3 describe 'keystone::ldap' do
4 describe 'with basic params' do
8 :user => 'cn=foo,dc=example,dc=com',
9 :password => 'abcdefg',
10 :suffix => 'dc=example,dc=com',
11 :query_scope => 'sub',
13 :user_tree_dn => 'cn=users,dc=example,dc=com',
14 :user_filter => '(memberOf=cn=openstack,cn=groups,cn=accounts,dc=example,dc=com)',
15 :user_objectclass => 'inetUser',
16 :user_id_attribute => 'uid',
17 :user_name_attribute => 'cn',
18 :user_mail_attribute => 'mail',
19 :user_enabled_attribute => 'UserAccountControl',
20 :user_enabled_mask => '2',
21 :user_enabled_default => '512',
22 :user_enabled_invert => 'False',
23 :user_attribute_ignore => '',
24 :user_default_project_id_attribute => 'defaultProject',
25 :user_allow_create => 'False',
26 :user_allow_update => 'False',
27 :user_allow_delete => 'False',
28 :user_pass_attribute => 'krbPassword',
29 :user_enabled_emulation => 'True',
30 :user_enabled_emulation_dn => 'cn=openstack-enabled,cn=groups,cn=accounts,dc=example,dc=com',
31 :user_additional_attribute_mapping => 'description:name, gecos:name',
32 :project_tree_dn => 'ou=projects,ou=openstack,dc=example,dc=com',
33 :project_filter => '',
34 :project_objectclass => 'organizationalUnit',
35 :project_id_attribute => 'ou',
36 :project_member_attribute => 'member',
37 :project_desc_attribute => 'description',
38 :project_name_attribute => 'ou',
39 :project_enabled_attribute => 'enabled',
40 :project_domain_id_attribute => 'businessCategory',
41 :project_attribute_ignore => '',
42 :project_allow_create => 'True',
43 :project_allow_update => 'True',
44 :project_allow_delete => 'True',
45 :project_enabled_emulation => 'False',
46 :project_enabled_emulation_dn => 'True',
47 :project_additional_attribute_mapping => 'cn=enabled,ou=openstack,dc=example,dc=com',
48 :role_tree_dn => 'ou=roles,ou=openstack,dc=example,dc=com',
50 :role_objectclass => 'organizationalRole',
51 :role_id_attribute => 'cn',
52 :role_name_attribute => 'ou',
53 :role_member_attribute => 'roleOccupant',
54 :role_attribute_ignore => 'description',
55 :role_allow_create => 'True',
56 :role_allow_update => 'True',
57 :role_allow_delete => 'True',
58 :role_additional_attribute_mapping => '',
59 :group_tree_dn => 'ou=groups,ou=openstack,dc=example,dc=com',
60 :group_filter => 'cn=enabled-groups,cn=groups,cn=accounts,dc=example,dc=com',
61 :group_objectclass => 'organizationalRole',
62 :group_id_attribute => 'cn',
63 :group_name_attribute => 'cn',
64 :group_member_attribute => 'roleOccupant',
65 :group_desc_attribute => 'description',
66 :group_attribute_ignore => '',
67 :group_allow_create => 'False',
68 :group_allow_update => 'False',
69 :group_allow_delete => 'False',
70 :group_additional_attribute_mapping => '',
72 :tls_cacertdir => '/etc/ssl/certs/',
73 :tls_cacertfile => '/etc/ssl/certs/ca-certificates.crt',
74 :tls_req_cert => 'demand',
75 :identity_driver => 'keystone.identity.backends.ldap.Identity',
76 :credential_driver => 'keystone.credential.backends.ldap.Credential',
77 :assignment_driver => 'keystone.assignment.backends.ldap.Assignment',
81 :pool_retry_delay => 0.2,
82 :pool_connection_timeout => 222,
83 :pool_connection_lifetime => 222,
84 :use_auth_pool => 'True',
85 :auth_pool_size => 20,
86 :auth_pool_connection_lifetime => 200,
89 it { is_expected.to contain_package('python-ldap') }
90 it { is_expected.to contain_package('python-ldappool') }
91 it 'should have basic params' do
93 is_expected.to contain_keystone_config('ldap/url').with_value('ldap://foo')
94 is_expected.to contain_keystone_config('ldap/user').with_value('cn=foo,dc=example,dc=com')
95 is_expected.to contain_keystone_config('ldap/password').with_value('abcdefg').with_secret(true)
96 is_expected.to contain_keystone_config('ldap/suffix').with_value('dc=example,dc=com')
97 is_expected.to contain_keystone_config('ldap/query_scope').with_value('sub')
98 is_expected.to contain_keystone_config('ldap/page_size').with_value('50')
101 is_expected.to contain_keystone_config('ldap/user_tree_dn').with_value('cn=users,dc=example,dc=com')
102 is_expected.to contain_keystone_config('ldap/user_filter').with_value('(memberOf=cn=openstack,cn=groups,cn=accounts,dc=example,dc=com)')
103 is_expected.to contain_keystone_config('ldap/user_objectclass').with_value('inetUser')
104 is_expected.to contain_keystone_config('ldap/user_id_attribute').with_value('uid')
105 is_expected.to contain_keystone_config('ldap/user_name_attribute').with_value('cn')
106 is_expected.to contain_keystone_config('ldap/user_mail_attribute').with_value('mail')
107 is_expected.to contain_keystone_config('ldap/user_enabled_attribute').with_value('UserAccountControl')
