From 175a79328f720b00d593d6de812c473cca8dbf08 Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk Date: Jul 11 2016 10:09:15 +0000 Subject: [PATCH 1/10] Test for some more dependencies that we also use Signed-off-by: Howard Johnson Signed-off-by: Patrick Uiterwijk Reviewed-by: Pierre-Yves Chibon --- diff --git a/Makefile b/Makefile index 9f88a72..fe0ff42 100644 --- a/Makefile +++ b/Makefile @@ -14,6 +14,8 @@ testdeps: which openssl which slapd # Now, python libraries + python -c 'import argparse' + python -c 'import requests_kerberos' python -c 'import openid' python -c 'import openid_teams' python -c 'import openid_cla' @@ -28,9 +30,9 @@ testdeps: python -c 'import jinja2' python -c 'import psycopg2' # And now everything else - ls /usr/share/doc/sssd - ls /usr/lib64/libsss_simpleifp.so.0 - ls /usr/lib64/httpd/modules/mod_wsgi.so + ls /usr/lib*/security/pam_sss.so + ls /usr/lib*/libsss_simpleifp.so.0 + ls /usr/lib*/httpd/modules/mod_wsgi.so ls /usr/libexec/mod_auth_mellon lint: From 664ea7bbeb575a094680b13bc286f2279acfc079 Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk Date: Jul 11 2016 10:09:20 +0000 Subject: [PATCH 2/10] Use more specific paths to binaries for pre-usrmove compatibility Move some binary calls to their actual specific location where they were before the usrmove. This will allow us to support operating systems that don't have the usrmove. Signed-off-by: Howard Johnson Signed-off-by: Patrick Uiterwijk Reviewed-by: Pierre-Yves Chibon --- diff --git a/ipsilon/install/ipsilon-server-install b/ipsilon/install/ipsilon-server-install index 2559357..33e3596 100755 --- a/ipsilon/install/ipsilon-server-install +++ b/ipsilon/install/ipsilon-server-install @@ -229,7 +229,7 @@ def install(plugins, args): files.fix_user_dirs(instance_conf, opts['system_user']) files.fix_user_dirs(args['data_dir'], opts['system_user']) try: - subprocess.call(['/usr/sbin/restorecon', '-R', args['data_dir']]) + subprocess.call(['/sbin/restorecon', '-R', args['data_dir']]) except Exception: # pylint: disable=broad-except pass diff --git a/quickrun.py b/quickrun.py index 3189ba4..ce7eb94 100755 --- a/quickrun.py +++ b/quickrun.py @@ -59,13 +59,13 @@ def config(workdir): text = t.substitute({'workdir': workdir}) with open(sql, 'w+') as f: f.write(text) - subprocess.call(['sqlite3', '-init', sql, admin_db, '.quit']) + subprocess.call(['/usr/bin/sqlite3', '-init', sql, admin_db, '.quit']) users_db = os.path.join(workdir, 'userprefs.sqlite') sql = os.path.join(workdir, 'users.sql') with open(sql, 'w+') as f: f.write(USERS_TEMPLATE) - subprocess.call(['sqlite3', '-init', sql, users_db, '.quit']) + subprocess.call(['/usr/bin/sqlite3', '-init', sql, users_db, '.quit']) trans_db = os.path.join(workdir, 'transactions.sqlite') cachedir = os.path.join(workdir, 'cache') diff --git a/tests/dbupgrades.py b/tests/dbupgrades.py index 0e6518f..bfa3788 100755 --- a/tests/dbupgrades.py +++ b/tests/dbupgrades.py @@ -64,7 +64,7 @@ class IpsilonTest(IpsilonTestBase): db_in = os.path.join(db_indir, '%s.sqlite.dump' % database) db_out = os.path.join(db_outdir, '%s.sqlite' % database) os.unlink(db_out) - cmd = ['/bin/sqlite3', db_out, '.read %s' % db_in] + cmd = ['/usr/bin/sqlite3', db_out, '.read %s' % db_in] subprocess.check_call(cmd) # Upgrade that database @@ -80,7 +80,7 @@ class IpsilonTest(IpsilonTestBase): # Check all features in a newly created database # Let's verify if at least one index was created test_db = os.path.join(db_outdir, 