[SSSD] [PATCH v2] intg: Add more LDAP tests

Michal Židek mzidek at redhat.com
Fri Oct 23 11:54:13 UTC 2015


Hi!

There is one new pep8 error in the code:
../src/tests/intg/ldap_test.py:819:37: E126 continuation line 
over-indented for hanging indent


For the memcache workaroud please do this change in the
code:
diff --git a/src/tests/intg/ldap_test.py b/src/tests/intg/ldap_test.py
index 8263d88..eb466ab 100644
--- a/src/tests/intg/ldap_test.py
+++ b/src/tests/intg/ldap_test.py
@@ -194,8 +194,10 @@ def cleanup_sssd_process():
      subprocess.call(["sss_cache", "-E"])
      for path in os.listdir(config.DB_PATH):
          os.unlink(config.DB_PATH + "/" + path)
-    for path in os.listdir(config.MCACHE_PATH):
-        os.unlink(config.MCACHE_PATH + "/" + path)
+    # FIXME: Uncomment this when ticket #2726 is solved
+    # https://fedorahosted.org/sssd/ticket/2726
+    # for path in os.listdir(config.MCACHE_PATH):
+    #    os.unlink(config.MCACHE_PATH + "/" + path)


See some comments bellow...

On 10/12/2015 03:31 PM, Nikolai Kondrashov wrote:
>
> 0002-intg-Add-more-LDAP-tests.patch
>
>
>  From a2c75e045f8f341402a5c771489b462f18e27a39 Mon Sep 17 00:00:00 2001
> From: Nikolai Kondrashov<Nikolai.Kondrashov at redhat.com>
> Date: Tue, 29 Sep 2015 21:18:18 +0300
> Subject: [PATCH 2/3] intg: Add more LDAP tests
>
> Add a bunch of LDAP tests.
>
>      * Adding/removing a user/group/membership with rfc2307(bis) schema.
>      * Filtering users/groups with rfc2307(bis) schema.
>      * The effect of override_homedir option.
>      * The effect of fallback_homedir option.
>      * The effect of override_shell option.
>      * The effect of shell_fallback option.
>      * The effect of default_shell option.
>      * The effect of vetoed_shells option.
> ---
>   src/tests/intg/ldap_test.py | 534 ++++++++++++++++++++++++++++++++++++++++++++
>   1 file changed, 534 insertions(+)
>
> diff --git a/src/tests/intg/ldap_test.py b/src/tests/intg/ldap_test.py
> index 6a09b37..cca9431 100644
> --- a/src/tests/intg/ldap_test.py
> +++ b/src/tests/intg/ldap_test.py
> @@ -125,6 +125,23 @@ def format_basic_conf(ldap_conn, schema, enum):
>       """).format(**locals())
>
>
> +def format_interactive_conf(ldap_conn, schema):
> +    """Format an SSSD configuration with all caches refreshing in 4 seconds"""
> +    return \
> +        format_basic_conf(ldap_conn, schema, enum=True) + \
> +        unindent("""
> +            [nss]
> +            memcache_timeout                    = 4

It is better to set memcache timeout to zero outside tests
that are not dedicated to memcache. This will also probably
solve the membership tests failure that you saw when using the
workaround for the memcache tests failure.

> +            enum_cache_timeout                  = 4
> +            entry_negative_timeout              = 4

I would set negative cache timeout to zero as well,
see comments below.

> +
> +            [domain/LDAP]
> +            ldap_enumeration_refresh_timeout    = 4
> +            ldap_purge_cache_timeout            = 1
> +            entry_cache_timeout                 = 4
> +        """)
> +
> +
>   def create_conf_file(contents):
>       """Create sssd.conf with specified contents"""
>       conf = open(config.CONF_PATH, "w")
> @@ -387,3 +404,520 @@ def test_refresh_after_cleanup_task(ldap_conn, refresh_after_cleanup_task):
>       ent.assert_group_by_name(
>           "group2",
>           dict(mem=ent.contains_only("user1")))
> +
> +
> + at pytest.fixture
> +def blank_rfc2307(request, ldap_conn):
> +    """Create blank RFC2307 directory fixture with interactive SSSD conf"""
> +    create_ldap_cleanup(request, ldap_conn)
> +    create_conf_fixture(request,
> +                        format_interactive_conf(ldap_conn, SCHEMA_RFC2307))
> +    create_sssd_fixture(request)
> +
> +
> + at pytest.fixture
> +def blank_rfc2307_bis(request, ldap_conn):
> +    """Create blank RFC2307bis directory fixture with interactive SSSD conf"""
> +    create_ldap_cleanup(request, ldap_conn)
> +    create_conf_fixture(request,
> +                        format_interactive_conf(ldap_conn, SCHEMA_RFC2307_BIS))
> +    create_sssd_fixture(request)
> +
> +
> + at pytest.fixture
> +def user_and_group_rfc2307(request, ldap_conn):
> +    """
> +    Create an RFC2307 directory fixture with interactive SSSD conf,
> +    one user and one group
> +    """
> +    ent_list = ldap_ent.List(ldap_conn.ds_inst.base_dn)
> +    ent_list.add_user("user", 1001, 2000)
> +    ent_list.add_group("group", 2001)
> +    create_ldap_fixture(request, ldap_conn, ent_list)
> +    create_conf_fixture(request,
> +                        format_interactive_conf(ldap_conn, SCHEMA_RFC2307))
> +    create_sssd_fixture(request)
> +    return None
> +
> +
> + at pytest.fixture
> +def user_and_groups_rfc2307_bis(request, ldap_conn):
> +    """
> +    Create an RFC2307bis directory fixture with interactive SSSD conf,
> +    one user and two groups
> +    """
> +    ent_list = ldap_ent.List(ldap_conn.ds_inst.base_dn)
> +    ent_list.add_user("user", 1001, 2000)
> +    ent_list.add_group_bis("group1", 2001)
> +    ent_list.add_group_bis("group2", 2002)
> +    create_ldap_fixture(request, ldap_conn, ent_list)
> +    create_conf_fixture(request,
> +                        format_interactive_conf(ldap_conn, SCHEMA_RFC2307_BIS))
> +    create_sssd_fixture(request)
> +    return None
> +
> +
> +def test_add_remove_user(ldap_conn, blank_rfc2307):
> +    """Test user addition and removal are reflected by SSSD"""
> +    e = ldap_ent.user(ldap_conn.ds_inst.base_dn, "user", 1001, 2000)
> +    time.sleep(2)