108 is_expected.to contain_keystone_config('ldap/user_enabled_mask').with_value('2')
109 is_expected.to contain_keystone_config('ldap/user_enabled_default').with_value('512')
110 is_expected.to contain_keystone_config('ldap/user_enabled_invert').with_value('False')
111 is_expected.to contain_keystone_config('ldap/user_attribute_ignore').with_value('')
112 is_expected.to contain_keystone_config('ldap/user_default_project_id_attribute').with_value('defaultProject')
113 is_expected.to contain_keystone_config('ldap/user_tree_dn').with_value('cn=users,dc=example,dc=com')
114 is_expected.to contain_keystone_config('ldap/user_allow_create').with_value('False')
115 is_expected.to contain_keystone_config('ldap/user_allow_update').with_value('False')
116 is_expected.to contain_keystone_config('ldap/user_allow_delete').with_value('False')
117 is_expected.to contain_keystone_config('ldap/user_pass_attribute').with_value('krbPassword')
118 is_expected.to contain_keystone_config('ldap/user_enabled_emulation').with_value('True')
119 is_expected.to contain_keystone_config('ldap/user_enabled_emulation_dn').with_value('cn=openstack-enabled,cn=groups,cn=accounts,dc=example,dc=com')
120 is_expected.to contain_keystone_config('ldap/user_additional_attribute_mapping').with_value('description:name, gecos:name')
123 is_expected.to contain_keystone_config('ldap/project_tree_dn').with_value('ou=projects,ou=openstack,dc=example,dc=com')
124 is_expected.to contain_keystone_config('ldap/project_filter').with_value('')
125 is_expected.to contain_keystone_config('ldap/project_objectclass').with_value('organizationalUnit')
126 is_expected.to contain_keystone_config('ldap/project_id_attribute').with_value('ou')
127 is_expected.to contain_keystone_config('ldap/project_member_attribute').with_value('member')
128 is_expected.to contain_keystone_config('ldap/project_desc_attribute').with_value('description')
129 is_expected.to contain_keystone_config('ldap/project_name_attribute').with_value('ou')
130 is_expected.to contain_keystone_config('ldap/project_enabled_attribute').with_value('enabled')
131 is_expected.to contain_keystone_config('ldap/project_domain_id_attribute').with_value('businessCategory')
132 is_expected.to contain_keystone_config('ldap/project_attribute_ignore').with_value('')
133 is_expected.to contain_keystone_config('ldap/project_allow_create').with_value('True')
134 is_expected.to contain_keystone_config('ldap/project_allow_update').with_value('True')
135 is_expected.to contain_keystone_config('ldap/project_allow_delete').with_value('True')
136 is_expected.to contain_keystone_config('ldap/project_enabled_emulation').with_value('False')
137 is_expected.to contain_keystone_config('ldap/project_enabled_emulation_dn').with_value('True')
138 is_expected.to contain_keystone_config('ldap/project_additional_attribute_mapping').with_value('cn=enabled,ou=openstack,dc=example,dc=com')
141 is_expected.to contain_keystone_config('ldap/role_tree_dn').with_value('ou=roles,ou=openstack,dc=example,dc=com')
142 is_expected.to contain_keystone_config('ldap/role_filter').with_value('')
143 is_expected.to contain_keystone_config('ldap/role_objectclass').with_value('organizationalRole')
144 is_expected.to contain_keystone_config('ldap/role_id_attribute').with_value('cn')
145 is_expected.to contain_keystone_config('ldap/role_name_attribute').with_value('ou')
146 is_expected.to contain_keystone_config('ldap/role_member_attribute').with_value('roleOccupant')
147 is_expected.to contain_keystone_config('ldap/role_attribute_ignore').with_value('description')
148 is_expected.to contain_keystone_config('ldap/role_allow_create').with_value('True')
149 is_expected.to contain_keystone_config('ldap/role_allow_update').with_value('True')
150 is_expected.to contain_keystone_config('ldap/role_allow_delete').with_value('True')
151 is_expected.to contain_keystone_config('ldap/role_additional_attribute_mapping').with_value('')
154 is_expected.to contain_keystone_config('ldap/group_tree_dn').with_value('ou=groups,ou=openstack,dc=example,dc=com')
155 is_expected.to contain_keystone_config('ldap/group_filter').with_value('cn=enabled-groups,cn=groups,cn=accounts,dc=example,dc=com')
156 is_expected.to contain_keystone_config('ldap/group_objectclass').with_value('organizationalRole')
157 is_expected.to contain_keystone_config('ldap/group_id_attribute').with_value('cn')
158 is_expected.to contain_keystone_config('ldap/group_member_attribute').with_value('roleOccupant')
159 is_expected.to contain_keystone_config('ldap/group_desc_attribute').with_value('description')
160 is_expected.to contain_keystone_config('ldap/group_name_attribute').with_value('cn')
