test_pam_srv.c revision fd6f4047b58686bd4057c9859c3c804a77b136d8
/*
Authors:
Sumit Bose <sbose@redhat.com>
Copyright (C) 2015 Red Hat
SSSD tests: PAM responder tests
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include <security/pam_modules.h>
#include <popt.h>
#include "tests/cmocka/common_mock.h"
#include "tests/cmocka/common_mock_resp.h"
#include "responder/common/responder_packet.h"
#include "responder/common/negcache.h"
#include "responder/pam/pam_helpers.h"
#include "sss_client/pam_message.h"
#include "sss_client/sss_cli.h"
#include "util/crypto/sss_crypto.h"
#ifdef HAVE_NSS
#include "util/crypto/nss/nss_util.h"
#endif
#define TEST_CONF_DB "test_pam_conf.ldb"
#define TEST_DOM_NAME "pam_test"
#define TEST_SUBDOM_NAME "test.subdomain"
#define TEST_ID_PROVIDER "ldap"
#define NSS_DB_PATH TESTS_PATH
#define TEST_TOKEN_NAME "SSSD Test Token"
#define TEST_MODULE_NAME "NSS-Internal"
#define TEST_KEY_ID "A5EF7DEE625CA5996C8D1BA7D036708161FD49E7"
#define TEST_SUBJECT_DN "CN=ipa-devel.ipa.devel,O=IPA.DEVEL"
#define TEST_TOKEN_CERT \
"MIIECTCCAvGgAwIBAgIBCTANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlJUEEu" \
"REVWRUwxHjAcBgNVBAMMFUNlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0xNjA1MjMx" \
"NDE0MTVaFw0xODA1MjQxNDE0MTVaMDIxEjAQBgNVBAoMCUlQQS5ERVZFTDEcMBoG" \
"A1UEAwwTaXBhLWRldmVsLmlwYS5kZXZlbDCCASIwDQYJKoZIhvcNAQEBBQADggEP" \
"ADCCAQoCggEBALHvOzZy/3llvoAYxrtOpux0gDVvSuSRpTGOW/bjpgdTowvXoOb5" \
"G9Cy/9S6be7ZJ9D95lc/J9W8tX+ShKN8Q4b74l4WjmILQJ4dUsJ/BXfvoMPR8tw/" \
"Q/7Of7H3tf4bvxNTFkxh39KQMG28wjPZSv+SZWNHMB+rj2yZgyeHBMkoPOPesAEi" \
"7KKHxw1MHSv2xBI1AiV+aMdKfYUMy0Rq3PrRU4274i3eaBX4Q9GnDi36K/7bHjbt" \
"MBaAFPci/0Km5D/L5z7YqwEc7E1/GwgcMDsGCCsGAQUFBwEBBC8wLTArBggrBgEF" \
"BQcwAYYfaHR0cDovL2lwYS1jYS5pcGEuZGV2ZWwvY2Evb2NzcDAOBgNVHQ8BAf8E" \
"BAMCBPAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMHQGA1UdHwRtMGsw" \
"aaAxoC+GLWh0dHA6Ly9pcGEtY2EuaXBhLmRldmVsL2lwYS9jcmwvTWFzdGVyQ1JM" \
"LmJpbqI0pDIwMDEOMAwGA1UECgwFaXBhY2ExHjAcBgNVBAMMFUNlcnRpZmljYXRl" \
"IEF1dGhvcml0eTAdBgNVHQ4EFgQUIJuWIts3m3uEYqJ9pUL0y7utTiEwDQYJKoZI" \
"hvcNAQELBQADggEBAB0GyqGxtZ99fsXA1+fHfAwKOwznT7Hh8hN9efEMBJICVud+" \
"bwNMMSeTxSg6wbJnEyZqQEIr2h/TR9dRNxE+RbQXyamW0fUxSVT16iueL0hMwszT" \
"jCfI/UZv3tDMHbh6D4811A0HO8daW7ufMGb/M+kDxYigJiL2gllMZ+6xba1RRgzF" \
"8Z+9gqZhCa7FEKJOPNR9RVtJs0qUUutMZrp1zpyx0GTmXQBA7LbgPxy8L68uymEQ" \
"XyQBwOYRORlnfGyu+Yc9c3E0Wx8Tlznz0lqPR9g="
#define TEST2_KEY_ID "C8D60E009EB195D01A7083EE1D5419251AA87C2C"
#define TEST2_SUBJECT_DN "CN=IPA RA,O=IPA.DEVEL"
#define TEST_TOKEN_2ND_CERT \
"MIIDazCCAlOgAwIBAgIBBzANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlJUEEu" \
"REVWRUwxHjAcBgNVBAMMFUNlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0xNjA1MjMx" \
"NDEzMDFaFw0xODA1MTMxNDEzMDFaMCUxEjAQBgNVBAoMCUlQQS5ERVZFTDEPMA0G" \
"A1UEAwwGSVBBIFJBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3abE" \
"8LmIc6QN16VVxsMlN/rrCOoZKyyJolSzpP4+K66t+KZUiW/1j1MZogjyYyD39U1F" \
