nixos/tests/kanidm: test posix user creation and login
This commit is contained in:
parent
847a7f1102
commit
7575e488de
|
@ -2,6 +2,10 @@ import ./make-test-python.nix ({ pkgs, ... }:
|
||||||
let
|
let
|
||||||
certs = import ./common/acme/server/snakeoil-certs.nix;
|
certs = import ./common/acme/server/snakeoil-certs.nix;
|
||||||
serverDomain = certs.domain;
|
serverDomain = certs.domain;
|
||||||
|
|
||||||
|
testCredentials = {
|
||||||
|
password = "Password1_cZPEwpCWvrReripJmAZdmVIZd8HHoHcl";
|
||||||
|
};
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
name = "kanidm";
|
name = "kanidm";
|
||||||
|
@ -73,17 +77,55 @@ import ./make-test-python.nix ({ pkgs, ... }:
|
||||||
with subtest("Test CLI login"):
|
with subtest("Test CLI login"):
|
||||||
client.succeed("kanidm login -D anonymous")
|
client.succeed("kanidm login -D anonymous")
|
||||||
client.succeed("kanidm self whoami | grep anonymous@${serverDomain}")
|
client.succeed("kanidm self whoami | grep anonymous@${serverDomain}")
|
||||||
|
client.succeed("kanidm logout")
|
||||||
|
|
||||||
with subtest("Recover idm_admin account"):
|
with subtest("Recover idm_admin account"):
|
||||||
# Must stop the server for account recovery or else kanidmd fails with
|
# Must stop the server for account recovery or else kanidmd fails with
|
||||||
# "unable to lock kanidm exclusive lock at /var/lib/kanidm/kanidm.db.klock".
|
# "unable to lock kanidm exclusive lock at /var/lib/kanidm/kanidm.db.klock".
|
||||||
server.succeed("systemctl stop kanidm")
|
server.succeed("systemctl stop kanidm")
|
||||||
server.succeed("su - kanidm -c 'kanidmd recover-account -c ${serverConfigFile} idm_admin 2>&1 | rg -o \'[A-Za-z0-9]{48}\' '")
|
idm_admin_password = server.succeed("su - kanidm -c 'kanidmd recover-account -c ${serverConfigFile} idm_admin 2>&1 | rg -o \'[A-Za-z0-9]{48}\' '").strip().removeprefix("'").removesuffix("'")
|
||||||
server.succeed("systemctl start kanidm")
|
server.succeed("systemctl start kanidm")
|
||||||
|
|
||||||
with subtest("Test unixd connection"):
|
with subtest("Test unixd connection"):
|
||||||
client.wait_for_unit("kanidm-unixd.service")
|
client.wait_for_unit("kanidm-unixd.service")
|
||||||
# TODO: client.wait_for_file("/run/kanidm-unixd/sock")
|
# TODO: client.wait_for_file("/run/kanidm-unixd/sock")
|
||||||
client.wait_until_succeeds("kanidm-unix status | grep working!")
|
client.wait_until_succeeds("kanidm-unix status | grep working!")
|
||||||
|
|
||||||
|
with subtest("Test user creation"):
|
||||||
|
client.wait_for_unit("getty@tty1.service")
|
||||||
|
client.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
|
||||||
|
client.wait_until_tty_matches("1", "login: ")
|
||||||
|
client.send_chars("root\n")
|
||||||
|
client.send_chars("kanidm login -D idm_admin\n")
|
||||||
|
client.wait_until_tty_matches("1", "Enter password: ")
|
||||||
|
client.send_chars(f"{idm_admin_password}\n")
|
||||||
|
client.wait_until_tty_matches("1", "Login Success for idm_admin")
|
||||||
|
client.succeed("kanidm person create testuser TestUser")
|
||||||
|
client.succeed("kanidm person posix set --shell \"$SHELL\" testuser")
|
||||||
|
client.send_chars("kanidm person posix set-password testuser\n")
|
||||||
|
client.wait_until_tty_matches("1", "Enter new")
|
||||||
|
client.send_chars("${testCredentials.password}\n")
|
||||||
|
client.wait_until_tty_matches("1", "Retype")
|
||||||
|
client.send_chars("${testCredentials.password}\n")
|
||||||
|
output = client.succeed("getent passwd testuser")
|
||||||
|
assert "TestUser" in output
|
||||||
|
client.succeed("kanidm group create shell")
|
||||||
|
client.succeed("kanidm group posix set shell")
|
||||||
|
client.succeed("kanidm group add-members shell testuser")
|
||||||
|
|
||||||
|
with subtest("Test user login"):
|
||||||
|
client.send_key("alt-f2")
|
||||||
|
client.wait_until_succeeds("[ $(fgconsole) = 2 ]")
|
||||||
|
client.wait_for_unit("getty@tty2.service")
|
||||||
|
client.wait_until_succeeds("pgrep -f 'agetty.*tty2'")
|
||||||
|
client.wait_until_tty_matches("2", "login: ")
|
||||||
|
client.send_chars("testuser\n")
|
||||||
|
client.wait_until_tty_matches("2", "login: testuser")
|
||||||
|
client.wait_until_succeeds("pgrep login")
|
||||||
|
client.wait_until_tty_matches("2", "Password: ")
|
||||||
|
client.send_chars("${testCredentials.password}\n")
|
||||||
|
client.wait_until_succeeds("systemctl is-active user@$(id -u testuser).service")
|
||||||
|
client.send_chars("touch done\n")
|
||||||
|
client.wait_for_file("/home/testuser@${serverDomain}/done")
|
||||||
'';
|
'';
|
||||||
})
|
})
|
||||||
|
|
Loading…
Reference in a new issue