Test Day:2013-05-09 SSSD Improvements and AD Integration

Fedora 19 Test Days
Enterprise accounts
Date	2013-05-09
Time	all day
Website	realmd SSSD project, Feature page
IRC	#sssd (webirc, #fedora-test-day (webirc))

Can't make the date?
If you come to this page before or after the test day is completed, your testing is still valuable, and you can use the information on this page to test, file any bugs you find, and add your results to the results section.

What to test?

Today's Test Day will be focused on new features related to using enterprise accounts (coming from either Active Directory or FreeIPA), in particular realmd and adcli to join a machine to a domain and sssd to handle authentication and other related tasks.

Who's available

• Development: Stef Walter (stefw, realmd/adcli dev), Jakub Hrozek (jhrozek, sssd dev)
• Quality Assurance: Patrik Kis (pkis), Davis Spurek (dspurek), Kaushik Banerjee (kaushik)

Prerequisite for Test Day

• You may download a non-destructive Fedora 19 live image for your architecture. Tips on using a live image are available at FedoraLiveCD.

Architecture	SHA256SUM
x86_64	720f0cb153aac8ae2e55629ec4a50e1c3f53a5fbe4b2ce65f1d6792b15af94b0
i686	29d7de49bd77760299924f90e9f732d60892766ff32318f5fac5dcbb4089073e

• If you don't want to use the LiveCD, you can use an updated Fedora 19 pre-release
  • Make sure that the following components are installed:
    • adcli-0.7-1.fc19
    • realmd-0.14.0-1.fc19
    • sssd-1.10.0-4.fc19.beta1
    • selinux-policy-3.12.1-42.fc19
• A server to test against. Most test cases require an Active Directory domain, other tests require a FreeIPA server. Don't worry if you don't have both, any involvement in the test day is much appreciated!
• Domain user account or administrator account on the given Active Directory domain. See table below for which test cases require which privileges.
• If you are on Red Hat internal network you can test against our internal Test Bed: Test Day:2013-05-09 Red Hat Test Bed. Please note that the Test Bad doesn't have all capabilities which are required to run all test cases. While all test cases which requires administrator privileges and posix users are supported, the test cases with privileges listed below can't be run against the Test Bad (please skip them). In some cases you might need to contact the Test Bed admins to perform some special configuration; please contact pkis or dspurek.

How to test

At a high level the following are being tested:

• realmd used together with Active Directory or FreeIPA
• adcli used together with Active Directory
• latest Kerberos improvements
• sssd used together with Active Directory or FreeIPA

You can explore these, and their documentation. Or you can follow the test cases below.

There are many test cases, if you don't have a particular area of special interest, start from the top. The most common and simpler scenarios are generally in the earlier test cases.

All tests should pass with SELinux in enforcing mode unless otherwise specified.

Tests: Kerberos

These are tests that test basic kerberos functionality, including fixes that have been worked on to make using kerberos less brittle. Perform prerequisite setup before you run these tests.

Testcase	Description	Privileges	Duration
noconf	Using Active Directory without krb5.conf	Any	5 minutes
clocks	Kerberos client with unsynced clocks	Any	5 minutes
rdns	Kerberos client without reverse DNS	Any	5 minutes

File bugs for these test cases in the Red Hat bugzilla, and record results below.

User	noconf	clocks	rdns	References
Sample User	pass	none	fail
stefw	pass	pass	pass
dspurek	pass	fail
kaushik	pass	fail	pass
okos	pass	pass	pass
omoris	pass	pass	pass
pkis	fail	fail	pass
alich	fail	pass	pass
ksrot	pass	fail	pass
jjaburek	pass	pass	pass
yelley	pass	pass	none
spoore	pass	pass	pass
lnovy	pass	pass	pass

 

 

 

 

Tests: Basics of sssd and realmd

These tests cover the basics of realmd being used for configuring domain authentication, and sssd providing that authentication.

