mirror of
https://github.com/osixia/container-openldap.git
synced 2026-11-12 15:23:49 -04:00
119 lines
3.6 KiB
Bash
119 lines
3.6 KiB
Bash
#!/bin/bash
|
|
|
|
set -euo pipefail
|
|
|
|
# if container log level is trace:
|
|
# print commands and their arguments as they are executed
|
|
container log level eq trace && set -x
|
|
|
|
# shellcheck disable=SC1091
|
|
source /tmp/openldap-test-lib.sh
|
|
|
|
URI="ldap://127.0.0.1:3890"
|
|
USER_DN="uid=audit-user,${TEST_SUFFIX}"
|
|
RENAMED_DN="uid=audited-user,${TEST_SUFFIX}"
|
|
LOG_FILE="${TEST_AUDITLOG_FILE}"
|
|
|
|
if ! container --log-level debug --skip-process > /tmp/openldap-auditlog-bootstrap.log 2>&1; then
|
|
tail -60 /tmp/openldap-auditlog-bootstrap.log
|
|
exit 1
|
|
fi
|
|
|
|
start_ldap() {
|
|
slapd -F /etc/openldap/slapd.d -h "${URI}" -d 0 > /tmp/openldap-auditlog-slapd.log 2>&1 &
|
|
SLAPD_PID=$!
|
|
eventually has_entry "${URI}" "${TEST_SUFFIX}"
|
|
}
|
|
|
|
stop_ldap() {
|
|
kill "${SLAPD_PID}"
|
|
wait "${SLAPD_PID}"
|
|
}
|
|
|
|
trap 'kill "${SLAPD_PID}" 2>/dev/null || true' EXIT
|
|
start_ldap
|
|
|
|
expect_rc 0 bind_search "${URI}" "${CONFIG_ADMIN_DN}" \
|
|
-b 'cn=module{0},cn=config' -s base olcModuleLoad
|
|
if [ "${TEST_AUDITLOG_MODE}" = "default" ]; then
|
|
expect_no_output 'auditlog\.so'
|
|
else
|
|
expect_output 'auditlog\.so$'
|
|
fi
|
|
|
|
expect_rc 0 bind_search "${URI}" "${CONFIG_ADMIN_DN}" \
|
|
-b 'olcDatabase={1}mdb,cn=config' '(objectClass=olcAuditLogConfig)' olcAuditlogFile
|
|
if [ "${TEST_AUDITLOG_MODE}" = "default" ]; then
|
|
expect_no_output '^olcAuditlogFile:'
|
|
else
|
|
expect_output "^olcAuditlogFile: \"?${LOG_FILE}\"?$"
|
|
fi
|
|
|
|
expect_rc 0 bind_modify "${URI}" "${ADMIN_DN}" -a <<LDIF
|
|
dn: ${USER_DN}
|
|
objectClass: inetOrgPerson
|
|
uid: audit-user
|
|
cn: Audit User
|
|
sn: User
|
|
LDIF
|
|
|
|
if [ "${TEST_AUDITLOG_MODE}" = "default" ]; then
|
|
[ ! -e "${LOG_FILE}" ] || fail 'audit file created while disabled'
|
|
ok 'auditlog is disabled by default'
|
|
exit 0
|
|
fi
|
|
|
|
[ -s "${LOG_FILE}" ] || fail 'audit file is missing or empty'
|
|
grep -qE "^# add [0-9]+ ${TEST_SUFFIX} ${ADMIN_DN} " "${LOG_FILE}"
|
|
grep -qFx "dn: ${USER_DN}" "${LOG_FILE}"
|
|
ok "auditlog (${TEST_AUDITLOG_MODE}) records additions with the actor and target DN"
|
|
|
|
expect_rc 0 bind_modify "${URI}" "${ADMIN_DN}" <<LDIF
|
|
dn: ${USER_DN}
|
|
changetype: modify
|
|
replace: description
|
|
description: Audited change
|
|
LDIF
|
|
grep -qE '^# modify ' "${LOG_FILE}"
|
|
grep -qFx 'description: Audited change' "${LOG_FILE}"
|
|
|
|
expect_rc 0 ldapmodrdn -x -H "${URI}" -D "${ADMIN_DN}" -w "${TEST_PASSWORD}" \
|
|
-r "${USER_DN}" uid=audited-user
|
|
grep -qE '^# modrdn ' "${LOG_FILE}"
|
|
grep -qFx 'newrdn: uid=audited-user' "${LOG_FILE}"
|
|
ok 'auditlog records modifications and renames'
|
|
|
|
BEFORE=$(wc -c < "${LOG_FILE}")
|
|
expect_rc 0 bind_search "${URI}" "${ADMIN_DN}" -b "${RENAMED_DN}" -s base dn
|
|
expect_rc 68 bind_modify "${URI}" "${ADMIN_DN}" -a <<LDIF
|
|
dn: ${RENAMED_DN}
|
|
objectClass: inetOrgPerson
|
|
uid: audited-user
|
|
cn: Duplicate
|
|
sn: User
|
|
LDIF
|
|
[ "$(wc -c < "${LOG_FILE}")" = "${BEFORE}" ] || fail 'reads or failed operations were audited'
|
|
ok 'auditlog only records successful writes'
|
|
|
|
mv "${LOG_FILE}" "${LOG_FILE}.1"
|
|
expect_rc 0 ldapdelete -x -H "${URI}" -D "${ADMIN_DN}" -w "${TEST_PASSWORD}" "${RENAMED_DN}"
|
|
grep -qE '^# delete ' "${LOG_FILE}"
|
|
grep -qFx "dn: ${RENAMED_DN}" "${LOG_FILE}"
|
|
[ "$(wc -c < "${LOG_FILE}.1")" = "${BEFORE}" ] || fail 'rotated log was modified'
|
|
ok 'auditlog recreates its file after rotation without restarting slapd'
|
|
|
|
BEFORE=$(wc -c < "${LOG_FILE}")
|
|
stop_ldap
|
|
start_ldap
|
|
expect_rc 0 bind_modify "${URI}" "${ADMIN_DN}" -a <<LDIF
|
|
dn: ${USER_DN}
|
|
objectClass: inetOrgPerson
|
|
uid: audit-user
|
|
cn: Audit User After Restart
|
|
sn: User
|
|
LDIF
|
|
grep -qE '^# delete ' "${LOG_FILE}"
|
|
grep -qFx 'cn: Audit User After Restart' "${LOG_FILE}"
|
|
[ "$(wc -c < "${LOG_FILE}")" -gt "${BEFORE}" ] || fail 'audit file was not appended after restart'
|
|
ok 'auditlog appends to the existing file after restart'
|