def test_dnsrecords_single(self, mock_query, mock_query_srv):
"""Test single CA master, all SRV records"""
mock_query.side_effect = fake_query_one
mock_query_srv.side_effect = query_srv([m_api.env.host])
m_api.Command.server_find.side_effect = [{
'result': [
{
'cn': [m_api.env.host],
'enabled_role_servrole': ['CA server', 'IPA master'],
},
]
}]
framework = object()
registry.initialize(framework, config.Config)
f = IPADNSSystemRecordsCheck(registry)
self.results = capture_results(f)
assert len(self.results) == 9
for result in self.results.results:
assert result.result == constants.SUCCESS
assert result.source == 'ipahealthcheck.ipa.idns'
assert result.check == 'IPADNSSystemRecordsCheck'
def test_principal_fail(self):
service_dn = DN(('cn', 'ADTRUST'))
attrs = {
'ipaconfigstring': ['disabledService'],
}
fake_conn = LDAPClient('ldap://localhost', no_schema=True)
ldapentry = LDAPEntry(fake_conn, service_dn)
for attr, values in attrs.items():
ldapentry[attr] = values
framework = object()
registry.initialize(framework)
registry.trust_controller = True
f = IPATrustControllerServiceCheck(registry)
f.conn = mock_ldap(ldapentry)
f.config = config.Config()
self.results = capture_results(f)
assert len(self.results) == 1
result = self.results.results[0]
assert result.result == constants.ERROR
assert result.source == 'ipahealthcheck.ipa.trust'
assert result.kw.get('key') == 'ADTRUST'
def test_nss_agent_multiple_certs(self):
cert2 = IPACertificate(2)
attrs = dict(
description=['2;1;CN=ISSUER;CN=RA AGENT'],
usercertificate=[cert2, self.cert],
)
fake_conn = LDAPClient('ldap://localhost', no_schema=True)
ldapentry = LDAPEntry(fake_conn, DN('uid=ipara,ou=people,o=ipaca'))
for attr, values in attrs.items():
ldapentry[attr] = values
framework = object()
registry.initialize(framework, config.Config)
f = IPARAAgent(registry)
f.conn = mock_ldap([ldapentry])
self.results = capture_results(f)
assert len(self.results) == 1
result = self.results.results[0]
assert result.result == constants.SUCCESS
assert result.source == 'ipahealthcheck.ipa.certs'
assert result.check == 'IPARAAgent'
def test_topology_ok(self):
m_api.Command.topologysuffix_verify.side_effect = [
{
u'result': {
u"in_order": True,
}
},
{
u'result': {
u"in_order": True,
}
},
]
m_api.Command.ca_is_enabled.return_value = {'result': True}
framework = object()
registry.initialize(framework, config.Config)
f = IPATopologyDomainCheck(registry)
self.results = capture_results(f)
assert len(self.results) == 2
for result in self.results.results:
assert result.result == constants.SUCCESS
assert result.source == 'ipahealthcheck.ipa.topology'
assert result.check == 'IPATopologyDomainCheck'
def test_openssl_validation_bad(self, mock_run):
def run(args, raiseonerr=True):
result = _RunResult('', '', 2)
result.raw_output = bytes(
'O = EXAMPLE.TEST, CN = ipa.example.test\n'
'error 20 at 0 depth lookup: unable to get local issuer '
'certificate\nerror %s: verification failed'.format(
args[-1]).encode('utf-8'))
result.raw_error_output = b''
result.error_log = ''
return result
mock_run.side_effect = run
framework = object()
registry.initialize(framework, config.Config)
f = IPAOpenSSLChainValidation(registry)
self.results = capture_results(f)
assert len(self.results) == 2
for result in self.results.results:
assert result.result == constants.ERROR
assert result.source == 'ipahealthcheck.ipa.certs'
assert result.check == 'IPAOpenSSLChainValidation'
assert 'failed' in result.kw.get('msg')
def test_expiration_warning(self):
warning = datetime.now(timezone.utc) + timedelta(days=20)
replaceme = {
'nickname': '7777',
'cert-file': paths.RA_AGENT_PEM,
'key-file': paths.RA_AGENT_KEY,
'ca-name': 'dogtag-ipa-ca-renew-agent',
'not-valid-after': int(warning.timestamp()),
}
set_requests(remove=0, add=replaceme)
framework = object()
registry.initialize(framework, config.Config)
f = IPACertmongerExpirationCheck(registry)
f.config.cert_expiration_days = str(CERT_EXPIRATION_DAYS)
self.results = capture_results(f)
