summaryrefslogtreecommitdiff
path: root/gnu/tests
diff options
context:
space:
mode:
authorRicardo Wurmus <rekado@elephly.net>2019-03-20 19:43:07 +0100
committerRicardo Wurmus <rekado@elephly.net>2019-03-20 20:31:15 +0100
commitc16423f143919916a5273761d7ed29bd49f14519 (patch)
treef0e9ddca711bb138845815f0f196e4dc25bdb9b0 /gnu/tests
parentbcf66fc2e75151b248265ed12ec8453fe9b0ce47 (diff)
services: Add nslcd-service-type.
* gnu/services/authentication.scm (nslcd-service-type, nslcd-configuration, %nslcd-accounts): New variables. (uglify-field-name, value->string, serialize-field, serialize-list, ssl-option?, tls-reqcert-option?, deref-option?, comma-separated-list-of-strings?, serialize-ignore-users-option, log-option?, serialize-log-option, valid-map?, scope-option?, serialize-scope-option, map-entry?, list-of-map-entries?, filter-entry?, list-of-filter-entries?, serialize-filter-entry, serialize-list-of-filter-entries, serialize-map-entry, serialize-list-of-map-entries, nslcd-config-file, nslcd-etc-service, nslcd-shepherd-service, pam-ldap-pam-services, pam-ldap-pam-service, generate-nslcd-documentation): New procedures. * gnu/tests/ldap.scm: New file. * gnu/local.mk (GNU_SYSTEM_MODULES): Add it. * doc/guix.texi (LDAP Services): Document it.
Diffstat (limited to 'gnu/tests')
-rw-r--r--gnu/tests/ldap.scm160
1 files changed, 160 insertions, 0 deletions
diff --git a/gnu/tests/ldap.scm b/gnu/tests/ldap.scm
new file mode 100644
index 0000000000..2d4f15fb3c
--- /dev/null
+++ b/gnu/tests/ldap.scm
@@ -0,0 +1,160 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2019 Ricardo Wurmus <rekado@elephly.net>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu tests ldap)
+ #:use-module (gnu tests)
+ #:use-module (gnu system)
+ #:use-module (gnu system nss)
+ #:use-module (gnu system vm)
+ #:use-module (gnu services)
+ #:use-module (gnu services authentication)
+ #:use-module (gnu services networking)
+ #:use-module (gnu packages base)
+ #:use-module (gnu packages openldap)
+ #:use-module (guix gexp)
+ #:use-module (guix store)
+ #:export (%test-ldap))
+
+(define %ldap-os
+ (let ((simple
+ (simple-operating-system
+ (service dhcp-client-service-type)
+ (service nslcd-service-type))))
+ (operating-system
+ (inherit simple)
+ (name-service-switch
+ (let ((services (list (name-service (name "db"))
+ (name-service (name "files"))
+ (name-service (name "ldap")))))
+ (name-service-switch
+ (inherit %mdns-host-lookup-nss)
+ (password services)
+ (shadow services)
+ (group services)
+ (netgroup services)
+ (gshadow services)))))))
+
+(define (run-ldap-test)
+ "Run tests in %LDAP-OS."
+ (define os
+ (marionette-operating-system
+ %ldap-os
+ #:imported-modules '((gnu services herd)
+ (guix combinators))))
+
+ (define vm
+ (virtual-machine os))
+
+ (define test
+ (with-imported-modules '((gnu build marionette))
+ #~(begin
+ (use-modules (srfi srfi-11) (srfi srfi-64)
+ (gnu build marionette))
+
+ (define marionette
+ (make-marionette (list #$vm)))
+
+ (mkdir #$output)
+ (chdir #$output)
+
+ (test-begin "ldap")
+
+ ;; Set up LDAP directory server
+ (test-assert "LDAP server instance running"
+ (marionette-eval
+ '(begin
+ (with-output-to-file "instance.inf"
+ (lambda ()
+ (display "[general]
+config_version = 2
+
+\n[slapd]
+root_password = SECRET
+user = root
+group = root
+
+\n[backend-userroot]
+sample_entries = yes
+suffix = dc=example,dc=com")))
+ (and
+ ;; Create instance
+ (zero? (system* #$(file-append 389-ds-base "/sbin/dscreate")
+ "-v" "from-file" "instance.inf"))
+ ;; Start instance
+ (zero? (system* #$(file-append 389-ds-base "/sbin/dsctl")
+ "localhost" "start"))
+ ;; Create user account
+ (zero? (system* #$(file-append 389-ds-base "/sbin/dsidm")
+ "-b" "dc=example,dc=com"
+ "localhost" "user" "create"
+ "--uid" "eva" "--cn" "Eva Lu Ator"
+ "--displayName" "Eva Lu Ator"
+ "--uidNumber" "1234" "--gidNumber" "2345"
+ "--homeDirectory" "/home/eva"))))
+ marionette))
+
+ (test-assert "Manager can bind to LDAP server instance"
+ (marionette-eval
+ '(zero? (system* #$(file-append openldap "/bin/ldapwhoami")
+ "-H" "ldap://localhost" "-D"
+ "cn=Directory Manager" "-w" "SECRET"))
+ marionette))
+
+ ;; Wait for nslcd to be up and running.
+ (test-assert "nslcd service running"
+ (marionette-eval
+ '(begin
+ (use-modules (gnu services herd))
+ (match (start-service 'nslcd)
+ (#f #f)
+ (('service response-parts ...)
+ (match (assq-ref response-parts 'running)
+ ((pid) (number? pid))))))
+ marionette))
+
+ (test-assert "nslcd produces a log file"
+ (marionette-eval
+ '(file-exists? "/var/log/nslcd")
+ marionette))
+
+ (test-assert "Can query LDAP user accounts"
+ (marionette-eval
+ '(begin
+ ;; TODO: This shouldn't be necessary, but unfortunately it
+ ;; really is needed to discover LDAP accounts with "id".
+ (setenv "LD_LIBRARY_PATH"
+ #$(file-append nss-pam-ldapd "/lib"))
+ (zero? (system* #$(file-append coreutils "/bin/id") "eva")))
+ marionette))
+
+ (test-assert "Can become LDAP user"
+ (marionette-eval
+ '(zero? (system* "/run/setuid-programs/su" "eva" "-c"
+ #$(file-append coreutils "/bin/true")))
+ marionette))
+
+ (test-end)
+ (exit (= (test-runner-fail-count (test-runner-current)) 0)))))
+
+ (gexp->derivation "ldap-test" test))
+
+(define %test-ldap
+ (system-test
+ (name "ldap")
+ (description "Run an LDAP directory server and authenticate against it.")
+ (value (run-ldap-test))))