From 175a79328f720b00d593d6de812c473cca8dbf08 Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <puiterwijk@redhat.com>
Date: Jul 11 2016 10:09:15 +0000
Subject: [PATCH 1/10] Test for some more dependencies that we also use


Signed-off-by: Howard Johnson <merlin@merlinthp.org>
Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Reviewed-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/Makefile b/Makefile
index 9f88a72..fe0ff42 100644
--- a/Makefile
+++ b/Makefile
@@ -14,6 +14,8 @@ testdeps:
 	which openssl
 	which slapd
 	# Now, python libraries
+	python -c 'import argparse'
+	python -c 'import requests_kerberos'
 	python -c 'import openid'
 	python -c 'import openid_teams'
 	python -c 'import openid_cla'
@@ -28,9 +30,9 @@ testdeps:
 	python -c 'import jinja2'
 	python -c 'import psycopg2'
 	# And now everything else
-	ls /usr/share/doc/sssd
-	ls /usr/lib64/libsss_simpleifp.so.0
-	ls /usr/lib64/httpd/modules/mod_wsgi.so
+	ls /usr/lib*/security/pam_sss.so
+	ls /usr/lib*/libsss_simpleifp.so.0
+	ls /usr/lib*/httpd/modules/mod_wsgi.so
 	ls /usr/libexec/mod_auth_mellon
 
 lint:

From 664ea7bbeb575a094680b13bc286f2279acfc079 Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <puiterwijk@redhat.com>
Date: Jul 11 2016 10:09:20 +0000
Subject: [PATCH 2/10] Use more specific paths to binaries for pre-usrmove compatibility


Move some binary calls to their actual specific location where
they were before the usrmove.
This will allow us to support operating systems that don't have the
usrmove.

Signed-off-by: Howard Johnson <merlin@merlinthp.org>
Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Reviewed-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/ipsilon/install/ipsilon-server-install b/ipsilon/install/ipsilon-server-install
index 2559357..33e3596 100755
--- a/ipsilon/install/ipsilon-server-install
+++ b/ipsilon/install/ipsilon-server-install
@@ -229,7 +229,7 @@ def install(plugins, args):
     files.fix_user_dirs(instance_conf, opts['system_user'])
     files.fix_user_dirs(args['data_dir'], opts['system_user'])
     try:
-        subprocess.call(['/usr/sbin/restorecon', '-R', args['data_dir']])
+        subprocess.call(['/sbin/restorecon', '-R', args['data_dir']])
     except Exception:  # pylint: disable=broad-except
         pass
 
diff --git a/quickrun.py b/quickrun.py
index 3189ba4..ce7eb94 100755
--- a/quickrun.py
+++ b/quickrun.py
@@ -59,13 +59,13 @@ def config(workdir):
     text = t.substitute({'workdir': workdir})
     with open(sql, 'w+') as f:
         f.write(text)
-    subprocess.call(['sqlite3', '-init', sql, admin_db, '.quit'])
+    subprocess.call(['/usr/bin/sqlite3', '-init', sql, admin_db, '.quit'])
 
     users_db = os.path.join(workdir, 'userprefs.sqlite')
     sql = os.path.join(workdir, 'users.sql')
     with open(sql, 'w+') as f:
         f.write(USERS_TEMPLATE)
-    subprocess.call(['sqlite3', '-init', sql, users_db, '.quit'])
+    subprocess.call(['/usr/bin/sqlite3', '-init', sql, users_db, '.quit'])
 
     trans_db = os.path.join(workdir, 'transactions.sqlite')
     cachedir = os.path.join(workdir, 'cache')
diff --git a/tests/dbupgrades.py b/tests/dbupgrades.py
index 0e6518f..bfa3788 100755
--- a/tests/dbupgrades.py
+++ b/tests/dbupgrades.py
@@ -64,7 +64,7 @@ class IpsilonTest(IpsilonTestBase):
                 db_in = os.path.join(db_indir, '%s.sqlite.dump' % database)
                 db_out = os.path.join(db_outdir, '%s.sqlite' % database)
                 os.unlink(db_out)
-                cmd = ['/bin/sqlite3', db_out, '.read %s' % db_in]
+                cmd = ['/usr/bin/sqlite3', db_out, '.read %s' % db_in]
                 subprocess.check_call(cmd)
 
             # Upgrade that database
@@ -80,7 +80,7 @@ class IpsilonTest(IpsilonTestBase):
             # Check all features in a newly created database
             # Let's verify if at least one index was created
             test_db = os.path.join(db_outdir, 'adminconfig.sqlite')
-            p = subprocess.Popen(['/bin/sqlite3', test_db, '.dump'],
+            p = subprocess.Popen(['/usr/bin/sqlite3', test_db, '.dump'],
                                  stdout=subprocess.PIPE)
             output, _ = p.communicate()
             if p.returncode:
@@ -95,7 +95,7 @@ class IpsilonTest(IpsilonTestBase):
             # In 1 -> 2, we added indexes and primary keys
             # Let's verify if at least one index was created
             test_db = os.path.join(db_outdir, 'adminconfig.sqlite')
-            p = subprocess.Popen(['/bin/sqlite3', test_db, '.dump'],
+            p = subprocess.Popen(['/usr/bin/sqlite3', test_db, '.dump'],
                                  stdout=subprocess.PIPE)
             output, _ = p.communicate()
             if p.returncode:

From e3090bdc13cd3a32cb6e35335bdbf6967a329d19 Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <puiterwijk@redhat.com>
Date: Jul 11 2016 10:09:23 +0000
Subject: [PATCH 3/10] Make apache configs compatible with pre-2.3


Make Apache configuration files compatible with versions
that do not have mod_authz_core module, for example httpd
2.2.