What is the purpose of this timeout? It does not seem to be
necessary. You use it in all the other tests as well, so
I guess it had some meaning (but I tried to remove them and
tests passed for me without problems).

> +    # Add the user
> +    ent.assert_passwd(ent.contains_only())
> +    ldap_conn.add_s(*e)
> +    ent.assert_passwd(ent.contains_only())

I would avoid testing the negative cache outside tests
that are dedicated to negative cache. We had this same
pattern in our C code tests and it timed out when CI
was under heavy load. We can add dedicated tests
for negative cache in CI later with big enough timeout
to pass even under heavy load CI.

So please, remove the negative cache testing from everywhere
in these tests.

> +    time.sleep(4)

Instead of the number 4, could you use some global constant. You
could use the constant to generate the "interactive" config
file as well. If we later see some timeout issues related to
this, we can change it on one place. Also I think that this
particular timeout will not be necessary if we stop testing the
negative cache, which will speed up the tests.

> +    ent.assert_passwd(ent.contains_only(dict(name="user", uid=1001)))
> +    # Remove the user
> +    ldap_conn.delete_s(e[0])
> +    ent.assert_passwd(ent.contains_only(dict(name="user", uid=1001)))
> +    time.sleep(4)
> +    ent.assert_passwd(ent.contains_only())
> +
> +
> +def test_add_remove_group_rfc2307(ldap_conn, blank_rfc2307):
> +    """Test RFC2307 group addition and removal are reflected by SSSD"""
> +    e = ldap_ent.group(ldap_conn.ds_inst.base_dn, "group", 2001)
> +    time.sleep(2)
> +    # Add the group
> +    ent.assert_group(ent.contains_only())
> +    ldap_conn.add_s(*e)
> +    ent.assert_group(ent.contains_only())
> +    time.sleep(4)
> +    ent.assert_group(ent.contains_only(dict(name="group", gid=2001)))
> +    # Remove the group
> +    ldap_conn.delete_s(e[0])
> +    ent.assert_group(ent.contains_only(dict(name="group", gid=2001)))
> +    time.sleep(4)
> +    ent.assert_group(ent.contains_only())
> +
> +
> +def test_add_remove_group_rfc2307_bis(ldap_conn, blank_rfc2307_bis):
> +    """Test RFC2307bis group addition and removal are reflected by SSSD"""
> +    e = ldap_ent.group_bis(ldap_conn.ds_inst.base_dn, "group", 2001)
> +    time.sleep(2)
> +    # Add the group
> +    ent.assert_group(ent.contains_only())
> +    ldap_conn.add_s(*e)
> +    ent.assert_group(ent.contains_only())
> +    time.sleep(4)
> +    ent.assert_group(ent.contains_only(dict(name="group", gid=2001)))
> +    # Remove the group
> +    ldap_conn.delete_s(e[0])
> +    ent.assert_group(ent.contains_only(dict(name="group", gid=2001)))
> +    time.sleep(4)
> +    ent.assert_group(ent.contains_only())
> +
> +
> +def test_add_remove_membership_rfc2307(ldap_conn, user_and_group_rfc2307):
> +    """Test user membership addition and removal are reflected by SSSD"""
> +    time.sleep(2)
> +    # Add user to group
> +    ent.assert_group_by_name("group", dict(mem=ent.contains_only()))
> +    ldap_conn.modify_s("cn=group,ou=Groups," + ldap_conn.ds_inst.base_dn,
> +                       [(ldap.MOD_REPLACE, "memberUid", "user")])
> +    ent.assert_group_by_name("group", dict(mem=ent.contains_only()))
> +    time.sleep(4)
> +    ent.assert_group_by_name("group", dict(mem=ent.contains_only("user")))
> +    # Remove user from group
> +    ldap_conn.modify_s("cn=group,ou=Groups," + ldap_conn.ds_inst.base_dn,
> +                       [(ldap.MOD_DELETE, "memberUid", None)])
> +    ent.assert_group_by_name("group", dict(mem=ent.contains_only("user")))
> +    time.sleep(4)
> +    ent.assert_group_by_name("group", dict(mem=ent.contains_only()))
> +
> +
> +def test_add_remove_membership_rfc2307_bis(ldap_conn,
