blob: 0ade03a07450442b657fd195c3cbbfec0e98f997 [file] [log] [blame]
Sivas SRR7d7bae32019-05-29 00:31:14 -05001*** Settings ***
2Documentation Test Redfish LDAP user configuration.
Sivas SRR73379bc2019-07-22 10:21:45 -05003
Sivas SRRd21c9842019-06-21 05:41:18 -05004Library ../../lib/gen_robot_valid.py
Sivas SRR7d7bae32019-05-29 00:31:14 -05005Resource ../../lib/resource.robot
6Resource ../../lib/bmc_redfish_resource.robot
7Resource ../../lib/openbmc_ffdc.robot
Sivas SRRf4ec6492019-06-16 01:59:30 -05008Library ../../lib/gen_robot_valid.py
Sivas SRR7d7bae32019-05-29 00:31:14 -05009
10Suite Setup Suite Setup Execution
Sivas SRR939b4b12019-06-26 00:01:59 -050011Suite Teardown Run Keywords Restore LDAP Privilege AND Redfish.Logout
Sivas SRRf4ec6492019-06-16 01:59:30 -050012Test Teardown FFDC On Test Case Fail
Sivas SRR7d7bae32019-05-29 00:31:14 -050013
Sivas SRR9358b5c2019-06-06 04:57:03 -050014Force Tags LDAP_Test
15
Sivas SRRf4ec6492019-06-16 01:59:30 -050016*** Variables ***
Sivas SRR873de8e2019-09-26 00:37:53 -050017${old_ldap_privilege} ${EMPTY}
Sivas SRRd21c9842019-06-21 05:41:18 -050018&{old_account_service} &{EMPTY}
Sivas SRR873de8e2019-09-26 00:37:53 -050019&{old_ldap_config} &{EMPTY}
20${hostname} ${EMPTY}
Sivas SRRf4ec6492019-06-16 01:59:30 -050021
Sivas SRR7d7bae32019-05-29 00:31:14 -050022** Test Cases **
23
Sivas SRRb1b85752019-07-04 01:28:28 -050024Verify LDAP Configuration Created
Sivas SRR6f8ac5d2019-08-27 01:09:52 -050025 [Documentation] Verify that LDAP configuration created.
Sivas SRRb1b85752019-07-04 01:28:28 -050026 [Tags] Verify_LDAP_Configuration_Created
27
28 Create LDAP Configuration
29 # Call 'Get LDAP Configuration' to verify that LDAP configuration exists.
30 Get LDAP Configuration ${LDAP_TYPE}
31 Sleep 10s
32 Redfish.Login ${LDAP_USER} ${LDAP_USER_PASSWORD}
33 Redfish.Logout
34 Redfish.Login
35
36
37Verify LDAP Service Disable
Sivas SRR6f8ac5d2019-08-27 01:09:52 -050038 [Documentation] Verify that LDAP is disabled and that LDAP user cannot
39 ... login.
Sivas SRRb1b85752019-07-04 01:28:28 -050040 [Tags] Verify_LDAP_Service_Disable
41
42 Redfish.Patch ${REDFISH_BASE_URI}AccountService
43 ... body={'${LDAP_TYPE}': {'ServiceEnabled': ${False}}}
44 Sleep 15s
45 ${resp}= Run Keyword And Return Status Redfish.Login ${LDAP_USER}
46 ... ${LDAP_USER_PASSWORD}
George Keishing333bb722019-12-11 11:40:49 -060047 Should Be Equal ${resp} ${False}
48 ... msg=LDAP user was able to login even though the LDAP service was disabled.
Sivas SRRb1b85752019-07-04 01:28:28 -050049 Redfish.Logout
50 Redfish.Login
51 # Enabling LDAP so that LDAP user works.
52 Redfish.Patch ${REDFISH_BASE_URI}AccountService
53 ... body={'${LDAP_TYPE}': {'ServiceEnabled': ${True}}}
54 Redfish.Logout
55 Redfish.Login
56
57
Sivas SRR73379bc2019-07-22 10:21:45 -050058Verify LDAP Login With ServiceEnabled
Sivas SRR6f8ac5d2019-08-27 01:09:52 -050059 [Documentation] Verify that LDAP Login with ServiceEnabled.
Sivas SRR73379bc2019-07-22 10:21:45 -050060 [Tags] Verify_LDAP_Login_With_ServiceEnabled
61
62 Disable Other LDAP
63 # Actual service enablement.
64 Redfish.Patch ${REDFISH_BASE_URI}AccountService
65 ... body={'${LDAP_TYPE}': {'ServiceEnabled': ${True}}}
66 Sleep 15s
67 # After update, LDAP login.
68 Redfish.Login ${LDAP_USER} ${LDAP_USER_PASSWORD}
69 Redfish.Logout
70 Redfish.Login
71
72
73Verify LDAP Login With Correct AuthenticationType
Sivas SRR6f8ac5d2019-08-27 01:09:52 -050074 [Documentation] Verify that LDAP Login with right AuthenticationType.