assert len(self.results) == 2
result = self.results.results[0]
assert result.result == constants.SUCCESS
assert result.source == 'ipahealthcheck.ipa.certs'
assert result.check == 'IPACertmongerExpirationCheck'
assert result.kw.get('key') == '5678'
result = self.results.results[1]
assert result.result == constants.WARNING
assert result.source == 'ipahealthcheck.ipa.certs'
assert result.check == 'IPACertmongerExpirationCheck'
assert result.kw.get('key') == '7777'
assert result.kw.get('days') == 19
def test_kra_agent_nonmatching_cert(self):
cert2 = IPACertificate(2)
attrs = dict(
description=['2;1;CN=ISSUER;CN=RA AGENT'],
usercertificate=[cert2],
)
fake_conn = LDAPClient('ldap://localhost', no_schema=True)
ldapentry = LDAPEntry(fake_conn,
DN('uid=ipakra,ou=people,o=kra,o=ipaca'))
for attr, values in attrs.items():
ldapentry[attr] = values
framework = object()
registry.initialize(framework, config.Config())
f = IPAKRAAgent(registry)
f.conn = mock_ldap([ldapentry])
self.results = capture_results(f)
result = self.results.results[0]
assert result.result == constants.ERROR
assert result.kw.get('certfile') == paths.RA_AGENT_PEM
assert result.kw.get('dn') == 'uid=ipakra,ou=people,o=kra,o=ipaca'
def test_one_expired(self, mock_load):
mock_load.return_value = [
FakeIPACertificate(None,
subject=self.sub_ca,
not_after=datetime.now(timezone.utc) +
timedelta(days=-3)),
FakeIPACertificate(None,
subject=self.root_ca,
not_after=datetime.now(timezone.utc) +
timedelta(days=20))
]
framework = object()
registry.initialize(framework, config.Config)
f = IPACAChainExpirationCheck(registry)
f.config.cert_expiration_days = '7'
self.results = capture_results(f)
assert len(self.results) == 2
result = self.results.results[0]
assert result.result == constants.CRITICAL
assert result.source == 'ipahealthcheck.ipa.certs'
assert result.check == 'IPACAChainExpirationCheck'
assert result.kw.get('key') == self.sub_ca
assert 'expired' in result.kw.get('msg')
result = self.results.results[1]
assert result.result == constants.SUCCESS
assert result.source == 'ipahealthcheck.ipa.certs'
assert result.check == 'IPACAChainExpirationCheck'
assert result.kw.get('key') == self.root_ca
def test_revocation_one_bad(self):
m_api.Command.cert_show.side_effect = [
{
u'result': {
u"revoked": False,
}
},
{
u'result': {
u"revoked": True,
u"revocation_reason": 4,
}
},
]
set_requests()
framework = object()
registry.initialize(framework)
f = IPACertRevocation(registry)
f.config = config.Config()
self.results = capture_results(f)
assert len(self.results) == 2
result = self.results.results[0]
assert result.result == constants.SUCCESS
assert result.source == 'ipahealthcheck.ipa.certs'
assert result.check == 'IPACertRevocation'
result = self.results.results[1]
assert result.result == constants.ERROR
assert result.source == 'ipahealthcheck.ipa.certs'
assert result.check == 'IPACertRevocation'
assert result.kw.get('revocation_reason') == 'superseded'
def test_revocation_ok(self):
m_api.Command.cert_show.side_effect = [
{
u'result': {
u"revoked": False,
}
},
{
u'result': {
u"revoked": False,
}
},
]
set_requests()
framework = object()
registry.initialize(framework)
f = IPACertRevocation(registry)
f.config = config.Config()
self.results = capture_results(f)
assert len(self.results) == 2
for result in self.results.results:
assert result.result == constants.SUCCESS
assert result.source == 'ipahealthcheck.ipa.certs'
assert result.check == 'IPACertRevocation'
def test_trust_get_trust_domains_fail(self, mock_trust, mock_run):
# sssctl domain-list
run_result = namedtuple('run', ['returncode', 'error_log'])
run_result.returncode = 0
run_result.error_log = ''
run_result.output = 'implicit_files\nipa.example\nad.example\n'
mock_run.return_value = run_result
mock_trust.side_effect = errors.NotFound(reason='bad')
framework = object()
registry.initialize(framework)
registry.trust_agent = True
f = IPATrustDomainsCheck(registry)
f.config = config.Config()
self.results = capture_results(f)