'adminconfig.sqlite') - p = subprocess.Popen(['/bin/sqlite3', test_db, '.dump'], + p = subprocess.Popen(['/usr/bin/sqlite3', test_db, '.dump'], stdout=subprocess.PIPE) output, _ = p.communicate() if p.returncode: @@ -95,7 +95,7 @@ class IpsilonTest(IpsilonTestBase): # In 1 -> 2, we added indexes and primary keys # Let's verify if at least one index was created test_db = os.path.join(db_outdir, 'adminconfig.sqlite') - p = subprocess.Popen(['/bin/sqlite3', test_db, '.dump'], + p = subprocess.Popen(['/usr/bin/sqlite3', test_db, '.dump'], stdout=subprocess.PIPE) output, _ = p.communicate() if p.returncode: From e3090bdc13cd3a32cb6e35335bdbf6967a329d19 Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk Date: Jul 11 2016 10:09:23 +0000 Subject: [PATCH 3/10] Make apache configs compatible with pre-2.3 Make Apache configuration files compatible with versions that do not have mod_authz_core module, for example httpd 2.2. Signed-off-by: Howard Johnson Signed-off-by: Patrick Uiterwijk Reviewed-by: Pierre-Yves Chibon --- diff --git a/templates/install/idp.conf b/templates/install/idp.conf index 57725a2..66a1bc9 100644 --- a/templates/install/idp.conf +++ b/templates/install/idp.conf @@ -23,15 +23,33 @@ ${wsgi_socket} + Require all granted + + + Order Allow,Deny + Allow from All + + Require all granted + + + Order Allow,Deny + Allow from All + + Require all granted + + + Order Allow,Deny + Allow from All + ForceType application/json @@ -40,6 +58,11 @@ ${wsgi_socket} SetHandler None AllowOverride None - Satisfy Any - Allow from all + + Require all granted + + + Order Allow,Deny + Allow from All + diff --git a/templates/install/saml2/sp.conf b/templates/install/saml2/sp.conf index 3ea4ca5..075f700 100644 --- a/templates/install/saml2/sp.conf +++ b/templates/install/saml2/sp.conf @@ -35,7 +35,13 @@ ${sp} ${sp} ${sp} SSLRequireSSL ${sp} +${sp} ${sp} Require all granted +${sp} +${sp} +${sp} Order Allow,Deny +${sp} Allow from All +${sp} ${sp} # Redirect requests to the secure port diff --git a/tests/attrs.py b/tests/attrs.py index 929ef66..a9fbcc8 100755 --- a/tests/attrs.py +++ b/tests/attrs.py @@ -58,7 +58,13 @@ def fixup_sp_httpd(httpdir): Alias /sp ${HTTPDIR}/sp - Require all granted + + Require all granted + + + Order Allow,Deny + Allow from All + Options +Includes """ diff --git a/tests/fconf.py b/tests/fconf.py index 305a6cf..c2440d4 100755 --- a/tests/fconf.py +++ b/tests/fconf.py @@ -77,7 +77,13 @@ def fixup_sp_httpd(httpdir): Alias /sp ${HTTPDIR}/sp - Require all granted + + Require all granted + + + Order Allow,Deny + Allow from All + """ index = """WORKS!""" diff --git a/tests/httpd.conf b/tests/httpd.conf index 10b6dcd..75d6c65 100644 --- a/tests/httpd.conf +++ b/tests/httpd.conf @@ -1,94 +1,80 @@ ServerRoot "${HTTPROOT}" ServerName ${NAME}.ipsilon.dev -LoadModule access_compat_module modules/mod_access_compat.so -LoadModule actions_module modules/mod_actions.so -LoadModule alias_module modules/mod_alias.so -LoadModule allowmethods_module modules/mod_allowmethods.so -LoadModule auth_basic_module modules/mod_auth_basic.so -#LoadModule auth_digest_module modules/mod_auth_digest.so -LoadModule authn_anon_module modules/mod_authn_anon.so -LoadModule authn_core_module modules/mod_authn_core.so -LoadModule authn_dbd_module modules/mod_authn_dbd.so -LoadModule authn_dbm_module modules/mod_authn_dbm.so LoadModule authn_file_module modules/mod_authn_file.so -LoadModule authn_socache_module modules/mod_authn_socache.so -LoadModule