> would check if the expected value is matching the
>>>> pwd structure (in the same way as the simple
>>>> asserts will do, so the matching part will be
>>>> reusable). The usage would be like this:
>>>>
>>>> uid_expval_list = [(2001, {"name"="user1"}),
>>>>                     (2002, {"name"="user2"})]
>>>>
>>>> assert_getpwall_uid(ldap_conn, uid_expval_list)
>>>>
>>>> Similiar would it be with the assert_getpwall_name.
>>>> Of course we could check for more than just correct
>>>> "name" attribute, but checking just the "name" attribute
>>>> should be possible (we would only test requested
>>>> parts of pwd structure). As you see, we do not
>>>> need to filter any root user if we do it this way
>>>> (yes the root will be there in the returned list
>>>> by getpwall but only names in the uid_expval_list
>>>> will be used).
>>>>
>>>> Anyway, I am OK if the getpwall part is done later
>>>> and for now only the simple asserts are implemented
>>>> and used in the sanity tests.
>>>
>>> This looks almost perfectly fine, but it accounts only for checking
>>> users that
>>> should be there, yet not for users that *shouldn't* be there. So, I
>>> think it
>>> is still better to explicitly remove that one root account and maybe
>>> have
>>> variations of assert_getpwall* which check for the absence of extra
>>> users.
>>>
>>
>> I am not sure if this is good. getpwall can return a lot of
>> users we do not care about (root, ldap, ntp, abrt, etc.).
>> IMO we should simply ignore them and do not mention them
>> in any way in the code. I do not think the API provides
>> a way to ask for sssd managed users only, like in
>> getent -s sss passwd (correct me if I am wrong). I f there was
>> such option, then that would be what we would do, but if there
>> is not, I think ignoring the users is OK.
>
> Yes, that would be true, if we were using the host's passwd and group
> databases, but we're not. We're using nss_wrapper with our own dummy passwd
> and group files, generated in src/tests/intg/Makefile.am and containing
> only
> "root" entries.
>
> I did that specifically to avoid clashes with host databases.
>
> Nick

That is true, I did not realize that. In that case removing
the root is OK. Just make sure you remove the one big assert
and replace it with smaller ones that check one particular
thing (as I described in some previous mail).

Michal



More information about the sssd-devel mailing list