"+ZZRm+u/NDdIRFI5wfKLRR1r/ONaJA9nz1TxSEsgLsjG/1m+Zbb6lGG4pePIFkQ9" \
"Iotpi64obBh93oIxzQR29lBG/FMjQVHlPIbx+xuGx11Vtp5pAomgFz0HRrj0leI7" \
"YS1kZXZlbC5pcGEuZGV2ZWw6ODAvY2Evb2NzcDAOBgNVHQ8BAf8EBAMCBPAwHQYD" \
"VR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA0GCSqGSIb3DQEBCwUAA4IBAQBg" \
"M6JUpELuQYgqugoCgBXMgsMlpAO/0C3CFq4ZH3KgIsRlRngKPrt6RG0UPMRD1CE2" \
"tSVkwUWvyK83lDiu2BbWDXyMyz5eZOlp7uHusf5BKvob8jEndHj1YzaNTmVSsDM5" \
"kiIwf8qgFhsO1HCq08PtAnbVHhqkcvnmIJN98eNWNfTKodDmFVbN8gB0wK+WB5ii" \
"WVOw7+3/zF1QgqnYX3t+kPLRryip/wvTZkzXWwMNj/W6UHgjNF/4gWGoBgCHu+u3" \
"EvjMmbVSrEkesibpGQS5"
static char CACHED_AUTH_TIMEOUT_STR[] = "4";
static const int CACHED_AUTH_TIMEOUT = 4;
struct pam_test_ctx {
struct sss_test_ctx *tctx;
struct sss_domain_info *subdom;
struct sss_cmd_table *pam_cmds;
int ncache_hits;
int exp_pam_status;
bool provider_contacted;
const char *pam_user_fqdn;
const char *wrong_user_fqdn;
};
/* Must be global because it is needed in some wrappers */
struct pam_test_ctx *pam_test_ctx;
static errno_t setup_nss_db(void)
{
int ret;
int status;
return ret;
}
return ret;
}
if (child_pid == 0) { /* child */
if (ret == -1) {
exit(-1);
}
} else if (child_pid > 0) {
} else {
return ret;
}
if (child_pid == 0) { /* child */
if (ret == -1) {
exit(-1);
}
} else if (child_pid > 0) {
} else {
return ret;
}
return ret;
}
if (ret < 0) {
return ret;
}
ret = fprintf(fp, "parameters=configdir='sql:%s/src/tests/cmocka/p11_nssdb' dbSlotDescription='SSSD Test Slot' dbTokenDescription='SSSD Test Token' secmod='secmod.db' flags=readOnly \n\n", ABS_SRC_DIR);
if (ret < 0) {
return ret;
}
if (ret != 0) {
return ret;
}
return ret;
}
if (ret < 0) {
return ret;
}
ret = fprintf(fp, "parameters=configdir='sql:%s/src/tests/cmocka/p11_nssdb_2certs' dbSlotDescription='SSSD Test Slot' dbTokenDescription='SSSD Test Token' secmod='secmod.db' flags=readOnly \n\n", ABS_SRC_DIR);
if (ret < 0) {
return ret;
}
if (ret != 0) {
return ret;
}
return EOK;
}
static void cleanup_nss_db(void)
{
int ret;
}
}
}
}
}
}
}
}
}
{
/* Two NULLs so that tests can just assign a const to the first slot
* should they need it. The code iterates until first NULL anyway
*/
return NULL;
}
return pctx;
}
{
const char *val[2];
int ret;
}
return EOK;
}
struct confdb_ctx *cdb)
{
}
struct confdb_ctx *cdb)
{
}
struct sss_test_conf_param pam_params[],
struct sss_test_conf_param monitor_params[],
void **state)
{
struct cli_protocol *prctx;
/* FIXME - perhaps this should be folded into sssd_domain_init or stricty
* used together
*/
/* Initialize the PAM responder */
/* Create client context */
}
static void pam_test_setup_common(void)
{
"pamuser",
"wronguser",
/* integer values cannot be set by pam_params */
/* Prime the cache with a valid user */
123, 456, "pam user",
NULL, 300, 0);
/* Add entry to the initgr cache to make sure no initgr request is sent to
* the backend */
discard_const("pamuser"),
/* Prime the cache with a user for wrong matches */
321, 654, "wrong user",