authz_core_module modules/mod_authz_core.so -LoadModule authz_dbd_module modules/mod_authz_dbd.so -LoadModule authz_dbm_module modules/mod_authz_dbm.so -LoadModule authz_groupfile_module modules/mod_authz_groupfile.so -LoadModule authz_host_module modules/mod_authz_host.so -LoadModule authz_owner_module modules/mod_authz_owner.so +LoadModule authn_anon_module modules/mod_authn_anon.so LoadModule authz_user_module modules/mod_authz_user.so -LoadModule autoindex_module modules/mod_autoindex.so -LoadModule cache_module modules/mod_cache.so -LoadModule cache_disk_module modules/mod_cache_disk.so -LoadModule data_module modules/mod_data.so -LoadModule dbd_module modules/mod_dbd.so -LoadModule deflate_module modules/mod_deflate.so -LoadModule dir_module modules/mod_dir.so -LoadModule dumpio_module modules/mod_dumpio.so -LoadModule echo_module modules/mod_echo.so +LoadModule authz_host_module modules/mod_authz_host.so +LoadModule include_module modules/mod_include.so +LoadModule log_config_module modules/mod_log_config.so LoadModule env_module modules/mod_env.so -LoadModule expires_module modules/mod_expires.so LoadModule ext_filter_module modules/mod_ext_filter.so -LoadModule filter_module modules/mod_filter.so +LoadModule expires_module modules/mod_expires.so LoadModule headers_module modules/mod_headers.so -LoadModule include_module modules/mod_include.so -LoadModule info_module modules/mod_info.so -LoadModule log_config_module modules/mod_log_config.so -LoadModule logio_module modules/mod_logio.so -LoadModule macro_module modules/mod_macro.so -LoadModule mime_magic_module modules/mod_mime_magic.so LoadModule mime_module modules/mod_mime.so -LoadModule negotiation_module modules/mod_negotiation.so -LoadModule remoteip_module modules/mod_remoteip.so -LoadModule reqtimeout_module modules/mod_reqtimeout.so -LoadModule rewrite_module modules/mod_rewrite.so -LoadModule setenvif_module modules/mod_setenvif.so -LoadModule slotmem_plain_module modules/mod_slotmem_plain.so -LoadModule slotmem_shm_module modules/mod_slotmem_shm.so -LoadModule socache_dbm_module modules/mod_socache_dbm.so -LoadModule socache_memcache_module modules/mod_socache_memcache.so -LoadModule socache_shmcb_module modules/mod_socache_shmcb.so LoadModule status_module modules/mod_status.so +LoadModule negotiation_module modules/mod_negotiation.so +LoadModule dir_module modules/mod_dir.so LoadModule ssl_module modules/mod_ssl.so -LoadModule substitute_module modules/mod_substitute.so -LoadModule suexec_module modules/mod_suexec.so -LoadModule unique_id_module modules/mod_unique_id.so -LoadModule unixd_module modules/mod_unixd.so -LoadModule userdir_module modules/mod_userdir.so +LoadModule alias_module modules/mod_alias.so +LoadModule rewrite_module modules/mod_rewrite.so LoadModule version_module modules/mod_version.so -LoadModule vhost_alias_module modules/mod_vhost_alias.so - -LoadModule mpm_prefork_module modules/mod_mpm_prefork.so LoadModule wsgi_module modules/mod_wsgi.so -LoadModule auth_gssapi_module modules/mod_auth_gssapi.so # openidc needs to be before mellon: https://bugzilla.redhat.com/show_bug.cgi?id=1332729 LoadModule auth_openidc_module modules/mod_auth_openidc.so -LoadModule auth_mellon_module modules/mod_auth_mellon.so Listen ${HTTPADDR}:${HTTPPORT} https SSLCertificateFile "${CERTROOT}/${NAME}.pem" SSLCertificateKeyFile "${CERTROOT}/${NAME}.key" SSLEngine on + + LoadModule auth_kerb_module modules/mod_auth_kerb.so + += 2.4> + LoadModule