3rdparty/modules/keystone/spec/classes/keystone_ldap_spec.rb

   1 require 'spec_helper'
   2
   3 describe 'keystone::ldap' do
   4   describe 'with basic params' do
   5     let :params do
   6       {
   7         :url => 'ldap://foo',
   8         :user => 'cn=foo,dc=example,dc=com',
   9         :password => 'abcdefg',
  10         :suffix => 'dc=example,dc=com',
  11         :query_scope => 'sub',
  12         :page_size => '50',
  13         :user_tree_dn => 'cn=users,dc=example,dc=com',
  14         :user_filter => '(memberOf=cn=openstack,cn=groups,cn=accounts,dc=example,dc=com)',
  15         :user_objectclass => 'inetUser',
  16         :user_id_attribute => 'uid',
  17         :user_name_attribute => 'cn',
  18         :user_mail_attribute => 'mail',
  19         :user_enabled_attribute => 'UserAccountControl',
  20         :user_enabled_mask => '2',
  21         :user_enabled_default => '512',
  22         :user_enabled_invert => 'False',
  23         :user_attribute_ignore => '',
  24         :user_default_project_id_attribute => 'defaultProject',
  25         :user_allow_create => 'False',
  26         :user_allow_update => 'False',
  27         :user_allow_delete => 'False',
  28         :user_pass_attribute => 'krbPassword',
  29         :user_enabled_emulation => 'True',
  30         :user_enabled_emulation_dn => 'cn=openstack-enabled,cn=groups,cn=accounts,dc=example,dc=com',
  31         :user_additional_attribute_mapping => 'description:name, gecos:name',
  32         :project_tree_dn => 'ou=projects,ou=openstack,dc=example,dc=com',
  33         :project_filter => '',
  34         :project_objectclass => 'organizationalUnit',
  35         :project_id_attribute => 'ou',
  36         :project_member_attribute => 'member',
  37         :project_desc_attribute => 'description',
  38         :project_name_attribute => 'ou',
  39         :project_enabled_attribute => 'enabled',
  40         :project_domain_id_attribute => 'businessCategory',
  41         :project_attribute_ignore => '',
  42         :project_allow_create => 'True',
  43         :project_allow_update => 'True',
  44         :project_allow_delete => 'True',
  45         :project_enabled_emulation => 'False',
  46         :project_enabled_emulation_dn => 'True',
  47         :project_additional_attribute_mapping => 'cn=enabled,ou=openstack,dc=example,dc=com',
  48         :role_tree_dn => 'ou=roles,ou=openstack,dc=example,dc=com',
  49         :role_filter => '',
  50         :role_objectclass => 'organizationalRole',
  51         :role_id_attribute => 'cn',
  52         :role_name_attribute => 'ou',
  53         :role_member_attribute => 'roleOccupant',
  54         :role_attribute_ignore => 'description',
  55         :role_allow_create => 'True',
  56         :role_allow_update => 'True',
  57         :role_allow_delete => 'True',
  58         :role_additional_attribute_mapping => '',
  59         :group_tree_dn => 'ou=groups,ou=openstack,dc=example,dc=com',
  60         :group_filter => 'cn=enabled-groups,cn=groups,cn=accounts,dc=example,dc=com',
  61         :group_objectclass => 'organizationalRole',
  62         :group_id_attribute => 'cn',
  63         :group_name_attribute => 'cn',
  64         :group_member_attribute => 'roleOccupant',
  65         :group_desc_attribute => 'description',
  66         :group_attribute_ignore => '',
  67         :group_allow_create => 'False',
  68         :group_allow_update => 'False',
  69         :group_allow_delete => 'False',
  70         :group_additional_attribute_mapping => '',
  71         :use_tls => 'False',
  72         :tls_cacertdir => '/etc/ssl/certs/',
  73         :tls_cacertfile => '/etc/ssl/certs/ca-certificates.crt',
  74         :tls_req_cert => 'demand',
  75         :identity_driver => 'keystone.identity.backends.ldap.Identity',
  76         :credential_driver => 'keystone.credential.backends.ldap.Credential',
  77         :assignment_driver => 'keystone.assignment.backends.ldap.Assignment',
  78         :use_pool => 'True',
  79         :pool_size => 20,
  80         :pool_retry_max => 2,