NULL, 300, 0);
/* Add entry to the initgr cache to make sure no initgr request is sent to
* the backend */
discard_const("wronguser"),
}
static int pam_test_setup(void **state)
{
struct sss_test_conf_param dom_params[] = {
{ "enumerate", "false" },
{ "cache_credentials", "true" },
};
struct sss_test_conf_param pam_params[] = {
{ "p11_child_timeout", "30" },
};
struct sss_test_conf_param monitor_params[] = {
{ "certificate_verification", "no_ocsp"},
};
return 0;
}
#ifdef HAVE_NSS
static int pam_test_setup_no_verification(void **state)
{
struct sss_test_conf_param dom_params[] = {
{ "enumerate", "false" },
{ "cache_credentials", "true" },
};
struct sss_test_conf_param pam_params[] = {
{ "p11_child_timeout", "30" },
};
struct sss_test_conf_param monitor_params[] = {
{ "certificate_verification", "no_verification" },
};
return 0;
}
#endif /* HAVE_NSS */
static int pam_cached_test_setup(void **state)
{
struct sss_test_conf_param dom_params[] = {
{ "enumerate", "false" },
{ "cache_credentials", "true" },
{ "cached_auth_timeout", CACHED_AUTH_TIMEOUT_STR },
};
struct sss_test_conf_param pam_params[] = {
{ "p11_child_timeout", "30" },
};
struct sss_test_conf_param monitor_params[] = {
{ "certificate_verification", "no_ocsp"},
};
return 0;
}
static int pam_test_teardown(void **state)
{
int ret;
pam_test_ctx->pam_user_fqdn, 0);
pam_test_ctx->wrong_user_fqdn, 0);
return 0;
}
{
if (wtype == WRAP_CALL_REAL) {
}
if (len == 0) {
}
return;
}
{
struct cli_protocol *prctx;
struct sss_packet *packet;
}
{
return sss_mock_type(enum sss_cli_command);
}
{
return EOK;
}
{
}
{
pam_test_ctx->provider_contacted = true;
/* Set expected status */
return EOK;
}
const char *name,
const char *pwd,
const char *fa2,
const char *svc,
bool contact_dp)
{
int ret;
char *s_name;
char *dom;
} else {
pi.pam_user_size = 0;
}
} else {
}
}
svc = "pam_test_service";
}
assert_int_equal(ret, 0);
} else {
}
if (contact_dp) {
}
}
const char *name,
const char *pwd,
const char *fa2)
{
}
const char *pin, const char *token_name,
const char *module_name, const char *key_id,
const char *service,
bool only_one_provider_call)
{
int ret;
bool already_mocked = false;
} else {
pi.pam_user_size = 0;
}
key_id, 0,
&needed_size);
}
assert_int_equal(ret, 0);
already_mocked = true;
}
if (!(only_one_provider_call && already_mocked)) {
}
}
}
{
assert_int_equal(status, 0);
return EOK;
}
#define PKCS11_LOGIN_TOKEN_ENV_NAME "PKCS11_LOGIN_TOKEN_NAME"
{
assert_int_equal(status, 0);
+ sizeof(TEST_TOKEN_NAME)));
+ sizeof(TEST_TOKEN_NAME)
+ sizeof(TEST_MODULE_NAME)
+ sizeof(TEST_KEY_ID)
+ sizeof(TEST_SUBJECT_DN)));
rp += sizeof(TEST_TOKEN_NAME);
rp += sizeof(TEST_MODULE_NAME);
rp += sizeof(TEST_KEY_ID);
rp += sizeof(TEST_SUBJECT_DN);
return EOK;
}
const char *name2)
{
assert_int_equal(status, 0);
} else {
} else {
}
}
+ sizeof(TEST_TOKEN_NAME)
+ sizeof(TEST_MODULE_NAME)
+ sizeof(TEST_KEY_ID)
+ sizeof(TEST_SUBJECT_DN)));
rp += sizeof(TEST_TOKEN_NAME);
