tools/sync-groups/federation_test.go

   1 // Copyright (C) The Arvados Authors. All rights reserved.
   2 //
   3 // SPDX-License-Identifier: AGPL-3.0
   4
   5 package main
   6
   7 import (
   8         "bytes"
   9         "net"
  10         "os"
  11         "path/filepath"
  12
  13         "git.arvados.org/arvados.git/lib/boot"
  14         "git.arvados.org/arvados.git/lib/config"
  15         "git.arvados.org/arvados.git/sdk/go/arvados"
  16         "git.arvados.org/arvados.git/sdk/go/arvadostest"
  17         "git.arvados.org/arvados.git/sdk/go/ctxlog"
  18         check "gopkg.in/check.v1"
  19 )
  20
  21 var _ = check.Suite(&FederationSuite{})
  22
  23 var origAPIHost, origAPIToken string
  24
  25 type FederationSuite struct {
  26         testClusters map[string]*boot.TestCluster
  27         oidcprovider *arvadostest.OIDCProvider
  28 }
  29
  30 func (s *FederationSuite) SetUpSuite(c *check.C) {
  31         origAPIHost = os.Getenv("ARVADOS_API_HOST")
  32         origAPIToken = os.Getenv("ARVADOS_API_TOKEN")
  33
  34         cwd, _ := os.Getwd()
  35
  36         s.oidcprovider = arvadostest.NewOIDCProvider(c)
  37         s.oidcprovider.AuthEmail = "user@example.com"
  38         s.oidcprovider.AuthEmailVerified = true
  39         s.oidcprovider.AuthName = "Example User"
  40         s.oidcprovider.ValidClientID = "clientid"
  41         s.oidcprovider.ValidClientSecret = "clientsecret"
  42
  43         s.testClusters = map[string]*boot.TestCluster{
  44                 "z1111": nil,
  45                 "z2222": nil,
  46         }
  47         hostport := map[string]string{}
  48         for id := range s.testClusters {
  49                 hostport[id] = func() string {
  50                         // TODO: Instead of expecting random ports on
  51                         // 127.0.0.11, 22 to be race-safe, try
  52                         // different 127.x.y.z until finding one that
  53                         // isn't in use.
  54                         ln, err := net.Listen("tcp", ":0")
  55                         c.Assert(err, check.IsNil)
  56                         ln.Close()
  57                         _, port, err := net.SplitHostPort(ln.Addr().String())
  58                         c.Assert(err, check.IsNil)
  59                         return "127.0.0." + id[3:] + ":" + port
  60                 }()
  61         }
  62         for id := range s.testClusters {
  63                 yaml := `Clusters:
  64   ` + id + `:
  65     Services:
  66       Controller:
  67         ExternalURL: https://` + hostport[id] + `
  68     TLS:
  69       Insecure: true
  70     SystemLogs:
  71       Format: text
  72     RemoteClusters:
  73       z1111:
  74         Host: ` + hostport["z1111"] + `
  75         Scheme: https
  76         Insecure: true
  77         Proxy: true
  78         ActivateUsers: true
  79 `
  80                 if id != "z2222" {
  81                         yaml += `      z2222:
  82         Host: ` + hostport["z2222"] + `
  83         Scheme: https
  84         Insecure: true
  85         Proxy: true
  86         ActivateUsers: true
  87 `
  88                 }
  89                 if id == "z1111" {
  90                         yaml += `
  91     Login:
  92       LoginCluster: z1111
  93       OpenIDConnect:
  94         Enable: true
  95         Issuer: ` + s.oidcprovider.Issuer.URL + `
  96         ClientID: ` + s.oidcprovider.ValidClientID + `
  97         ClientSecret: ` + s.oidcprovider.ValidClientSecret + `
  98         EmailClaim: email
  99         EmailVerifiedClaim: email_verified
 100 `
 101                 } else {
 102                         yaml += `
 103     Login:
 104       LoginCluster: z1111
 105 `
 106                 }
 107
 108                 loader := config.NewLoader(bytes.NewBufferString(yaml), ctxlog.TestLogger(c))
 109                 loader.Path = "-"
 110                 loader.SkipLegacy = true
 111                 loader.SkipAPICalls = true
 112                 cfg, err := loader.Load()
 113                 c.Assert(err, check.IsNil)
 114                 tc := boot.NewTestCluster(
 115                         filepath.Join(cwd, "..", ".."),
 116                         id, cfg, "127.0.0."+id[3:], c.Log)
 117                 tc.Super.NoWorkbench1 = true
 118                 tc.Start()
 119                 s.testClusters[id] = tc
 120         }
 121         for _, tc := range s.testClusters {
 122                 ok := tc.WaitReady()
 123                 c.Assert(ok, check.Equals, true)
 124         }
 125
 126         // Activate user, make it admin.
