| # Licensed under the Apache License, Version 2.0 (the "License"); you may |
| # not use this file except in compliance with the License. You may obtain |
| # a copy of the License at |
| # |
| # http://www.apache.org/licenses/LICENSE-2.0 |
| # |
| # Unless required by applicable law or agreed to in writing, software |
| # distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
| # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the |
| # License for the specific language governing permissions and limitations |
| # under the License. |
| |
| import datetime |
| import re |
| |
| from oslo_utils import timeutils |
| from tempest_lib import exceptions as lib_exc |
| |
| from tempest.api.identity import base |
| from tempest import clients |
| from tempest.common import cred_provider |
| from tempest.common.utils import data_utils |
| from tempest import config |
| from tempest import test |
| |
| CONF = config.CONF |
| |
| |
| class BaseTrustsV3Test(base.BaseIdentityV3AdminTest): |
| |
| def setUp(self): |
| super(BaseTrustsV3Test, self).setUp() |
| # Use alt_username as the trustee |
| if not CONF.identity_feature_enabled.trust: |
| raise self.skipException("Trusts aren't enabled") |
| |
| self.trustee_username = CONF.identity.alt_username |
| self.trust_id = None |
| |
| def tearDown(self): |
| if self.trust_id: |
| # Do the delete in tearDown not addCleanup - we want the test to |
| # fail in the event there is a bug which causes undeletable trusts |
| self.delete_trust() |
| super(BaseTrustsV3Test, self).tearDown() |
| |
| def create_trustor_and_roles(self): |
| # create a project that trusts will be granted on |
| self.trustor_project_name = data_utils.rand_name(name='project') |
| project = self.client.create_project(self.trustor_project_name, |
| domain_id='default') |
| self.trustor_project_id = project['id'] |
| self.assertIsNotNone(self.trustor_project_id) |
| |
| # Create a trustor User |
| self.trustor_username = data_utils.rand_name('user') |
| u_desc = self.trustor_username + 'description' |
| u_email = self.trustor_username + '@testmail.xx' |
| self.trustor_password = data_utils.rand_name('pass') |
| user = self.client.create_user( |
| self.trustor_username, |
| description=u_desc, |
| password=self.trustor_password, |
| email=u_email, |
| project_id=self.trustor_project_id, |
| domain_id='default') |
| self.trustor_user_id = user['id'] |
| |
| # And two roles, one we'll delegate and one we won't |
| self.delegated_role = data_utils.rand_name('DelegatedRole') |
| self.not_delegated_role = data_utils.rand_name('NotDelegatedRole') |
| |
| role = self.client.create_role(self.delegated_role) |
| self.delegated_role_id = role['id'] |
| |
| role = self.client.create_role(self.not_delegated_role) |
| self.not_delegated_role_id = role['id'] |
| |
| # Assign roles to trustor |
| self.client.assign_user_role(self.trustor_project_id, |
| self.trustor_user_id, |
| self.delegated_role_id) |
| self.client.assign_user_role(self.trustor_project_id, |
| self.trustor_user_id, |
| self.not_delegated_role_id) |
| |
| # Get trustee user ID, use the demo user |
| trustee_username = self.non_admin_client.user |
| self.trustee_user_id = self.get_user_by_name(trustee_username)['id'] |
| self.assertIsNotNone(self.trustee_user_id) |
| |
| # Initialize a new client with the trustor credentials |
| creds = cred_provider.get_credentials( |
| identity_version='v3', |
| username=self.trustor_username, |
| password=self.trustor_password, |
| user_domain_id='default', |
| tenant_name=self.trustor_project_name, |
| project_domain_id='default') |
| os = clients.Manager(credentials=creds) |
| self.trustor_client = os.identity_v3_client |
| |
| def cleanup_user_and_roles(self): |
| if self.trustor_user_id: |
| self.client.delete_user(self.trustor_user_id) |
| if self.trustor_project_id: |
| self.client.delete_project(self.trustor_project_id) |
| if self.delegated_role_id: |
| self.client.delete_role(self.delegated_role_id) |
| if self.not_delegated_role_id: |
| self.client.delete_role(self.not_delegated_role_id) |
| |
| def create_trust(self, impersonate=True, expires=None): |
| |
| trust_create = self.trustor_client.create_trust( |
| trustor_user_id=self.trustor_user_id, |
| trustee_user_id=self.trustee_user_id, |
| project_id=self.trustor_project_id, |
| role_names=[self.delegated_role], |
| impersonation=impersonate, |
| expires_at=expires) |
| self.trust_id = trust_create['id'] |
| return trust_create |
| |
| def validate_trust(self, trust, impersonate=True, expires=None, |
| summary=False): |
| self.assertIsNotNone(trust['id']) |
| self.assertEqual(impersonate, trust['impersonation']) |
| if expires is not None: |
| # Omit microseconds component of the expiry time |
| trust_expires_at = re.sub(r'\.([0-9]){6}', '', trust['expires_at']) |
| self.assertEqual(expires, trust_expires_at) |
| else: |
| self.assertIsNone(trust['expires_at']) |
| self.assertEqual(self.trustor_user_id, trust['trustor_user_id']) |
