···
1
-
import ./make-test.nix ({ pkgs, lib, ...} :
1
+
import ./make-test-python.nix ({ pkgs, lib, ...} :
unlines = lib.concatStringsSep "\n";
···
client1 = mkClient true; # use nss_pam_ldapd
client2 = mkClient false; # use nss_ldap and pam_ldap
296
-
$server->waitForUnit("default.target");
294
+
def expect_script(*commands):
295
+
script = ";".join(commands)
296
+
return f"${pkgs.expect}/bin/expect -c '{script}'"
298
-
subtest "slapd", sub {
299
-
subtest "auth as database admin with SASL and check a POSIX account", sub {
300
-
$server->succeed(join ' ', 'test',
301
-
'"$(ldapsearch -LLL -H ldapi:// -Y EXTERNAL',
302
-
'-b \'uid=${ldapUser},ou=accounts,ou=posix,${dbSuffix}\' ',
303
-
'-s base uidNumber |',
304
-
'sed -ne \'s/^uidNumber: \\(.*\\)/\\1/p\' ',
305
-
')" -eq ${toString ldapUserId}');
307
-
subtest "auth as database admin with password and check a POSIX account", sub {
308
-
$server->succeed(join ' ', 'test',
309
-
'"$(ldapsearch -LLL -H ldap://server',
310
-
'-D \'cn=admin,${dbSuffix}\' -w \'${dbAdminPwd}\' ',
311
-
'-b \'uid=${ldapUser},ou=accounts,ou=posix,${dbSuffix}\' ',
312
-
'-s base uidNumber |',
313
-
'sed -ne \'s/^uidNumber: \\(.*\\)/\\1/p\' ',
314
-
')" -eq ${toString ldapUserId}');
319
-
$client1->waitForUnit("default.target");
300
+
server.wait_for_unit("default.target")
321
-
subtest "password", sub {
322
-
subtest "su with password to a POSIX account", sub {
323
-
$client1->succeed("${pkgs.expect}/bin/expect -c '" . join ';',
324
-
'spawn su "${ldapUser}"',
325
-
'expect "Password:"',
326
-
'send "${ldapUserPwd}\n"',
329
-
'expect -ex "${ldapUser}" {exit}',
332
-
subtest "change password of a POSIX account as root", sub {
333
-
$client1->succeed("chpasswd <<<'${ldapUser}:new-password'");
334
-
$client1->succeed("${pkgs.expect}/bin/expect -c '" . join ';',
335
-
'spawn su "${ldapUser}"',
336
-
'expect "Password:"',
337
-
'send "new-password\n"',
340
-
'expect -ex "${ldapUser}" {exit}',
342
-
$client1->succeed('chpasswd <<<\'${ldapUser}:${ldapUserPwd}\' ');
344
-
subtest "change password of a POSIX account from itself", sub {
345
-
$client1->succeed('chpasswd <<<\'${ldapUser}:${ldapUserPwd}\' ');
346
-
$client1->succeed("${pkgs.expect}/bin/expect -c '" . join ';',
347
-
'spawn su --login ${ldapUser} -c passwd',
348
-
'expect "Password: "',
349
-
'send "${ldapUserPwd}\n"',
350
-
'expect "(current) UNIX password: "',
351
-
'send "${ldapUserPwd}\n"',
352
-
'expect "New password: "',
353
-
'send "new-password\n"',
354
-
'expect "Retype new password: "',
355
-
'send "new-password\n"',
356
-
'expect "passwd: password updated successfully" {exit}',
358
-
$client1->succeed("${pkgs.expect}/bin/expect -c '" . join ';',
359
-
'spawn su "${ldapUser}"',
360
-
'expect "Password:"',
361
-
'send "${ldapUserPwd}\n"',
362
-
'expect "su: Authentication failure" {exit}',
364
-
$client1->succeed("${pkgs.expect}/bin/expect -c '" . join ';',
365
-
'spawn su "${ldapUser}"',
366
-
'expect "Password:"',
367
-
'send "new-password\n"',
370
-
'expect -ex "${ldapUser}" {exit}',
372
-
$client1->succeed('chpasswd <<<\'${ldapUser}:${ldapUserPwd}\' ');
302
+
with subtest("slapd: auth as database admin with SASL and check a POSIX account"):
304
+
'test "$(ldapsearch -LLL -H ldapi:// -Y EXTERNAL '
305
+
+ "-b 'uid=${ldapUser},ou=accounts,ou=posix,${dbSuffix}' "
306
+
+ "-s base uidNumber | "
307
+
+ "sed -ne 's/^uidNumber: \\(.*\\)/\\1/p')\" -eq ${toString ldapUserId}"
377
-