Signed-off-by: Howard Johnson <merlin@merlinthp.org>
Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Reviewed-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/templates/install/idp.conf b/templates/install/idp.conf
index 57725a2..66a1bc9 100644
--- a/templates/install/idp.conf
+++ b/templates/install/idp.conf
@@ -23,15 +23,33 @@ ${wsgi_socket}
 </Location>
 
 <Directory ${ipsilondir}>
+  <IfModule mod_authz_core.c>
     Require all granted
+  </IfModule>
+  <IfModule !mod_authz_core.c>
+    Order Allow,Deny
+    Allow from All
+  </IfModule>
 </Directory>
 
 <Directory ${staticdir}>
+  <IfModule mod_authz_core.c>
     Require all granted
+  </IfModule>
+  <IfModule !mod_authz_core.c>
+    Order Allow,Deny
+    Allow from All
+  </IfModule>
 </Directory>
 
 <Directory ${wellknowndir}>
+  <IfModule mod_authz_core.c>
     Require all granted
+  </IfModule>
+  <IfModule !mod_authz_core.c>
+    Order Allow,Deny
+    Allow from All
+  </IfModule>
 </Directory>
 <Location /.well-known/browserid>
     ForceType application/json
@@ -40,6 +58,11 @@ ${wsgi_socket}
 <Directory "/var/cache/ipsilon">
   SetHandler None
   AllowOverride None
-  Satisfy Any
-  Allow from all
+  <IfModule mod_authz_core.c>
+    Require all granted
+  </IfModule>
+  <IfModule !mod_authz_core.c>
+    Order Allow,Deny
+    Allow from All
+  </IfModule>
 </Directory>
diff --git a/templates/install/saml2/sp.conf b/templates/install/saml2/sp.conf
index 3ea4ca5..075f700 100644
--- a/templates/install/saml2/sp.conf
+++ b/templates/install/saml2/sp.conf
@@ -35,7 +35,13 @@ ${sp}    </IfModule>
 ${sp}    <IfModule !mod_nss.c>
 ${sp}        SSLRequireSSL
 ${sp}    </IfModule>
+${sp}  <IfModule mod_authz_core.c>
 ${sp}    Require all granted
+${sp}  </IfModule>
+${sp}  <IfModule !mod_authz_core.c>
+${sp}    Order Allow,Deny
+${sp}    Allow from All
+${sp}  </IfModule>
 ${sp}</Directory>
 
 # Redirect requests to the secure port
diff --git a/tests/attrs.py b/tests/attrs.py
index 929ef66..a9fbcc8 100755
--- a/tests/attrs.py
+++ b/tests/attrs.py
@@ -58,7 +58,13 @@ def fixup_sp_httpd(httpdir):
 Alias /sp ${HTTPDIR}/sp
 
 <Directory ${HTTPDIR}/sp>
-    Require all granted
+    <IfModule mod_authz_core.c>
+        Require all granted
+    </IfModule>
+    <IfModule !mod_authz_core.c>
+        Order Allow,Deny
+        Allow from All
+    </IfModule>
     Options +Includes
 </Directory>
 """
diff --git a/tests/fconf.py b/tests/fconf.py
index 305a6cf..c2440d4 100755
--- a/tests/fconf.py
+++ b/tests/fconf.py
@@ -77,7 +77,13 @@ def fixup_sp_httpd(httpdir):
 Alias /sp ${HTTPDIR}/sp
 
 <Directory ${HTTPDIR}/sp>
-    Require all granted
+    <IfModule mod_authz_core.c>
+        Require all granted
+    </IfModule>
+    <IfModule !mod_authz_core.c>
+        Order Allow,Deny
+        Allow from All
+    </IfModule>
 </Directory>
 """
     index = """WORKS!"""
diff --git a/tests/httpd.conf b/tests/httpd.conf
index 10b6dcd..75d6c65 100644
--- a/tests/httpd.conf
+++ b/tests/httpd.conf
@@ -1,94 +1,80 @@
 ServerRoot "${HTTPROOT}"
 ServerName ${NAME}.ipsilon.dev
 
