diff options
| -rw-r--r-- | .github/workflows/smb-kerberos.yml | 49 | ||||
| -rw-r--r-- | apps/files_external/tests/sso-setup/apps.config.php | 15 | ||||
| -rwxr-xr-x | apps/files_external/tests/sso-setup/client-cmd.sh (renamed from apps/files_external/tests/client-cmd.sh) | 0 | ||||
| -rwxr-xr-x | apps/files_external/tests/sso-setup/setup-sso-nc.sh | 21 | ||||
| -rwxr-xr-x | apps/files_external/tests/sso-setup/start-apache.sh | 16 | ||||
| -rwxr-xr-x | apps/files_external/tests/sso-setup/start-dc.sh (renamed from apps/files_external/tests/start-dc.sh) | 1 | ||||
| -rwxr-xr-x | apps/files_external/tests/sso-setup/test-sso-smb.sh | 24 | ||||
| -rwxr-xr-x | apps/files_external/tests/start-apache.sh | 11 |
8 files changed, 93 insertions, 44 deletions
diff --git a/.github/workflows/smb-kerberos.yml b/.github/workflows/smb-kerberos.yml index 0326a882bc0..519b1ce3700 100644 --- a/.github/workflows/smb-kerberos.yml +++ b/.github/workflows/smb-kerberos.yml @@ -25,50 +25,33 @@ jobs: uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac with: submodules: true + - name: Checkout user_saml + uses: actions/checkout@v3 + with: + repository: nextcloud/user_saml + path: apps/user_saml - name: Pull images run: | - docker pull icewind1991/samba-krb-test-dc - docker pull icewind1991/samba-krb-test-apache - docker pull icewind1991/samba-krb-test-client + docker pull ghcr.io/icewind1991/samba-krb-test-dc + docker pull ghcr.io/icewind1991/samba-krb-test-apache + docker pull ghcr.io/icewind1991/samba-krb-test-client + docker tag ghcr.io/icewind1991/samba-krb-test-dc icewind1991/samba-krb-test-dc + docker tag ghcr.io/icewind1991/samba-krb-test-apache icewind1991/samba-krb-test-apache + docker tag ghcr.io/icewind1991/samba-krb-test-client icewind1991/samba-krb-test-client - name: Setup AD-DC run: | - cp apps/files_external/tests/*.sh . - mkdir data - sudo chown -R 33 data apps config - DC_IP=$(./start-dc.sh) - ./start-apache.sh $DC_IP $PWD + DC_IP=$(apps/files_external/tests/sso-setup/start-dc.sh) + apps/files_external/tests/sso-setup/start-apache.sh $DC_IP $PWD echo "DC_IP=$DC_IP" >> $GITHUB_ENV - name: Set up Nextcloud run: | - docker exec --user 33 apache ./occ maintenance:install --verbose --database=sqlite --database-name=nextcloud --database-host=127.0.0.1 --database-user=root --database-pass=rootpassword --admin-user admin --admin-pass password - docker exec --user 33 apache ./occ config:system:set trusted_domains 1 --value 'httpd.domain.test' - - # setup user_saml - docker exec --user 33 apache ./occ app:enable user_saml --force - docker exec --user 33 apache ./occ config:app:set user_saml type --value 'environment-variable' - docker exec --user 33 apache ./occ saml:config:create - docker exec --user 33 apache ./occ saml:config:set 1 --general-uid_mapping=REMOTE_USER - - # setup external storage - docker exec --user 33 apache ./occ app:enable files_external --force - docker exec --user 33 apache ./occ files_external:create smb smb smb::kerberosapache - docker exec --user 33 apache ./occ files_external:config 1 host krb.domain.test - docker exec --user 33 apache ./occ files_external:config 1 share netlogon - docker exec --user 33 apache ./occ files_external:list + apps/files_external/tests/sso-setup/setup-sso-nc.sh - name: Test SSO run: | - mkdir /tmp/shared/cookies - chmod 0777 /tmp/shared/cookies - - echo "SAML login" - ./client-cmd.sh ${{ env.DC_IP }} curl -c /shared/cookies/jar -s --negotiate -u testuser@DOMAIN.TEST: --delegation always http://httpd.domain.test/index.php/apps/user_saml/saml/login - echo "Check we are logged in" - CONTENT=$(./client-cmd.sh ${{ env.DC_IP }} curl -b /shared/cookies/jar -s --negotiate -u testuser@DOMAIN.TEST: --delegation always http://httpd.domain.test/remote.php/webdav/smb/test.txt) - CONTENT=$(echo $CONTENT | head -n 1 | tr -d '[:space:]') - [[ $CONTENT == "testfile" ]] + apps/files_external/tests/sso-setup/test-sso-smb.sh ${{ env.DC_IP }} - name: Show logs if: failure() run: | - docker exec --user 33 apache ./occ log:file FILEPATH=$(docker exec --user 33 apache ./occ log:file | grep "Log file:" | cut -d' ' -f3) + echo "$FILEPATH:" docker exec --user 33 apache cat $FILEPATH diff --git a/apps/files_external/tests/sso-setup/apps.config.php b/apps/files_external/tests/sso-setup/apps.config.php new file mode 100644 index 00000000000..507d43dd44e --- /dev/null +++ b/apps/files_external/tests/sso-setup/apps.config.php @@ -0,0 +1,15 @@ +<?php +$CONFIG = [ + "apps_paths" => [ + [ + "path" => "/var/www/html/apps", + "url" => "/apps", + "writable" => false, + ], + [ + "path" => "/var/www/html/extra-apps", + "url" => "/extra-apps", + "writable" => true, + ], + ], +]; diff --git a/apps/files_external/tests/client-cmd.sh b/apps/files_external/tests/sso-setup/client-cmd.sh index c97045bea4c..c97045bea4c 100755 --- a/apps/files_external/tests/client-cmd.sh +++ b/apps/files_external/tests/sso-setup/client-cmd.sh diff --git a/apps/files_external/tests/sso-setup/setup-sso-nc.sh b/apps/files_external/tests/sso-setup/setup-sso-nc.sh new file mode 100755 index 00000000000..60cc51ff68d --- /dev/null +++ b/apps/files_external/tests/sso-setup/setup-sso-nc.sh @@ -0,0 +1,21 @@ +#!