Testcase	Description	Privileges	Duration
discover domain	Using realmd to discover information about an Active Directory domain	Any	5 minutes
discover server	Using realmd to discover information about an Active Directory server	Any	5 minutes
join domain	Using realmd to join a domain using standard options and configure sssd	Admin account	15 minutes
leave domain	Using realmd to leave a domain and deconfigure sssd	Any	10 minutes
join otp	Using realmd to join a domain using a one time password	Admin account	15 minutes
leave remove	Using realmd to leave a domain, removing the computer account, and deconfigure sssd	Any	10 minutes
login domain	After joining a domain, log in using domain credentials	User and admin account	10 minutes
dns update	Verifies an AD client is able to update its DNS record.	Joined to a domain	20 minutes

Please file bugs in the Red Hat bugzilla, and create a table line below for your test results.

User	discover domain	discover server	join domain	leave domain	join otp	leave remove	login domain	dns update	References
Sample User	none	pass	warn	fail	none	none	none	none
stefw	warn	pass	warn	pass	warn	warn	fail	warn
dspurek	pass	pass	pass	pass	pass	pass	fail	fail
okos	warn	pass	warn	pass	warn	warn	fail	none
Kaushik	warn	pass	pass	pass	pass	pass	fail	none
omoris	pass	pass	pass	pass	pass	pass	fail	none
pkis	warn	pass	warn	pass	pass	pass	fail	fail
jjaburek	pass	pass	pass	pass	pass	warn	warn	none
ksrot	pass	pass	fail	pass	none	pass	none	none
yelley	pass	pass	pass	pass	pass	pass	none	none
alich	warn	pass	warn	pass	warn	pass	warn	none
spoore	pass	pass	pass	pass	pass	pass	warn	pass
lnovy	pass	pass	fail	pass	pass	pass	pass	pass

 

 

 

 

Tests: Integration of realmd

These tests test integration of realmd with several of its clients and callers. Each test has a few extra or differing requirements, which you should be on the lookout for in the setup section of the test.

Testcase	Description	Privileges	Duration
kickstart	Use anaconda and kickstart to join a domain during installation.	Admin account	45 minutes
control center	Use control center to add an Enterprise Login from a domain.	User or admin account	20 minutes
gdm screen	Check the GDM login screen domain hints	Joined to a domain	10 minutes
openlmi	Use the OpenLMI realmd CIM provider to join a domain	Admin account	30 minutes

Please file bugs in the Red Hat bugzilla, and create a table line below for your test results. Bugs will be reassigned when appropriate to other components.

User	kickstart	control center	gdm screen	openlmi	References
Sample User	none	pass	warn	fail
stefw	pass	warn	warn	fail
okos	none	none	pass	none
pkis	warn	warn	pass	pass
spoore	pass	none	none	none
dspurek	none	pass	warn	pass
yelley	fail	none	none	pass
lnovy	fail	pass	pass	pass

 

 

 

 

Advanced Tests: sssd and realmd

These are additional advanced tests which could be completed after the above, these go into further detail about various aspects of sssd and realmd usage. As each test requires that you have access to Active Directory, you can through that prerequisite setup before you start.

Testcase	Description	Privileges	Duration
site disco	Verifies an AD client is able to connect to a particular DNS site as defined on the AD server	Requires a joined client	20 minutes
netbios disco	This test case verifies an Active Directory client is able to discover the NetBIOS name automatically	Requires a joined client	15 minutes
login any	Allow any domain user to log into local machine	User and admin account	15 minutes
login withdraw	Withdraw access to a user to log into the machine	User and admin account	15 minutes
deny any	Deny any domain logins to the machine	User and admin account	15 minutes
join ccache	Join the current machine to an Active Directory domain using kerberos credentials already acquired before the join.	Administrator	10 minutes
join osinfo	Join the current machine to an Active Directory, and set the operating system name and version of the account.	Administrator	10 minutes
join packages	Join the current machine to an Active Directory, and prevent automatic installation of packages.	Administrator	10 minutes
join names	Join the current machine to an Active Directory, without using fully qualified user names.	Administrator	10 minutes
join posix	Join the current machine to an Active Directory, but use the POSIX attributes in the directory.	Administrator or user with posix attributes	10 minutes
join server	Join the current machine to an Active Directory, manually specifying the domain server you want to join against.	Administrator	10 minutes
join upn	Join the current machine to an Active Directory, while creating a userPrincipalName.	Administrator	10 minutes

Bugs can be filed in the Red Hat bugzilla for sssd or realmd components. Please create a row in the table below for your testing.