> +                                           user_and_groups_rfc2307_bis):
> +    """
> +    Test user and group membership addition and removal are reflected by SSSD,
> +    with RFC2307bis schema
> +    """
> +    time.sleep(2)
> +    # Add user to group1
> +    ent.assert_group_by_name("group1", dict(mem=ent.contains_only()))
> +    ldap_conn.modify_s("cn=group1,ou=Groups," + ldap_conn.ds_inst.base_dn,
> +                       [(ldap.MOD_REPLACE, "member",
> +                         "uid=user,ou=Users," + ldap_conn.ds_inst.base_dn)])
> +    ent.assert_group_by_name("group1", dict(mem=ent.contains_only()))
> +    time.sleep(4)
> +    ent.assert_group_by_name("group1", dict(mem=ent.contains_only("user")))
> +
> +    # Add group1 to group2
> +    ldap_conn.modify_s("cn=group2,ou=Groups," + ldap_conn.ds_inst.base_dn,
> +                       [(ldap.MOD_REPLACE, "member",
> +                         "cn=group1,ou=Groups," + ldap_conn.ds_inst.base_dn)])
> +    ent.assert_group_by_name("group2", dict(mem=ent.contains_only()))
> +    time.sleep(4)
> +    ent.assert_group_by_name("group2", dict(mem=ent.contains_only("user")))
> +
> +    # Remove group1 from group2
> +    ldap_conn.modify_s("cn=group2,ou=Groups," + ldap_conn.ds_inst.base_dn,
> +                       [(ldap.MOD_DELETE, "member", None)])
> +    ent.assert_group_by_name("group2", dict(mem=ent.contains_only("user")))
> +    time.sleep(4)
> +    ent.assert_group_by_name("group2", dict(mem=ent.contains_only()))
> +
> +    # Remove user from group1
> +    ldap_conn.modify_s("cn=group1,ou=Groups," + ldap_conn.ds_inst.base_dn,
> +                       [(ldap.MOD_DELETE, "member", None)])
> +    ent.assert_group_by_name("group1", dict(mem=ent.contains_only("user")))
> +    time.sleep(4)
> +    ent.assert_group_by_name("group1", dict(mem=ent.contains_only()))
> +
> +
> + at pytest.fixture
> +def void_conf(request):
> +    create_conf_cleanup(request)
> +
> +
> + at pytest.fixture
> +def void_sssd(request):
> +    create_sssd_cleanup(request)
> +
> +
> + at pytest.fixture
> +def three_users_three_groups_rfc2307(request, ldap_conn):
> +    ent_list = ldap_ent.List(ldap_conn.ds_inst.base_dn)
> +    ent_list.add_user("user1", 1001, 2001)
> +    ent_list.add_user("user2", 1002, 2002)
> +    ent_list.add_user("user3", 1003, 2003)
> +    ent_list.add_group("group1", 2001, ["user1"])
> +    ent_list.add_group("group2", 2002, ["user2"])
> +    ent_list.add_group("group3", 2003, ["user3"])
> +    create_ldap_fixture(request, ldap_conn, ent_list)
> +
> +
> +def test_filter_users(request, ldap_conn, three_users_three_groups_rfc2307,
> +                      void_conf, void_sssd):
> +    """Test the effect of the "filter_users" option"""
> +    all_users = frozenset([1, 2, 3])
> +    for filter_users_in_groups in [False, True]:
> +        for filter_users in [frozenset([]),
> +                             frozenset([1]),
> +                             frozenset([1, 2]),
> +                             frozenset([1, 2, 3])]:
> +            unfiltered_users = all_users - filter_users
> +            filter_users_str = ",".join(map(lambda i: "user" + str(i),
> +                                            filter_users))
> +
> +            conf = \
> +                format_basic_conf(ldap_conn, SCHEMA_RFC2307, enum=True) + \
> +                unindent("""
> +                    [nss]
> +                    filter_users            = {filter_users_str}
> +                    filter_users_in_groups  = {filter_users_in_groups}

Instead of generating the conf files in nested for loops, it would be
better to split the test to multiple smaller tests where each has
different config file fixture (instad of void_conf and void_sssd).
This may seem like code duplication, but I believe it will result in
better readable code.

