Switch away from using an external LDAP server that sometimes goes down, #7522
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
to a local (docker) LDAP server. The schema and data changes too, unfortunately.
Attempt to convert TestIdentityStore_Integ_GroupAliases to use the docker ldap server, but it's not working yet. The first obstacle was that it expects a user to exist in two external group: Scientists and Italians. There are no users in the new ldap server's data who belong to two ldap groups. One thing Becca was saying she hoped the docker ldap server would allow us is to make changes to the LDAP data. So I decided to modify the test such that it first sees a user in a single LDAP group, then once we add the user to a second group, upon re-logging in we see them in that identity group as well. This proved not to be so easy. I got LDAP Result Code 8 "Strong Auth Required": modifications require authentication Some googling suggested this would be fixed if we used TLS. This was a bit of an adventure since they use a self-signed cert, but eventually I got that working, at least in the context of a test: I wasn't able to get the LDAP backend itself to be happy with that, which is why PrepareTestContainer now returns two ldaputil.ConfigEntry structs. Anyway, that turned out not to be the right fix, or possible just insufficient. I'm still getting the same error, but now I think it's because the admin user hasn't been granted write privs. I'm not certain how to do that without building a new docker image, and if that is required I might revisit which docker image we use.
tyrannosaurus-becks
previously approved these changes
Oct 21, 2019
| "testing" | ||
| ) | ||
|
|
||
| func PrepareTestContainer(t *testing.T, version string) (cleanup func(), cfg *ldaputil.ConfigEntry) { |
There was a problem hiding this comment.
Nice! Thank you for exporting this. I wonder if at some point we'll even want to move it into the sdk so it can be reused externally in miscellaneous LDAP plugins.
There was a problem hiding this comment.
Sure, that makes sense.
tyrannosaurus-becks
previously approved these changes
Oct 21, 2019
catsby
added a commit
that referenced
this pull request
Oct 24, 2019
* master: changelog++ Update CHANGELOG.md Abstract generate-root authentication into the strategy interface (#7698) Changelog: clarify enterprise seal migration fix changelog++ Update transit docs to add aes128/p384/p521 information (#7718) Show versions that are active when delete_version_after is configured (#7685) changelog++ agent: fix data race on inmemSink's token (#7707) Use docker instead of an external LDAP server that sometimes goes down (#7522) changelog++ Fix a nil map pointer in mergeEntity. (#7711) changelog++ TestSysRekey_Verification would fail sometimes when recovery=true (#7710)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
to a local (docker) LDAP server. The schema and data changes too, unfortunately.