User	site disco	netbios disco	login any	login withdraw	deny any	join ccache	join osinfo	join packages	join names	join posix	join server	join upn	References
Sample User	none	pass	warn	fail	none	none	none	none	none	none	none	none
stefw	warn	warn	none	none	none	pass	pass	pass	pass	pass	pass	pass
dspurek	pass	pass	none	none	none	pass	fail	pass	warn	pass	fail	warn
kaushik	pass	pass	none	none	pass	pass	pass	none	none	none	none	none
yelley	none	pass	none	none	none	pass	none	fail	fail	none	fail	fail
spoore	pass	pass	pass	pass	pass	pass	pass	pass	pass	pass	fail	warn
pkis	pass	pass	warn	warn	warn	pass	pass	pass	warn	pass	pass	pass
lnovy	pass	pass	warn	warn	warn	warn	warn	pass	pass	pass	pass	pass

 

 

 

 

Advanced Tests: adcli

adcli is a component that realmd uses to talk to Active Directory.

To run these test cases you need to fulfill these prerequisites. In addition, further for using adcli with complex domains.

Testcase	Description	Privileges	Approx. time required
info domain	This test case retrieves basic information about a domain.	Any	5 minutes
info server	This test case retrieves basic information about a domain controller and the domain it is a part of.	Any	5 minutes
join simple	This test case verifies that adcli join works with basic options.	Administrator	5 minutes
join nodns	his test case verifies that adcli join can work without DNS.	Administrator	5 minutes
preset auto	This test case precreates accounts in the domain using adcli join, using the default automatic 'reset' computer account password.	Administrator	5 minutes
preset otp	This test case precreates accounts in the domain using adcli join.	Administrator	5 minutes

Please file bugs in the Red Hat bugzilla, and create a table line below for your test results.

User	info domain	info server	join simple	join nodns	preset auto	preset otp	References
Sample User	none	pass	warn	fail	none	none
dspurek	pass	pass	pass	pass	pass	pass
User:okos	pass	pass	pass	pass	pass	pass
jjaburek	pass	pass	pass	pass	pass	pass
stefw	pass	pass	pass	pass	fail	fail
yelley	pass	pass	pass	pass	pass	pass
spoore	pass	pass	pass	pass	pass	pass
pkis	pass	pass	pass	pass	pass	pass
lnovy	pass	pass	pass	pass	pass	pass

 

 

 

 

Advanced Tests: With FreeIPA

Testcase	Description	Privileges	Approx. time required
join	Join a client machine to a domain	admin	10 minutes
login	Log in using FreeIPA credentials, both online and offline	admin	15 minutes
sudo	Test FreeIPA's sudo management capabilities	admin	10 minutes
ssh	Verify FreeIPA's SSH public key management	admin	20 minutes
automount	Test FreeIPA's automounter maps management	admin	20 minutes
leave	Leave a FreeIPA domain by deconfiguring it locally.	Any	5 minutes

• realmd bugzilla
• Red Hat bugzilla
• SSSD Trac

User	FreeIPA join	FreeIPA login	sudo	FreeIPA SSH	FreeIPA automount	FreeIPA control center	FreeIPA leave	References
Sample User	none	pass	none	warn	fail	none	none
Steeve	pass	pass	pass	pass	fail	none	fail
okos	none	none	none	none	none	none	none
stefw	none	none	none	none	none	none	fail
spoore	pass	pass	pass	pass	none	none	none
pkis	pass	pass	pass	pass	none	pass	pass
dspurek	pass	pass	pass	none	none	pass	pass
lnovy	pass	pass	pass	pass	none	pass	pass