Sivas SRR73379bc2019-07-22 10:21:45 -050075 [Tags] Verify_LDAP_Login_With_Correct_AuthenticationType
76
77 Redfish.Patch ${REDFISH_BASE_URI}AccountService
78 ... body={'${ldap_type}': {'Authentication': {'AuthenticationType':'UsernameAndPassword'}}}
79 Sleep 15s
80 # After update, LDAP login.
81 Redfish.Login ${LDAP_USER} ${LDAP_USER_PASSWORD}
82 Redfish.Logout
83 Redfish.Login
84
85
86Verify LDAP Config Update With Incorrect AuthenticationType
Sivas SRR6f8ac5d2019-08-27 01:09:52 -050087 [Documentation] Verify that invalid AuthenticationType is not updated.
Sivas SRR73379bc2019-07-22 10:21:45 -050088 [Tags] Verify_LDAP_Update_With_Incorrect_AuthenticationType
89
George Keishing2d0804e2019-12-12 22:27:05 -060090 ${body}= Catenate {'${ldap_type}': {'Authentication': {'AuthenticationType':'KerberosKeytab'}}}
Prashanth Katti7d38a092020-01-10 06:01:09 -060091
Sivas SRR73379bc2019-07-22 10:21:45 -050092 Redfish.Patch ${REDFISH_BASE_URI}AccountService
Prashanth Katti7d38a092020-01-10 06:01:09 -060093 ... body=${body} valid_status_codes=[400]
Sivas SRR73379bc2019-07-22 10:21:45 -050094
95
96Verify LDAP Login With Correct LDAP URL
97 [Documentation] Verify LDAP Login with right LDAP URL.
98 [Tags] Verify_LDAP_Login_With_Correct_LDAP_URL
99
100 Config LDAP URL ${LDAP_SERVER_URI}
101
102
103Verify LDAP Config Update With Incorrect LDAP URL
Sivas SRR6f8ac5d2019-08-27 01:09:52 -0500104 [Documentation] Verify that LDAP Login fails with invalid LDAP URL.
Sivas SRR73379bc2019-07-22 10:21:45 -0500105 [Tags] Verify_LDAP_Config_Update_With_Incorrect_LDAP_URL
106 [Teardown] Run Keywords Restore LDAP URL AND
107 ... FFDC On Test Case Fail
108
Prashanth Katti7d38a092020-01-10 06:01:09 -0600109 Config LDAP URL ldap://1.2.3.4/ ${FALSE}
Sivas SRR73379bc2019-07-22 10:21:45 -0500110
Sivas SRR7d7bae32019-05-29 00:31:14 -0500111Verify LDAP Configuration Exist
Sivas SRR6f8ac5d2019-08-27 01:09:52 -0500112 [Documentation] Verify that LDAP configuration is available.
Sivas SRR7d7bae32019-05-29 00:31:14 -0500113 [Tags] Verify_LDAP_Configuration_Exist
Sivas SRR73379bc2019-07-22 10:21:45 -0500114
Sivas SRR7d7bae32019-05-29 00:31:14 -0500115 ${resp}= Redfish.Get Attribute ${REDFISH_BASE_URI}AccountService
116 ... ${LDAP_TYPE} default=${EMPTY}
117 Should Not Be Empty ${resp} msg=LDAP configuration is not defined.
118
119
120Verify LDAP User Login
Sivas SRR6f8ac5d2019-08-27 01:09:52 -0500121 [Documentation] Verify that LDAP user able to login into BMC.
Sivas SRR7d7bae32019-05-29 00:31:14 -0500122 [Tags] Verify_LDAP_User_Login
Sivas SRR73379bc2019-07-22 10:21:45 -0500123
124 Redfish.Login ${LDAP_USER} ${LDAP_USER_PASSWORD}
Sivas SRR939b4b12019-06-26 00:01:59 -0500125 Redfish.Logout
126 Redfish.Login
Sivas SRR7d7bae32019-05-29 00:31:14 -0500127
128
129Verify LDAP Service Available
Sivas SRR6f8ac5d2019-08-27 01:09:52 -0500130 [Documentation] Verify that LDAP service is available.
Sivas SRR7d7bae32019-05-29 00:31:14 -0500131 [Tags] Verify_LDAP_Service_Available
Sivas SRR73379bc2019-07-22 10:21:45 -0500132
Sivas SRR7d7bae32019-05-29 00:31:14 -0500133 @{ldap_configuration}= Get LDAP Configuration ${LDAP_TYPE}
134 Should Contain ${ldap_configuration} LDAPService
135 ... msg=LDAPService is not available.
136
137
Sivas SRR108f9d32019-06-03 10:05:34 -0500138Verify LDAP Login Works After BMC Reboot
Sivas SRR6f8ac5d2019-08-27 01:09:52 -0500139 [Documentation] Verify that LDAP login works after BMC reboot.
