nixos/tests/kanidm.nix

   1 import ./make-test-python.nix ({ pkgs, ... }:
   2   let
   3     certs = import ./common/acme/server/snakeoil-certs.nix;
   4     serverDomain = certs.domain;
   5
   6     testCredentials = {
   7       password = "Password1_cZPEwpCWvrReripJmAZdmVIZd8HHoHcl";
   8     };
   9
  10     # copy certs to store to work around mount namespacing
  11     certsPath = pkgs.runCommandNoCC "snakeoil-certs" { } ''
  12       mkdir $out
  13       cp ${certs."${serverDomain}".cert} $out/snakeoil.crt
  14       cp ${certs."${serverDomain}".key} $out/snakeoil.key
  15     '';
  16   in
  17   {
  18     name = "kanidm";
  19     meta.maintainers = with pkgs.lib.maintainers; [ erictapen Flakebi oddlama ];
  20
  21     nodes.server = { pkgs, ... }: {
  22       services.kanidm = {
  23         enableServer = true;
  24         serverSettings = {
  25           origin = "https://${serverDomain}";
  26           domain = serverDomain;
  27           bindaddress = "[::]:443";
  28           ldapbindaddress = "[::1]:636";
  29           tls_chain = "${certsPath}/snakeoil.crt";
  30           tls_key = "${certsPath}/snakeoil.key";
  31         };
  32       };
  33
  34       security.pki.certificateFiles = [ certs.ca.cert ];
  35
  36       networking.hosts."::1" = [ serverDomain ];
  37       networking.firewall.allowedTCPPorts = [ 443 ];
  38
  39       users.users.kanidm.shell = pkgs.bashInteractive;
  40
  41       environment.systemPackages = with pkgs; [ kanidm openldap ripgrep ];
  42     };
  43
  44     nodes.client = { nodes, ... }: {
  45       services.kanidm = {
  46         enableClient = true;
  47         clientSettings = {
  48           uri = "https://${serverDomain}";
  49           verify_ca = true;
  50           verify_hostnames = true;
  51         };
  52         enablePam = true;
  53         unixSettings = {
  54           pam_allowed_login_groups = [ "shell" ];
  55         };
  56       };
  57
  58       networking.hosts."${nodes.server.networking.primaryIPAddress}" = [ serverDomain ];
  59
  60       security.pki.certificateFiles = [ certs.ca.cert ];
  61     };
  62
  63     testScript = { nodes, ... }:
  64       let
  65         ldapBaseDN = builtins.concatStringsSep "," (map (s: "dc=" + s) (pkgs.lib.splitString "." serverDomain));
  66
  67         # We need access to the config file in the test script.
  68         filteredConfig = pkgs.lib.converge
  69           (pkgs.lib.filterAttrsRecursive (_: v: v != null))
  70           nodes.server.services.kanidm.serverSettings;
  71         serverConfigFile = (pkgs.formats.toml { }).generate "server.toml" filteredConfig;
  72       in
  73       ''
  74         server.start()
  75         client.start()
  76         server.wait_for_unit("kanidm.service")
  77         client.systemctl("start network-online.target")
  78         client.wait_for_unit("network-online.target")
  79
  80         with subtest("Test HTTP interface"):
  81             server.wait_until_succeeds("curl -Lsf https://${serverDomain} | grep Kanidm")
  82
  83         with subtest("Test LDAP interface"):
  84             server.succeed("ldapsearch -H ldaps://${serverDomain}:636 -b '${ldapBaseDN}' -x '(name=test)'")
  85
  86         with subtest("Recover idm_admin account"):
  87             idm_admin_password = server.succeed("su - kanidm -c 'kanidmd recover-account -c ${serverConfigFile} idm_admin 2>&1 | rg -o \'[A-Za-z0-9]{48}\' '").strip().removeprefix("'").removesuffix("'")
  88
  89         with subtest("Test CLI login"):
  90             client.wait_until_tty_matches("1", "login: ")
  91             client.send_chars("root\n")
  92             client.send_chars("kanidm login -D idm_admin\n")
  93             client.wait_until_tty_matches("1", "Enter password: ")
  94             client.send_chars(f"{idm_admin_password}\n")
  95             client.wait_until_tty_matches("1", "Login Success for idm_admin")
  96
  97         with subtest("Test unixd connection"):
  98             client.wait_for_unit("kanidm-unixd.service")
  99             client.wait_for_file("/run/kanidm-unixd/sock")
 100             client.wait_until_succeeds("kanidm-unix status | grep working!")
 101
 102         with subtest("Test user creation"):
 103             client.wait_for_unit("getty@tty1.service")
 104             client.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
 105             client.succeed("kanidm person create testuser TestUser")
 106             client.succeed("kanidm person posix set --shell \"$SHELL\" testuser")
 107             client.send_chars("kanidm person posix set-password testuser\n")
 108             client.wait_until_tty_matches("1", "Enter new")
 109             client.send_chars("${testCredentials.password}\n")
 110             client.wait_until_tty_matches("1", "Retype")
 111             client.send_chars("${testCredentials.password}\n")
 112             output = client.succeed("getent passwd testuser")
 113             assert "TestUser" in output
 114             client.succeed("kanidm group create shell")
 115             client.succeed("kanidm group posix set shell")
 116             client.succeed("kanidm group add-members shell testuser")
 117
 118         with subtest("Test user login"):
 119             client.send_key("alt-f2")
 120             client.wait_until_succeeds("[ $(fgconsole) = 2 ]")
 121             client.wait_for_unit("getty@tty2.service")
 122             client.wait_until_succeeds("pgrep -f 'agetty.*tty2'")
 123             client.wait_until_tty_matches("2", "login: ")
 124             client.send_chars("testuser\n")
 125             client.wait_until_tty_matches("2", "login: testuser")
 126             client.wait_until_succeeds("pgrep login")
 127             client.wait_until_tty_matches("2", "Password: ")
 128             client.send_chars("${testCredentials.password}\n")
 129             client.wait_until_succeeds("systemctl is-active user@$(id -u testuser).service")
 130             client.send_chars("touch done\n")
 131             client.wait_for_file("/home/testuser@${serverDomain}/done")
 132
 133         server.shutdown()
 134         client.shutdown()
 135       '';
 136   })