-LoadModule access_compat_module modules/mod_access_compat.so
-LoadModule actions_module modules/mod_actions.so
-LoadModule alias_module modules/mod_alias.so
-LoadModule allowmethods_module modules/mod_allowmethods.so
-LoadModule auth_basic_module modules/mod_auth_basic.so
-#LoadModule auth_digest_module modules/mod_auth_digest.so
-LoadModule authn_anon_module modules/mod_authn_anon.so
-LoadModule authn_core_module modules/mod_authn_core.so
-LoadModule authn_dbd_module modules/mod_authn_dbd.so
-LoadModule authn_dbm_module modules/mod_authn_dbm.so
 LoadModule authn_file_module modules/mod_authn_file.so
-LoadModule authn_socache_module modules/mod_authn_socache.so
-LoadModule authz_core_module modules/mod_authz_core.so
-LoadModule authz_dbd_module modules/mod_authz_dbd.so
-LoadModule authz_dbm_module modules/mod_authz_dbm.so
-LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
-LoadModule authz_host_module modules/mod_authz_host.so
-LoadModule authz_owner_module modules/mod_authz_owner.so
+LoadModule authn_anon_module modules/mod_authn_anon.so
 LoadModule authz_user_module modules/mod_authz_user.so
-LoadModule autoindex_module modules/mod_autoindex.so
-LoadModule cache_module modules/mod_cache.so
-LoadModule cache_disk_module modules/mod_cache_disk.so
-LoadModule data_module modules/mod_data.so
-LoadModule dbd_module modules/mod_dbd.so
-LoadModule deflate_module modules/mod_deflate.so
-LoadModule dir_module modules/mod_dir.so
-LoadModule dumpio_module modules/mod_dumpio.so
-LoadModule echo_module modules/mod_echo.so
+LoadModule authz_host_module modules/mod_authz_host.so
+LoadModule include_module modules/mod_include.so
+LoadModule log_config_module modules/mod_log_config.so
 LoadModule env_module modules/mod_env.so
-LoadModule expires_module modules/mod_expires.so
 LoadModule ext_filter_module modules/mod_ext_filter.so
-LoadModule filter_module modules/mod_filter.so
+LoadModule expires_module modules/mod_expires.so
 LoadModule headers_module modules/mod_headers.so
-LoadModule include_module modules/mod_include.so
-LoadModule info_module modules/mod_info.so
-LoadModule log_config_module modules/mod_log_config.so
-LoadModule logio_module modules/mod_logio.so
-LoadModule macro_module modules/mod_macro.so
-LoadModule mime_magic_module modules/mod_mime_magic.so
 LoadModule mime_module modules/mod_mime.so
-LoadModule negotiation_module modules/mod_negotiation.so
-LoadModule remoteip_module modules/mod_remoteip.so
-LoadModule reqtimeout_module modules/mod_reqtimeout.so
-LoadModule rewrite_module modules/mod_rewrite.so
-LoadModule setenvif_module modules/mod_setenvif.so
-LoadModule slotmem_plain_module modules/mod_slotmem_plain.so
-LoadModule slotmem_shm_module modules/mod_slotmem_shm.so
-LoadModule socache_dbm_module modules/mod_socache_dbm.so
-LoadModule socache_memcache_module modules/mod_socache_memcache.so
-LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
 LoadModule status_module modules/mod_status.so
+LoadModule negotiation_module modules/mod_negotiation.so
+LoadModule dir_module modules/mod_dir.so
 LoadModule ssl_module modules/mod_ssl.so
-LoadModule substitute_module modules/mod_substitute.so
-LoadModule suexec_module modules/mod_suexec.so
-LoadModule unique_id_module modules/mod_unique_id.so
-LoadModule unixd_module modules/mod_unixd.so
-LoadModule userdir_module modules/mod_userdir.so
+LoadModule alias_module modules/mod_alias.so
+LoadModule rewrite_module modules/mod_rewrite.so
 LoadModule version_module modules/mod_version.so
-LoadModule vhost_alias_module modules/mod_vhost_alias.so
-
-LoadModule mpm_prefork_module modules/mod_mpm_prefork.so
 LoadModule wsgi_module modules/mod_wsgi.so
-LoadModule auth_gssapi_module modules/mod_auth_gssapi.so
 # openidc needs to be before mellon: https://bugzilla.redhat.com/show_bug.cgi?id=1332729
 LoadModule auth_openidc_module modules/mod_auth_openidc.so
-LoadModule auth_mellon_module modules/mod_auth_mellon.so
 
 Listen ${HTTPADDR}:${HTTPPORT} https
 SSLCertificateFile "${CERTROOT}/${NAME}.pem"
 SSLCertificateKeyFile "${CERTROOT}/${NAME}.key"
 SSLEngine on
 
+<IfVersion < 2.4>
+    LoadModule auth_kerb_module modules/mod_auth_kerb.so
+</IfVersion>
+<IfVersion >= 2.4>
+    LoadModule authn_core_module modules/mod_authn_core.so
+    LoadModule authz_core_module modules/mod_authz_core.so
+    LoadModule unixd_module modules/mod_unixd.so
+    LoadModule mpm_prefork_module modules/mod_mpm_prefork.so
+    LoadModule auth_gssapi_module modules/mod_auth_gssapi.so
+</IfVersion>
+
+# This needs to be loaded last
+LoadModule auth_mellon_module modules/mod_auth_mellon.so
 
 <Directory />
     AllowOverride none
-    Require all denied
+    <IfModule mod_authz_core.c>
+      Require all denied
+    </IfModule>
+    <IfModule !mod_authz_core.c>
+      Order Allow,Deny
+      Deny from All
+    </IfModule>
 </Directory>
 