$client2->waitForUnit("default.target");
310
+
with subtest("slapd: auth as database admin with password and check a POSIX account"):
312
+
"test \"$(ldapsearch -LLL -H ldap://server -D 'cn=admin,${dbSuffix}' "
313
+
+ "-w '${dbAdminPwd}' -b 'uid=${ldapUser},ou=accounts,ou=posix,${dbSuffix}' "
314
+
+ "-s base uidNumber | "
315
+
+ "sed -ne 's/^uidNumber: \\(.*\\)/\\1/p')\" -eq ${toString ldapUserId}"
379
-
subtest "NSS", sub {
380
-
$client1->succeed("test \"\$(id -u '${ldapUser}')\" -eq ${toString ldapUserId}");
381
-
$client1->succeed("test \"\$(id -u -n '${ldapUser}')\" = '${ldapUser}'");
382
-
$client1->succeed("test \"\$(id -g '${ldapUser}')\" -eq ${toString ldapGroupId}");
383
-
$client1->succeed("test \"\$(id -g -n '${ldapUser}')\" = '${ldapGroup}'");
384
-
$client2->succeed("test \"\$(id -u '${ldapUser}')\" -eq ${toString ldapUserId}");
385
-
$client2->succeed("test \"\$(id -u -n '${ldapUser}')\" = '${ldapUser}'");
386
-
$client2->succeed("test \"\$(id -g '${ldapUser}')\" -eq ${toString ldapGroupId}");
387
-
$client2->succeed("test \"\$(id -g -n '${ldapUser}')\" = '${ldapGroup}'");
319
+
client1.wait_for_unit("default.target")
321
+
with subtest("password: su with password to a POSIX account"):
324
+
'spawn su "${ldapUser}"',
325
+
'expect "Password:"',
326
+
'send "${ldapUserPwd}\n"',
329
+
'expect -ex "${ldapUser}" {exit}',
334
+
with subtest("password: change password of a POSIX account as root"):
336
+
"chpasswd <<<'${ldapUser}:new-password'",
338
+
'spawn su "${ldapUser}"',
339
+
'expect "Password:"',
340
+
'send "new-password\n"',
343
+
'expect -ex "${ldapUser}" {exit}',
346
+
"chpasswd <<<'${ldapUser}:${ldapUserPwd}'",
349
+
with subtest("password: change password of a POSIX account from itself"):
351
+
"chpasswd <<<'${ldapUser}:${ldapUserPwd}' ",
353
+
"spawn su --login ${ldapUser} -c passwd",
354
+
'expect "Password: "',
355
+
'send "${ldapUserPwd}\n"',
356
+
'expect "(current) UNIX password: "',
357
+
'send "${ldapUserPwd}\n"',
358
+
'expect "New password: "',
359
+
'send "new-password\n"',
360
+
'expect "Retype new password: "',
361
+
'send "new-password\n"',
362
+
'expect "passwd: password updated successfully" {exit}',
366
+
'spawn su "${ldapUser}"',
367
+
'expect "Password:"',
368
+
'send "${ldapUserPwd}\n"',
369
+
'expect "su: Authentication failure" {exit}',
373
+
'spawn su "${ldapUser}"',
374
+
'expect "Password:"',
375
+
'send "new-password\n"',
378
+
'expect -ex "${ldapUser}" {exit}',
381
+
"chpasswd <<<'${ldapUser}:${ldapUserPwd}'",
385
+
client2.wait_for_unit("default.target")
387
+
with subtest("NSS"):
389
+
"test \"$(id -u '${ldapUser}')\" -eq ${toString ldapUserId}",
390
+
"test \"$(id -u -n '${ldapUser}')\" = '${ldapUser}'",
391
+
"test \"$(id -g '${ldapUser}')\" -eq ${toString ldapGroupId}",
392
+
"test \"$(id -g -n '${ldapUser}')\" = '${ldapGroup}'",
393
+
"test \"$(id -u '${ldapUser}')\" -eq ${toString ldapUserId}",
394
+
"test \"$(id -u -n '${ldapUser}')\" = '${ldapUser}'",
395
+
"test \"$(id -g '${ldapUser}')\" -eq ${toString ldapGroupId}",
396
+
"test \"$(id -g -n '${ldapUser}')\" = '${ldapGroup}'",
390
-
subtest "PAM", sub {
391
-
$client1->succeed("echo ${ldapUserPwd} | su -l '${ldapUser}' -c true");
392
-
$client2->succeed("echo ${ldapUserPwd} | su -l '${ldapUser}' -c true");
399
+
with subtest("PAM"):
401
+
"echo ${ldapUserPwd} | su -l '${ldapUser}' -c true",
402
+
"echo ${ldapUserPwd} | su -l '${ldapUser}' -c true",
pyrox.dev