Skip to content

Commit 43f3c27

Browse files
andreboscattoandreboscatto
committed
TESTS: Add access control simple filter tests
Added 3 tests for access control simple filter using the new testing framework
1 parent ed6956e commit 43f3c27

File tree

2 files changed

+325
-0
lines changed

2 files changed

+325
-0
lines changed

‎src/tests/system/tests/test_access_control.py

+139
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,139 @@
1+
"""
2+
SSSD Authentication Test Cases
3+
4+
:requirement: access control
5+
"""
6+
7+
from __future__ import annotations
8+
9+
import pytest
10+
from sssd_test_framework.roles.client import Client
11+
from sssd_test_framework.roles.generic import GenericProvider
12+
from sssd_test_framework.topology import KnownTopologyGroup
13+
14+
15+
@pytest.mark.topology(KnownTopologyGroup.AnyProvider)
16+
@pytest.mark.parametrize("sssd_service_user", ("root", "sssd"))
17+
@pytest.mark.parametrize("method", ["su", "ssh"])
18+
@pytest.mark.importance("critical")
19+
@pytest.mark.require(
20+
lambda client, sssd_service_user: ((sssd_service_user == "root") or client.features["non-privileged"]),
21+
"SSSD was built without support for running under non-root",
22+
)
23+
def test_access_control__simple_filter_permits_user_login(
24+
client: Client, provider: GenericProvider, method: str, sssd_service_user: str
25+
):
26+
"""
27+
:title: Simple access filter permits user login
28+
:setup:
29+
1. Create users ‘user1’ and ‘user2’
30+
2. Configure SSSD with ‘access_provider = simple’, ‘simple_allow_users = user1’
31+
3. Start SSSD
32+
:steps:
33+
1. Try to login as ‘user1’
34+
2. Try to login as ‘user2’
35+
:expectedresults:
36+
1. User1 can login
37+
2. User2 cannot login
38+
:customerscenario: False
39+
"""
40+
provider.user("user1").add(password="Secret123")
41+
provider.user("user2").add(password="Secret123")
42+
43+
client.sssd.domain["access_provider"] = "simple"
44+
client.sssd.domain["simple_allow_users"] = "user1"
45+
46+
client.sssd.start(service_user=sssd_service_user)
47+
48+
assert client.auth.parametrize(method).password("user1", "Secret123"), "User login!"
49+
assert not client.auth.parametrize(method).password("user2", "Secret123"), "User cannot login!"
50+
51+
52+
@pytest.mark.topology(KnownTopologyGroup.AnyProvider)
53+
@pytest.mark.parametrize("sssd_service_user", ("root", "sssd"))
54+
@pytest.mark.parametrize("method", ["su", "ssh"])
55+
@pytest.mark.importance("critical")
56+
@pytest.mark.require(
57+
lambda client, sssd_service_user: ((sssd_service_user == "root") or client.features["non-privileged"]),
58+
"SSSD was built without support for running under non-root",
59+
)
60+
def test_access_control__simple_filter_deny_user_login(
61+
client: Client, provider: GenericProvider, method: str, sssd_service_user: str
62+
):
63+
"""
64+
:title: Simple access filter permits user login
65+
:setup:
66+
1. Create users ‘user1’ and ‘user2’
67+
2. Configure SSSD with ‘access_provider = simple’, ‘simple_deny_users = user1’
68+
3. Start SSSD
69+
:steps:
70+
1. Try to login as ‘user1’
71+
2. Try to login as ‘user2’
72+
:expectedresults:
73+
1. User1 cannot login
74+
2. User2 can login
75+
:customerscenario: False
76+
"""
77+
provider.user("user1").add(password="Secret123")
78+
provider.user("user2").add(password="Secret123")
79+
80+
client.sssd.domain["access_provider"] = "simple"
81+
client.sssd.domain["simple_deny_users"] = "user1"
82+
83+
client.sssd.start(service_user=sssd_service_user)
84+
85+
assert not client.auth.parametrize(method).password("user1", "Secret123"), "User cannot login!"
86+
assert client.auth.parametrize(method).password("user2", "Secret123"), "User can login!"
87+
88+
89+
@pytest.mark.topology(KnownTopologyGroup.AnyProvider)
90+
@pytest.mark.parametrize("sssd_service_user", ("root", "sssd"))
91+
@pytest.mark.parametrize("method", ["su", "ssh"])
92+
@pytest.mark.importance("critical")
93+
@pytest.mark.require(
94+
lambda client, sssd_service_user: ((sssd_service_user == "root") or client.features["non-privileged"]),
95+
"SSSD was built without support for running under non-root",
96+
)
97+
def test_access_control__simple_filter_permits_user_login_based_on_group(
98+
client: Client, provider: GenericProvider, method: str, sssd_service_user: str
99+
):
100+
"""
101+
:title: Simple access filter permits user login
102+
:setup:
103+
1. Create users ‘user1’, ‘user2’, ‘user3’
104+
2. Create group ‘group1’ with members ‘user1, user3’
105+
3. Create group ‘group2’ with member ‘user2, user3’
106+
4. Configure SSSD with ‘access_provider = simple’,
107+
5. Configure SSSD with ‘simple_allow_groups = group1’ and ‘simple_deny_groups = group2’
108+
6. Start SSSD
109+
:steps:
110+
1. Try to login with ‘user1’
111+
2. Try to login with ‘user2’
112+
3. Try to login with ‘user3’
113+
:expectedresults:
114+
1. User1 can login
115+
2. User2 cannot login
116+
3. User3 cannot login
117+
:customerscenario: False
118+
"""
119+
user1 = provider.user("user1").add(password="Secret123")
120+
user2 = provider.user("user2").add(password="Secret123")
121+
user3 = provider.user("user3").add(password="Secret123")
122+
123+
group1 = provider.group("group1").add()
124+
group2 = provider.group("group2").add()
125+
126+
group1.add_member(user1)
127+
group1.add_member(user3)
128+
group2.add_member(user2)
129+
group2.add_member(user3)
130+
131+
client.sssd.domain["access_provider"] = "simple"
132+
client.sssd.domain["simple_allow_groups"] = "group1"
133+
client.sssd.domain["simple_deny_groups"] = "group2"
134+
135+
client.sssd.start(service_user=sssd_service_user)
136+
137+
assert client.auth.parametrize(method).password("user1", "Secret123"), "User can login!"
138+
assert not client.auth.parametrize(method).password("user2", "Secret123"), "User cannot login!"
139+
assert not client.auth.parametrize(method).password("user3", "Secret123"), "User cannot login!"