  81         :pool_retry_delay => 0.2,
  82         :pool_connection_timeout => 222,
  83         :pool_connection_lifetime => 222,
  84         :use_auth_pool => 'True',
  85         :auth_pool_size => 20,
  86         :auth_pool_connection_lifetime => 200,
  87       }
  88     end
  89     it { is_expected.to contain_package('python-ldap') }
  90     it { is_expected.to contain_package('python-ldappool') }
  91     it 'should have basic params' do
  92       # basic params
  93       is_expected.to contain_keystone_config('ldap/url').with_value('ldap://foo')
  94       is_expected.to contain_keystone_config('ldap/user').with_value('cn=foo,dc=example,dc=com')
  95       is_expected.to contain_keystone_config('ldap/password').with_value('abcdefg').with_secret(true)
  96       is_expected.to contain_keystone_config('ldap/suffix').with_value('dc=example,dc=com')
  97       is_expected.to contain_keystone_config('ldap/query_scope').with_value('sub')
  98       is_expected.to contain_keystone_config('ldap/page_size').with_value('50')
  99
 100       # users
 101       is_expected.to contain_keystone_config('ldap/user_tree_dn').with_value('cn=users,dc=example,dc=com')
 102       is_expected.to contain_keystone_config('ldap/user_filter').with_value('(memberOf=cn=openstack,cn=groups,cn=accounts,dc=example,dc=com)')
 103       is_expected.to contain_keystone_config('ldap/user_objectclass').with_value('inetUser')
 104       is_expected.to contain_keystone_config('ldap/user_id_attribute').with_value('uid')
 105       is_expected.to contain_keystone_config('ldap/user_name_attribute').with_value('cn')
 106       is_expected.to contain_keystone_config('ldap/user_mail_attribute').with_value('mail')
 107       is_expected.to contain_keystone_config('ldap/user_enabled_attribute').with_value('UserAccountControl')
 108       is_expected.to contain_keystone_config('ldap/user_enabled_mask').with_value('2')
 109       is_expected.to contain_keystone_config('ldap/user_enabled_default').with_value('512')
 110       is_expected.to contain_keystone_config('ldap/user_enabled_invert').with_value('False')
 111       is_expected.to contain_keystone_config('ldap/user_attribute_ignore').with_value('')
 112       is_expected.to contain_keystone_config('ldap/user_default_project_id_attribute').with_value('defaultProject')
 113       is_expected.to contain_keystone_config('ldap/user_tree_dn').with_value('cn=users,dc=example,dc=com')
 114       is_expected.to contain_keystone_config('ldap/user_allow_create').with_value('False')
 115       is_expected.to contain_keystone_config('ldap/user_allow_update').with_value('False')
 116       is_expected.to contain_keystone_config('ldap/user_allow_delete').with_value('False')
 117       is_expected.to contain_keystone_config('ldap/user_pass_attribute').with_value('krbPassword')
 118       is_expected.to contain_keystone_config('ldap/user_enabled_emulation').with_value('True')
 119       is_expected.to contain_keystone_config('ldap/user_enabled_emulation_dn').with_value('cn=openstack-enabled,cn=groups,cn=accounts,dc=example,dc=com')
 120       is_expected.to contain_keystone_config('ldap/user_additional_attribute_mapping').with_value('description:name, gecos:name')
 121
 122       # projects/tenants
 123       is_expected.to contain_keystone_config('ldap/project_tree_dn').with_value('ou=projects,ou=openstack,dc=example,dc=com')
 124       is_expected.to contain_keystone_config('ldap/project_filter').with_value('')
 125       is_expected.to contain_keystone_config('ldap/project_objectclass').with_value('organizationalUnit')
 126       is_expected.to contain_keystone_config('ldap/project_id_attribute').with_value('ou')
 127       is_expected.to contain_keystone_config('ldap/project_member_attribute').with_value('member')
 128       is_expected.to contain_keystone_config('ldap/project_desc_attribute').with_value('description')
 129       is_expected.to contain_keystone_config('ldap/project_name_attribute').with_value('ou')
 130       is_expected.to contain_keystone_config('ldap/project_enabled_attribute').with_value('enabled')
