Add rgw ldap authentication test.

Implements tracker issue 25105

Signed-off-by: Warren Usui <wusui@redhat.com>

diff --git a/qa/suites/rgw/multifs/tasks/rgw_ldapauth.yaml b/qa/suites/rgw/multifs/tasks/rgw_ldapauth.yaml
new file mode 100644 (file)
index 0000000..7b220c0
--- /dev/null
+++ b/qa/suites/rgw/multifs/tasks/rgw_ldapauth.yaml
@@ -0,0 +1,11 @@
+tasks:
+- install:
+- ceph:
+- sequential:
+  - ldap_server: [client.1]
+  - ldap_client: [client.0]
+  - rgw: [client.0]
+- workunit:
+    clients:
+      client.0:
+        - rgw/ldap_client.pl

diff --git a/qa/tasks/ldap_client.py b/qa/tasks/ldap_client.py
new file mode 100644 (file)
index 0000000..d4c46a9
--- /dev/null
+++ b/qa/tasks/ldap_client.py
@@ -0,0 +1,105 @@
+"""
+ldap_client
+"""
+import logging
+import contextlib
+import time
+import os
+
+from teuthology.orchestra import run
+from teuthology import misc
+
+log = logging.getLogger(__name__)
+
+def get_node_name(ctx, this_task):
+    """
+    Given a teuthology task site ('client.1' for example), return
+    the network hostname for that site.
+    """
+    for task_list in ctx.cluster.remotes:
+        if this_task in ctx.cluster.remotes[task_list]:
+            return task_list.name.split('@')[1]
+    return ''
+
+def get_task_site(ctx, taskname):
+    """
+    Given a taskname ('ldap_client' for example), return the associated
+    teuthology location that that task is running on ('client.1' for example)
+    """
+    for tentry in ctx.config['tasks']:
+        if taskname in tentry:
+            return tentry[taskname][0]
+    return ''
+
+def fix_yum_boto(client):
+    """
+    Set up boto on Rhel/Fedora/Centos.
+    """
+    client.run(args=['sudo', 'yum-config-manager', '--enable', 'epel'])
+    client.run(args=['sudo', 'yum', '-y', 'install', 'python-boto'])
+    client.run(args=['sudo', 'yum-config-manager', '--disable', 'epel'])
+
+def get_dc_path(path):
+    dcvals = path.split('.')[1:]
+    out_str = []
+    for path_part in dcvals:
+        out_str.append('dc=%s' % path_part)
+    return (','.join(out_str))
+
+@contextlib.contextmanager
+def task(ctx, config):
+    """
+    Install ldap_client in order to test ldap rgw authentication
+
+    Usage
+       tasks:
+       - ldap_client:
+           [client.0]
+
+    """
+    log.info('in ldap_client')
+    assert isinstance(config, list)
+    ldap_admin_key = os.environ.get('LDAP_ADMIN_KEY_VALUE', 't0pSecret')
+    (client,) = ctx.cluster.only(config[0]).remotes
+    system_type = misc.get_system_type(client)
+    if system_type == 'rpm':
+        install_cmd = ['sudo', 'yum', '-y', 'install', 'openldap-clients']
+        client.run(args=install_cmd)
+        fix_yum_boto(client)
+    else:
+        install_cmd = ['sudo', 'apt-get', '-y', 'install', 'ldap-utils']
+        client.run(args=install_cmd)
+        client.run(args=['sudo', 'apt-get', 'install', 'python-boto', '-y'])
+    client.run(args=['sudo', 'pip', 'install', '-U', 'boto'])
+
+    ldap_server_task = get_task_site(ctx, 'ldap_server')
+    server_site = get_node_name(ctx, ldap_server_task)
+    ldap_client_task = get_task_site(ctx, 'ldap_client')
+    client_site = get_node_name(ctx, ldap_client_task)
+
+    dc_splits = get_dc_path(ctx.cluster.remotes.keys()[0].name)
+    new_globals = ctx.ceph['ceph'].conf['global']
+    new_globals.update({'rgw_ldap_secret': '/etc/bindpass'})
+    new_globals.update({'rgw_ldap_uri': 'ldap://%s:389' % server_site})
+    new_globals.update({'rgw_ldap_binddn': 'uid=rgw,cn=users,cn=accounts,%s' % dc_splits})
+    new_globals.update({'rgw_ldap_searchdn': 'cn=users,cn=accounts,%s' % dc_splits})
+    new_globals.update({'rgw_ldap_dnattr': 'uid'})
+    new_globals.update({'rgw_s3_auth_use_ldap': 'true'})
+    new_globals.update({'debug rgw': '20'})
+    with open('/tmp/ceph.conf', 'w+') as cephconf:
+        ctx.ceph['ceph'].conf.write(outfile=cephconf)
+    with open('/tmp/ceph.conf', 'r') as newcephconf:
+        confstr = newcephconf.read()
+    tbindpass = ldap_admin_key
+    for remote in ctx.cluster.remotes:
+        misc.sudo_write_file(remote, '/etc/ceph/ceph.conf', confstr, perms='0644', owner='root:root')
+        misc.sudo_write_file(remote, '/etc/bindpass', tbindpass, perms='0600', owner='ceph:ceph')
+    iyam = client.name.split('@')[-1].split('.')[0]
+    if misc.get_system_type(client) == 'rpm':
+        client.run(args=['sudo', 'systemctl', 'restart', 'ceph-radosgw@rgw.%s' % iyam])
+    else:
+        client.run(args=['sudo', 'service', 'radosgw', 'restart', 'id=rgw.%s' % iyam])
+    try:
+        yield
+    finally:
+        pass

