tools/sync-groups/federation_test.go

   1 // Copyright (C) The Arvados Authors. All rights reserved.
   2 //
   3 // SPDX-License-Identifier: AGPL-3.0
   4
   5 package main
   6
   7 import (
   8         "bytes"
   9         "net"
  10         "os"
  11         "path/filepath"
  12
  13         "git.arvados.org/arvados.git/lib/boot"
  14         "git.arvados.org/arvados.git/lib/config"
  15         "git.arvados.org/arvados.git/sdk/go/arvados"
  16         "git.arvados.org/arvados.git/sdk/go/arvadostest"
  17         "git.arvados.org/arvados.git/sdk/go/ctxlog"
  18         check "gopkg.in/check.v1"
  19 )
  20
  21 var _ = check.Suite(&FederationSuite{})
  22
  23 var origAPIHost, origAPIToken string
  24
  25 type FederationSuite struct {
  26         testClusters map[string]*boot.TestCluster
  27         oidcprovider *arvadostest.OIDCProvider
  28 }
  29
  30 func (s *FederationSuite) SetUpSuite(c *check.C) {
  31         origAPIHost = os.Getenv("ARVADOS_API_HOST")
  32         origAPIToken = os.Getenv("ARVADOS_API_TOKEN")
  33
  34         cwd, _ := os.Getwd()
  35
  36         s.oidcprovider = arvadostest.NewOIDCProvider(c)
  37         s.oidcprovider.AuthEmail = "user@example.com"
  38         s.oidcprovider.AuthEmailVerified = true
  39         s.oidcprovider.AuthName = "Example User"
  40         s.oidcprovider.ValidClientID = "clientid"
  41         s.oidcprovider.ValidClientSecret = "clientsecret"
  42
  43         s.testClusters = map[string]*boot.TestCluster{
  44                 "z1111": nil,
  45                 "z2222": nil,
  46         }
  47         hostport := map[string]string{}
  48         for id := range s.testClusters {
  49                 hostport[id] = func() string {
  50                         // TODO: Instead of expecting random ports on
  51                         // 127.0.0.11, 22 to be race-safe, try
  52                         // different 127.x.y.z until finding one that
  53                         // isn't in use.
  54                         ln, err := net.Listen("tcp", ":0")
  55                         c.Assert(err, check.IsNil)
  56                         ln.Close()
  57                         _, port, err := net.SplitHostPort(ln.Addr().String())
  58                         c.Assert(err, check.IsNil)
  59                         return "127.0.0." + id[3:] + ":" + port
  60                 }()
  61         }
  62         for id := range s.testClusters {
  63                 yaml := `Clusters:
  64   ` + id + `:
  65     Services:
  66       Controller:
  67         ExternalURL: https://` + hostport[id] + `
  68     TLS:
  69       Insecure: true
  70     SystemLogs:
  71       Format: text
  72     RemoteClusters:
  73       z1111:
  74         Host: ` + hostport["z1111"] + `
  75         Scheme: https
  76         Insecure: true
  77         Proxy: true
  78         ActivateUsers: true
  79 `
  80                 if id != "z2222" {
  81                         yaml += `      z2222:
  82         Host: ` + hostport["z2222"] + `
  83         Scheme: https
  84         Insecure: true
  85         Proxy: true
  86         ActivateUsers: true
  87 `
  88                 }
  89                 if id == "z1111" {
  90                         yaml += `
  91     Login:
  92       LoginCluster: z1111
  93       OpenIDConnect:
  94         Enable: true
  95         Issuer: ` + s.oidcprovider.Issuer.URL + `
  96         ClientID: ` + s.oidcprovider.ValidClientID + `
  97         ClientSecret: ` + s.oidcprovider.ValidClientSecret + `
  98         EmailClaim: email
  99         EmailVerifiedClaim: email_verified
 100 `
 101                 } else {
 102                         yaml += `
 103     Login:
 104       LoginCluster: z1111
 105 `
 106                 }
 107
 108                 loader := config.NewLoader(bytes.NewBufferString(yaml), ctxlog.TestLogger(c))
 109                 loader.Path = "-"
 110                 loader.SkipLegacy = true
 111                 loader.SkipAPICalls = true
 112                 cfg, err := loader.Load()
 113                 c.Assert(err, check.IsNil)
 114                 tc := boot.NewTestCluster(
 115                         filepath.Join(cwd, "..", ".."),
 116                         id, cfg, "127.0.0."+id[3:], c.Log)
 117                 s.testClusters[id] = tc
 118                 s.testClusters[id].Start()
 119         }
 120         for _, tc := range s.testClusters {
 121                 ok := tc.WaitReady()
 122                 c.Assert(ok, check.Equals, true)
 123         }
 124
 125         // Activate user, make it admin.