# There are more than one result I just care about this particular
# value. The error is not fatal.
result = self.results.results[0]
assert result.result == constants.WARNING
assert result.source == 'ipahealthcheck.ipa.trust'
assert result.check == 'IPATrustDomainsCheck'
assert result.kw.get('key') == 'trust-find'
def test_dnsrecords_two(self, mock_query, mock_query_srv):
"""Test two CA masters, all SRV records"""
mock_query_srv.side_effect = query_srv(
[m_api.env.host, 'replica.' + m_api.env.domain])
mock_query.side_effect = fake_query_two
m_api.Command.server_find.side_effect = [{
'result': [
{
'cn': [m_api.env.host],
'enabled_role_servrole': ['CA server', 'IPA master'],
},
{
'cn': ['replica.' + m_api.env.domain],
'enabled_role_servrole': ['CA server', 'IPA master'],
},
]
}]
framework = object()
registry.initialize(framework)
f = IPADNSSystemRecordsCheck(registry)
f.config = config.Config()
self.results = capture_results(f)
assert len(self.results) == 17
for result in self.results.results:
assert result.result == constants.SUCCESS
assert result.source == 'ipahealthcheck.ipa.dns'
assert result.check == 'IPADNSSystemRecordsCheck'
def test_dnsrecords_one_with_ad(self, mock_query, mock_query_uri,
mock_query_srv, mock_rrset):
mock_query.side_effect = fake_query_one
mock_query_srv.side_effect = query_srv([m_api.env.host], True)
mock_query_uri.side_effect = query_uri([m_api.env.host])
mock_rrset.side_effect = [
resolve_rrsets(m_api.env.host, (rdatatype.A, rdatatype.AAAA))
]
m_api.Command.server_find.side_effect = [{
'result': [
{
'cn': [m_api.env.host],
'enabled_role_servrole':
['CA server', 'IPA master', 'AD trust controller'],
},
]
}]
framework = object()
registry.initialize(framework, config.Config)
f = IPADNSSystemRecordsCheck(registry)
self.results = capture_results(f)
if has_uri_support:
expected = 20
else:
expected = 16
assert len(self.results) == expected
for result in self.results.results:
assert result.result == constants.SUCCESS
assert result.source == 'ipahealthcheck.ipa.idns'
assert result.check == 'IPADNSSystemRecordsCheck'
def test_nss_validation_ok_no_ca(self, mock_run, mock_cainstance):
"""Test with the CA marked as not configured so there should only
be a DS certificate to check.
"""
def run(args, raiseonerr=True):
result = _RunResult('', '', 0)
result.raw_output = b'certutil: certificate is valid\n'
result.raw_error_output = b''
return result
mock_run.side_effect = run
mock_cainstance.return_value = CAInstance(False)
framework = object()
registry.initialize(framework)
f = IPANSSChainValidation(registry)
f.config = config.Config()
self.results = capture_results(f)
assert len(self.results) == 1
for result in self.results.results:
assert result.result == constants.SUCCESS
assert result.source == 'ipahealthcheck.ipa.certs'
assert result.check == 'IPANSSChainValidation'
assert 'slapd-' in result.kw.get('key')
def test_principal_fail(self):
admin_dn = DN(('uid', 'admin'))
attrs = {
'ipantsecurityidentifier': ['S-1-5-21-1234-5678-1976041503-400'],
}
fake_conn = LDAPClient('ldap://localhost', no_schema=True)
ldapentry = LDAPEntry(fake_conn, admin_dn)
for attr, values in attrs.items():
ldapentry[attr] = values
framework = object()
registry.initialize(framework, config.Config)
registry.trust_controller = True
f = IPATrustControllerAdminSIDCheck(registry)
f.conn = mock_ldap(ldapentry)
self.results = capture_results(f)
assert len(self.results) == 1
result = self.results.results[0]
assert result.result == constants.ERROR
assert result.source == 'ipahealthcheck.ipa.trust'
assert result.check == 'IPATrustControllerAdminSIDCheck'
assert result.kw.get('key') == 'ipantsecurityidentifier'
assert result.kw.get('rid') == 'S-1-5-21-1234-5678-1976041503-400'
def test_nss_validation_bad(self, mock_run, mock_cainstance):
def run(args, raiseonerr=True):
result = _RunResult('', '', 255)
result.raw_output = str.encode(
'certutil: certificate is invalid: Peer\'s certificate issuer '
'has been marked as not trusted by the user.')