‎src/tests/system/tests/test_access_control_simple.py

+186
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,186 @@
1+
"""
2+
SSSD Authentication Test Cases
3+
4+
:requirement: access control
5+
"""
6+
7+
from __future__ import annotations
8+
9+
import pytest
10+
from sssd_test_framework.roles.client import Client
11+
from sssd_test_framework.roles.generic import GenericProvider
12+
from sssd_test_framework.topology import KnownTopologyGroup
13+
14+
15+
@pytest.mark.topology(KnownTopologyGroup.AnyProvider)
16+
@pytest.mark.importance("critical")
17+
def test_access_control__simple_filter_permits_user_login(client: Client, provider: GenericProvider):
18+
"""
19+
:title: Simple access filter permits user login
20+
:setup:
21+
1. Create users ‘user1’ and ‘user2’
22+
2. Configure SSSD with ‘access_provider = simple’, ‘simple_allow_users = user1’
23+
3. Start SSSD
24+
:steps:
25+
1. Try to login as ‘user1’
26+
2. Try to login as ‘user2’
27+
:expectedresults:
28+
1. User1 can login
29+
2. User2 cannot login
30+
:customerscenario: False
31+
"""
32+
provider.user("user1").add(password="Secret123")
33+
provider.user("user2").add(password="Secret123")
34+
35+
client.sssd.domain["access_provider"] = "simple"
36+
client.sssd.domain["simple_allow_users"] = "user1"
37+
38+
client.sssd.start()
39+
40+
assert client.auth.ssh.password("user1", "Secret123"), "User can not login!"
41+
assert not client.auth.ssh.password("user2", "Secret123"), "User cannot login!"
42+
43+
44+
@pytest.mark.topology(KnownTopologyGroup.AnyProvider)
45+
@pytest.mark.importance("critical")
46+
def test_access_control__simple_filter_deny_user_login(client: Client, provider: GenericProvider):
47+
"""
48+
:title: Simple access filter permits user login
49+
:setup:
50+
1. Create users ‘user1’ and ‘user2’
51+
2. Configure SSSD with ‘access_provider = simple’, ‘simple_deny_users = user1’
52+
3. Start SSSD
53+
:steps:
54+
1. Try to login as ‘user1’
55+
2. Try to login as ‘user2’
56+
:expectedresults:
57+
1. User1 cannot login
58+
2. User2 can login
59+
:customerscenario: False
60+
"""
61+
provider.user("user1").add(password="Secret123")
62+
provider.user("user2").add(password="Secret123")
63+
64+
client.sssd.domain["access_provider"] = "simple"
65+
client.sssd.domain["simple_deny_users"] = "user1"
66+
67+
client.sssd.start()
68+
69+
assert not client.auth.ssh.password("user1", "Secret123"), "User cannot login!"
70+
assert client.auth.ssh.password("user2", "Secret123"), "User can login!"
71+
72+
73+
@pytest.mark.topology(KnownTopologyGroup.AnyProvider)
74+
@pytest.mark.importance("critical")
75+
def test_access_control__simple_filter_permits_user_login_based_on_group(client: Client, provider: GenericProvider):
76+
"""
77+
:title: Simple access filter permits user login
78+
:setup:
79+
1. Create users ‘user1’, ‘user2’, ‘user3’
80+
2. Create group ‘group1’ with members ‘user1, user3’
81+
3. Create group ‘group2’ with member ‘user2, user3’
82+
4. Configure SSSD with ‘access_provider = simple’,
83+
5. Configure SSSD with ‘simple_allow_groups = group1’ and ‘simple_deny_groups = group2’
84+
6. Start SSSD
85+
:steps:
86+
1. Try to login with ‘user1’
87+
2. Try to login with ‘user2’
88+
3. Try to login with ‘user3’
89+
:expectedresults:
90+
1. User1 can login
91+
2. User2 cannot login
92+
3. User3 cannot login
93+
:customerscenario: False
94+
"""
95+
user1 = provider.user("user1").add(password="Secret123")
96+
user2 = provider.user("user2").add(password="Secret123")
97+
user3 = provider.user("user3").add(password="Secret123")
98+
99+
group1 = provider.group("group1").add()
100+
group2 = provider.group("group2").add()
101+
102+
group1.add_member(user1)
103+
group1.add_member(user3)
104+
group2.add_member(user2)
105+
group2.add_member(user3)
106+
107+
client.sssd.domain["access_provider"] = "simple"