 126         conn1 := s.testClusters["z1111"].Conn()
 127         rootctx1, _, _ := s.testClusters["z1111"].RootClients()
 128         userctx1, _, _, _ := s.testClusters["z1111"].UserClients(rootctx1, c, conn1, s.oidcprovider.AuthEmail, true)
 129         user1, err := conn1.UserGetCurrent(userctx1, arvados.GetOptions{})
 130         c.Assert(err, check.IsNil)
 131         c.Assert(user1.IsAdmin, check.Equals, false)
 132         user1, err = conn1.UserUpdate(rootctx1, arvados.UpdateOptions{
 133                 UUID: user1.UUID,
 134                 Attrs: map[string]interface{}{
 135                         "is_admin": true,
 136                 },
 137         })
 138         c.Assert(err, check.IsNil)
 139         c.Assert(user1.IsAdmin, check.Equals, true)
 140 }
 141
 142 func (s *FederationSuite) TearDownSuite(c *check.C) {
 143         for _, c := range s.testClusters {
 144                 c.Super.Stop()
 145         }
 146         _ = os.Setenv("ARVADOS_API_HOST", origAPIHost)
 147         _ = os.Setenv("ARVADOS_API_TOKEN", origAPIToken)
 148 }
 149
 150 func (s *FederationSuite) TestGroupSyncingOnFederatedCluster(c *check.C) {
 151         // Get admin user's V2 token
 152         conn1 := s.testClusters["z1111"].Conn()
 153         rootctx1, _, _ := s.testClusters["z1111"].RootClients()
 154         userctx1, _, _, _ := s.testClusters["z1111"].UserClients(rootctx1, c, conn1, s.oidcprovider.AuthEmail, true)
 155         user1Auth, err := conn1.APIClientAuthorizationCurrent(userctx1, arvados.GetOptions{})
 156         c.Check(err, check.IsNil)
 157         userV2Token := user1Auth.TokenV2()
 158
 159         // Get federated admin clients on z2222 to set up environment
 160         conn2 := s.testClusters["z2222"].Conn()
 161         userctx2, userac2, _ := s.testClusters["z2222"].ClientsWithToken(userV2Token)
 162         user2, err := conn2.UserGetCurrent(userctx2, arvados.GetOptions{})
 163         c.Check(err, check.IsNil)
 164         c.Check(user2.IsAdmin, check.Equals, true)
 165
 166         // Set up environment for sync-groups using admin user credentials on z2222
 167         err = os.Setenv("ARVADOS_API_HOST", userac2.APIHost)
 168         c.Assert(err, check.IsNil)
 169         err = os.Setenv("ARVADOS_API_TOKEN", userac2.AuthToken)
 170         c.Assert(err, check.IsNil)
 171
 172         // Check that no parent group is created
 173         gl := arvados.GroupList{}
 174         params := arvados.ResourceListParams{
 175                 Filters: []arvados.Filter{{
 176                         Attr:     "owner_uuid",
 177                         Operator: "=",
 178                         Operand:  s.testClusters["z2222"].ClusterID + "-tpzed-000000000000000",
 179                 }, {
 180                         Attr:     "name",
 181                         Operator: "=",
 182                         Operand:  "Externally synchronized groups",
 183                 }},
 184         }
 185         err = userac2.RequestAndDecode(&gl, "GET", "/arvados/v1/groups", nil, params)
 186         c.Assert(err, check.IsNil)
 187         c.Assert(gl.ItemsAvailable, check.Equals, 0)
 188
 189         // Set up config, confirm that the parent group was created
 190         os.Args = []string{"cmd", "somefile.csv"}
 191         config, err := GetConfig()
 192         c.Assert(err, check.IsNil)
 193         userac2.RequestAndDecode(&gl, "GET", "/arvados/v1/groups", nil, params)
 194         c.Assert(gl.ItemsAvailable, check.Equals, 1)
 195
 196         // Run the tool with custom config
 197         data := [][]string{
 198                 {"TestGroup1", user2.Email},
 199         }
 200         tmpfile, err := MakeTempCSVFile(data)
 201         c.Assert(err, check.IsNil)
 202         defer os.Remove(tmpfile.Name()) // clean up
 203         config.Path = tmpfile.Name()
 204         err = doMain(&config)
 205         c.Assert(err, check.IsNil)
 206         // Check the group was created correctly, and has the user as a member
 207         groupUUID, err := RemoteGroupExists(&config, "TestGroup1")
 208         c.Assert(err, check.IsNil)
 209         c.Assert(groupUUID, check.Not(check.Equals), "")
 210         c.Assert(GroupMembershipExists(config.Client, user2.UUID, groupUUID, "can_write"), check.Equals, true)
 211 }