authn_core_module modules/mod_authn_core.so + LoadModule authz_core_module modules/mod_authz_core.so + LoadModule unixd_module modules/mod_unixd.so + LoadModule mpm_prefork_module modules/mod_mpm_prefork.so + LoadModule auth_gssapi_module modules/mod_auth_gssapi.so + + +# This needs to be loaded last +LoadModule auth_mellon_module modules/mod_auth_mellon.so AllowOverride none - Require all denied + + Require all denied + + + Order Allow,Deny + Deny from All + DocumentRoot "${HTTPROOT}/html" AllowOverride None # Allow open access: - Require all granted + + Require all granted + + + Order Allow,Deny + Allow from All + Options Indexes FollowSymLinks AllowOverride None - Require all granted + + Require all granted + + + Order Allow,Deny + Allow from All + @@ -96,7 +82,13 @@ DocumentRoot "${HTTPROOT}/html" - Require all denied + + Require all denied + + + Order Allow,Deny + Deny from All + PidFile "${HTTPROOT}/logs/httpd.pid" @@ -119,6 +111,6 @@ LogLevel debug AddDefaultCharset UTF-8 -IncludeOptional conf.d/*.conf +Include conf.d/*.conf CoreDumpDirectory /tmp diff --git a/tests/ldap.py b/tests/ldap.py index 9942dfc..b262351 100755 --- a/tests/ldap.py +++ b/tests/ldap.py @@ -62,7 +62,13 @@ def fixup_sp_httpd(httpdir): Alias /sp ${HTTPDIR}/sp - Require all granted + + Require all granted + + + Order Allow,Deny + Allow from All + Options +Includes """ diff --git a/tests/ldapdown.py b/tests/ldapdown.py index 4522f45..6316a5e 100755 --- a/tests/ldapdown.py +++ b/tests/ldapdown.py @@ -64,7 +64,13 @@ def fixup_sp_httpd(httpdir): Alias /sp ${HTTPDIR}/sp - Require all granted + + Require all granted + + + Order Allow,Deny + Allow from All + Options +Includes """ diff --git a/tests/openid.py b/tests/openid.py index b72956a..a695096 100755 --- a/tests/openid.py +++ b/tests/openid.py @@ -39,7 +39,13 @@ def fixup_sp_httpd(httpdir, testdir): WSGIScriptAlias / ${TESTDIR}/blobs/openid_app.py - Require all granted + + Require all granted + + + Order Allow,Deny + Allow from All + """ t = Template(client_wsgi) diff --git a/tests/pgdb.py b/tests/pgdb.py index 27a2b23..2b10366 100755 --- a/tests/pgdb.py +++ b/tests/pgdb.py @@ -55,7 +55,13 @@ def fixup_sp_httpd(httpdir): Alias /sp ${HTTPDIR}/sp - Require all granted + + Require all granted + + + Order Allow,Deny + Allow from All + Alias /open ${HTTPDIR}/open diff --git a/tests/test1.py b/tests/test1.py index 5858dca..26343e2 100755 --- a/tests/test1.py +++ b/tests/test1.py @@ -76,7 +76,13 @@ def fixup_sp_httpd(httpdir): Alias /sp ${HTTPDIR}/sp - Require all granted + + Require all granted + + + Order Allow,Deny + Allow from All + """ index = """WORKS!""" diff --git a/tests/testgssapi.py b/tests/testgssapi.py index 3e3abea..540dac6 100755 --- a/tests/testgssapi.py +++ b/tests/testgssapi.py @@ -64,7 +64,13 @@ def fixup_sp_httpd(httpdir): Alias /sp ${HTTPDIR}/sp - Require all granted + + Require all granted + + + Order Allow,Deny + Allow from All + """ index = """WORKS!""" diff --git a/tests/testlogout.py b/tests/testlogout.py index f956bd2..a687e3e 100755 --- a/tests/testlogout.py +++ b/tests/testlogout.py @@ -86,7 +86,13 @@ def fixup_sp_httpd(httpdir): Alias /sp ${HTTPDIR}/sp - Require all granted + + Require all granted + + + Order Allow,Deny + Allow from All + Alias /open ${HTTPDIR}/open diff --git a/tests/testmapping.py b/tests/testmapping.py index 59a173f..ac22627 100755 --- a/tests/testmapping.py +++ b/tests/testmapping.py @@ -103,7 +103,13 @@ AddOutputFilter INCLUDES .html Alias /sp ${HTTPDIR}/sp - Require all granted + + Require all granted + + + Order Allow,Deny + Allow from All + Options +Includes diff --git a/tests/testnameid.py b/tests/testnameid.py index 22beed5..792a1e5 100755 --- a/tests/testnameid.py +++ b/tests/testnameid.py @@ -88,7 +88,13 @@ AddOutputFilter INCLUDES .html Alias /sp ${HTTPDIR}/sp - Require all granted + + Require all granted + + + Order Allow,Deny + Allow from All + Options +Includes """ diff --git a/tests/testrest.py b/tests/testrest.py index 1218981..02824ed 100755 --- a/tests/testrest.py +++ b/tests/testrest.py @@ -72,7 +72,13 @@ def fixup_sp_httpd(httpdir, alias): Alias /${ALIAS} ${HTTPDIR}/sp - Require all granted + + Require all granted + + + Order Allow,Deny + Allow from All + """ index = """WORKS!""" diff --git a/tests/trans.py b/tests/trans.py index 4749eb8..8d83da1 100755 --- a/tests/trans.py +++ b/tests/trans.py @@ -49,7 +49,13 @@ def fixup_sp_httpd(httpdir): Alias /sp ${HTTPDIR}/sp - Require all granted + + Require all granted + + + Order Allow,Deny + Allow from All + """ index = """WORKS!""" From 93a7e84d465b7d968c45321ea09df5ee51e6c783 Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk Date: Jul 11 2016 10:09:26 +0000 Subject: [PATCH 4/10] Use temporary testdir This makes sure that two parallel runs of the test suite do not collide with eachother. Signed-off-by: Patrick Uiterwijk Reviewed-by: Pierre-Yves Chibon --- diff --git a/Makefile b/Makefile index fe0ff42..0d935e3 100644 --- a/Makefile +++ b/Makefile @@ -94,23 +94,25 @@ wrappers: #SOCKET_WRAPPER_DIR=wrapdir #SOCKET_WRAPPER_DEFAULT_IFACE=9 +TESTDIR := $(shell mktemp --directory /tmp/ipsilon-testdir.XXXXXXXX) + tests: wrappers - rm -rf testdir - PYTHONPATH=./ ./tests/tests.py --test=test1 - PYTHONPATH=./ ./tests/tests.py --test=testlogout - PYTHONPATH=./ ./tests/tests.py --test=testnameid - PYTHONPATH=./ ./tests/tests.py --test=testrest - PYTHONPATH=./ ./tests/tests.py --test=testmapping - PYTHONPATH=./ ./tests/tests.py --test=testgssapi - PYTHONPATH=./ ./tests/tests.py --test=attrs - PYTHONPATH=./ ./tests/tests.py --test=trans - PYTHONPATH=./ ./tests/tests.py --test=pgdb - PYTHONPATH=./ ./tests/tests.py --test=fconf - PYTHONPATH=./ ./tests/tests.py --test=ldap - PYTHONPATH=./ ./tests/tests.py --test=ldapdown - PYTHONPATH=./ ./tests/tests.py --test=openid - PYTHONPATH=./ ./tests/tests.py --test=openidc - PYTHONPATH=./ ./tests/tests.py --test=dbupgrades + echo "Testdir: $(TESTDIR)" + PYTHONPATH=./ ./tests/tests.py --path=$(TESTDIR) --test=test1 + PYTHONPATH=./ ./tests/tests.py --path=$(TESTDIR) --test=testlogout + PYTHONPATH=./ ./tests/tests.py --path=$(TESTDIR) --test=testnameid + PYTHONPATH=./ ./tests/tests.py --path=$(TESTDIR) --test=testrest + PYTHONPATH=./ ./tests/tests.py --path=$(TESTDIR) --test=testmapping + PYTHONPATH=./ ./tests/tests.py --path=$(TESTDIR) --test=testgssapi + PYTHONPATH=./ ./tests/tests.py --path=$(TESTDIR) --test=attrs + PYTHONPATH=./ ./tests/tests.py --path=$(TESTDIR) --test=trans + PYTHONPATH=./ ./tests/tests.py --path=$(TESTDIR) --test=pgdb + PYTHONPATH=./ ./tests/tests.py --path=$(TESTDIR) --test=fconf + PYTHONPATH=./ ./tests/tests.py --path=$(TESTDIR) --test=ldap + PYTHONPATH=./ ./tests/tests.py --path=$(TESTDIR) --test=ldapdown + PYTHONPATH=./ ./tests/tests.py --path=$(TESTDIR) --test=openid + PYTHONPATH=./ ./tests/tests.py --path=$(TESTDIR) --test=openidc + PYTHONPATH=./ ./tests/tests.py --path=$(TESTDIR) --test=dbupgrades test: lp-test unittests tests From 