[SSSD] [PATCH] Add integration tests

Nikolai Kondrashov Nikolai.Kondrashov at redhat.com
Tue Apr 21 14:08:38 UTC 2015


On 04/21/2015 04:59 PM, Michal Židek wrote:
> On 04/21/2015 03:32 PM, Nikolai Kondrashov wrote:
>> On 04/21/2015 04:23 PM, Michal Židek wrote:
>>> On 04/20/2015 07:15 PM, Nikolai Kondrashov wrote:
>>>> On 03/19/2015 07:27 PM, Michal Židek wrote:
>>>>> On 03/18/2015 03:48 PM, Nikolai Kondrashov wrote:
>>>>>> On 03/18/2015 03:06 AM, Michal Židek wrote:
>>>>>
>>>>> I see. You mean to test results from getpwall.
>>>>> We could do this:
>>>>> Create simple asserts like
>>>>> assert_get_user_by_uid and
>>>>> assert_get_user_by_name
>>>>> as described in my previous mail bellow. Than
>>>>> create their getpwall ekvivalents like
>>>>> assert_getpwall_uid
>>>>> assert_getpwall_name
>>>>>
>>>>> These functions would have the same arguments as
>>>>> the simpler asserts (not just one time, but as
>>>>> a list).
>>>>> In these functions we would first convert the list
>>>>> returned by getpwall to a dictionary where the
>>>>> uid (name) will be a key and the pwd structure a
>>>>> value. Then we would iterate throught the list
>>>>> of input values and for each UID (name) we
>>>>> would check if the expected value is matching the
>>>>> pwd structure (in the same way as the simple
>>>>> asserts will do, so the matching part will be
>>>>> reusable). The usage would be like this:
>>>>>
>>>>> uid_expval_list = [(2001, {"name"="user1"}),
>>>>>                     (2002, {"name"="user2"})]
>>>>>
>>>>> assert_getpwall_uid(ldap_conn, uid_expval_list)
>>>>>
>>>>> Similiar would it be with the assert_getpwall_name.
>>>>> Of course we could check for more than just correct
>>>>> "name" attribute, but checking just the "name" attribute
>>>>> should be possible (we would only test requested
>>>>> parts of pwd structure). As you see, we do not
>>>>> need to filter any root user if we do it this way
>>>>> (yes the root will be there in the returned list
>>>>> by getpwall but only names in the uid_expval_list
>>>>> will be used).
>>>>>
>>>>> Anyway, I am OK if the getpwall part is done later
>>>>> and for now only the simple asserts are implemented
>>>>> and used in the sanity tests.
>>>>
>>>> This looks almost perfectly fine, but it accounts only for checking
>>>> users that
>>>> should be there, yet not for users that *shouldn't* be there. So, I
>>>> think it
>>>> is still better to explicitly remove that one root account and maybe
>>>> have
>>>> variations of assert_getpwall* which check for the absence of extra
>>>> users.
>>>>
>>>
>>> I am not sure if this is good. getpwall can return a lot of
>>> users we do not care about (root, ldap, ntp, abrt, etc.).
>>> IMO we should simply ignore them and do not mention them
>>> in any way in the code. I do not think the API provides
>>> a way to ask for sssd managed users only, like in
>>> getent -s sss passwd (correct me if I am wrong). I f there was
>>> such option, then that would be what we would do, but if there
>>> is not, I think ignoring the users is OK.
>>
>> Yes, that would be true, if we were using the host's passwd and group
>> databases, but we're not. We're using nss_wrapper with our own dummy passwd
>> and group files, generated in src/tests/intg/Makefile.am and containing
>> only
>> "root" entries.
>>
>> I did that specifically to avoid clashes with host databases.
>>
>> Nick
>
> That is true, I did not realize that. In that case removing
> the root is OK. Just make sure you remove the one big assert
> and replace it with smaller ones that check one particular
> thing (as I described in some previous mail).

Sure, I'm working on that at the moment. Will send updates.

Nick



More information about the sssd-devel mailing list