Add test for samba kerberos sso in ci

Signed-off-by: Robin Appelman <robin@icewind.nl>

diff --git a/.github/workflows/smb-kerberos.yml b/.github/workflows/smb-kerberos.yml
new file mode 100644 (file)
index 0000000..2875a7f
--- /dev/null
+++ b/.github/workflows/smb-kerberos.yml
@@ -0,0 +1,78 @@
+name: Samba Kerberos SSO
+on:
+  push:
+    branches:
+      - master
+      - stable*
+    paths:
+      - 'apps/files_external/**'
+  pull_request:
+    paths:
+      - 'apps/files_external/**'
+
+jobs:
+  smb-kerberos-tests:
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        php-versions: ['7.4', '8.0']
+
+    name: php${{ matrix.php-versions }}-${{ matrix.ftpd }}
+
+    steps:
+      - name: Checkout server
+        uses: actions/checkout@v2
+        with:
+          submodules: true
+      - name: Pull images
+        run: |
+          docker pull icewind1991/samba-krb-test-dc
+          docker pull icewind1991/samba-krb-test-apache
+          docker pull icewind1991/samba-krb-test-client
+      - name: Setup AD-DC
+        run: |
+          mkdir data
+          sudo chown -R 33 data apps config
+          apps/files_external/tests/setup-krb.sh
+      - name: Set up Nextcloud
+        run: |
+          docker exec --user 33 apache ./occ maintenance:install --verbose --database=sqlite --database-name=nextcloud --database-host=127.0.0.1 --database-user=root --database-pass=rootpassword --admin-user admin --admin-pass password
+          docker exec --user 33 apache ./occ config:system:set trusted_domains 1 --value 'httpd.domain.test'
+
+          # setup user_saml
+          docker exec --user 33 apache ./occ app:enable user_saml --force
+          docker exec --user 33 apache ./occ config:app:set user_saml type --value 'environment-variable'
+          docker exec --user 33 apache ./occ config:app:set user_saml general-uid_mapping --value REMOTE_USER
+
+          # setup external storage
+          docker exec --user 33 apache ./occ app:enable files_external --force
+          docker exec --user 33 apache ./occ files_external:create smb smb smb::kerberosapache
+          docker exec --user 33 apache ./occ files_external:config 1 host krb.domain.test
+          docker exec --user 33 apache ./occ files_external:config 1 share netlogon
+          docker exec --user 33 apache ./occ files_external:list
+      - name: Test SSO
+        run: |
+          mkdir cookies
+          chmod 0777 cookies
+
+          DC_IP=$(docker inspect dc --format '{{.NetworkSettings.IPAddress}}')
+          docker run --rm --name client -v $PWD/cookies:/cookies -v /tmp/shared:/shared --dns $DC_IP --hostname client.domain.test icewind1991/samba-krb-test-client \
+            curl -c /cookies/jar -s --negotiate -u testuser@DOMAIN.TEST: --delegation always http://httpd.domain.test/index.php/apps/user_saml/saml/login
+          CONTENT=$(docker run --rm --name client -v $PWD/cookies:/cookies -v /tmp/shared:/shared --dns $DC_IP --hostname client.domain.test icewind1991/samba-krb-test-client \
+            curl -b /cookies/jar -s --negotiate -u testuser@DOMAIN.TEST: --delegation always http://httpd.domain.test/remote.php/webdav/smb/test.txt)
+          echo $CONTENT
+          CONTENT=$(echo $CONTENT | tr -d '[:space:]')
+          [[ $CONTENT == "testfile" ]]
+
+
+  smb-kerberos-summary:
+    runs-on: ubuntu-latest
+    needs: smb-kerberos-tests
+
+    if: always()
+
+    steps:
+      - name: Summary status
+        run: if ${{ needs.smb-kerberos-tests.result != 'success' }}; then exit 1; fi

diff --git a/apps/files_external/tests/setup-krb.sh b/apps/files_external/tests/setup-krb.sh
new file mode 100755 (executable)
index 0000000..968ba80
--- /dev/null
+++ b/apps/files_external/tests/setup-krb.sh
@@ -0,0 +1,33 @@
+#!/bin/bash
+
+function getContainerHealth {
+  docker inspect --format "{{.State.Health.Status}}" $1
+}
+
+function waitContainer {
+  while STATUS=$(getContainerHealth $1); [ $STATUS != "healthy" ]; do
+    if [ $STATUS == "unhealthy" ]; then
+      echo "Failed!"
+      exit -1
+    fi
+    printf .
+    lf=$'\n'
+    sleep 1
+  done
+  printf "$lf"
+}
+
+mkdir /tmp/shared
+
+# start the dc
+docker run -dit --name dc -v /tmp/shared:/shared --hostname krb.domain.test --cap-add SYS_ADMIN icewind1991/samba-krb-test-dc
+DC_IP=$(docker inspect dc --format '{{.NetworkSettings.IPAddress}}')
+
+waitContainer dc
+
+# start apache
+docker run -d --name apache -v $PWD:/var/www/html -v /tmp/shared:/shared --dns $DC_IP --hostname httpd.domain.test icewind1991/samba-krb-test-apache
+APACHE_IP=$(docker inspect apache --format '{{.NetworkSettings.IPAddress}}')
+
+# add the dns record for apache
+docker exec dc samba-tool dns add krb.domain.test domain.test httpd A $APACHE_IP -U administrator --password=passwOrd1