 127         conn1 := s.testClusters["z1111"].Conn()
 128         rootctx1, _, _ := s.testClusters["z1111"].RootClients()
 129         userctx1, _, _, _ := s.testClusters["z1111"].UserClients(rootctx1, c, conn1, s.oidcprovider.AuthEmail, true)
 130         user1, err := conn1.UserGetCurrent(userctx1, arvados.GetOptions{})
 131         c.Assert(err, check.IsNil)
 132         c.Assert(user1.IsAdmin, check.Equals, false)
 133         user1, err = conn1.UserUpdate(rootctx1, arvados.UpdateOptions{
 134                 UUID: user1.UUID,
 135                 Attrs: map[string]interface{}{
 136                         "is_admin": true,
 137                 },
 138         })
 139         c.Assert(err, check.IsNil)
 140         c.Assert(user1.IsAdmin, check.Equals, true)
 141 }
 142
 143 func (s *FederationSuite) TearDownSuite(c *check.C) {
 144         for _, c := range s.testClusters {
 145                 c.Super.Stop()
 146         }
 147         _ = os.Setenv("ARVADOS_API_HOST", origAPIHost)
 148         _ = os.Setenv("ARVADOS_API_TOKEN", origAPIToken)
 149 }
 150
 151 func (s *FederationSuite) TestGroupSyncingOnFederatedCluster(c *check.C) {
 152         // Get admin user's V2 token
 153         conn1 := s.testClusters["z1111"].Conn()
 154         rootctx1, _, _ := s.testClusters["z1111"].RootClients()
 155         userctx1, _, _, _ := s.testClusters["z1111"].UserClients(rootctx1, c, conn1, s.oidcprovider.AuthEmail, true)
 156         user1Auth, err := conn1.APIClientAuthorizationCurrent(userctx1, arvados.GetOptions{})
 157         c.Check(err, check.IsNil)
 158         userV2Token := user1Auth.TokenV2()
 159
 160         // Get federated admin clients on z2222 to set up environment
 161         conn2 := s.testClusters["z2222"].Conn()
 162         userctx2, userac2, _ := s.testClusters["z2222"].ClientsWithToken(userV2Token)
 163         user2, err := conn2.UserGetCurrent(userctx2, arvados.GetOptions{})
 164         c.Check(err, check.IsNil)
 165         c.Check(user2.IsAdmin, check.Equals, true)
 166
 167         // Set up environment for sync-groups using admin user credentials on z2222
 168         err = os.Setenv("ARVADOS_API_HOST", userac2.APIHost)
 169         c.Assert(err, check.IsNil)
 170         err = os.Setenv("ARVADOS_API_TOKEN", userac2.AuthToken)
 171         c.Assert(err, check.IsNil)
 172
 173         // Check that no parent group is created
 174         gl := arvados.GroupList{}
 175         params := arvados.ResourceListParams{
 176                 Filters: []arvados.Filter{{
 177                         Attr:     "owner_uuid",
 178                         Operator: "=",
 179                         Operand:  s.testClusters["z2222"].ClusterID + "-tpzed-000000000000000",
 180                 }, {
 181                         Attr:     "name",
 182                         Operator: "=",
 183                         Operand:  "Externally synchronized groups",
 184                 }},
 185         }
 186         err = userac2.RequestAndDecode(&gl, "GET", "/arvados/v1/groups", nil, params)
 187         c.Assert(err, check.IsNil)
 188         c.Assert(gl.ItemsAvailable, check.Equals, 0)
 189
 190         // Set up config, confirm that the parent group was created
 191         os.Args = []string{"cmd", "somefile.csv"}
 192         config, err := GetConfig()
 193         c.Assert(err, check.IsNil)
 194         userac2.RequestAndDecode(&gl, "GET", "/arvados/v1/groups", nil, params)
 195         c.Assert(gl.ItemsAvailable, check.Equals, 1)
 196
 197         // Run the tool with custom config
 198         data := [][]string{
 199                 {"TestGroup1", user2.Email},
 200         }
 201         tmpfile, err := MakeTempCSVFile(data)
 202         c.Assert(err, check.IsNil)
 203         defer os.Remove(tmpfile.Name()) // clean up
 204         config.Path = tmpfile.Name()
 205         err = doMain(&config)
 206         c.Assert(err, check.IsNil)
 207         // Check the group was created correctly, and has the user as a member
 208         groupUUID, err := RemoteGroupExists(&config, "TestGroup1")
 209         c.Assert(err, check.IsNil)
 210         c.Assert(groupUUID, check.Not(check.Equals), "")
 211         c.Assert(GroupMembershipExists(config.Client, user2.UUID, groupUUID, "can_write"), check.Equals, true)
 212 }