rp += sizeof(TEST_MODULE_NAME);
rp += sizeof(TEST_KEY_ID);
rp += sizeof(TEST_SUBJECT_DN);
+ sizeof(TEST_TOKEN_NAME)
+ sizeof(TEST_MODULE_NAME)
+ sizeof(TEST2_KEY_ID)
+ sizeof(TEST2_SUBJECT_DN)));
rp += sizeof(TEST_TOKEN_NAME);
rp += sizeof(TEST_MODULE_NAME);
rp += sizeof(TEST2_KEY_ID);
rp += sizeof(TEST2_SUBJECT_DN);
}
return EOK;
}
{
NULL);
}
{
NULL);
}
{
}
{
}
{
"pamuser@"TEST_DOM_NAME);
}
{
assert_int_equal(status, 0);
return EOK;
}
{
}
{
}
{
}
{
}
{
}
{
assert_int_equal(status, 0);
assert_int_equal(val, 0);
return EOK;
}
{
assert_int_equal(status, 0);
assert_int_equal(val, 0);
return EOK;
}
void test_pam_authenticate(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
void test_pam_setcreds(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
void test_pam_acct_mgmt(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
void test_pam_open_session(void **state)
{
int ret;
/* make sure pam_status is not touched by setting it to a value which is
* not used by SSSD. */
/* Wait until the test finishes with EOK */
}
void test_pam_close_session(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
void test_pam_chauthtok(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
void test_pam_chauthtok_prelim(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
void test_pam_preauth(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
/* Cached on-line authentication */
static void common_test_pam_cached_auth(const char *pwd)
{
int ret;
/* Wait until the test finishes with EOK */
}
void test_pam_cached_auth_success(void **state)
{
int ret;
common_test_pam_cached_auth("12345");
/* Back end should be contacted */
"12345");
/* Reset before next call */
pam_test_ctx->provider_contacted = false;
common_test_pam_cached_auth("12345");
/* Back end should not be contacted */
}
void test_pam_cached_auth_wrong_pw(void **state)
{
int ret;
"12345");
common_test_pam_cached_auth("11111");
/* Back end should be contacted */
}
/* test cached_auth_timeout option */
void test_pam_cached_auth_opt_timeout(void **state)
{
int ret;
"12345");
common_test_pam_cached_auth("12345");
/* Back end should be contacted */
}
/* too long since last on-line authentication */
void test_pam_cached_auth_timeout(void **state)
{
int ret;
"12345");
0);
common_test_pam_cached_auth("12345");
/* Back end should be contacted */
}
{
int ret;
common_test_pam_cached_auth("12345678");
/* Reset before next call */
pam_test_ctx->provider_contacted = false;
common_test_pam_cached_auth("12345678");
}
{
int ret;
common_test_pam_cached_auth("1111abcde");
}
/* Off-line authentication */
void test_pam_offline_auth_no_hash(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
void test_pam_offline_auth_success(void **state)
{
int ret;
"12345");
/* Wait until the test finishes with EOK */
}
void test_pam_offline_auth_wrong_pw(void **state)
{
int ret;
"12345");
/* Wait until the test finishes with EOK */
}
void test_pam_offline_auth_success_2fa(void **state)
{