 DocumentRoot "${HTTPROOT}/html"
 <Directory "${HTTPROOT}">
     AllowOverride None
     # Allow open access:
-    Require all granted
+    <IfModule mod_authz_core.c>
+      Require all granted
+    </IfModule>
+    <IfModule !mod_authz_core.c>
+      Order Allow,Deny
+      Allow from All
+    </IfModule>
 </Directory>
 <Directory "${HTTPROOT}/html">
     Options Indexes FollowSymLinks
     AllowOverride None
-    Require all granted
+    <IfModule mod_authz_core.c>
+      Require all granted
+    </IfModule>
+    <IfModule !mod_authz_core.c>
+      Order Allow,Deny
+      Allow from All
+    </IfModule>
 </Directory>
 
 <IfModule dir_module>
@@ -96,7 +82,13 @@ DocumentRoot "${HTTPROOT}/html"
 </IfModule>
 
 <Files ".ht*">
-    Require all denied
+    <IfModule mod_authz_core.c>
+      Require all denied
+    </IfModule>
+    <IfModule !mod_authz_core.c>
+      Order Allow,Deny
+      Deny from All
+    </IfModule>
 </Files>
 
 PidFile "${HTTPROOT}/logs/httpd.pid"
@@ -119,6 +111,6 @@ LogLevel debug
 
 AddDefaultCharset UTF-8
 
-IncludeOptional conf.d/*.conf
+Include conf.d/*.conf
 
 CoreDumpDirectory /tmp
diff --git a/tests/ldap.py b/tests/ldap.py
index 9942dfc..b262351 100755
--- a/tests/ldap.py
+++ b/tests/ldap.py
@@ -62,7 +62,13 @@ def fixup_sp_httpd(httpdir):
 Alias /sp ${HTTPDIR}/sp
 
 <Directory ${HTTPDIR}/sp>
-    Require all granted
+    <IfModule mod_authz_core.c>
+        Require all granted
+    </IfModule>
+    <IfModule !mod_authz_core.c>
+        Order Allow,Deny
+        Allow from All
+    </IfModule>
     Options +Includes
 </Directory>
 """
diff --git a/tests/ldapdown.py b/tests/ldapdown.py
index 4522f45..6316a5e 100755
--- a/tests/ldapdown.py
+++ b/tests/ldapdown.py
@@ -64,7 +64,13 @@ def fixup_sp_httpd(httpdir):
 Alias /sp ${HTTPDIR}/sp
 
 <Directory ${HTTPDIR}/sp>
-    Require all granted
+    <IfModule mod_authz_core.c>
+        Require all granted
+    </IfModule>
+    <IfModule !mod_authz_core.c>
+        Order Allow,Deny
+        Allow from All
+    </IfModule>
     Options +Includes
 </Directory>
 """
diff --git a/tests/openid.py b/tests/openid.py
index b72956a..a695096 100755
--- a/tests/openid.py
+++ b/tests/openid.py
@@ -39,7 +39,13 @@ def fixup_sp_httpd(httpdir, testdir):
 WSGIScriptAlias / ${TESTDIR}/blobs/openid_app.py
 
 <Directory ${TESTDIR}/blobs>
-    Require all granted
+    <IfModule mod_authz_core.c>
+        Require all granted
+    </IfModule>
+    <IfModule !mod_authz_core.c>
+        Order Allow,Deny
+        Allow from All
+    </IfModule>
 </Directory>
 """
     t = Template(client_wsgi)
diff --git a/tests/pgdb.py b/tests/pgdb.py
index 27a2b23..2b10366 100755
--- a/tests/pgdb.py
+++ b/tests/pgdb.py
@@ -55,7 +55,13 @@ def fixup_sp_httpd(httpdir):
 Alias /sp ${HTTPDIR}/sp
 
 <Directory ${HTTPDIR}/sp>
-    Require all granted
+    <IfModule mod_authz_core.c>
+        Require all granted
+    </IfModule>
+    <IfModule !mod_authz_core.c>
+        Order Allow,Deny
+        Allow from All
+    </IfModule>
 </Directory>
 
 Alias /open ${HTTPDIR}/open
diff --git a/tests/test1.py b/tests/test1.py
index 5858dca..26343e2 100755
--- a/tests/test1.py
+++ b/tests/test1.py
@@ -76,7 +76,13 @@ def fixup_sp_httpd(httpdir):
 Alias /sp ${HTTPDIR}/sp
 
 <Directory ${HTTPDIR}/sp>
-    Require all granted
+    <IfModule mod_authz_core.c>
+        Require all granted
+    </IfModule>
+    <IfModule !mod_authz_core.c>
+        Order Allow,Deny
+        Allow from All
+    </IfModule>
 </Directory>
 """
     index = """WORKS!"""
diff --git a/tests/testgssapi.py b/tests/testgssapi.py
index 3e3abea..540dac6 100755
--- a/tests/testgssapi.py
+++ b/tests/testgssapi.py
@@ -64,7 +64,13 @@ def fixup_sp_httpd(httpdir):
 Alias /sp ${HTTPDIR}/sp
 
