freeipa

#7889 test_integration/test_trust.py need improvement
Closed: fixed by sorlov. Opened by sorlov.

Closed: fixed
Reopen Issue

Multiple issues found in trust tests, will update

Issues with tests:
1) trust can be established only in the environment with external DNS server with DNSSEC support, which contains A records for Windows servers and SRV records for AD services.
It is rather complicated to create such setup (and it is not documented). This happens due to not creating dns forwarder for AD domain.
2) (Not broken, but strange) Tests expect that in the config file all three AD instances are located in one domain.hosts object. Because of that, to find domain name of AD machines we split and join hostname (lines 51 and 59 at test_trust.py) instead of using host.domain.name property provided by pytest_multihost plugin. I think every AD machine must be in its own domain in test config (as domain names are different indeed).
3) Tests fail randomly when trying to synchronize time before establishing trust (at least in vagrant). I've read that windows time server can have very big jitter value and chronyd must be invoked with maxlag and maxdistance options (need do investigate)
4) TestExternalTrustWithRootDomain is mistakenly inherited from ADTrustSubdomainBase instead of ADTrustBase. So external trust with subdomain is checked twice.
5) ADTrustBase.test_all_trustdomains_found expects that after establishing trust with forest root domain ipa trustdomain-find will show all three domains. I think this is wrong, it should only retrieve root domain and its subdomain, but not the other tree domain. I suspect the test could pass with invalid test configuration, when domain.hosts.*.name field contained value without dot at end. in this case multihost plugin constructs hostname from first part of name and the value of domain.name. And as all AD machines are in same domain object (see 2), we actually three times check that root domain is visible in output.
6) Test module contains 10 test classes. Each class requires ipa server setup/teardown. This results in tests running for about 1.5 hours. But there is nothing in those tests that require reinstalling ipa server when changing trust type and target. If we add simple cleanup (ipa trust-del, remove sssd keytab), we could place all tests in one class and run them in under 20 minutes. The better option would be to create module-level fixture for topolgy installation/uninstallation (similar to IntegrationTest.install/uninstall methods) but I think it is too much for the scope of this task.
7) Time on ipa master is synchronized with AD after ipa-server installation. This can (and sometimes does in my setup) lead to ipa certificat being not yet valid.

Metadata Update from @rcritten:
- Issue set to the milestone: FreeIPA 4.7.3
- Issue tagged with: tests

Need to update test documentation:
1. Each AD machine must reside in its own domain object of multihost configuration
2. Add proper description of test objects that must be created on AD machines, possibly provide powershell snippet
Edited by sorlov

master:

  • cc1fb2fac565827291feda986c663c1b06e7b16e Revert "Tests: Remove DNS configuration from trust tests"
  • 3e01d2619e87141b6d6078d818c7394aa6b63281 ipatests: in test_trust.py fix prameters in invocation of tasks.configure_dns_for_trust
  • 14f27d299e4ef3a9fc0deb642e6cd4e48796364d ipatests: disable bind dns validation when preparing to establish AD trust
  • 1d0a612a0fd9d5682bb7e0793d4c1c56d3365517 ipatests: in test_trust.py fix parent class
  • e8955cc7966b767415e2c9da6169f109c9c2119c ipatests: fix expectations of ipa trust-find output for trust with root domain
  • 03e2693a7dc6cae292b80f83fe6a295b66f3e3df ipatests: relax requirements for time server quality
  • 35a4642ad0defb5564009c0a09185a9a96d88919 ipatests: allow AD hosts to be placed in separate domain config objects
  • 94a6cb11eaffaff2790d7d56f092ed20111bc604 ipatests: adapt test_trust.py for changes in multihost fixture
  • c81971652144e6c17503bdc38ff62c7fd5aa2d7d ipatests: refactor test_trust.py

ipa-4-7:

  • 9a1b75472f3de14ff70f95d0924f63da207e4e7f Revert "Tests: Remove DNS configuration from trust tests"
  • d3b6f2aef8e28b7ff389f8d86c84aafc75d7bc74 ipatests: in test_trust.py fix prameters in invocation of tasks.configure_dns_for_trust
  • 2c3d4254ccfef9cd310276ced40313616371dd11 ipatests: disable bind dns validation when preparing to establish AD trust
  • 81f8fbd7fd5d5bdd5dab4fe9954c6a7d68e04514 ipatests: in test_trust.py fix parent class
  • 1547f9de82dde479a88acb76e793c470a9f54bea ipatests: fix expectations of ipa trust-find output for trust with root domain
  • 4d51875663d05c9c432c88060575836442a3cd89 ipatests: relax requirements for time server quality
  • cfa2e3916dd8b205b0e6c9c86eba8858b32c6a9f ipatests: allow AD hosts to be placed in separate domain config objects
  • 37ef3bdfe2da9739a8715730ed64386ea1f30fb0 ipatests: adapt test_trust.py for changes in multihost fixture
  • 3f4fc3d9806adc092d9c8aaf1832a265fa3a61f3 ipatests: refactor test_trust.py

ipa-4-6:

  • d1f7db826a64708a094018622f1f8eafd964b05e Revert "Tests: Remove DNS configuration from trust tests"
  • fc9634d25908a9919b7d765757bcb989ef0fe415 ipatests: in test_trust.py fix prameters in invocation of tasks.configure_dns_for_trust
  • e8460e4131346172be2ad60c3893ffda4da36841 ipatests: disable bind dns validation when preparing to establish AD trust
  • 07a471d421b3c08672955eacd04b503c22f02abd ipatests: in test_trust.py fix parent class
  • a37d20bf803bd97c916051945bf538f4a8472341 ipatests: fix expectations of ipa trust-find output for trust with root domain
  • 17975167806d9271f6a88a6e7667464374629e22 ipatests: allow AD hosts to be placed in separate domain config objects
  • 1fa1003fc1dd75c6a2c83d3a8e6d0511bc3d9929 ipatests: adapt test_trust.py for changes in multihost fixture
  • bb40cd85315712c8ecca5fb5b6c7961269eac08b ipatests: refactor test_trust.py

Metadata Update from @sorlov:
- Custom field affects_doc adjusted to on
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None

tests

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.