int ret;
"12345");
/* Wait until the test finishes with EOK */
}
void test_pam_offline_auth_failed_2fa(void **state)
{
int ret;
"12345");
/* Wait until the test finishes with EOK */
}
void test_pam_offline_auth_success_2fa_with_cached_2fa(void **state)
{
int ret;
"12345",
SSS_AUTHTOK_TYPE_2FA, 5);
/* Wait until the test finishes with EOK */
}
void test_pam_offline_auth_failed_2fa_with_cached_2fa(void **state)
{
int ret;
"12345",
SSS_AUTHTOK_TYPE_2FA, 5);
/* Wait until the test finishes with EOK */
}
void test_pam_offline_auth_success_pw_with_cached_2fa(void **state)
{
int ret;
"12345",
SSS_AUTHTOK_TYPE_2FA, 5);
/* Wait until the test finishes with EOK */
}
void test_pam_offline_auth_failed_pw_with_cached_2fa(void **state)
{
int ret;
"12345",
SSS_AUTHTOK_TYPE_2FA, 5);
/* Wait until the test finishes with EOK */
}
{
int ret;
/* Wait until the test finishes with EOK */
}
{
int ret;
/* Wait until the test finishes with EOK */
}
{
int ret;
/* Wait until the test finishes with EOK */
}
void test_pam_offline_chauthtok_prelim(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
void test_pam_offline_chauthtok(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
void test_pam_preauth_no_logon_name(void **state)
{
int ret;
NULL, false);
/* Wait until the test finishes with EOK */
}
void test_pam_auth_no_upn_logon_name(void **state)
{
int ret;
"12345");
true);
/* Wait until the test finishes with EOK */
}
void test_pam_auth_upn_logon_name(void **state)
{
int ret;
struct sysdb_attrs *attrs;
"12345");
true);
/* Wait until the test finishes with EOK */
}
{
}
void test_pam_preauth_cert_nocert(void **state)
{
int ret;
/* Wait until the test finishes with EOK */
}
static int test_lookup_by_cert_cb(void *pvt)
{
int ret;
struct sysdb_attrs *attrs;
}
return EOK;
}
static int test_lookup_by_cert_cb_2nd_cert_same_user(void *pvt)
{
int ret;
struct sysdb_attrs *attrs;
return EOK;
}
static int test_lookup_by_cert_double_cb(void *pvt)
{
int ret;
struct sysdb_attrs *attrs;
}
return EOK;
}
static int test_lookup_by_cert_wrong_user_cb(void *pvt)
{
int ret;
struct sysdb_attrs *attrs;
}
return EOK;
}
void test_pam_preauth_cert_nomatch(void **state)
{
int ret;
test_lookup_by_cert_cb, NULL, false);
/* Wait until the test finishes with EOK */
}
void test_pam_preauth_cert_match(void **state)
{
int ret;
test_lookup_by_cert_cb, TEST_TOKEN_CERT, false);
/* Wait until the test finishes with EOK */
}
/* Test if PKCS11_LOGIN_TOKEN_NAME is added for the gdm-smartcard service */
void test_pam_preauth_cert_match_gdm_smartcard(void **state)
{
int ret;
"gdm-smartcard", test_lookup_by_cert_cb,
TEST_TOKEN_CERT, false);
/* Wait until the test finishes with EOK */
}
void test_pam_preauth_cert_match_wrong_user(void **state)
{
int ret;
TEST_TOKEN_CERT, false);
/* Wait until the test finishes with EOK */
}
void test_pam_preauth_cert_no_logon_name(void **state)
{
int ret;
/* If no logon name is given the user is looked by certificate first.