result.raw_error_output = b''
result.error_log = ''
return result
mock_run.side_effect = run
mock_cainstance.return_value = CAInstance()
framework = object()
registry.initialize(framework)
f = IPANSSChainValidation(registry)
f.config = config.Config()
self.results = capture_results(f)
assert len(self.results) == 2
for result in self.results.results:
assert result.result == constants.ERROR
assert result.source == 'ipahealthcheck.ipa.certs'
assert result.check == 'IPANSSChainValidation'
def test_member_fail(self):
agent_dn = DN(('fqdn', m_api.env.host), m_api.env.container_host,
m_api.env.basedn)
attrs = {
'memberof': [agent_dn],
}
fake_conn = LDAPClient('ldap://localhost', no_schema=True)
ldapentry = LDAPEntry(fake_conn, agent_dn)
for attr, values in attrs.items():
ldapentry[attr] = values
framework = object()
registry.initialize(framework, config.Config)
registry.trust_controller = True
f = IPATrustControllerPrincipalCheck(registry)
f.conn = mock_ldap(ldapentry)
self.results = capture_results(f)
assert len(self.results) == 1
result = self.results.results[0]
assert result.result == constants.ERROR
assert result.source == 'ipahealthcheck.ipa.trust'
assert result.kw.get('key') == 'cifs/%s@%s' % \
(m_api.env.host, m_api.env.realm)
def test_service_enabled(self):
service_dn = DN(('cn', 'ADTRUST'))
for type in [ENABLED_SERVICE, HIDDEN_SERVICE]:
attrs = {
'ipaconfigstring': [type],
}
fake_conn = LDAPClient('ldap://localhost', no_schema=True)
ldapentry = LDAPEntry(fake_conn, service_dn)
for attr, values in attrs.items():
ldapentry[attr] = values
framework = object()
registry.initialize(framework, config.Config)
registry.trust_controller = True
f = IPATrustControllerServiceCheck(registry)
f.conn = mock_ldap(ldapentry)
self.results = capture_results(f)
assert len(self.results) == 1
result = self.results.results[0]
assert result.result == constants.SUCCESS
assert result.source == 'ipahealthcheck.ipa.trust'
assert result.check == 'IPATrustControllerServiceCheck'
assert result.kw.get('key') == 'ADTRUST'
def test_sidgen_fail(self):
attrs = {
'nsslapd-pluginEnabled': ['off'],
}
fake_conn = LDAPClient('ldap://localhost', no_schema=True)
ldapentry = LDAPEntry(fake_conn, DN('cn=plugin, cn=config'))
for attr, values in attrs.items():
ldapentry[attr] = values
framework = object()
registry.initialize(framework, config.Config)
registry.trust_agent = True
f = IPAsidgenpluginCheck(registry)
f.conn = mock_ldap(ldapentry)
self.results = capture_results(f)
assert len(self.results) == 2
result = self.results.results[0]
assert result.result == constants.ERROR
assert result.source == 'ipahealthcheck.ipa.trust'
assert result.check == 'IPAsidgenpluginCheck'
assert result.kw.get('key') == 'IPA SIDGEN'
result = self.results.results[1]
assert result.result == constants.ERROR
assert result.source == 'ipahealthcheck.ipa.trust'
assert result.check == 'IPAsidgenpluginCheck'
assert result.kw.get('key') == 'ipa-sidgen-task'
def test_member_ok(self):
agent_dn = DN(('fqdn', m_api.env.host), m_api.env.container_host,
m_api.env.basedn)
group_dn = DN(('cn', 'adtrust agents'),
m_api.env.container_sysaccounts, m_api.env.basedn)
attrs = {
'memberof': [group_dn],
}
fake_conn = LDAPClient('ldap://localhost', no_schema=True)
ldapentry = LDAPEntry(fake_conn, agent_dn)
for attr, values in attrs.items():
ldapentry[attr] = values
framework = object()
registry.initialize(framework)
registry.trust_agent = True
f = IPATrustAgentMemberCheck(registry)
f.conn = mock_ldap(ldapentry)
f.config = config.Config()
self.results = capture_results(f)
assert len(self.results) == 1
result = self.results.results[0]
assert result.result == constants.SUCCESS
assert result.source == 'ipahealthcheck.ipa.trust'