 <Directory ${HTTPDIR}/sp>
-    Require all granted
+    <IfModule mod_authz_core.c>
+        Require all granted
+    </IfModule>
+    <IfModule !mod_authz_core.c>
+        Order Allow,Deny
+        Allow from All
+    </IfModule>
 </Directory>
 """
     index = """WORKS!"""
diff --git a/tests/testlogout.py b/tests/testlogout.py
index f956bd2..a687e3e 100755
--- a/tests/testlogout.py
+++ b/tests/testlogout.py
@@ -86,7 +86,13 @@ def fixup_sp_httpd(httpdir):
 Alias /sp ${HTTPDIR}/sp
 
 <Directory ${HTTPDIR}/sp>
-    Require all granted
+    <IfModule mod_authz_core.c>
+        Require all granted
+    </IfModule>
+    <IfModule !mod_authz_core.c>
+        Order Allow,Deny
+        Allow from All
+    </IfModule>
 </Directory>
 
 Alias /open ${HTTPDIR}/open
diff --git a/tests/testmapping.py b/tests/testmapping.py
index 59a173f..ac22627 100755
--- a/tests/testmapping.py
+++ b/tests/testmapping.py
@@ -103,7 +103,13 @@ AddOutputFilter INCLUDES .html
 Alias /sp ${HTTPDIR}/sp
 
 <Directory ${HTTPDIR}/sp>
-    Require all granted
+    <IfModule mod_authz_core.c>
+        Require all granted
+    </IfModule>
+    <IfModule !mod_authz_core.c>
+        Order Allow,Deny
+        Allow from All
+    </IfModule>
     Options +Includes
 </Directory>
 
diff --git a/tests/testnameid.py b/tests/testnameid.py
index 22beed5..792a1e5 100755
--- a/tests/testnameid.py
+++ b/tests/testnameid.py
@@ -88,7 +88,13 @@ AddOutputFilter INCLUDES .html
 Alias /sp ${HTTPDIR}/sp
 
 <Directory ${HTTPDIR}/sp>
-    Require all granted
+    <IfModule mod_authz_core.c>
+        Require all granted
+    </IfModule>
+    <IfModule !mod_authz_core.c>
+        Order Allow,Deny
+        Allow from All
+    </IfModule>
     Options +Includes
 </Directory>
 """
diff --git a/tests/testrest.py b/tests/testrest.py
index 1218981..02824ed 100755
--- a/tests/testrest.py
+++ b/tests/testrest.py
@@ -72,7 +72,13 @@ def fixup_sp_httpd(httpdir, alias):
 Alias /${ALIAS} ${HTTPDIR}/sp
 
 <Directory ${HTTPDIR}/${ALIAS}>
-    Require all granted
+    <IfModule mod_authz_core.c>
+        Require all granted
+    </IfModule>
+    <IfModule !mod_authz_core.c>
+        Order Allow,Deny
+        Allow from All
+    </IfModule>
 </Directory>
 """
     index = """WORKS!"""
diff --git a/tests/trans.py b/tests/trans.py
index 4749eb8..8d83da1 100755
--- a/tests/trans.py
+++ b/tests/trans.py
@@ -49,7 +49,13 @@ def fixup_sp_httpd(httpdir):
 Alias /sp ${HTTPDIR}/sp
 
 <Directory ${HTTPDIR}/sp>
-    Require all granted
+    <IfModule mod_authz_core.c>
+        Require all granted
+    </IfModule>
+    <IfModule !mod_authz_core.c>
+        Order Allow,Deny
+        Allow from All
+    </IfModule>
 </Directory>
 """
     index = """WORKS!"""

From 93a7e84d465b7d968c45321ea09df5ee51e6c783 Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <puiterwijk@redhat.com>
Date: Jul 11 2016 10:09:26 +0000
Subject: [PATCH 4/10] Use temporary testdir


This makes sure that two parallel runs of the test suite do
not collide with eachother.

Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Reviewed-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/Makefile b/Makefile
index fe0ff42..0d935e3 100644
--- a/Makefile
+++ b/Makefile
@@ -94,23 +94,25 @@ wrappers:
 	#SOCKET_WRAPPER_DIR=wrapdir
 	#SOCKET_WRAPPER_DEFAULT_IFACE=9
 