108+
client.sssd.domain["simple_allow_groups"] = "group1"
109+
client.sssd.domain["simple_deny_groups"] = "group2"
110+
111+
client.sssd.start()
112+
113+
assert client.auth.ssh.password("user1", "Secret123"), "User can login!"
114+
assert not client.auth.ssh.password("user2", "Secret123"), "User cannot login!"
115+
assert not client.auth.ssh.password("user3", "Secret123"), "User cannot login!"
116+
117+
118+
@pytest.mark.topology(KnownTopologyGroup.AnyProvider)
119+
@pytest.mark.importance("critical")
120+
def test_sssd_simple_allow_and_deny_users_and_groups(client: Client, provider: GenericProvider):
121+
"""
122+
:title: Validate `simple_allow_users`, `simple_deny_users`, `simple_allow_groups`, and `simple_deny_groups`
123+
:description: This test checks whether SSSD correctly applies both allow and deny lists
124+
for individual users and groups.
125+
:setup:
126+
1. Create users:
127+
- `user1` (explicitly allowed)
128+
- `user2` (explicitly allowed)
129+
- `user3` (explicitly denied)
130+
- `user4` (explicitly denied)
131+
- `user5` (not in any list but part of an allowed group)
132+
- `user6` (not in any list but part of a denied group)
133+
2. Create groups:
134+
- `allowed_group` (includes `user5`)
135+
- `denied_group` (includes `user6`)
136+
3. Configure SSSD with:
137+
- `access_provider = simple`
138+
- `simple_allow_users = user1, user2`
139+
- `simple_deny_users = user3, user4`
140+
- `simple_allow_groups = allowed_group`
141+
- `simple_deny_groups = denied_group`
142+
4. Start SSSD.
143+
:steps:
144+
1. Attempt login with `user1` (explicitly allowed)
145+
2. Attempt login with `user2` (explicitly allowed)
146+
3. Attempt login with `user3` (explicitly denied)
147+
4. Attempt login with `user4` (explicitly denied)
148+
5. Attempt login with `user5` (allowed via group membership)
149+
6. Attempt login with `user6` (denied via group membership)
150+
:expectedresults:
151+
1. `user1` should be able to log in.
152+
2. `user2` should be able to log in.
153+
3. `user3` should NOT be able to log in.
154+
4. `user4` should NOT be able to log in.
155+
5. `user5` should be able to log in (due to allowed group membership).
156+
6. `user6` should NOT be able to log in (due to denied group membership).
157+
:customerscenario: False
158+
"""
159+
160+
provider.user("user1").add(password="Secret123")
161+
provider.user("user2").add(password="Secret123")
162+
provider.user("user3").add(password="Secret123")
163+
provider.user("user4").add(password="Secret123")
164+
provider.user("user5").add(password="Secret123")
165+
provider.user("user6").add(password="Secret123")
166+
167+
allowed_group = provider.group("allowed_group").add()
168+
denied_group = provider.group("denied_group").add()
169+
170+
allowed_group.add_member(provider.user("user5"))
171+
denied_group.add_member(provider.user("user6"))
172+
173+
client.sssd.domain["access_provider"] = "simple"
174+
client.sssd.domain["simple_allow_users"] = "user1, user2"
175+
client.sssd.domain["simple_deny_users"] = "user3, user4"
176+
client.sssd.domain["simple_allow_groups"] = "allowed_group"
177+
client.sssd.domain["simple_deny_groups"] = "denied_group"
178+
179+
client.sssd.start()
180+
181+
assert client.auth.ssh.password("user1", "Secret123"), "User1 should be able to log in!"
182+
assert client.auth.ssh.password("user2", "Secret123"), "User2 should be able to log in!"
183+
assert not client.auth.ssh.password("user3", "Secret123"), "User3 should NOT be able to log in!"
184+
assert not client.auth.ssh.password("user4", "Secret123"), "User4 should NOT be able to log in!"
185+
assert client.auth.ssh.password("user5", "Secret123"), "User5 should be able to log in!"
186+
assert not client.auth.ssh.password("user6", "Secret123"), "User6 should NOT be able to log in!"

0 commit comments

Comments
 (0)