> +                """).format(**locals())
> +            create_conf_file(conf)
> +            create_sssd_process()
> +            ent.assert_passwd(
> +                ent.contains_only(
> +                    *map(
> +                        lambda i:
> +                            dict(name="user" + str(i), uid=1000 + i),
> +                        unfiltered_users
> +                    )
> +                )
> +            )
> +            ent.assert_group(
> +                ent.contains_only(
> +                    *map(
> +                        lambda i:
> +                            dict(
> +                                name="group" + str(i),
> +                                gid=2000 + i,
> +                                mem=ent.contains_only()
> +                                if filter_users_in_groups and i in filter_users
> +                                else ent.contains_only("user" + str(i))
> +                            ),
> +                        all_users
> +                    )
> +                )
> +            )
> +            cleanup_sssd_process()
> +            cleanup_conf_file()
> +
> +
> +def test_filter_groups_rfc2307(request, ldap_conn,
> +                               three_users_three_groups_rfc2307,
> +                               void_conf, void_sssd):
> +    """Test the effect of the "filter_groups" option with RFC2307 groups"""
> +    all_groups = frozenset([1, 2, 3])
> +    for filter_groups in [frozenset([]),
> +                          frozenset([1]),
> +                          frozenset([1, 2]),
> +                          frozenset([1, 2, 3])]:
> +        unfiltered_groups = all_groups - filter_groups
> +        filter_groups_str = ",".join(map(lambda i: "group" + str(i),
> +                                         filter_groups))
> +
> +        conf = \
> +            format_basic_conf(ldap_conn, SCHEMA_RFC2307, enum=True) + \
> +            unindent("""
> +                [nss]
> +                filter_groups   = {filter_groups_str}

Same as above, please do not generate the conf file inside the test, but
split it to multiple tests.

> +            """).format(**locals())
> +        create_conf_file(conf)
> +        create_sssd_process()
> +        ent.assert_group(
> +            ent.contains_only(
> +                *map(
> +                    lambda i:
> +                        dict(
> +                            name="group" + str(i),
> +                            gid=2000 + i,
> +                            mem=ent.contains_only("user" + str(i))
> +                        ),
> +                    unfiltered_groups
> +                )
> +            )
> +        )
> +        cleanup_sssd_process()
> +        cleanup_conf_file()
> +
> +
> + at pytest.fixture
> +def three_users_three_groups_rfc2307_bis(request, ldap_conn):
> +    ent_list = ldap_ent.List(ldap_conn.ds_inst.base_dn)
> +    ent_list.add_user("user1", 1001, 2001)
> +    ent_list.add_user("user2", 1002, 2002)
> +    ent_list.add_user("user3", 1003, 2003)
> +    ent_list.add_group_bis("group1", 2001, ["user1"])
> +    ent_list.add_group_bis("group2", 2002, ["user2"], ["group1"])
> +    ent_list.add_group_bis("group3", 2003, ["user3"], ["group2"])
> +    create_ldap_fixture(request, ldap_conn, ent_list)
> +
> +
> +def test_filter_groups_rfc2307_bis(request, ldap_conn,
> +                                   three_users_three_groups_rfc2307_bis,
> +                                   void_conf, void_sssd):
> +    """Test the effect of the "filter_groups" option with RFC2307bis groups"""
> +    all_groups = frozenset([1, 2, 3])
> +    for filter_groups in [frozenset([]),
> +                          frozenset([1]),
> +                          frozenset([1, 2]),
> +                          frozenset([1, 2, 3])]:
> +        unfiltered_groups = all_groups - filter_groups
> +        filter_groups_str = ",".join(map(lambda i: "group" + str(i),
> +                                         filter_groups))
> +
> +        conf = \
> +            format_basic_conf(ldap_conn, SCHEMA_RFC2307_BIS, enum=True) + \
> +            unindent("""
> +                [nss]
> +                filter_groups   = {filter_groups_str}

The same thing as above.