assert result.check == 'IPATrustAgentMemberCheck'
assert result.kw.get('key') == m_api.env.host
def test_dnsrecords_one_with_ad(self, mock_query, mock_query_srv):
mock_query.side_effect = fake_query_one
mock_query_srv.side_effect = query_srv([m_api.env.host], True)
m_api.Command.server_find.side_effect = [{
'result': [
{
'cn': [m_api.env.host],
'enabled_role_servrole':
['CA server', 'IPA master', 'AD trust controller'],
},
]
}]
framework = object()
registry.initialize(framework)
f = IPADNSSystemRecordsCheck(registry)
f.config = config.Config()
self.results = capture_results(f)
assert len(self.results) == 15
for result in self.results.results:
assert result.result == constants.SUCCESS
assert result.source == 'ipahealthcheck.ipa.dns'
assert result.check == 'IPADNSSystemRecordsCheck'
def test_nss_agent_too_many(self):
attrs = dict(
description=['2;1;CN=ISSUER;CN=RA AGENT'],
usercertificate=[self.cert],
)
fake_conn = LDAPClient('ldap://localhost', no_schema=True)
ldapentry = LDAPEntry(fake_conn, DN('uid=ipara,ou=people,o=ipaca'))
for attr, values in attrs.items():
ldapentry[attr] = values
ldapentry2 = LDAPEntry(fake_conn, DN('uid=ipara2,ou=people,o=ipaca'))
for attr, values in attrs.items():
ldapentry[attr] = values
framework = object()
registry.initialize(framework, config.Config())
f = IPARAAgent(registry)
f.conn = mock_ldap([ldapentry, ldapentry2])
self.results = capture_results(f)
result = self.results.results[0]
assert result.result == constants.ERROR
assert result.kw.get('found') == 2
def test_dnsrecords_bad_realm(self, mock_query, mock_query_srv):
"""Unexpected Kerberos TXT record"""
mock_query.side_effect = fake_query_one_txt
mock_query_srv.side_effect = query_srv([m_api.env.host])
m_api.Command.server_find.side_effect = [{
'result': [
{
'cn': [m_api.env.host],
'enabled_role_servrole': ['CA server', 'IPA master'],
},
]
}]
framework = object()
registry.initialize(framework)
f = IPADNSSystemRecordsCheck(registry)
f.config = config.Config()
self.results = capture_results(f)
assert len(self.results) == 9
ok = get_results_by_severity(self.results.results, constants.SUCCESS)
warn = get_results_by_severity(self.results.results, constants.WARNING)
assert len(ok) == 8
assert len(warn) == 1
result = warn[0]
assert result.kw.get('msg') == 'expected realm missing'
assert result.kw.get('key') == '\"FAKE_REALM\"'
def test_expiration(self):
set_requests()
framework = object()
registry.initialize(framework, config.Config)
f = IPACertmongerExpirationCheck(registry)
f.config.cert_expiration_days = 7
self.results = capture_results(f)
assert len(self.results) == 2
result = self.results.results[0]
assert result.result == constants.ERROR
assert result.source == 'ipahealthcheck.ipa.certs'
assert result.check == 'IPACertmongerExpirationCheck'
assert result.kw.get('key') == '1234'
assert result.kw.get('msg') == 'Request id 1234 expired on ' \
'19700101001704Z'
result = self.results.results[1]
assert result.result == constants.SUCCESS
assert result.source == 'ipahealthcheck.ipa.certs'
assert result.check == 'IPACertmongerExpirationCheck'
assert result.kw.get('key') == '5678'
def test_certmogner_missing(self, mock_find_ca):
mock_find_ca.side_effect = [
'IPA',
'dogtag-ipa-ca-renew-agent',
]
framework = object()
registry.initialize(framework)
f = IPACertmongerCA(registry)
self.results = capture_results(f)
assert len(self.results) == 3
for r in range(0, 1):
result = self.results.results[r]
assert result.result == constants.SUCCESS
assert result.source == 'ipahealthcheck.ipa.certs'
assert result.check == 'IPACertmongerCA'
assert self.results.results[2].result == constants.ERROR
assert self.results.results[2].kw.get('key') == \
'dogtag-ipa-ca-renew-agent-reuse'