 131       is_expected.to contain_keystone_config('ldap/project_domain_id_attribute').with_value('businessCategory')
 132       is_expected.to contain_keystone_config('ldap/project_attribute_ignore').with_value('')
 133       is_expected.to contain_keystone_config('ldap/project_allow_create').with_value('True')
 134       is_expected.to contain_keystone_config('ldap/project_allow_update').with_value('True')
 135       is_expected.to contain_keystone_config('ldap/project_allow_delete').with_value('True')
 136       is_expected.to contain_keystone_config('ldap/project_enabled_emulation').with_value('False')
 137       is_expected.to contain_keystone_config('ldap/project_enabled_emulation_dn').with_value('True')
 138       is_expected.to contain_keystone_config('ldap/project_additional_attribute_mapping').with_value('cn=enabled,ou=openstack,dc=example,dc=com')
 139
 140       # roles
 141       is_expected.to contain_keystone_config('ldap/role_tree_dn').with_value('ou=roles,ou=openstack,dc=example,dc=com')
 142       is_expected.to contain_keystone_config('ldap/role_filter').with_value('')
 143       is_expected.to contain_keystone_config('ldap/role_objectclass').with_value('organizationalRole')
 144       is_expected.to contain_keystone_config('ldap/role_id_attribute').with_value('cn')
 145       is_expected.to contain_keystone_config('ldap/role_name_attribute').with_value('ou')
 146       is_expected.to contain_keystone_config('ldap/role_member_attribute').with_value('roleOccupant')
 147       is_expected.to contain_keystone_config('ldap/role_attribute_ignore').with_value('description')
 148       is_expected.to contain_keystone_config('ldap/role_allow_create').with_value('True')
 149       is_expected.to contain_keystone_config('ldap/role_allow_update').with_value('True')
 150       is_expected.to contain_keystone_config('ldap/role_allow_delete').with_value('True')
 151       is_expected.to contain_keystone_config('ldap/role_additional_attribute_mapping').with_value('')
 152
 153       # groups
 154       is_expected.to contain_keystone_config('ldap/group_tree_dn').with_value('ou=groups,ou=openstack,dc=example,dc=com')
 155       is_expected.to contain_keystone_config('ldap/group_filter').with_value('cn=enabled-groups,cn=groups,cn=accounts,dc=example,dc=com')
 156       is_expected.to contain_keystone_config('ldap/group_objectclass').with_value('organizationalRole')
 157       is_expected.to contain_keystone_config('ldap/group_id_attribute').with_value('cn')
 158       is_expected.to contain_keystone_config('ldap/group_member_attribute').with_value('roleOccupant')
 159       is_expected.to contain_keystone_config('ldap/group_desc_attribute').with_value('description')
 160       is_expected.to contain_keystone_config('ldap/group_name_attribute').with_value('cn')
 161       is_expected.to contain_keystone_config('ldap/group_attribute_ignore').with_value('')
 162       is_expected.to contain_keystone_config('ldap/group_allow_create').with_value('False')
 163       is_expected.to contain_keystone_config('ldap/group_allow_update').with_value('False')
 164       is_expected.to contain_keystone_config('ldap/group_allow_delete').with_value('False')
 165       is_expected.to contain_keystone_config('ldap/group_additional_attribute_mapping').with_value('')
 166
 167       # tls
 168       is_expected.to contain_keystone_config('ldap/use_tls').with_value('False')
 169       is_expected.to contain_keystone_config('ldap/tls_cacertdir').with_value('/etc/ssl/certs/')
 170       is_expected.to contain_keystone_config('ldap/tls_cacertfile').with_value('/etc/ssl/certs/ca-certificates.crt')
 171       is_expected.to contain_keystone_config('ldap/tls_req_cert').with_value('demand')
 172
 173       # ldap pooling
 174       is_expected.to contain_keystone_config('ldap/use_pool').with_value('True')
 175       is_expected.to contain_keystone_config('ldap/pool_size').with_value('20')
 176       is_expected.to contain_keystone_config('ldap/pool_retry_max').with_value('2')
 177       is_expected.to contain_keystone_config('ldap/pool_retry_delay').with_value('0.2')