19a11e8c3855ad240fe056cb7f5c4216158a85cc Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk Date: Jul 11 2016 10:14:46 +0000 Subject: [PATCH 5/10] Use new sqlalchemy and jinja2 Use the pkg_resources WorkingSet method to make sure we have a reasonably sane version of sqlalchemy and jinja2 on systems where the old version is primary, but the new version is installed. Signed-off-by: Patrick Uiterwijk --- diff --git a/Makefile b/Makefile index 0d935e3..e1bfe63 100644 --- a/Makefile +++ b/Makefile @@ -22,7 +22,7 @@ testdeps: python -c 'import cherrypy' python -c 'import M2Crypto' python -c 'import lasso' - python -c 'import sqlalchemy' + python -c '__requires__ = ["sqlalchemy >= 0.8"]; import pkg_resources; import sqlalchemy' python -c 'import ldap' python -c 'import pam' python -c 'import fedora' @@ -85,7 +85,7 @@ lp-test: --ignored-classes=cherrypy \ --disable=star-args \ ./tests - pep8 tests + pep8 --ignore=E121,E123,E126,E226,E24,E704,E402 tests wrappers: #rm -fr wrapdir diff --git a/ipsilon/install/ipsilon-db2conf b/ipsilon/install/ipsilon-db2conf index 4d9760a..ed52942 100755 --- a/ipsilon/install/ipsilon-db2conf +++ b/ipsilon/install/ipsilon-db2conf @@ -2,6 +2,9 @@ # # Copyright (C) 2015 Ipsilon project Contributors, for license see COPYING +__requires__ = ['sqlalchemy >= 0.8'] +import pkg_resources # pylint: disable=unused-import + import argparse import cherrypy from ConfigParser import RawConfigParser diff --git a/ipsilon/install/ipsilon-server-install b/ipsilon/install/ipsilon-server-install index 33e3596..3a2c796 100755 --- a/ipsilon/install/ipsilon-server-install +++ b/ipsilon/install/ipsilon-server-install @@ -1,6 +1,9 @@ #!/usr/bin/python # Copyright (C) 2014 Ipsilon project Contributors, for license see COPYING +__requires__ = ['sqlalchemy >= 0.8'] +import pkg_resources # pylint: disable=unused-import + from ipsilon.login.common import LoginMgrsInstall from ipsilon.info.common import InfoProviderInstall from ipsilon.providers.common import ProvidersInstall diff --git a/ipsilon/install/ipsilon-upgrade-database b/ipsilon/install/ipsilon-upgrade-database index cb1d4fa..795e190 100755 --- a/ipsilon/install/ipsilon-upgrade-database +++ b/ipsilon/install/ipsilon-upgrade-database @@ -2,6 +2,9 @@ # # Copyright (C) 2015 Ipsilon project Contributors, for license see COPYING +__requires__ = ['sqlalchemy >= 0.8'] +import pkg_resources # pylint: disable=unused-import + import sys from ipsilon import find_config from ipsilon.tools import dbupgrade diff --git a/ipsilon/ipsilon b/ipsilon/ipsilon index db82e7a..aeb1e58 100755 --- a/ipsilon/ipsilon +++ b/ipsilon/ipsilon @@ -2,6 +2,12 @@ # # Copyright (C) 2013 Ipsilon project Contributors, for license see COPYING +# These lines make sure that we have at least a minimum version of some +# packages, since we depend on features provided by them. +import __main__ +__main__.__requires__ = ['sqlalchemy >= 0.8', 'jinja2 >= 2.4'] +import pkg_resources # pylint: disable=unused-import + import sys sys.stdout = sys.stderr import glob diff --git a/tests/tests.py b/tests/tests.py index 7a7b168..f84059b 100755 --- a/tests/tests.py +++ b/tests/tests.py @@ -2,6 +2,9 @@ # # Copyright (C) 2014 Ipsilon project Contributors, for license see COPYING +__requires__ = ['sqlalchemy >= 0.8'] +import pkg_resources # pylint: disable=unused-import + import argparse import inspect from ipsilon.util import plugin From 36d3ce73c3164387e444a2c33186f71a11829105 Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk Date: Jul 