> +            """).format(**locals())
> +        create_conf_file(conf)
> +        create_sssd_process()
> +        ent.assert_group(
> +            ent.contains_only(
> +                *map(
> +                    lambda i:
> +                        dict(
> +                            name="group" + str(i),
> +                            gid=2000 + i,
> +                            mem=ent.contains_only(
> +                                    *map(lambda j: "user" + str(j),
> +                                         range(1, i + 1)))
> +                        ),
> +                    unfiltered_groups
> +                )
> +            )
> +        )
> +        cleanup_sssd_process()
> +        cleanup_conf_file()
> +
> +
> + at pytest.fixture
> +def override_homedir(request, ldap_conn):
> +    ent_list = ldap_ent.List(ldap_conn.ds_inst.base_dn)
> +    ent_list.add_user("user_with_homedir_A", 1001, 2001,
> +                      homeDirectory="/home/A")
> +    ent_list.add_user("user_with_homedir_B", 1002, 2002,
> +                      homeDirectory="/home/B")
> +    ent_list.add_user("user_with_empty_homedir", 1003, 2003,
> +                      homeDirectory="")
> +    create_ldap_fixture(request, ldap_conn, ent_list)
> +    conf = \
> +        format_basic_conf(ldap_conn, SCHEMA_RFC2307, enum=True) + \
> +        unindent("""\
> +            [nss]
> +            override_homedir    = /home/B
> +        """).format(**locals())
> +    create_conf_fixture(request, conf)
> +    create_sssd_fixture(request)
> +
> +
> +def test_override_homedir(override_homedir):
> +    """Test the effect of the "override_homedir" option"""
> +    ent.assert_passwd(
> +        ent.contains_only(
> +            dict(name="user_with_homedir_A", uid=1001, dir="/home/B"),
> +            dict(name="user_with_homedir_B", uid=1002, dir="/home/B"),
> +            dict(name="user_with_empty_homedir", uid=1003, dir="/home/B")
> +        )
> +    )
> +
> +
> + at pytest.fixture
> +def fallback_homedir(request, ldap_conn):
> +    ent_list = ldap_ent.List(ldap_conn.ds_inst.base_dn)
> +    ent_list.add_user("user_with_homedir_A", 1001, 2001,
> +                      homeDirectory="/home/A")
> +    ent_list.add_user("user_with_homedir_B", 1002, 2002,
> +                      homeDirectory="/home/B")
> +    ent_list.add_user("user_with_empty_homedir", 1003, 2003,
> +                      homeDirectory="")
> +    create_ldap_fixture(request, ldap_conn, ent_list)
> +    conf = \
> +        format_basic_conf(ldap_conn, SCHEMA_RFC2307, enum=True) + \
> +        unindent("""\
> +            [nss]
> +            fallback_homedir    = /home/B
> +        """).format(**locals())
> +    create_conf_fixture(request, conf)
> +    create_sssd_fixture(request)
> +
> +
> +def test_fallback_homedir(fallback_homedir):
> +    """Test the effect of the "fallback_homedir" option"""
> +    ent.assert_passwd(
> +        ent.contains_only(
> +            dict(name="user_with_homedir_A", uid=1001, dir="/home/A"),
> +            dict(name="user_with_homedir_B", uid=1002, dir="/home/B"),
> +            dict(name="user_with_empty_homedir", uid=1003, dir="/home/B")
> +        )
> +    )
> +
> +
> + at pytest.fixture
> +def override_shell(request, ldap_conn):
> +    ent_list = ldap_ent.List(ldap_conn.ds_inst.base_dn)
> +    ent_list.add_user("user_with_shell_A", 1001, 2001,
> +                      loginShell="/bin/A")
> +    ent_list.add_user("user_with_shell_B", 1002, 2002,
> +                      loginShell="/bin/B")
> +    ent_list.add_user("user_with_empty_shell", 1003, 2003,
> +                      loginShell="")
> +    create_ldap_fixture(request, ldap_conn, ent_list)
> +    conf = \
> +        format_basic_conf(ldap_conn, SCHEMA_RFC2307, enum=True) + \
> +        unindent("""\
> +            [nss]
> +            override_shell      = /bin/B
> +        """).format(**locals())
> +    create_conf_fixture(request, conf)
> +    create_sssd_fixture(request)
> +
> +
> +def test_override_shell(override_shell):
> +    """Test the effect of the "override_shell" option"""
> +    ent.assert_passwd(
> +        ent.contains_only(
> +            dict(name="user_with_shell_A", uid=1001, shell="/bin/B"),
> +            dict(name="user_with_shell_B", uid=1002, shell="/bin/B"),
> +            dict(name="user_with_empty_shell", uid=1003, shell="/bin/B")
> +        )
> +    )
> +
> +
> + at pytest.fixture
> +def shell_fallback(request, ldap_conn):
> +    ent_list = ldap_ent.List(ldap_conn.ds_inst.base_dn)
> +    ent_list.add_user("user_with_sh_shell", 1001, 2001,
