Add tests of rlm_winbind

diff --git a/.github/actions/ci-tests/action.yml b/.github/actions/ci-tests/action.yml
index 59e2c12f83cae88f72a05e5ef03494882c4d151b..02d71d5447b7355fb79d16f7812d6ac8876c9345 100644 (file)
--- a/.github/actions/ci-tests/action.yml
+++ b/.github/actions/ci-tests/action.yml
@@ -229,6 +229,7 @@ runs:
         RFC4533_TEST_SERVER: ldap://${{ inputs.ldap_test_server }}:${{ inputs.ldap_test_server_port }}/
         PERSISTENT_SEARCH_TEST_SERVER: ldap://${{ inputs.ldap389_test_server }}:${{ inputs.ldap389_test_server_port }}/
         ACTIVE_DIRECTORY_TEST_SERVER: ${{ inputs.active_directory_test_server }}
+        WINBIND_TEST_SERVER: ${{ inputs.active_directory_test_server }}
         REST_TEST_SERVER: ${{ inputs.rest_test_server }}
         REST_TEST_SERVER_PORT: ${{ inputs.rest_test_port }}
         REST_TEST_SERVER_SSL_PORT: ${{ inputs.rest_test_ssl_port }}

diff --git a/scripts/ci/samba-setup.sh b/scripts/ci/samba-setup.sh
index af5eb94920ed0f9906b8d283b57e4ce92338961c..362ba98a61c5521c3ccc2ac9d375270aeb71ef6d 100755 (executable)
--- a/scripts/ci/samba-setup.sh
+++ b/scripts/ci/samba-setup.sh
@@ -47,6 +47,9 @@ fi
 # Allow non TLS LDAP connections to Samba
 sudo sed -i 's/\[global\]/\[global\]\n\tldap server require strong auth = no/' /etc/samba/smb.conf
 
+# Create user for testing winbind auth
+sudo /usr/bin/samba-tool user create aduser secret_123
+
 # Start the domain controller
 if [ "$USE_DOCKER" != "true" ]; then
        sudo systemctl start samba-ad-dc

diff --git a/src/tests/modules/unit_test_module.conf b/src/tests/modules/unit_test_module.conf
index 6eba4ea57f994b6c627549ad06ec63a4b6edb401..01f4bc34f642428e08f3d6b18ae0809077bee85d 100644 (file)
--- a/src/tests/modules/unit_test_module.conf
+++ b/src/tests/modules/unit_test_module.conf
@@ -52,6 +52,8 @@ server default {
        authenticate pap {
                pap
        }
+
+       $-INCLUDE $ENV{MODULE_TEST_DIR}/authenticate.conf
 }
 
 policy {

diff --git a/src/tests/modules/winbind/all.mk b/src/tests/modules/winbind/all.mk
new file mode 100644 (file)
index 0000000..22c86d9
--- /dev/null
+++ b/src/tests/modules/winbind/all.mk
@@ -0,0 +1,6 @@
+#
+# Test the "winbind" module
+#
+
+# Don't test winbind if WINBIND_TEST_SERVER ENV is not set
+winbind_require_test_server := 1

diff --git a/src/tests/modules/winbind/auth.attrs b/src/tests/modules/winbind/auth.attrs
new file mode 100644 (file)
index 0000000..7ca74a8
--- /dev/null
+++ b/src/tests/modules/winbind/auth.attrs
@@ -0,0 +1,11 @@
+#
+#  Input packet
+#
+Packet-Type = Access-Request
+User-Name = 'aduser'
+User-Password = 'secret_123'
+
+#
+#  Expected answer
+#
+Packet-Type == Access-Accept

diff --git a/src/tests/modules/winbind/auth.unlang b/src/tests/modules/winbind/auth.unlang
new file mode 100644 (file)
index 0000000..43f5905
--- /dev/null
+++ b/src/tests/modules/winbind/auth.unlang
@@ -0,0 +1,10 @@
+# Test "authenticate" winbind call.
+winbind
+
+if !(&control.Auth-Type == winbind) {
+       test_fail
+}
+
+winbind.authenticate
+
+test_pass

diff --git a/src/tests/modules/winbind/authenticate.conf b/src/tests/modules/winbind/authenticate.conf
new file mode 100644 (file)
index 0000000..90a6583
--- /dev/null
+++ b/src/tests/modules/winbind/authenticate.conf
@@ -0,0 +1,3 @@
+authenticate winbind {
+       winbind
+}

diff --git a/src/tests/modules/winbind/group.attrs b/src/tests/modules/winbind/group.attrs
new file mode 100644 (file)
index 0000000..7ca74a8
--- /dev/null
+++ b/src/tests/modules/winbind/group.attrs
@@ -0,0 +1,11 @@
+#
+#  Input packet
+#
+Packet-Type = Access-Request
+User-Name = 'aduser'
+User-Password = 'secret_123'
+
+#
+#  Expected answer
+#
+Packet-Type == Access-Accept

diff --git a/src/tests/modules/winbind/group.unlang b/src/tests/modules/winbind/group.unlang
new file mode 100644 (file)
index 0000000..6f892ea
--- /dev/null
+++ b/src/tests/modules/winbind/group.unlang
@@ -0,0 +1,9 @@
+if !(%winbind.group('domain users')) {
+       test_fail
+}
+
+if (%winbind.group('nongroup')) {
+       test_fail
+}
+
+test_pass

diff --git a/src/tests/modules/winbind/module.conf b/src/tests/modules/winbind/module.conf
new file mode 100644 (file)
index 0000000..9464999
--- /dev/null
+++ b/src/tests/modules/winbind/module.conf
@@ -0,0 +1,8 @@
+#winbind unit test config
+
+winbind {
+       username = "%{&Stripped-User-Name || &User-Name}"
+       group {
+               search_username = "%{&Stripped-User-Name || &User-Name}"
+       }
+}