diff --git a/qa/tasks/ldap_server.py b/qa/tasks/ldap_server.py
new file mode 100644 (file)
index 0000000..101e060
--- /dev/null
+++ b/qa/tasks/ldap_server.py
@@ -0,0 +1,82 @@
+"""
+ldap_server
+"""
+import logging
+import contextlib
+import time
+import os
+
+from teuthology.orchestra import run
+from teuthology import misc
+
+log = logging.getLogger(__name__)
+
+@contextlib.contextmanager
+def task(ctx, config):
+    """
+    Start up an ldap_server in order to test ldap rgw authentication
+
+    Usage
+       tasks:
+       - ldap_server:
+           [client.0]
+
+    Note: the ldap server runs on a teuthology client, so the client
+          references in this file are ldap server references.
+    """
+
+    log.info('in ldap_server')
+    assert isinstance(config, list)
+    ldap_admin_key = os.environ.get('LDAP_ADMIN_KEY_VALUE', 't0pSecret')
+    ldap_user_key = os.environ.get('LDAP_USER_KEY_VALUE', 't0pSecret')
+    try:
+        (client,) = ctx.cluster.only(config[0]).remotes
+        system_type = misc.get_system_type(client)
+        if system_type == 'rpm':
+            install_cmd = ['sudo', 'yum', '-y', 'install', 'ipa-server', 'ipa-server-dns']
+        else:
+            install_cmd = ['sudo', 'apt-get', '-y', 'install', 'freeipa-server', 'freeipa-server-dns']
+        client.run(args=install_cmd)
+        path_parts = ctx.cluster.remotes.keys()[0].name.split('.')[1:]
+        client.run(args=['sudo',
+                         'ipa-server-install',
+                         '--realm',
+                         '.'.join(path_parts),
+                         '--ds-password',
+                         ldap_admin_key,
+                         '--admin-password',
+                         ldap_admin_key,
+                         '--unattended'])
+        time.sleep(120)
+        client.run(args=['echo',
+                         ldap_admin_key,
+                         run.Raw('|'),
+                         'kinit',
+                         'admin'])
+        client.run(args=['ipa', 'user-add', 'rgw',
+                         '--first', 'rados', '--last', 'gateway'])
+        client.run(args=['ipa', 'user-add', 'testuser',
+                         '--first', 'new', '--last', 'user'])
+        client.run(args=['echo',
+                         '%s\n%s' % (ldap_admin_key,ldap_admin_key),
+                         run.Raw('|'),
+                         'ipa',
+                         'user-mod',
+                         'rgw',
+                         '--password'])
+        client.run(args=['echo',
+                         '%s\n%s' % (ldap_user_key,ldap_user_key),
+                         run.Raw('|'),
+                         'ipa',
+                         'user-mod',
+                         'testuser',
+                         '--password'])
+        yield
+    finally:
+        (client,) = ctx.cluster.only(config[0]).remotes
+        client.run(args=[ 'yes',
+                          run.Raw('|'),
+                          'sudo',
+                          'ipa-server-install',
+                          '--uninstall'])
+        log.info("Finished ldap_server task")

diff --git a/qa/workunits/rgw/ldap_client.py b/qa/workunits/rgw/ldap_client.py
new file mode 100755 (executable)
index 0000000..c1d46fb
--- /dev/null
+++ b/qa/workunits/rgw/ldap_client.py
@@ -0,0 +1,30 @@
+#!/usr/bin/python
+import sys
+import socket
+import boto
+import boto.s3.connection
+
+inkeyfile = sys.argv[1]
+
+access_key = ""
+with open(inkeyfile) as fd_read:
+    access_key = fd_read.read().strip()
+
+boto.config.add_section('s3')
+boto.config.set('s3', 'use-sigv2', 'True')
+conn = boto.connect_s3(
+    aws_access_key_id = access_key,
+    aws_secret_access_key = '',
+    host = socket.getfqdn(),
+    port = 7280,
+    is_secure=False,
+    calling_format = boto.s3.connection.OrdinaryCallingFormat(),
+    )
+
+bucket = conn.create_bucket('testuser-new-bucket')
+for bucket in conn.get_all_buckets():
+    print "{name}\t{created}".format(
+        name = bucket.name,
+        created = bucket.creation_date,
+)
+

diff --git a/qa/workunits/rgw/ldap_client.sh b/qa/workunits/rgw/ldap_client.sh
new file mode 100755 (executable)
index 0000000..321b432
--- /dev/null
+++ b/qa/workunits/rgw/ldap_client.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+keyfile=`mktemp`
+LDAP_USER_KEY_VALUE=${LDAP_USER_KEY_VALUE:-t0pSecret}
+sudo RGW_ACCESS_KEY_ID=testuser RGW_SECRET_ACCESS_KEY=${LDAP_USER_KEY_VALUE} radosgw-token --encode --ttype=ldap > ${keyfile}
+curdir=`pwd`
+retstr=`python ${curdir}/ldap_client.py ${keyfile}`
+rm -rf $keyfile
+if [[ $retstr == testuser* ]]; then
+    echo "LDAP authentication worked"
+    exit 0
+fi
+exit 1