assert self.results.results[2].kw.get('msg') == \
"Certmonger CA 'dogtag-ipa-ca-renew-agent-reuse' missing"
def test_missing_cert_tracking(self):
# remove one of the requests to force it to be missing
set_requests(remove=0)
framework = object()
registry.initialize(framework, config.Config)
f = IPACertTracking(registry)
self.results = capture_results(f)
assert len(self.results) == 2
result = self.results.results[0]
assert result.result == constants.ERROR
assert result.source == 'ipahealthcheck.ipa.certs'
assert result.check == 'IPACertTracking'
assert result.kw.get('msg') == "Missing tracking for " \
"cert-file=/var/lib/ipa/ra-agent.pem, " \
"key-file=/var/lib/ipa/ra-agent.key, " \
"ca-name=dogtag-ipa-ca-renew-agent, " \
"cert-storage=FILE, "\
"cert-presave-command=" \
"/usr/libexec/ipa/certmonger/renew_ra_cert_pre, " \
"cert-postsave-command=" \
"/usr/libexec/ipa/certmonger/renew_ra_cert"
def test_principal_ok(self):
agent_dn = DN(('krbprincipalname', 'cifs/%s@%s' %
(m_api.env.host, m_api.env.realm)),
m_api.env.container_service, m_api.env.basedn)
group_dn = DN(('cn', 'adtrust agents'),
m_api.env.container_sysaccounts, m_api.env.basedn)
attrs = {
'memberof': [group_dn],
}
fake_conn = LDAPClient('ldap://localhost', no_schema=True)
ldapentry = LDAPEntry(fake_conn, agent_dn)
for attr, values in attrs.items():
ldapentry[attr] = values
framework = object()
registry.initialize(framework, config.Config)
registry.trust_controller = True
f = IPATrustControllerPrincipalCheck(registry)
f.conn = mock_ldap(ldapentry)
self.results = capture_results(f)
assert len(self.results) == 1
result = self.results.results[0]
assert result.result == constants.SUCCESS
assert result.source == 'ipahealthcheck.ipa.trust'
assert result.check == 'IPATrustControllerPrincipalCheck'
assert result.kw.get('key') == 'cifs/%s@%s' % \
(m_api.env.host, m_api.env.realm)
def test_certs_mismatch(self, mock_certdb):
""" Ensure mismatches are detected"""
fake_conn = LDAPClient('ldap://localhost', no_schema=True)
pkidbentry = LDAPEntry(
fake_conn,
DN('uid=pkidbuser,ou=people,o=ipaca'),
userCertificate=[IPACertificate(serial_number=2)],
subjectName=['test'])
casignentry = LDAPEntry(fake_conn,
DN('cn=%s IPA CA' % m_api.env.realm,
'cn=certificates,cn=ipa,cn=etc',
m_api.env.basedn),
CACertificate=[IPACertificate()],
userCertificate=[IPACertificate()],
subjectName=['test'])
ldap_entries = [pkidbentry, casignentry]
trust = {
'ocspSigningCert cert-pki-ca': 'u,u,u',
'caSigningCert cert-pki-ca': 'u,u,u',
'subsystemCert cert-pki-ca': 'u,u,u',
'auditSigningCert cert-pki-ca': 'u,u,Pu',
'Server-Cert cert-pki-ca': 'u,u,u',
'transportCert cert-pki-kra': 'u,u,u',
'storageCert cert-pki-kra': 'u,u,u',
'auditSigningCert cert-pki-kra': 'u,u,Pu',
}
dogtag_entries_subjects = (
'CN=OCSP Subsystem,O=%s' % m_api.env.realm,
'CN=CA Subsystem,O=%s' % m_api.env.realm,
'CN=CA Audit,O=%s' % m_api.env.realm,
'CN=%s,O=%s' % (m_api.env.host, m_api.env.realm),
'CN=KRA Transport Certificate,O=%s' % m_api.env.realm,
'CN=KRA Storage Certificate,O=%s' % m_api.env.realm,
'CN=KRA Audit,O=%s' % m_api.env.realm,
)
for i, subject in enumerate(dogtag_entries_subjects):
entry = LDAPEntry(fake_conn,
DN('cn=%i,ou=certificateRepository' % i,
'ou=ca,o=ipaca'),
userCertificate=[IPACertificate()],
subjectName=[subject])
ldap_entries.append(entry)
mock_certdb.return_value = mock_CertDB(trust)
framework = object()
registry.initialize(framework, config.Config())
f = IPADogtagCertsMatchCheck(registry)
f.conn = mock_ldap(ldap_entries)
self.results = capture_results(f)
assert len(self.results) == 3
result = self.results.results[0]
assert result.result == constants.ERROR
assert result.source == 'ipahealthcheck.ipa.certs'