11 2016 10:14:48 +0000 Subject: [PATCH 6/10] Support mod_auth_kerb Add support for mod_auth_kerb back, depending on which module has been loaded. Signed-off-by: Patrick Uiterwijk Reviewed-by: Pierre-Yves Chibon --- diff --git a/ipsilon/login/authgssapi.py b/ipsilon/login/authgssapi.py index a05644d..973402b 100644 --- a/ipsilon/login/authgssapi.py +++ b/ipsilon/login/authgssapi.py @@ -25,7 +25,7 @@ class GSSAPIAuth(LoginPageBase): # If we can get here, we must be authenticated and remote_user # was set. Check the session has a user set already or error. us = UserSession() - us.remote_login() + us.remote_login(is_krb=True) self.user = us.get_user() if not self.user.is_anonymous: principal = cherrypy.request.wsgi_environ.get('GSS_NAME', None) @@ -87,11 +87,19 @@ apache plugin for actual authentication. """ CONF_TEMPLATE = """ - AuthType GSSAPI AuthName "GSSAPI Single Sign On Login" - $keytab - GssapiSSLonly $gssapisslonly - GssapiLocalName on + + GssapiCredStore keytab:$keytab + AuthType GSSAPI + GssapiSSLonly $gssapisslonly + GssapiLocalName on + + + Krb5KeyTab $keytab + AuthType Kerberos + KrbMethodNegotiate On + KrbMethodK5Passwd Off + Require valid-user ErrorDocument 401 /${instance}/login/gssapi/unauthorized @@ -121,8 +129,7 @@ class Installer(LoginManagerInstaller): confopts = {'instance': opts['instance']} if os.path.exists(opts['gssapi_httpd_keytab']): - confopts['keytab'] = 'GssapiCredStore keytab:%s' % ( - opts['gssapi_httpd_keytab']) + confopts['keytab'] = opts['gssapi_httpd_keytab'] else: raise Exception('Keytab not found') diff --git a/ipsilon/login/common.py b/ipsilon/login/common.py index 8bb3631..d0ef41a 100644 --- a/ipsilon/login/common.py +++ b/ipsilon/login/common.py @@ -56,6 +56,11 @@ class LoginHelper(Log): auth_type = cherrypy.request.wsgi_environ.get('AUTH_TYPE') if auth_type: auth_type = 'external:%s' % (auth_type.lower()) + if auth_type == 'external:negotiate' and '@' in username: + # This was likely mod_auth_kerb. Let's be compatible with + # gssapi + cherrypy.request.wsgi_environ['GSS_NAME'] = username + username = username[:username.find('@')] self.debug("get_external_auth_info: username=%s auth_type=%s" % ( username, auth_type)) diff --git a/ipsilon/util/user.py b/ipsilon/util/user.py index ee3fe41..1158d31 100644 --- a/ipsilon/util/user.py +++ b/ipsilon/util/user.py @@ -99,9 +99,13 @@ class UserSession(Log): def get_user(self): return User(self.user) - def remote_login(self): + def remote_login(self, is_krb=False): if cherrypy.request.login: - self.login(cherrypy.request.login) + username = cherrypy.request.login + if is_krb and '@' in username: + cherrypy.request.wsgi_environ['GSS_NAME'] = username + username = username[:username.find('@')] + self.login(username) else: self.nuke_data('user') From 371f4daebbb79494715ba8e648c04ac1a899a1b0 Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk Date: Jul 11 2016 10:14:48 +0000 Subject: [PATCH 7/10] Resolve identity problem in ldap test Signed-off-by: Patrick Uiterwijk Reviewed-by: Pierre-Yves Chibon --- diff --git a/tests/ldap.py b/tests/ldap.py index b262351..bc8b86a 100755 --- a/tests/ldap.py +++ b/tests/ldap.py @@ -130,7 +130,7 @@ if __name__ == '__main__': sess.add_server(idpname, 'https://127.0.0.10:45080', user, 'tuser') sess.add_server(spname, 'https://127.0.0.11:45081') - print "test1: Authenticate to IDP ...", + print "ldap: Authenticate to IDP ...", try: sess.auth_to_idp(idpname) except Exception, e: # pylint: disable=broad-except @@ -138,7 +138,7 @@ if __name__ == '__main__': sys.exit(1) print " SUCCESS" - print "test1: Add SP Metadata to IDP ...", + print "ldap: Add SP Metadata to IDP ...", try: sess.add_sp_metadata(idpname, spname) except Exception, e: # pylint: disable=broad-except @@ -146,7 +146,7 @@ if __name__ == '__main__': sys.exit(1) print " SUCCESS" - print "test1: Access SP Protected Area ...", + print "ldap: Access SP Protected Area ...", try: page = sess.fetch_page(idpname, 'https://127.0.0.11:45081/sp/index.shtml') From 8f35c097916db648ad2dbd07a65557418d505d62 Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk Date: Jul 11 2016 10:14:48 +0000 Subject: [PATCH 8/10] Use version-independent way to pass socket dir to postgres With version <9.3 we would need to specify unix_socket_directory and with >=9.3 we would need unix_socket_directories. Both versions have a -k flag which is equivalient to setting either option, so this makes it compatible across all versions. Signed-off-by: Patrick Uiterwijk Reviewed-by: Pierre-Yves Chibon --- diff --git a/tests/helpers/common.py b/tests/helpers/common.py index 70dffd2..409ffe5 100755 --- a/tests/helpers/common.py +++ b/tests/helpers/common.py @@ -250,7 +250,7 @@ basicConstraints = CA:false""" % {'certdir': os.path.join(self.testdir, def start_pgdb_server(self, datadir, rundir, log, addr, port, env): p = subprocess.Popen(['/usr/bin/pg_ctl', 'start', '-D', datadir, '-o', - '-c unix_socket_directories=%s -c port=%s -c \ + '-k %s -c port=%s -c \ listen_addresses=%s' % (rundir, port, addr), '-l', log, '-w'], env=env, preexec_fn=os.setsid) From 48126c70ad7d47966c9a22bfacc3b04b249b48c5 Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk Date: Jul 11 2016 10:14:49 +0000 Subject: [PATCH 9/10] Move the KDC port outside of the privileged range On EL6 we can't use the libsocket-wrapper. This means that ports below 1024 are still privileged, and this would mean we would need to run the test suite as root. Since we explicitly say we do not want to run this as root, let's instead just move the last thing to a non-privileged port. Signed-off-by: Howard Johnson Signed-off-by: Patrick Uiterwijk Reviewed-by: Pierre-Yves Chibon --- diff --git a/tests/helpers/common.py b/tests/helpers/common.py index 409ffe5..ddefbcb 100755 --- a/tests/helpers/common.py +++ b/tests/helpers/common.py @@ -32,7 +32,7 @@ KRB5_CONF_TEMPLATE = ''' [realms] ${TESTREALM} = { - kdc =${WRAP_HOSTNAME} + kdc =${WRAP_HOSTNAME}:8888 } [domain_realm] @@ -47,8 +47,8 @@ KRB5_CONF_TEMPLATE = ''' KDC_CONF_TEMPLATE = ''' [kdcdefaults] - kdc_ports = 88 - kdc_tcp_ports = 88 + kdc_ports = 8888 + kdc_tcp_ports = 8888 restrict_anonymous_to_tgt = true [realms] From 6f9d4b4d69272ee6bad784c6dbffa8094890073e Mon Sep 17 00:00:00 2001 From: Patrick Uiterwijk Date: Jul 11 2016 10:14:49 +0000 Subject: [PATCH 10/10] Explicitly default to WSGI Socket Prefix run/wsgi Signed-off-by: Howard Johnson Signed-off-by: Patrick Uiterwijk --- diff --git a/ipsilon/install/ipsilon-server-install b/ipsilon/install/ipsilon-server-install index 3a2c796..0afbf84 100755 --- a/ipsilon/install/ipsilon-server-install +++ b/ipsilon/install/ipsilon-server-install @@ -135,7 +135,7 @@ def install(plugins, args): if WSGI_SOCKET_PREFIX: confopts['wsgi_socket'] = 'WSGISocketPrefix %s' % WSGI_SOCKET_PREFIX else: - confopts['wsgi_socket'] = '' + confopts['wsgi_socket'] = 'WSGISocketPrefix run/wsgi' files.write_from_template(ipsilon_conf, os.path.join(TEMPLATES, 'ipsilon.conf'), confopts)