> +                      loginShell="/bin/sh")
> +    ent_list.add_user("user_with_not_installed_shell", 1002, 2002,
> +                      loginShell="/bin/not_installed")
> +    ent_list.add_user("user_with_empty_shell", 1003, 2003,
> +                      loginShell="")
> +    create_ldap_fixture(request, ldap_conn, ent_list)
> +    conf = \
> +        format_basic_conf(ldap_conn, SCHEMA_RFC2307, enum=True) + \
> +        unindent("""\
> +            [nss]
> +            shell_fallback      = /bin/fallback
> +            allowed_shells      = /bin/not_installed
> +        """).format(**locals())
> +    create_conf_fixture(request, conf)
> +    create_sssd_fixture(request)
> +
> +
> +def test_shell_fallback(shell_fallback):
> +    """Test the effect of the "shell_fallback" option"""
> +    ent.assert_passwd(
> +        ent.contains_only(
> +            dict(name="user_with_sh_shell", uid=1001, shell="/bin/sh"),
> +            dict(name="user_with_not_installed_shell", uid=1002,
> +                 shell="/bin/fallback"),
> +            dict(name="user_with_empty_shell", uid=1003, shell="")
> +        )
> +    )
> +
> +
> + at pytest.fixture
> +def default_shell(request, ldap_conn):
> +    ent_list = ldap_ent.List(ldap_conn.ds_inst.base_dn)
> +    ent_list.add_user("user_with_sh_shell", 1001, 2001,
> +                      loginShell="/bin/sh")
> +    ent_list.add_user("user_with_not_installed_shell", 1002, 2002,
> +                      loginShell="/bin/not_installed")
> +    ent_list.add_user("user_with_empty_shell", 1003, 2003,
> +                      loginShell="")
> +    create_ldap_fixture(request, ldap_conn, ent_list)
> +    conf = \
> +        format_basic_conf(ldap_conn, SCHEMA_RFC2307, enum=True) + \
> +        unindent("""\
> +            [nss]
> +            default_shell       = /bin/default
> +            allowed_shells      = /bin/default, /bin/not_installed
> +            shell_fallback      = /bin/fallback
> +        """).format(**locals())
> +    create_conf_fixture(request, conf)
> +    create_sssd_fixture(request)
> +
> +
> +def test_default_shell(default_shell):
> +    """Test the effect of the "default_shell" option"""
> +    ent.assert_passwd(
> +        ent.contains_only(
> +            dict(name="user_with_sh_shell", uid=1001, shell="/bin/sh"),
> +            dict(name="user_with_not_installed_shell", uid=1002,
> +                 shell="/bin/fallback"),
> +            dict(name="user_with_empty_shell", uid=1003,
> +                 shell="/bin/default")
> +        )
> +    )
> +
> +
> + at pytest.fixture
> +def vetoed_shells(request, ldap_conn):
> +    ent_list = ldap_ent.List(ldap_conn.ds_inst.base_dn)
> +    ent_list.add_user("user_with_sh_shell", 1001, 2001,
> +                      loginShell="/bin/sh")
> +    ent_list.add_user("user_with_vetoed_shell", 1002, 2002,
> +                      loginShell="/bin/vetoed")
> +    ent_list.add_user("user_with_empty_shell", 1003, 2003,
> +                      loginShell="")
> +    create_ldap_fixture(request, ldap_conn, ent_list)
> +    conf = \
> +        format_basic_conf(ldap_conn, SCHEMA_RFC2307, enum=True) + \
> +        unindent("""\
> +            [nss]
> +            default_shell       = /bin/default
> +            vetoed_shells       = /bin/vetoed
> +            shell_fallback      = /bin/fallback
> +        """).format(**locals())
> +    create_conf_fixture(request, conf)
> +    create_sssd_fixture(request)
> +
> +
> +def test_vetoed_shells(vetoed_shells):
> +    """Test the effect of the "vetoed_shells" option"""
> +    ent.assert_passwd(
> +        ent.contains_only(
> +            dict(name="user_with_sh_shell", uid=1001, shell="/bin/sh"),
> +            dict(name="user_with_vetoed_shell", uid=1002,
> +                 shell="/bin/fallback"),
> +            dict(name="user_with_empty_shell", uid=1003,
> +                 shell="/bin/default")
> +        )
> +    )
> -- 2.6.1
>
>
> 0003-intg-Add-a-memcache-invalidation-failure-test.patch
>
>
>  From 2c13856c9f650503b8eeb2d4446469548728804b Mon Sep 17 00:00:00 2001
> From: Nikolai Kondrashov<Nikolai.Kondrashov at redhat.com>
> Date: Mon, 12 Oct 2015 16:17:46 +0300
> Subject: [PATCH 3/3] intg: Add a memcache invalidation failure test
>
> Add a memcache invalidation failure integration test. It fails as is,
> and passes if ldap_enumeration_refresh_timeout in the first half is set
> to e.g. 30. The sss_nss_check_header function was observed to always
> return 0 for the second half of the test, when it was failing.

