From Fedora Project Wiki

No edit summary
m (Add cacert instructions)
 
(2 intermediate revisions by 2 users not shown)
Line 1: Line 1:
{{QA/Test_Case
{{QA/Test_Case
|description= This test is designed to validate the feature [[Features/SSSDByDefault]].  The test involves configuring a system for LDAP identity and authentication, and performing several actions on the system.
|description= This test is designed to validate the feature [[Features/SSSDByDefault]].  The test requires an existing LDAP server to perform several identity and authentication actions.
{{admon/tip|Testing for the SSSD by Default Test Day?|If you are testing during the [[Test_Day:2010-03-30_SSSDByDefault|SSSD by Default Test Day]], you may use the server information provided on the [[Test_Day:2010-03-30_SSSDByDefault|test day wiki]].  Otherwise, you will need a LDAP server to connect with to perform this test.}}
{{admon/tip|Testing for the SSSD by Default Test Day?|If you are testing during the [[Test_Day:2010-03-30_SSSDByDefault|SSSD by Default Test Day]], you may use the server information provided on the [[Test_Day:2010-03-30_SSSDByDefault|test day wiki]].  Otherwise, you will need a LDAP server to connect with to perform this test.}}


Line 8: Line 8:
#: rm -f /etc/sysconfig/firstboot
#: rm -f /etc/sysconfig/firstboot
#: /sbin/chkconfig firstboot on</pre>
#: /sbin/chkconfig firstboot on</pre>
# At firstboot, proceed to the ''Create User'' step and select ''Use Network Login...'' to start the ''Authentication Configuration''
# At firstboot, proceed to the ''Create User'' step and select ''Use Network Login...'' to start the ''Authentication Configuration'' (see [[:Image:Screenshot-firstboot.png]])
[[Image:Screenshot-firstboot.png]]
# In the ''Authentication Configuration'' application, under the ''Identity & Authentication'' tab set '''User Account Database''' to '''LDAP''' and make the configuration changes listed below.   
# In the ''Authentication Configuration'' application, under the ''Identity & Authentication'' tab set '''User Account Database''' to '''LDAP''' and make the configuration changes listed below.   
#* Enter a valid ''Search Base DN''
#* Enter a valid ''Search Base DN''
#* Enter a LDAP server in the field ''Server''.  Use the format <code>ldaps://my.ldap.server</code>
#* Enter a LDAP server in the field ''Server''.  Use the format <code>ldaps://my.ldap.server</code>
# Also in the ''Authentication Configuration'' application, under the ''Identity & Authentication'' tab set '''Authentication Method''' to '''LDAP password'''. 
#* Select ''Download CA Certificate...'' and enter the certificate URL
 
# Also in the ''Authentication Configuration'' application, under the ''Identity & Authentication'' tab set '''Authentication Method''' to '''LDAP password''' (see [[:Image:Screenshot-LDAP Authentication Configuration.png]])
[[Image:Screenshot-LDAP Authentication Configuration.png]]
 
# Click on the '''Advanced Options''' and enable '''Create home directories on the first login'''.
[[Image:Screenshot-Advanced Options.png]]
 
# When finished, select ''Apply'' and complete the remaining steps in {{command|firstboot}} as desired.
# When finished, select ''Apply'' and complete the remaining steps in {{command|firstboot}} as desired.
# When the graphical login screen appears, login to the system using a valid LDAP username and password.
# When the graphical login screen appears, login to the system using a valid LDAP username and password.
Line 52: Line 46:
# The commands {{command|getent}} and {{command|finger}} return information about LDAP users.  Sample output appears below.
# The commands {{command|getent}} and {{command|finger}} return information about LDAP users.  Sample output appears below.
#: <pre>
#: <pre>
#: getent -s sss passwd puser1
#: getent passwd sssdtest10001
#: puser1:*:1001:1001::/export/puser1:
#: sssdtest10001:*:10001:20001:SSSD 10001 test user:/home/sssdtest10001:/bin/bash
#:  
#:  
#: finger -s puser1
#: finger sssdtest10001
#: Login     Name       Tty      Idle  Login Time  Office    Office Phone
#: Login: sssdtest10001  Name: SSSD 10001 test user
#: puser1              pts/2          Mar 29 11:04 (localhost)
#: Directory: /home/sssdtest10001      Shell: /bin/bash
#: On since Mon Mar 29 15:57 (IST) on pts/2 from localhost
#: </pre>
#: </pre>
# Whether using a graphical utility, or the command {{command|passwd}}, the password is successfully changed
# Whether using a graphical utility, or the command {{command|passwd}}, the password is successfully changed

Latest revision as of 15:28, 30 March 2010

Description

This test is designed to validate the feature Features/SSSDByDefault. The test requires an existing LDAP server to perform several identity and authentication actions.