* Since there is a matching user the upcoming lookup by name will find
* the user entry. But since we force the lookup by name to go to the
* backend to make sure the group-membership data is up to date the
* backend response has to be mocked twice.
* Additionally sss_parse_inp_recv() must be mocked because the cache
* request will be done with the username found by the certificate
* lookup. */
test_lookup_by_cert_cb, TEST_TOKEN_CERT, false);
/* Wait until the test finishes with EOK */
}
void test_pam_preauth_cert_no_logon_name_with_hint(void **state)
{
int ret;
/* If no logon name is given the user is looked by certificate first.
* Since user name hint is enabled we do not have to search the user
* during pre-auth and there is no need for an extra mocked response as in
* test_pam_preauth_cert_no_logon_name. */
test_lookup_by_cert_cb, TEST_TOKEN_CERT, false);
/* Wait until the test finishes with EOK */
}
void test_pam_preauth_cert_no_logon_name_double_cert(void **state)
{
int ret;
test_lookup_by_cert_double_cb, TEST_TOKEN_CERT, false);
/* Wait until the test finishes with EOK */
}
{
int ret;
test_lookup_by_cert_double_cb, TEST_TOKEN_CERT, false);
/* Wait until the test finishes with EOK */
}
void test_pam_preauth_no_cert_no_logon_name(void **state)
{
int ret;
NULL, false);
/* Wait until the test finishes with EOK */
}
void test_pam_preauth_cert_no_logon_name_no_match(void **state)
{
int ret;
test_lookup_by_cert_cb, NULL, false);
/* Wait until the test finishes with EOK */
}
void test_pam_cert_auth(void **state)
{
int ret;
/* Here the last option must be set to true because the backend is only
* connected once. During authentication the backend is connected first to
* see if it can handle Smartcard authentication, but before that the user
* is looked up. Since the first mocked reply already adds the certificate
* to the user entry the lookup by certificate will already find the user
* in the cache and no second request to the backend is needed. */
"NSS-Internal",
"A5EF7DEE625CA5996C8D1BA7D036708161FD49E7", NULL,
test_lookup_by_cert_cb, TEST_TOKEN_CERT, true);
/* Assume backend cannot handle Smartcard credentials */
/* Wait until the test finishes with EOK */
}
void test_pam_cert_auth_no_logon_name(void **state)
{
int ret;
/* Here the last option must be set to true because the backend is only
* connected once. During authentication the backend is connected first to
* see if it can handle Smartcard authentication, but before that the user
* is looked up. Since the first mocked reply already adds the certificate
* to the user entry the lookup by certificate will already find the user
* in the cache and no second request to the backend is needed. */
"NSS-Internal",
"A5EF7DEE625CA5996C8D1BA7D036708161FD49E7", NULL,
test_lookup_by_cert_cb, TEST_TOKEN_CERT, true);
/* Assume backend cannot handle Smartcard credentials */
/* Wait until the test finishes with EOK */
}
void test_pam_cert_auth_no_logon_name_no_key_id(void **state)
{
int ret;
/* Here the last option must be set to true because the backend is only
* connected once. During authentication the backend is connected first to
* see if it can handle Smartcard authentication, but before that the user
* is looked up. Since the first mocked reply already adds the certificate