+TESTDIR := $(shell mktemp --directory /tmp/ipsilon-testdir.XXXXXXXX)
+
 tests: wrappers
-	rm -rf testdir
-	PYTHONPATH=./ ./tests/tests.py --test=test1
-	PYTHONPATH=./ ./tests/tests.py --test=testlogout
-	PYTHONPATH=./ ./tests/tests.py --test=testnameid
-	PYTHONPATH=./ ./tests/tests.py --test=testrest
-	PYTHONPATH=./ ./tests/tests.py --test=testmapping
-	PYTHONPATH=./ ./tests/tests.py --test=testgssapi
-	PYTHONPATH=./ ./tests/tests.py --test=attrs
-	PYTHONPATH=./ ./tests/tests.py --test=trans
-	PYTHONPATH=./ ./tests/tests.py --test=pgdb
-	PYTHONPATH=./ ./tests/tests.py --test=fconf
-	PYTHONPATH=./ ./tests/tests.py --test=ldap
-	PYTHONPATH=./ ./tests/tests.py --test=ldapdown
-	PYTHONPATH=./ ./tests/tests.py --test=openid
-	PYTHONPATH=./ ./tests/tests.py --test=openidc
-	PYTHONPATH=./ ./tests/tests.py --test=dbupgrades
+	echo "Testdir: $(TESTDIR)"
+	PYTHONPATH=./ ./tests/tests.py --path=$(TESTDIR) --test=test1
+	PYTHONPATH=./ ./tests/tests.py --path=$(TESTDIR) --test=testlogout
+	PYTHONPATH=./ ./tests/tests.py --path=$(TESTDIR) --test=testnameid
+	PYTHONPATH=./ ./tests/tests.py --path=$(TESTDIR) --test=testrest
+	PYTHONPATH=./ ./tests/tests.py --path=$(TESTDIR) --test=testmapping
+	PYTHONPATH=./ ./tests/tests.py --path=$(TESTDIR) --test=testgssapi
+	PYTHONPATH=./ ./tests/tests.py --path=$(TESTDIR) --test=attrs
+	PYTHONPATH=./ ./tests/tests.py --path=$(TESTDIR) --test=trans
+	PYTHONPATH=./ ./tests/tests.py --path=$(TESTDIR) --test=pgdb
+	PYTHONPATH=./ ./tests/tests.py --path=$(TESTDIR) --test=fconf
+	PYTHONPATH=./ ./tests/tests.py --path=$(TESTDIR) --test=ldap
+	PYTHONPATH=./ ./tests/tests.py --path=$(TESTDIR) --test=ldapdown
+	PYTHONPATH=./ ./tests/tests.py --path=$(TESTDIR) --test=openid
+	PYTHONPATH=./ ./tests/tests.py --path=$(TESTDIR) --test=openidc
+	PYTHONPATH=./ ./tests/tests.py --path=$(TESTDIR) --test=dbupgrades
 
 test: lp-test unittests tests
 

From 19a11e8c3855ad240fe056cb7f5c4216158a85cc Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <puiterwijk@redhat.com>
Date: Jul 11 2016 10:14:46 +0000
Subject: [PATCH 5/10] Use new sqlalchemy and jinja2


Use the pkg_resources WorkingSet method to make sure we have
a reasonably sane version of sqlalchemy and jinja2 on systems
where the old version is primary, but the new version is installed.

Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>

---

diff --git a/Makefile b/Makefile
index 0d935e3..e1bfe63 100644
--- a/Makefile
+++ b/Makefile
@@ -22,7 +22,7 @@ testdeps:
 	python -c 'import cherrypy'
 	python -c 'import M2Crypto'
 	python -c 'import lasso'
-	python -c 'import sqlalchemy'
+	python -c '__requires__ = ["sqlalchemy >= 0.8"]; import pkg_resources; import sqlalchemy'
 	python -c 'import ldap'
 	python -c 'import pam'
 	python -c 'import fedora'
@@ -85,7 +85,7 @@ lp-test:
 		   --ignored-classes=cherrypy \
 		   --disable=star-args \
 		   ./tests
-	pep8 tests
+	pep8 --ignore=E121,E123,E126,E226,E24,E704,E402 tests
 
 wrappers:
 	#rm -fr wrapdir
diff --git a/ipsilon/install/ipsilon-db2conf b/ipsilon/install/ipsilon-db2conf
index 4d9760a..ed52942 100755
--- a/ipsilon/install/ipsilon-db2conf
+++ b/ipsilon/install/ipsilon-db2conf
@@ -2,6 +2,9 @@
 #
 # Copyright (C) 2015 Ipsilon project Contributors, for license see COPYING
 
+__requires__ = ['sqlalchemy >= 0.8']
+import pkg_resources  # pylint: disable=unused-import
+
 import argparse
 import cherrypy
 from ConfigParser import RawConfigParser
diff --git a/ipsilon/install/ipsilon-server-install b/ipsilon/install/ipsilon-server-install
index 33e3596..3a2c796 100755
--- a/ipsilon/install/ipsilon-server-install
+++ b/ipsilon/install/ipsilon-server-install
@@ -1,6 +1,9 @@
 #!/usr/bin/python
 # Copyright (C) 2014 Ipsilon project Contributors, for license see COPYING
 
+__requires__ = ['sqlalchemy >= 0.8']
+import pkg_resources  # pylint: disable=unused-import
+
 from ipsilon.login.common import LoginMgrsInstall
 from ipsilon.info.common import InfoProviderInstall
 from ipsilon.providers.common import ProvidersInstall
diff --git a/ipsilon/install/ipsilon-upgrade-database b/ipsilon/install/ipsilon-upgrade-database
index cb1d4fa..795e190 100755
--- a/ipsilon/install/ipsilon-upgrade-database
+++ b/ipsilon/install/ipsilon-upgrade-database
@@ -2,6 +2,9 @@
 #
 # Copyright (C) 2015 Ipsilon project Contributors, for license see COPYING
 
+__requires__ = ['sqlalchemy >= 0.8']
+import pkg_resources  # pylint: disable=unused-import
+
 import sys
 from ipsilon import find_config
 from ipsilon.tools import dbupgrade
diff --git a/ipsilon/ipsilon b/ipsilon/ipsilon
index db82e7a..aeb1e58 100755
--- a/ipsilon/ipsilon
+++ b/ipsilon/ipsilon
@@ -2,6 +2,12 @@
 #
 # Copyright (C) 2013 Ipsilon project Contributors, for license see COPYING
 