 178       is_expected.to contain_keystone_config('ldap/pool_connection_timeout').with_value('222')
 179       is_expected.to contain_keystone_config('ldap/pool_connection_lifetime').with_value('222')
 180       is_expected.to contain_keystone_config('ldap/use_auth_pool').with_value('True')
 181       is_expected.to contain_keystone_config('ldap/auth_pool_size').with_value('20')
 182       is_expected.to contain_keystone_config('ldap/auth_pool_connection_lifetime').with_value('200')
 183
 184       # drivers
 185       is_expected.to contain_keystone_config('identity/driver').with_value('keystone.identity.backends.ldap.Identity')
 186       is_expected.to contain_keystone_config('credential/driver').with_value('keystone.credential.backends.ldap.Credential')
 187       is_expected.to contain_keystone_config('assignment/driver').with_value('keystone.assignment.backends.ldap.Assignment')
 188     end
 189   end
 190
 191   describe 'with deprecated params' do
 192     let :params do
 193       {
 194         :tenant_tree_dn => 'ou=projects,ou=openstack,dc=example,dc=com',
 195         :tenant_filter => '',
 196         :tenant_objectclass => 'organizationalUnit',
 197         :tenant_id_attribute => 'ou',
 198         :tenant_member_attribute => 'member',
 199         :tenant_desc_attribute => 'description',
 200         :tenant_name_attribute => 'ou',
 201         :tenant_enabled_attribute => 'enabled',
 202         :tenant_domain_id_attribute => 'businessCategory',
 203         :tenant_attribute_ignore => '',
 204         :tenant_allow_create => 'True',
 205         :tenant_allow_update => 'True',
 206         :tenant_allow_delete => 'True',
 207         :tenant_enabled_emulation => 'False',
 208         :tenant_enabled_emulation_dn => 'True',
 209         :tenant_additional_attribute_mapping => 'cn=enabled,ou=openstack,dc=example,dc=com',
 210       }
 211     end
 212     it 'should work with deprecated params' do
 213       is_expected.to contain_keystone_config('ldap/project_tree_dn').with_value('ou=projects,ou=openstack,dc=example,dc=com')
 214       is_expected.to contain_keystone_config('ldap/project_filter')
 215       is_expected.to contain_keystone_config('ldap/project_objectclass').with_value('organizationalUnit')
 216       is_expected.to contain_keystone_config('ldap/project_id_attribute').with_value('ou')
 217       is_expected.to contain_keystone_config('ldap/project_member_attribute').with_value('member')
 218       is_expected.to contain_keystone_config('ldap/project_desc_attribute').with_value('description')
 219       is_expected.to contain_keystone_config('ldap/project_name_attribute').with_value('ou')
 220       is_expected.to contain_keystone_config('ldap/project_enabled_attribute').with_value('enabled')
 221       is_expected.to contain_keystone_config('ldap/project_domain_id_attribute').with_value('businessCategory')
 222       is_expected.to contain_keystone_config('ldap/project_attribute_ignore')
 223       is_expected.to contain_keystone_config('ldap/project_allow_create').with_value('True')
 224       is_expected.to contain_keystone_config('ldap/project_allow_update').with_value('True')
 225       is_expected.to contain_keystone_config('ldap/project_allow_delete').with_value('True')
 226       is_expected.to contain_keystone_config('ldap/project_enabled_emulation').with_value('False')
 227       is_expected.to contain_keystone_config('ldap/project_enabled_emulation_dn').with_value('True')
 228       is_expected.to contain_keystone_config('ldap/project_additional_attribute_mapping').with_value('cn=enabled,ou=openstack,dc=example,dc=com')
 229     end
 230   end
 231
 232   describe 'with deprecated and new params both set' do
 233     let :params do
 234       {
 235         :tenant_tree_dn  => 'ou=projects,ou=old-openstack,dc=example,dc=com',
 236         :project_tree_dn => 'ou=projects,ou=new-openstack,dc=example,dc=com',
 237       }
 238     end
 239
 240     it_raises 'a Puppet::Error', /tenant_tree_dn and project_tree_dn are both set. results may be unexpected/
 241   end
 242 end