freeipa

#9666 Nightly test failure (f42) in test_adtrust_install
Closed: fixed by frenaud. Opened by frenaud.

Closed: fixed
Reopen Issue

The nightly test test_adtrust_install is failing in rawhide in the test test_integration/test_adtrust_install.py::TestIpaAdTrustInstall::test_user_connects_smb_share_if_locked_specific_group.

The test creates a share in the samba server and calls smbclient --use-kerberos=desired to access the share. With the update of samba to samba-4.20.4-1.fc42 the test started failing with

RUN ['smbclient', '--use-kerberos=desired', '-c=put before', '//master.ufreeipa.test/share']
RUN ['smbclient', '--use-kerberos=desired', '-c=put before', '//master.ufreeipa.test/share']
lpcfg_do_global_parameter: WARNING: The "domain logons" option is deprecated
Password for [admin@UFREEIPA.TEST]:
Anonymous login successful
tree connect failed: NT_STATUS_ACCESS_DENIED
Exit code: 1

Traces:

self = <ipatests.test_integration.test_adtrust_install.TestIpaAdTrustInstall object at 0x7f5c974e0500>
    def test_user_connects_smb_share_if_locked_specific_group(self):
        """
        Test scenario:
        Create a share in the samba server
        Access the share as admin, should work
        set valid users = admins to limit the share access to
        members of the "admins" group
        Access the share as admin, should work
        https://pagure.io/freeipa/issue/4234
        """
        msg = "tree connect failed: NT_STATUS_ACCESS_DENIED"
        self.master.run_command(
            ["ipa-adtrust-install", "-a",
             self.master.config.admin_password,
             "-U"]
        )
        # Wait for SSSD to become online before doing any other check
        tasks.wait_for_sssd_domain_status_online(self.master)
        self.master.run_command(["mkdir", "/freeipa4234"])
        self.master.run_command(
            ["chcon", "-t", "samba_share_t",
             "/freeipa4234"])
        self.master.run_command(
            ["setfacl", "-m", "g:admins:rwx",
             "/freeipa4234"])
        self.master.run_command(
            ["net", "conf", "setparm", "share",
             "comment", "Test Share"])
        self.master.run_command(
            ["net", "conf", "setparm", "share",
             "read only", "no"])
        self.master.run_command(
            ["net", "conf", "setparm", "share",
             "path", "/freeipa4234"])
        self.master.run_command(["touch", "before"])
        self.master.run_command(["touch", "after"])
>       self.master.run_command(
            ["smbclient", "--use-kerberos=desired",
             "-c=put before", "//{}/share".format(
                 self.master.hostname)]
        )
msg        = 'tree connect failed: NT_STATUS_ACCESS_DENIED'
self       = <ipatests.test_integration.test_adtrust_install.TestIpaAdTrustInstall object at 0x7f5c974e0500>

The test needs to provide a cache to the smbclient command otherwise the command prompts for a password.

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/7541

master:

  • 3203afcc11487730aceb222a54cbdbaaaf371d15 ipatests: provide a ccache to rpcclient deletetrustdom
  • c33e92d8954dd1578c89693e10d59d2bd4f31940 test_adtrust_install: add --use-krb5-ccache to smbclient command

ipa-4-12:

  • a343c149838a3058794f33c75c58b75bc1748f7f ipatests: provide a ccache to rpcclient deletetrustdom
  • 743c7b46e463bef666dc84e9f513eb7dee7f59f6 test_adtrust_install: add --use-krb5-ccache to smbclient command

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata

test-failure tests

None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.