Latest revision as of 23:20, 17 July 2018

Associated release criterion
This test case is associated with the Fedora_42_Final_Release_Criteria#domain-access-control release criterion. If you are doing release validation testing, a failure of this test case may be a breach of that release criterion. If so, please file a bug and nominate it as blocking the appropriate milestone, using the blocker bug nomination page.

Description

This test case checks that a system enrolled in a FreeIPA domain honors the domain controller's host-based access control (HBAC) rules.

Deploy a correctly-configured FreeIPA domain controller. You can follow:
QA:Testcase_Server_role_deploy with the Domain Controller role to deploy a FreeIPA domain controller on Fedora 28 or earlier

QA:Testcase_freeipa_trust_server_installation to deploy a FreeIPA domain controller on Fedora 29 or later
Enrol a test system in the domain. There are various ways to do this. You will find several test cases you can follow in the Server release validation test cases, FreeIPA test cases, and Realmd test cases
The intent here is to set up an HBAC rule which specifies that all access is prohibited, unless it is initiated by a specific user ("testuser")
Make sure you have freeipa-admintools installed
```
# yum install freeipa-admintools
```

Create a FreeIPA user (after acquiring admin credentials)

$ kinit admin

$ ipa user-add testuser --first test --last user --password

Create an HBAC rule that allows access to the user you just created

$ ipa hbacrule-add testrule --servicecat=all --hostcat=all

$ ipa hbacrule-add-user testrule --users=testuser

Disable the default rule that allows access to everyone
```
$ ipa hbacrule-disable allow_all
```
On the system that joined the domain, change the testuser password for the first time.
```
$ kinit testuser@IPA.EXAMPLE.ORG
```
You will be prompted to enter a new password here

On the system that joined the domain, switch to another VT (press Ctrl-Alt-F4).
Try to log in as the admin user.
```
host login: admin@ipa.example.org
```
Now try to log in as test user.
```
host login: testuser@ipa.example.org
```

Enable the allow_all rule again to avoid interference with other tests:

$ kinit admin
$ ipa hbacrule-enable allow_all

@@ Line 1: / Line 1: @@
-{{Template:Associated_release_criterion|Beta|domain-access-control}}
+{{Template:Associated_release_criterion|Final|domain-access-control}}
 {{QA/Test_Case
 |description=This test case checks that a system enrolled in a FreeIPA domain honors the domain controller's host-based access control (HBAC) rules.
 |setup=
-{{FreeIPA server client setup}}
+{{Domain server setup|ad=0}}
+{{Domain client setup|ad=0}}
 # The intent here is to set up an HBAC rule which specifies that all access is prohibited, unless it is initiated by a specific user ("testuser")
 # Make sure you have freeipa-admintools installed