67 lines
2.4 KiB
Diff
67 lines
2.4 KiB
Diff
From 701adb9185c77194ba1ad0c5fd2f13484417ef6f Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Fran=C3=A7ois=20Cami?= <fcami@redhat.com>
|
|
Date: Tue, 20 Jul 2021 20:22:23 +0200
|
|
Subject: [PATCH] test_acme: make password renewal more robust
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
A kinit immediately following a password change can fail.
|
|
Setting KRB5_TRACE and retrieving kdcinfo will help to understand
|
|
the cause of failure.
|
|
|
|
Fixes: https://pagure.io/freeipa/issue/8929
|
|
Signed-off-by: François Cami <fcami@redhat.com>
|
|
Reviewed-By: Michal Polovka <mpolovka@redhat.com>
|
|
---
|
|
ipatests/test_integration/test_acme.py | 28 +++++++++++++-------------
|
|
1 file changed, 14 insertions(+), 14 deletions(-)
|
|
|
|
diff --git a/ipatests/test_integration/test_acme.py b/ipatests/test_integration/test_acme.py
|
|
index b4aa1b351..10195a95f 100644
|
|
--- a/ipatests/test_integration/test_acme.py
|
|
+++ b/ipatests/test_integration/test_acme.py
|
|
@@ -576,25 +576,25 @@ class TestACMERenew(IntegrationTest):
|
|
# request a standalone acme cert
|
|
certbot_standalone_cert(self.clients[0], self.acme_server)
|
|
|
|
- cmd_input = (
|
|
- # Password for admin@{REALM}:
|
|
- "{pwd}\n"
|
|
- # Password expired. You must change it now.
|
|
- # Enter new password:
|
|
- "{pwd}\n"
|
|
- # Enter it again:
|
|
- "{pwd}\n"
|
|
- )
|
|
# move system date to expire acme cert
|
|
for host in self.clients[0], self.master:
|
|
tasks.kdestroy_all(host)
|
|
tasks.move_date(host, 'stop', '+90days')
|
|
- self.clients[0].run_command(
|
|
- ['kinit', 'admin'],
|
|
- stdin_text=cmd_input.format(
|
|
- pwd=self.clients[0].config.admin_password
|
|
- )
|
|
+
|
|
+ tasks.get_kdcinfo(host)
|
|
+ # Note raiseonerr=False:
|
|
+ # the assert is located after kdcinfo retrieval.
|
|
+ result = host.run_command(
|
|
+ "KRB5_TRACE=/dev/stdout kinit %s" % 'admin',
|
|
+ stdin_text='{0}\n{0}\n{0}\n'.format(
|
|
+ self.clients[0].config.admin_password
|
|
+ ),
|
|
+ raiseonerr=False
|
|
)
|
|
+ # Retrieve kdc.$REALM after the password change, just in case SSSD
|
|
+ # domain status flipped to online during the password change.
|
|
+ tasks.get_kdcinfo(host)
|
|
+ assert result.returncode == 0
|
|
|
|
yield
|
|
|
|
--
|
|
2.31.1
|
|
|