161 is_expected.to contain_keystone_config('ldap/group_attribute_ignore').with_value('')
162 is_expected.to contain_keystone_config('ldap/group_allow_create').with_value('False')
163 is_expected.to contain_keystone_config('ldap/group_allow_update').with_value('False')
164 is_expected.to contain_keystone_config('ldap/group_allow_delete').with_value('False')
165 is_expected.to contain_keystone_config('ldap/group_additional_attribute_mapping').with_value('')
168 is_expected.to contain_keystone_config('ldap/use_tls').with_value('False')
169 is_expected.to contain_keystone_config('ldap/tls_cacertdir').with_value('/etc/ssl/certs/')
170 is_expected.to contain_keystone_config('ldap/tls_cacertfile').with_value('/etc/ssl/certs/ca-certificates.crt')
171 is_expected.to contain_keystone_config('ldap/tls_req_cert').with_value('demand')
174 is_expected.to contain_keystone_config('ldap/use_pool').with_value('True')
175 is_expected.to contain_keystone_config('ldap/pool_size').with_value('20')
176 is_expected.to contain_keystone_config('ldap/pool_retry_max').with_value('2')
177 is_expected.to contain_keystone_config('ldap/pool_retry_delay').with_value('0.2')
178 is_expected.to contain_keystone_config('ldap/pool_connection_timeout').with_value('222')
179 is_expected.to contain_keystone_config('ldap/pool_connection_lifetime').with_value('222')
180 is_expected.to contain_keystone_config('ldap/use_auth_pool').with_value('True')
181 is_expected.to contain_keystone_config('ldap/auth_pool_size').with_value('20')
182 is_expected.to contain_keystone_config('ldap/auth_pool_connection_lifetime').with_value('200')
185 is_expected.to contain_keystone_config('identity/driver').with_value('keystone.identity.backends.ldap.Identity')
186 is_expected.to contain_keystone_config('credential/driver').with_value('keystone.credential.backends.ldap.Credential')
187 is_expected.to contain_keystone_config('assignment/driver').with_value('keystone.assignment.backends.ldap.Assignment')
191 describe 'with deprecated params' do
194 :tenant_tree_dn => 'ou=projects,ou=openstack,dc=example,dc=com',
195 :tenant_filter => '',
196 :tenant_objectclass => 'organizationalUnit',
197 :tenant_id_attribute => 'ou',
198 :tenant_member_attribute => 'member',
199 :tenant_desc_attribute => 'description',
200 :tenant_name_attribute => 'ou',
201 :tenant_enabled_attribute => 'enabled',
202 :tenant_domain_id_attribute => 'businessCategory',
203 :tenant_attribute_ignore => '',
204 :tenant_allow_create => 'True',
205 :tenant_allow_update => 'True',
206 :tenant_allow_delete => 'True',
207 :tenant_enabled_emulation => 'False',
208 :tenant_enabled_emulation_dn => 'True',
209 :tenant_additional_attribute_mapping => 'cn=enabled,ou=openstack,dc=example,dc=com',
212 it 'should work with deprecated params' do
213 is_expected.to contain_keystone_config('ldap/project_tree_dn').with_value('ou=projects,ou=openstack,dc=example,dc=com')
214 is_expected.to contain_keystone_config('ldap/project_filter')
215 is_expected.to contain_keystone_config('ldap/project_objectclass').with_value('organizationalUnit')
216 is_expected.to contain_keystone_config('ldap/project_id_attribute').with_value('ou')
217 is_expected.to contain_keystone_config('ldap/project_member_attribute').with_value('member')
218 is_expected.to contain_keystone_config('ldap/project_desc_attribute').with_value('description')
219 is_expected.to contain_keystone_config('ldap/project_name_attribute').with_value('ou')
220 is_expected.to contain_keystone_config('ldap/project_enabled_attribute').with_value('enabled')
221 is_expected.to contain_keystone_config('ldap/project_domain_id_attribute').with_value('businessCategory')
222 is_expected.to contain_keystone_config('ldap/project_attribute_ignore')
223 is_expected.to contain_keystone_config('ldap/project_allow_create').with_value('True')
224 is_expected.to contain_keystone_config('ldap/project_allow_update').with_value('True')
225 is_expected.to contain_keystone_config('ldap/project_allow_delete').with_value('True')
226 is_expected.to contain_keystone_config('ldap/project_enabled_emulation').with_value('False')
227 is_expected.to contain_keystone_config('ldap/project_enabled_emulation_dn').with_value('True')
228 is_expected.to contain_keystone_config('ldap/project_additional_attribute_mapping').with_value('cn=enabled,ou=openstack,dc=example,dc=com')
232 describe 'with deprecated and new params both set' do
235 :tenant_tree_dn => 'ou=projects,ou=old-openstack,dc=example,dc=com',
236 :project_tree_dn => 'ou=projects,ou=new-openstack,dc=example,dc=com',
240 it_raises 'a Puppet::Error', /tenant_tree_dn and project_tree_dn are both set. results may be unexpected/