This test passes for me with the memcache workaround. I guess we do
not need it then. The reproducer for the failure can be achieved
by removing the workaround (which we will do once we fix the
root cause).

> ---
>   src/tests/intg/ldap_test.py | 98 +++++++++++++++++++++++++++++++++++++++++++++
>   1 file changed, 98 insertions(+)
>
> diff --git a/src/tests/intg/ldap_test.py b/src/tests/intg/ldap_test.py
> index cca9431..cdd8c8d 100644
> --- a/src/tests/intg/ldap_test.py
> +++ b/src/tests/intg/ldap_test.py
> @@ -474,6 +474,99 @@ def test_add_remove_user(ldap_conn, blank_rfc2307):
>       ent.assert_passwd(ent.contains_only())
>
>
> +def test_add_remove_user_memcache_mix(ldap_conn,
> +                                      void_conf,
> +                                      void_sssd,
> +                                      void_ldap):
> +    # Setup
> +    conf = unindent("""\
> +            [sssd]
> +            debug_level         = 0xffff
> +            domains             = LDAP
> +            services            = nss, pam
> +
> +            [nss]
> +            memcache_timeout    = 0
> +
> +            [pam]
> +
> +            [domain/LDAP]
> +            ldap_auth_disable_tls_never_use_in_production = true
> +            debug_level         = 0xffff
> +            ldap_schema         = rfc2307
> +            enumerate           = true
> +            id_provider         = ldap
> +            auth_provider       = ldap
> +            ldap_uri            = {ldap_conn.ds_inst.ldap_url}
> +            ldap_search_base    = {ldap_conn.ds_inst.base_dn}
> +
> +            ldap_enumeration_refresh_timeout    = 4
> +            ldap_purge_cache_timeout            = 1
> +            entry_cache_timeout                 = 4
> +    """).format(**locals())
> +    create_conf_file(conf)
> +    create_sssd_process()
> +    e = ldap_ent.user(ldap_conn.ds_inst.base_dn, "user", 1001, 2001)
> +    time.sleep(2)
> +    # Add the user
> +    ldap_conn.add_s(*e)
> +    time.sleep(4)
> +    pwd.getpwnam("user")
> +    # Remove the user
> +    ldap_conn.delete_s(e[0])
> +    time.sleep(4)
> +    # Teardown
> +    cleanup_sssd_process()
> +    cleanup_conf_file()
> +    cleanup_ldap_entries(ldap_conn)
> +
> +    # Setup
> +    e = ldap_ent.user(ldap_conn.ds_inst.base_dn, "user", 1001, 2001)
> +    ldap_conn.add_s(*e)
> +    conf = unindent("""\
> +        [sssd]
> +        domains             = LDAP
> +        services            = nss
> +
> +        [nss]
> +        debug_level         = 0xffff
> +
> +        [domain/LDAP]
> +        ldap_auth_disable_tls_never_use_in_production = true
> +        ldap_schema         = rfc2307
> +        id_provider         = ldap
> +        auth_provider       = ldap
> +        sudo_provider       = ldap
> +        ldap_uri            = {ldap_conn.ds_inst.ldap_url}
> +        ldap_search_base    = {ldap_conn.ds_inst.base_dn}
> +    """).format(**locals())
> +    create_conf_file(conf)
> +    create_sssd_process()
> +    # Check user presence
> +    ent.assert_passwd_by_name(
> +        'user',
> +        dict(name='user', passwd='*', uid=1001, gid=2001,
> +             gecos='1001', shell='/bin/bash'))
> +    # Stop sssd
> +    pid_file = open(config.PIDFILE_PATH, "r")
> +    pid = int(pid_file.read())
> +    os.kill(pid, signal.SIGTERM)
> +    while True:
> +        try:
> +            os.kill(pid, signal.SIGCONT)
> +        except:
> +            break
> +        time.sleep(1)
> +    # Check user presence
> +    ent.assert_passwd_by_name(
> +        'user',
> +        dict(name='user', passwd='*', uid=1001, gid=2001,
> +             gecos='1001', shell='/bin/bash'))
> +    # Teardown
> +    cleanup_conf_file()
> +    cleanup_ldap_entries(ldap_conn)
> +
> +
>   def test_add_remove_group_rfc2307(ldap_conn, blank_rfc2307):
>       """Test RFC2307 group addition and removal are reflected by SSSD"""
>       e = ldap_ent.group(ldap_conn.ds_inst.base_dn, "group", 2001)
> @@ -566,6 +659,11 @@ def test_add_remove_membership_rfc2307_bis(ldap_conn,
>
>
>   @pytest.fixture
> +def void_ldap(request, ldap_conn):
> +    create_ldap_cleanup(request, ldap_conn)
> +
> +
> + at pytest.fixture
>   def void_conf(request):
>       create_conf_cleanup(request)
>
> -- 2.6.1


Just for info, this is git diff with
changes I made when testing your patches:

diff --git a/src/tests/intg/ldap_test.py b/src/tests/intg/ldap_test.py
index 8263d88..fc21275 100644
--- a/src/tests/intg/ldap_test.py
+++ b/src/tests/intg/ldap_test.py
@@ -133,9 +133,9 @@ def format_interactive_conf(ldap_conn, schema):
          format_basic_conf(ldap_conn, schema, enum=True) + \
          unindent("""
              [nss]
-            memcache_timeout                    = 4
+            memcache_timeout                    = 0
              enum_cache_timeout                  = 4
-            entry_negative_timeout              = 4
+            entry_negative_timeout              = 0