/usr/bin/env bash +set -e + +docker exec --user 33 apache ./occ maintenance:install --verbose --database=sqlite --database-name=nextcloud --database-host=127.0.0.1 --database-user=root --database-pass=rootpassword --admin-user admin --admin-pass password +docker exec --user 33 apache ./occ config:system:set trusted_domains 1 --value 'httpd.domain.test' + +# setup user_saml +docker exec --user 33 apache ./occ app:enable user_saml --force +docker exec --user 33 apache ./occ config:app:set user_saml type --value 'environment-variable' +docker exec --user 33 apache ./occ saml:config:create +docker exec --user 33 apache ./occ saml:config:set 1 --general-uid_mapping=REMOTE_USER + +# create user +docker exec -e OC_PASS=test --user 33 apache ./occ user:add 'testuser@DOMAIN.TEST' --password-from-env + +# setup external storage +docker exec --user 33 apache ./occ app:enable files_external --force +docker exec --user 33 apache ./occ files_external:create smb smb smb::kerberosapache +docker exec --user 33 apache ./occ files_external:config 1 host krb.domain.test +docker exec --user 33 apache ./occ files_external:config 1 share netlogon +docker exec --user 33 apache ./occ files_external:list diff --git a/apps/files_external/tests/sso-setup/start-apache.sh b/apps/files_external/tests/sso-setup/start-apache.sh new file mode 100755 index 00000000000..b483c73fa4f --- /dev/null +++ b/apps/files_external/tests/sso-setup/start-apache.sh @@ -0,0 +1,16 @@ +#!/usr/bin/env bash +set -e + +SCRIPT_DIR="${0%/*}" + +docker rm -f apache 2>/dev/null > /dev/null + +docker run -d --name apache -v $2:/var/www/html -v /var/www/html/data -v /var/www/html/config -v /var/www/html/extra-apps -v /tmp/shared:/shared --dns $1 --hostname httpd.domain.test icewind1991/samba-krb-test-apache 1>&2 +APACHE_IP=$(docker inspect apache --format '{{.NetworkSettings.IPAddress}}') +docker exec apache chown 33 /var/www/html/config /var/www/html/data /var/www/html/extra-apps +docker cp "$SCRIPT_DIR/apps.config.php" apache:/var/www/html/config/apps.config.php + +# add the dns record for apache +docker exec dc samba-tool dns add krb.domain.test domain.test httpd A $APACHE_IP -U administrator --password=passwOrd1 1>&2 + +echo $APACHE_IP diff --git a/apps/files_external/tests/start-dc.sh b/apps/files_external/tests/sso-setup/start-dc.sh index 45fbbfbf0b5..df8b02318df 100755 --- a/apps/files_external/tests/start-dc.sh +++ b/apps/files_external/tests/sso-setup/start-dc.sh @@ -1,4 +1,5 @@ #!/usr/bin/env bash +set -e function getContainerHealth { docker inspect --format "{{.State.Health.Status}}" $1 diff --git a/apps/files_external/tests/sso-setup/test-sso-smb.sh b/apps/files_external/tests/sso-setup/test-sso-smb.sh new file mode 100755 index 00000000000..b0f0a2c7af9 --- /dev/null +++ b/apps/files_external/tests/sso-setup/test-sso-smb.sh @@ -0,0 +1,24 @@ +#!/usr/bin/env bash +set -e + +DC_IP="$1" +SCRIPT_DIR="${0%/*}" + +echo -n "Checking that we can authenticate using kerberos: " +LOGIN_CONTENT=$("$SCRIPT_DIR/client-cmd.sh" $DC_IP curl -i -s --negotiate -u testuser@DOMAIN.TEST: --delegation always http://httpd.domain.test/index.php/apps/user_saml/saml/login?originalUrl=success) +if [[ "$LOGIN_CONTENT" =~ "Location: success" ]]; then + echo "✔️" +else + echo "❌" + exit 1 +fi +echo -n "Getting test file: " +CONTENT=$("$SCRIPT_DIR/client-cmd.sh" $DC_IP curl -s --negotiate -u testuser@DOMAIN.TEST: --delegation always http://httpd.domain.test/remote.php/webdav/smb/test.txt) +CONTENT=$(echo $CONTENT | head -n 1 | tr -d '[:space:]') + +if [[ $CONTENT == "testfile" ]]; then + echo "✔️" +else + echo "❌" + exit 1 +fi diff --git a/apps/files_external/tests/start-apache.sh b/apps/files_external/tests/start-apache.sh deleted file mode 100755 index 2c3e178e2ef..00000000000 --- a/apps/files_external/tests/start-apache.sh +++ /dev/null @@ -1,11 +0,0 @@ -#!/usr/bin/env bash - -docker rm -f apache 2>/dev/null > /dev/null - -docker run -d --name apache -v $2:/var/www/html -v /tmp/shared:/shared --dns $1 --hostname httpd.domain.test icewind1991/samba-krb-test-apache 1>&2 -APACHE_IP=$(docker inspect apache --format '{{.NetworkSettings.IPAddress}}') - -# add the dns record for apache -docker exec dc samba-tool dns add krb.domain.test domain.test httpd A $APACHE_IP -U administrator --password=passwOrd1 1>&2 - -echo $APACHE_IP |