| self.assertEqual(self.trustee_user_id, trust['trustee_user_id']) |
| self.assertIn('v3/OS-TRUST/trusts', trust['links']['self']) |
| self.assertEqual(self.trustor_project_id, trust['project_id']) |
| if not summary: |
| self.assertEqual(self.delegated_role, trust['roles'][0]['name']) |
| self.assertEqual(1, len(trust['roles'])) |
| |
| def get_trust(self): |
| trust_get = self.trustor_client.get_trust(self.trust_id) |
| return trust_get |
| |
| def validate_role(self, role): |
| self.assertEqual(self.delegated_role_id, role['id']) |
| self.assertEqual(self.delegated_role, role['name']) |
| self.assertIn('v3/roles/%s' % self.delegated_role_id, |
| role['links']['self']) |
| self.assertNotEqual(self.not_delegated_role_id, role['id']) |
| self.assertNotEqual(self.not_delegated_role, role['name']) |
| self.assertNotIn('v3/roles/%s' % self.not_delegated_role_id, |
| role['links']['self']) |
| |
| def check_trust_roles(self): |
| # Check we find the delegated role |
| roles_get = self.trustor_client.get_trust_roles( |
| self.trust_id) |
| self.assertEqual(1, len(roles_get)) |
| self.validate_role(roles_get[0]) |
| |
| role_get = self.trustor_client.get_trust_role( |
| self.trust_id, self.delegated_role_id) |
| self.validate_role(role_get) |
| |
| role_get = self.trustor_client.check_trust_role( |
| self.trust_id, self.delegated_role_id) |
| |
| # And that we don't find not_delegated_role |
| self.assertRaises(lib_exc.NotFound, |
| self.trustor_client.get_trust_role, |
| self.trust_id, |
| self.not_delegated_role_id) |
| |
| self.assertRaises(lib_exc.NotFound, |
| self.trustor_client.check_trust_role, |
| self.trust_id, |
| self.not_delegated_role_id) |
| |
| def delete_trust(self): |
| self.trustor_client.delete_trust(self.trust_id) |
| self.assertRaises(lib_exc.NotFound, |
| self.trustor_client.get_trust, |
| self.trust_id) |
| self.trust_id = None |
| |
| |
| class TrustsV3TestJSON(BaseTrustsV3Test): |
| |
| def setUp(self): |
| super(TrustsV3TestJSON, self).setUp() |
| self.create_trustor_and_roles() |
| self.addCleanup(self.cleanup_user_and_roles) |
| |
| @test.idempotent_id('5a0a91a4-baef-4a14-baba-59bf4d7fcace') |
| def test_trust_impersonate(self): |
| # Test case to check we can create, get and delete a trust |
| # updates are not supported for trusts |
| trust = self.create_trust() |
| self.validate_trust(trust) |
| |
| trust_get = self.get_trust() |
| self.validate_trust(trust_get) |
| |
| self.check_trust_roles() |
| |
| @test.idempotent_id('ed2a8779-a7ac-49dc-afd7-30f32f936ed2') |
| def test_trust_noimpersonate(self): |
| # Test case to check we can create, get and delete a trust |
| # with impersonation=False |
| trust = self.create_trust(impersonate=False) |
| self.validate_trust(trust, impersonate=False) |
| |
| trust_get = self.get_trust() |
| self.validate_trust(trust_get, impersonate=False) |
| |
| self.check_trust_roles() |
| |
| @test.idempotent_id('0ed14b66-cefd-4b5c-a964-65759453e292') |
| def test_trust_expire(self): |
| # Test case to check we can create, get and delete a trust |
| # with an expiry specified |
| expires_at = timeutils.utcnow() + datetime.timedelta(hours=1) |
| # NOTE(ylobankov) In some cases the expiry time may be rounded up |
| # because of microseconds. In fact, it depends on database and its |
| # version. At least MySQL 5.6.16 does this. |
| # For example, when creating a trust, we will set the expiry time of |
| # the trust to 2015-02-17T17:34:01.907051Z. However, if we make a GET |
| # request on the trust, the response will contain the time rounded up |
| # to 2015-02-17T17:34:02.000000Z. That is why we shouldn't set flag |
| # "subsecond" to True when we invoke timeutils.isotime(...) to avoid |
| # problems with rounding. |
| expires_str = timeutils.isotime(at=expires_at) |
| |
| trust = self.create_trust(expires=expires_str) |
| self.validate_trust(trust, expires=expires_str) |
| |
| trust_get = self.get_trust() |
| |
| self.validate_trust(trust_get, expires=expires_str) |
| |
| self.check_trust_roles() |
| |
| @test.idempotent_id('3e48f95d-e660-4fa9-85e0-5a3d85594384') |
| def test_trust_expire_invalid(self): |
| # Test case to check we can check an invlaid expiry time |
| # is rejected with the correct error |
| # with an expiry specified |
| expires_str = 'bad.123Z' |
| self.assertRaises(lib_exc.BadRequest, |
| self.create_trust, |
| expires=expires_str) |
| |
| @test.idempotent_id('6268b345-87ca-47c0-9ce3-37792b43403a') |
| def test_get_trusts_query(self): |
| self.create_trust() |
| trusts_get = self.trustor_client.get_trusts( |
| trustor_user_id=self.trustor_user_id) |
| self.assertEqual(1, len(trusts_get)) |
| self.validate_trust(trusts_get[0], summary=True) |
| |
| @test.attr(type='smoke') |
| @test.idempotent_id('4773ebd5-ecbf-4255-b8d8-b63e6f72b65d') |
| def test_get_trusts_all(self): |
| self.create_trust() |
| trusts_get = self.client.get_trusts() |
| trusts = [t for t in trusts_get |
| if t['id'] == self.trust_id] |
| self.assertEqual(1, len(trusts)) |
| self.validate_trust(trusts[0], summary=True) |