              [domain/LDAP]
              ldap_enumeration_refresh_timeout    = 4
@@ -194,8 +194,10 @@ def cleanup_sssd_process():
      subprocess.call(["sss_cache", "-E"])
      for path in os.listdir(config.DB_PATH):
          os.unlink(config.DB_PATH + "/" + path)
-    for path in os.listdir(config.MCACHE_PATH):
-        os.unlink(config.MCACHE_PATH + "/" + path)
+    # FIXME: Uncomment this when ticket #2726 is solved
+    # https://fedorahosted.org/sssd/ticket/2726
+    # for path in os.listdir(config.MCACHE_PATH):
+    #    os.unlink(config.MCACHE_PATH + "/" + path)


  def create_sssd_cleanup(request):
@@ -462,12 +464,9 @@ def user_and_groups_rfc2307_bis(request, ldap_conn):
  def test_add_remove_user(ldap_conn, blank_rfc2307):
      """Test user addition and removal are reflected by SSSD"""
      e = ldap_ent.user(ldap_conn.ds_inst.base_dn, "user", 1001, 2000)
-    time.sleep(2)
      # Add the user
      ent.assert_passwd(ent.contains_only())
      ldap_conn.add_s(*e)
-    ent.assert_passwd(ent.contains_only())
-    time.sleep(4)
      ent.assert_passwd(ent.contains_only(dict(name="user", uid=1001)))
      # Remove the user
      ldap_conn.delete_s(e[0])
@@ -509,10 +508,8 @@ def test_add_remove_user_memcache_mix(ldap_conn,
      create_conf_file(conf)
      create_sssd_process()
      e = ldap_ent.user(ldap_conn.ds_inst.base_dn, "user", 1001, 2001)
-    time.sleep(2)
      # Add the user
      ldap_conn.add_s(*e)
-    time.sleep(4)
      pwd.getpwnam("user")
      # Remove the user
      ldap_conn.delete_s(e[0])
@@ -572,12 +569,9 @@ def test_add_remove_user_memcache_mix(ldap_conn,
  def test_add_remove_group_rfc2307(ldap_conn, blank_rfc2307):
      """Test RFC2307 group addition and removal are reflected by SSSD"""
      e = ldap_ent.group(ldap_conn.ds_inst.base_dn, "group", 2001)
-    time.sleep(2)
      # Add the group
      ent.assert_group(ent.contains_only())
      ldap_conn.add_s(*e)
-    ent.assert_group(ent.contains_only())
-    time.sleep(4)
      ent.assert_group(ent.contains_only(dict(name="group", gid=2001)))
      # Remove the group
      ldap_conn.delete_s(e[0])
@@ -589,12 +583,9 @@ def test_add_remove_group_rfc2307(ldap_conn, 
blank_rfc2307):
  def test_add_remove_group_rfc2307_bis(ldap_conn, blank_rfc2307_bis):
      """Test RFC2307bis group addition and removal are reflected by SSSD"""
      e = ldap_ent.group_bis(ldap_conn.ds_inst.base_dn, "group", 2001)
-    time.sleep(2)
      # Add the group
      ent.assert_group(ent.contains_only())
      ldap_conn.add_s(*e)
-    ent.assert_group(ent.contains_only())
-    time.sleep(4)
      ent.assert_group(ent.contains_only(dict(name="group", gid=2001)))
      # Remove the group
      ldap_conn.delete_s(e[0])
@@ -605,13 +596,10 @@ def test_add_remove_group_rfc2307_bis(ldap_conn, 
blank_rfc2307_bis):

  def test_add_remove_membership_rfc2307(ldap_conn, user_and_group_rfc2307):
      """Test user membership addition and removal are reflected by SSSD"""
-    time.sleep(2)
      # Add user to group
      ent.assert_group_by_name("group", dict(mem=ent.contains_only()))
      ldap_conn.modify_s("cn=group,ou=Groups," + ldap_conn.ds_inst.base_dn,
                         [(ldap.MOD_REPLACE, "memberUid", "user")])
-    ent.assert_group_by_name("group", dict(mem=ent.contains_only()))
-    time.sleep(4)
      ent.assert_group_by_name("group", dict(mem=ent.contains_only("user")))
      # Remove user from group
      ldap_conn.modify_s("cn=group,ou=Groups," + ldap_conn.ds_inst.base_dn,
@@ -627,22 +615,17 @@ def test_add_remove_membership_rfc2307_bis(ldap_conn,
      Test user and group membership addition and removal are reflected 
by SSSD,
      with RFC2307bis schema
      """
-    time.sleep(2)
      # Add user to group1
      ent.assert_group_by_name("group1", dict(mem=ent.contains_only()))
      ldap_conn.modify_s("cn=group1,ou=Groups," + ldap_conn.ds_inst.base_dn,
                         [(ldap.MOD_REPLACE, "member",
                           "uid=user,ou=Users," + 
ldap_conn.ds_inst.base_dn)])
-    ent.assert_group_by_name("group1", dict(mem=ent.contains_only()))
-    time.sleep(4)
      ent.assert_group_by_name("group1", 
dict(mem=ent.contains_only("user")))

      # Add group1 to group2
      ldap_conn.modify_s("cn=group2,ou=Groups," + ldap_conn.ds_inst.base_dn,
                         [(ldap.MOD_REPLACE, "member",
                           "cn=group1,ou=Groups," + 
ldap_conn.ds_inst.base_dn)])
-    ent.assert_group_by_name("group2", dict(mem=ent.contains_only()))
-    time.sleep(4)
      ent.assert_group_by_name("group2", 
dict(mem=ent.contains_only("user")))

      # Remove group1 from group2


More information about the sssd-devel mailing list