+# These lines make sure that we have at least a minimum version of some
+# packages, since we depend on features provided by them.
+import __main__
+__main__.__requires__ = ['sqlalchemy >= 0.8', 'jinja2 >= 2.4']
+import pkg_resources  # pylint: disable=unused-import
+
 import sys
 sys.stdout = sys.stderr
 import glob
diff --git a/tests/tests.py b/tests/tests.py
index 7a7b168..f84059b 100755
--- a/tests/tests.py
+++ b/tests/tests.py
@@ -2,6 +2,9 @@
 #
 # Copyright (C) 2014 Ipsilon project Contributors, for license see COPYING
 
+__requires__ = ['sqlalchemy >= 0.8']
+import pkg_resources  # pylint: disable=unused-import
+
 import argparse
 import inspect
 from ipsilon.util import plugin

From 36d3ce73c3164387e444a2c33186f71a11829105 Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <puiterwijk@redhat.com>
Date: Jul 11 2016 10:14:48 +0000
Subject: [PATCH 6/10] Support mod_auth_kerb


Add support for mod_auth_kerb back, depending on which module
has been loaded.

Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Reviewed-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/ipsilon/login/authgssapi.py b/ipsilon/login/authgssapi.py
index a05644d..973402b 100644
--- a/ipsilon/login/authgssapi.py
+++ b/ipsilon/login/authgssapi.py
@@ -25,7 +25,7 @@ class GSSAPIAuth(LoginPageBase):
         # If we can get here, we must be authenticated and remote_user
         # was set. Check the session has a user set already or error.
         us = UserSession()
-        us.remote_login()
+        us.remote_login(is_krb=True)
         self.user = us.get_user()
         if not self.user.is_anonymous:
             principal = cherrypy.request.wsgi_environ.get('GSS_NAME', None)
@@ -87,11 +87,19 @@ apache plugin for actual authentication. """
 CONF_TEMPLATE = """
 
 <Location /${instance}/login/gssapi/negotiate>
-  AuthType GSSAPI
   AuthName "GSSAPI Single Sign On Login"
-  $keytab
-  GssapiSSLonly $gssapisslonly
-  GssapiLocalName on
+  <IfModule mod_auth_gssapi.c>
+    GssapiCredStore keytab:$keytab
+    AuthType GSSAPI
+    GssapiSSLonly $gssapisslonly
+    GssapiLocalName on
+  </IfModule>
+  <IfModule mod_auth_kerb.c>
+    Krb5KeyTab $keytab
+    AuthType Kerberos
+    KrbMethodNegotiate On
+    KrbMethodK5Passwd Off
+  </IfModule>
   Require valid-user
 
   ErrorDocument 401 /${instance}/login/gssapi/unauthorized
@@ -121,8 +129,7 @@ class Installer(LoginManagerInstaller):
         confopts = {'instance': opts['instance']}
 
         if os.path.exists(opts['gssapi_httpd_keytab']):
-            confopts['keytab'] = 'GssapiCredStore keytab:%s' % (
-                opts['gssapi_httpd_keytab'])
+            confopts['keytab'] = opts['gssapi_httpd_keytab']
         else:
             raise Exception('Keytab not found')
 
diff --git a/ipsilon/login/common.py b/ipsilon/login/common.py
index 8bb3631..d0ef41a 100644
--- a/ipsilon/login/common.py
+++ b/ipsilon/login/common.py
@@ -56,6 +56,11 @@ class LoginHelper(Log):
             auth_type = cherrypy.request.wsgi_environ.get('AUTH_TYPE')
             if auth_type:
                 auth_type = 'external:%s' % (auth_type.lower())
+                if auth_type == 'external:negotiate' and '@' in username:
+                    # This was likely mod_auth_kerb. Let's be compatible with
+                    # gssapi
+                    cherrypy.request.wsgi_environ['GSS_NAME'] = username
+                    username = username[:username.find('@')]
 
         self.debug("get_external_auth_info: username=%s auth_type=%s" % (
             username, auth_type))
diff --git a/ipsilon/util/user.py b/ipsilon/util/user.py
index ee3fe41..1158d31 100644
--- a/ipsilon/util/user.py
+++ b/ipsilon/util/user.py
@@ -99,9 +99,13 @@ class UserSession(Log):
     def get_user(self):
         return User(self.user)
 
-    def remote_login(self):
+    def remote_login(self, is_krb=False):
         if cherrypy.request.login:
-            self.login(cherrypy.request.login)
+            username = cherrypy.request.login
+            if is_krb and '@' in username:
+                cherrypy.request.wsgi_environ['GSS_NAME'] = username
+                username = username[:username.find('@')]
+            self.login(username)
         else:
             self.nuke_data('user')
 

From 371f4daebbb79494715ba8e648c04ac1a899a1b0 Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <puiterwijk@redhat.com>
Date: Jul 11 2016 10:14:48 +0000
Subject: [PATCH 7/10] Resolve identity problem in ldap test


Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Reviewed-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/tests/ldap.py b/tests/ldap.py
index b262351..bc8b86a 100755
--- a/tests/ldap.py
+++ b/tests/ldap.py
@@ -130,7 +130,7 @@ if __name__ == '__main__':
     sess.add_server(idpname, 'https://127.0.0.10:45080', user, 'tuser')
     sess.add_server(spname, 'https://127.0.0.11:45081')
 
-    print "test1: Authenticate to IDP ...",
+    print "ldap: Authenticate to IDP ...",
     try:
         sess.auth_to_idp(idpname)
     except Exception, e:  # pylint: disable=broad-except
@@ -138,7 +138,7 @@ if __name__ == '__main__':
         sys.exit(1)
     print " SUCCESS"
 
-    print "test1: Add SP Metadata to IDP ...",
+    print "ldap: Add SP Metadata to IDP ...",
     try:
         sess.add_sp_metadata(idpname, spname)
     except Exception, e:  # pylint: disable=broad-except
@@ -146,7 +146,7 @@ if __name__ == '__main__':
         sys.exit(1)
     print " SUCCESS"
 
-    print "test1: Access SP Protected Area ...",
+    print "ldap: Access SP Protected Area ...",
     try:
         page = sess.fetch_page(idpname,
                                'https://127.0.0.11:45081/sp/index.shtml')

From 8f35c097916db648ad2dbd07a65557418d505d62 Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <puiterwijk@redhat.com>
Date: Jul 11 2016 10:14:48 +0000
Subject: [PATCH 8/10] Use version-independent way to pass socket dir to postgres


With version <9.3 we would need to specify unix_socket_directory
and with >=9.3 we would need unix_socket_directories.
Both versions have a -k flag which is equivalient to setting either
option, so this makes it compatible across all versions.

Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Reviewed-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/tests/helpers/common.py b/tests/helpers/common.py
index 70dffd2..409ffe5 100755
--- a/tests/helpers/common.py
+++ b/tests/helpers/common.py
@@ -250,7 +250,7 @@ basicConstraints = CA:false""" % {'certdir': os.path.join(self.testdir,
 
     def start_pgdb_server(self, datadir, rundir, log, addr, port, env):
         p = subprocess.Popen(['/usr/bin/pg_ctl', 'start', '-D', datadir, '-o',
-                              '-c unix_socket_directories=%s -c port=%s -c \
+                              '-k %s -c port=%s -c \
                                listen_addresses=%s' % (rundir, port, addr),
                               '-l', log, '-w'],
                              env=env, preexec_fn=os.setsid)

From 48126c70ad7d47966c9a22bfacc3b04b249b48c5 Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <puiterwijk@redhat.com>
Date: Jul 11 2016 10:14:49 +0000
Subject: [PATCH 9/10] Move the KDC port outside of the privileged range


On EL6 we can't use the libsocket-wrapper. This means that
ports below 1024 are still privileged, and this would mean
we would need to run the test suite as root.
Since we explicitly say we do not want to run this as root,
let's instead just move the last thing to a non-privileged
port.

Signed-off-by: Howard Johnson <merlin@merlinthp.org>
Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Reviewed-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/tests/helpers/common.py b/tests/helpers/common.py
index 409ffe5..ddefbcb 100755
--- a/tests/helpers/common.py
+++ b/tests/helpers/common.py
@@ -32,7 +32,7 @@ KRB5_CONF_TEMPLATE = '''
 
 [realms]
   ${TESTREALM} = {
-    kdc =${WRAP_HOSTNAME}
+    kdc =${WRAP_HOSTNAME}:8888
   }
 
 [domain_realm]
@@ -47,8 +47,8 @@ KRB5_CONF_TEMPLATE = '''
 
 KDC_CONF_TEMPLATE = '''
 [kdcdefaults]
- kdc_ports = 88
- kdc_tcp_ports = 88
+ kdc_ports = 8888
+ kdc_tcp_ports = 8888
  restrict_anonymous_to_tgt = true
 
 [realms]

From 6f9d4b4d69272ee6bad784c6dbffa8094890073e Mon Sep 17 00:00:00 2001
From: Patrick Uiterwijk <puiterwijk@redhat.com>
Date: Jul 11 2016 10:14:49 +0000
Subject: [PATCH 10/10] Explicitly default to WSGI Socket Prefix run/wsgi


Signed-off-by: Howard Johnson <merlin@merlinthp.org>
Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>

---

diff --git a/ipsilon/install/ipsilon-server-install b/ipsilon/install/ipsilon-server-install
index 3a2c796..0afbf84 100755
--- a/ipsilon/install/ipsilon-server-install
+++ b/ipsilon/install/ipsilon-server-install
@@ -135,7 +135,7 @@ def install(plugins, args):
     if WSGI_SOCKET_PREFIX:
         confopts['wsgi_socket'] = 'WSGISocketPrefix %s' % WSGI_SOCKET_PREFIX
     else:
-        confopts['wsgi_socket'] = ''
+        confopts['wsgi_socket'] = 'WSGISocketPrefix run/wsgi'
     files.write_from_template(ipsilon_conf,
                               os.path.join(TEMPLATES, 'ipsilon.conf'),
                               confopts)