Testing for the SSSD by Default Test Day?
If you are testing during the SSSD by Default Test Day, you may use the server information provided on the test day wiki. Otherwise, you will need a LDAP server to connect with to perform this test.


How to test

  1. Prepare your system by configuring firstboot to start on boot. As an authorized user, run the commands listed below. Once complete, reboot your system. 
    

    rm -f /etc/sysconfig/firstboot
    

    /sbin/chkconfig firstboot on
    2. 

  2. At firstboot, proceed to the Create User step and select Use Network Login... to start the Authentication Configuration (see Image:Screenshot-firstboot.png)
    3. 

  3. In the Authentication Configuration application, under the Identity & Authentication tab set User Account Database to LDAP and make the configuration changes listed below.

    • Enter a valid Search Base DN
      • 

    • Enter a LDAP server in the field Server.  Use the format ldaps://my.ldap.server
      • 

    • Select Download CA Certificate... and enter the certificate URL
    4. 

  4. Also in the Authentication Configuration application, under the Identity & Authentication tab set Authentication Method to LDAP password (see Image:Screenshot-LDAP Authentication Configuration.png)
    5. 

  5. When finished, select Apply and complete the remaining steps in firstboot as desired.
    6. 

  6. When the graphical login screen appears, login to the system using a valid LDAP username and password.
    7. 

  7. Open a terminal application, and check whether you can query for information about other LDAP users.  For example, if using the Test Day login information you might run a commands similar to:

    

    getent passwd sssdtest10002
    

    getent group sssdgroup20002
    

    finger sssdtest10002
    8. 

  8. Change the password for the logged in LDAP user.  This can be accomplished by starting System → Preferences → About me, then selecting Change Password.  Or you can run the command passwd from a terminal application.  After changing the password, logout of the desktop.
    9. 

  9. Let's confirm the password change by logging into using the same LDAP user, but with the new password.  Once logged in, use the same procedure to revert the LDAP user password to the original value.
    10. 

  10. Finally, login to your system over the network.  For example, use ssh to login to your local system by typing: 
    ssh $USER@localhost


Expected Results


  1. Firstboot is configured to start without error
    2. 

  2. and starts on boot
    3. 

  3. The Authentication Configuration application starts and completes without error
    4. 

  4. The Authentication Configuration writes configuration information to /etc/sssd/sssd.conf that includes the following details:

    

    [domain/default]
    

    ldap_id_use_start_tls = False
    

    cache_credentials = True
    

    ldap_search_base = dc=example,dc=com
    

    krb5_realm = EXAMPLE.COM
    

    chpass_provider = ldap
    

    id_provider = ldap
    

    auth_provider = ldap
    

    debug_level = 0
    

    min_id = 1000
    

    ldap_uri = ldaps://publictest9.fedoraproject.org/
    

    krb5_kdcip = kerberos.example.com
    

    5. 

  5. Login to the graphical desktop is successful using a valid LDAP username and password
    6. 

  6. The commands getent and finger return information about LDAP users.  Sample output appears below.

    

    getent passwd sssdtest10001
    

    sssdtest10001:*:10001:20001:SSSD 10001 test user:/home/sssdtest10001:/bin/bash
    

    

    finger sssdtest10001
    

    Login: sssdtest10001  			Name: SSSD 10001 test user
    

    Directory: /home/sssdtest10001      	Shell: /bin/bash
    

    On since Mon Mar 29 15:57 (IST) on pts/2 from localhost
    

    7. 

  7. Whether using a graphical utility, or the command passwd, the password is successfully changed
    8. 

  8. The new password is accepted when logging into the desktop
    9. 

  9. You are able to login to your system using a remote shell command such as ssh
Retrieved from "https://fedoraproject.org/w/index.php?title=QA:Testcase_SSSD_LDAP_Identity_and_LDAP_Authentication&oldid=162446"