assert result.check == 'IPADogtagCertsMatchCheck'
def test_trust_get_trust_domains_ok(self, mock_run):
# sssctl domain-list
dlresult = namedtuple('run', ['returncode', 'error_log'])
dlresult.returncode = 0
dlresult.error_log = ''
dlresult.output = 'implicit_files\nipa.example\nad.example\n' \
'child.ad.example\nchild.example\n'
olresult = namedtuple('run', ['returncode', 'error_log'])
olresult.returncode = 0
olresult.error_log = ''
olresult.output = 'Online status: Online\n\n'
mock_run.side_effect = [dlresult, olresult, olresult, olresult]
# get_trust_domains()
m_api.Command.trust_find.side_effect = trust_find()
m_api.Command.trustdomain_find.side_effect = trustdomain_find()
framework = object()
registry.initialize(framework, config.Config)
registry.trust_agent = True
f = IPATrustDomainsCheck(registry)
self.results = capture_results(f)
assert len(self.results) == 4
result = self.results.results[0]
assert result.result == constants.SUCCESS
assert result.source == 'ipahealthcheck.ipa.trust'
assert result.check == 'IPATrustDomainsCheck'
assert result.kw.get('key') == 'domain-list'
assert result.kw.get('trust_domains') == \
'ad.example, child.ad.example, child.example'
assert result.kw.get('sssd_domains') == \
'ad.example, child.ad.example, child.example'
result = self.results.results[1]
assert result.result == constants.SUCCESS
assert result.source == 'ipahealthcheck.ipa.trust'
assert result.check == 'IPATrustDomainsCheck'
assert result.kw.get('key') == 'domain-status'
assert result.kw.get('domain') == 'ad.example'
result = self.results.results[2]
assert result.result == constants.SUCCESS
assert result.source == 'ipahealthcheck.ipa.trust'
assert result.check == 'IPATrustDomainsCheck'
assert result.kw.get('key') == 'domain-status'
assert result.kw.get('domain') == 'child.ad.example'
result = self.results.results[3]
assert result.result == constants.SUCCESS
assert result.source == 'ipahealthcheck.ipa.trust'
assert result.check == 'IPATrustDomainsCheck'
assert result.kw.get('key') == 'domain-status'
assert result.kw.get('domain') == 'child.example'
def test_trust_get_trust_domains_mismatch(self, mock_run):
# sssctl domain-list
dlresult = namedtuple('run', ['returncode', 'error_log'])
dlresult.returncode = 0
dlresult.error_log = ''
dlresult.output = 'implicit_files\nipa.example\n' \
'child.example\n'
olresult = namedtuple('run', ['returncode', 'error_log'])
olresult.returncode = 0
olresult.error_log = ''
olresult.output = 'Online status: Online\n\n'
mock_run.side_effect = [dlresult, olresult, olresult]
# get_trust_domains()
m_api.Command.trust_find.side_effect = [{
'result': [
{
'cn': ['ad.example'],
'ipantflatname': ['ADROOT'],
'ipanttrusteddomainsid': ['S-1-5-21-abc'],
'trusttype': ['Active Directory domain'],
},
{
'cn': ['child.example'],
'ipantflatname': ['ADROOT'],
'ipanttrusteddomainsid': ['S-1-5-21-def'],
'trusttype': ['Active Directory domain'],
},
]
}]
framework = object()
registry.initialize(framework)
registry.trust_agent = True
f = IPATrustDomainsCheck(registry)
f.config = config.Config()
self.results = capture_results(f)
assert len(self.results) == 2
result = self.results.results[0]
assert result.result == constants.ERROR
assert result.source == 'ipahealthcheck.ipa.trust'
assert result.check == 'IPATrustDomainsCheck'
assert result.kw.get('key') == 'domain-list'
assert result.kw.get('trust_domains') == 'ad.example, child.example'
assert result.kw.get('sssd_domains') == 'child.example'
result = self.results.results[1]
assert result.result == constants.SUCCESS
assert result.source == 'ipahealthcheck.ipa.trust'
assert result.check == 'IPATrustDomainsCheck'
assert result.kw.get('key') == 'domain-status'
assert result.kw.get('domain') == 'child.example'