* to the user entry the lookup by certificate will already find the user
* in the cache and no second request to the backend is needed. */
/* Assume backend cannot handle Smartcard credentials */
/* Wait until the test finishes with EOK */
}
void test_pam_cert_auth_double_cert(void **state)
{
int ret;
"NSS-Internal",
"A5EF7DEE625CA5996C8D1BA7D036708161FD49E7", NULL,
/* Assume backend cannot handle Smartcard credentials */
/* Wait until the test finishes with EOK */
}
void test_pam_cert_preauth_2certs_one_mapping(void **state)
{
int ret;
test_lookup_by_cert_cb, TEST_TOKEN_CERT, false);
/* Wait until the test finishes with EOK */
}
void test_pam_cert_preauth_2certs_two_mappings(void **state)
{
int ret;
TEST_TOKEN_CERT, false);
/* Wait until the test finishes with EOK */
}
void test_filter_response(void **state)
{
int ret;
char *env;
struct sss_test_conf_param pam_params[] = {
{ CONFDB_PAM_VERBOSITY, "1" },
};
sizeof(offline_auth_data), offline_auth_data);
/* pd->resp_list points to the SSS_PAM_USER_INFO and pd->resp_list->next
* to the SSS_PAM_ENV_ITEM message. */
/* Test CONFDB_PAM_VERBOSITY option */
/* SSS_PAM_USER_INFO_OFFLINE_AUTH message will only be shown with
* pam_verbosity 2 or above if cache password never expires. */
/* Test CONFDB_PAM_RESPONSE_FILTER option */
/* for all services */
/* service name does not match */
/* multiple rules with a match */
"ENV:MyEnv:MyService, "
"ENV:stu:xyz";
}
static int pam_test_setup_appsvc_posix_dom(void **state)
{
int ret;
return ret;
}
/* This config option is only read on startup, which is not executed
* in test, so we can't just pass in a param
*/
return 0;
}
void test_appsvc_posix_dom(void **state)
{
int ret;
/* The domain is POSIX, the request will skip over it */
}
void test_not_appsvc_posix_dom(void **state)
{
int ret;
/* A different service than the app one can authenticate against a POSIX domain */
/* Wait until the test finishes with EOK */
}
static int pam_test_setup_appsvc_app_dom(void **state)
{
struct sss_test_conf_param dom_params[] = {
{ "domain_type", "application" },
};
struct sss_test_conf_param pam_params[] = {
};
struct sss_test_conf_param monitor_params[] = {
};
/* This config option is only read on startup, which is not executed
* in test, so we can't just pass in a param
*/
return 0;
}
void test_appsvc_app_dom(void **state)
{
int ret;
/* The domain is POSIX, the request will skip over it */
/* Wait until the test finishes with EOK */
}
void test_not_appsvc_app_dom(void **state)
{
int ret;
/* A different service than the app one can authenticate against a POSIX domain */
}
{
int rv;
int no_cleanup = 0;
int opt;
struct poptOption long_options[] = {
_("Do not delete the test database after a test run"), NULL },
};
const struct CMUnitTest tests[] = {
/* p11_child is not built without NSS */
#ifdef HAVE_NSS
#endif /* HAVE_NSS */
};
/* Set debug level to invalid value so we can deside if -d 0 was used. */
switch (opt) {
default:
return 1;
}
}
/* Even though normally the tests should clean up after themselves
* they might not after a failed run. Remove the old db to be sure */
rv = setup_nss_db();
exit(-1);
}
if (rv == 0 && !no_cleanup) {
}
#ifdef HAVE_NSS
/* Cleanup NSS and NSPR to make valgrund happy. */
#endif
return rv;
}