Sivas SRR108f9d32019-06-03 10:05:34 -0500140 [Tags] Verify_LDAP_Login_Works_After_BMC_Reboot
Sivas SRR73379bc2019-07-22 10:21:45 -0500141
Sivas SRR108f9d32019-06-03 10:05:34 -0500142 Redfish OBMC Reboot (off)
143 Redfish.Login ${LDAP_USER} ${LDAP_USER_PASSWORD}
144 Redfish.Logout
Sivas SRR939b4b12019-06-26 00:01:59 -0500145 Redfish.Login
Sivas SRR108f9d32019-06-03 10:05:34 -0500146
147
148Verify LDAP User With Admin Privilege Able To Do BMC Reboot
Sivas SRR6f8ac5d2019-08-27 01:09:52 -0500149 [Documentation] Verify that LDAP user with administrator privilege able to do BMC reboot.
Sivas SRR108f9d32019-06-03 10:05:34 -0500150 [Tags] Verify_LDAP_User_With_Admin_Privilege_Able_To_Do_BMC_Reboot
151
Sivas SRR73379bc2019-07-22 10:21:45 -0500152
Sivas SRR108f9d32019-06-03 10:05:34 -0500153 Update LDAP Configuration with LDAP User Role And Group ${LDAP_TYPE}
154 ... ${GROUP_PRIVILEGE} ${GROUP_NAME}
155 Redfish.Login ${LDAP_USER} ${LDAP_USER_PASSWORD}
156 # With LDAP user and with right privilege trying to do BMC reboot.
157 Redfish OBMC Reboot (off)
158 Redfish.Login ${LDAP_USER} ${LDAP_USER_PASSWORD}
159 Redfish.Logout
Sivas SRR939b4b12019-06-26 00:01:59 -0500160 Redfish.Login
Sivas SRR108f9d32019-06-03 10:05:34 -0500161
162
Sivas SRR2b83ec02019-07-12 11:30:20 -0500163Verify LDAP User With Operator Privilege Able To Do Host Poweroff
Sivas SRR6f8ac5d2019-08-27 01:09:52 -0500164 [Documentation] Verify that LDAP user with operator privilege can do host
165 ... power off.
Sivas SRR2b83ec02019-07-12 11:30:20 -0500166 [Tags] Verify_LDAP_User_With_Operator_Privilege_Able_To_Do_Host_Poweroff
Sivas SRRf4ec6492019-06-16 01:59:30 -0500167 [Teardown] Restore LDAP Privilege
168
Sivas SRRf4ec6492019-06-16 01:59:30 -0500169 Update LDAP Configuration with LDAP User Role And Group ${LDAP_TYPE}
170 ... Operator ${GROUP_NAME}
Sivas SRRf4ec6492019-06-16 01:59:30 -0500171
Sivas SRRf4ec6492019-06-16 01:59:30 -0500172 Redfish.Login ${LDAP_USER} ${LDAP_USER_PASSWORD}
Sivas SRR2b83ec02019-07-12 11:30:20 -0500173 # Verify that the LDAP user with operator privilege is able to power the system off.
174 Redfish.Post ${REDFISH_POWER_URI}
Sivas SRR3d82b3c2019-07-12 12:20:04 -0500175 ... body={'ResetType': 'ForceOff'} valid_status_codes=[200]
Sivas SRRf4ec6492019-06-16 01:59:30 -0500176 Redfish.Logout
Sivas SRR939b4b12019-06-26 00:01:59 -0500177 Redfish.Login
Sivas SRRf4ec6492019-06-16 01:59:30 -0500178
179
Sivas SRRd21c9842019-06-21 05:41:18 -0500180Verify AccountLockout Attributes Set To Zero
Sivas SRR6f8ac5d2019-08-27 01:09:52 -0500181 [Documentation] Verify that attribute AccountLockoutDuration and
Sivas SRRd21c9842019-06-21 05:41:18 -0500182 ... AccountLockoutThreshold are set to 0.
183 [Teardown] Run Keywords Restore AccountLockout Attributes AND
184 ... FFDC On Test Case Fail
185 [Tags] Verify_AccountLockout_Attributes_Set_To_Zero
Sivas SRR73379bc2019-07-22 10:21:45 -0500186
Sivas SRRd21c9842019-06-21 05:41:18 -0500187 ${old_account_service}= Redfish.Get Properties
188 ... ${REDFISH_BASE_URI}AccountService
Michael Walsh39c00512019-07-17 10:54:06 -0500189 Rprint Vars old_account_service
Sivas SRRd21c9842019-06-21 05:41:18 -0500190 Redfish.Patch ${REDFISH_BASE_URI}AccountService
191 ... body=[('AccountLockoutDuration', 0)]
192 Redfish.Patch ${REDFISH_BASE_URI}AccountService
193 ... body=[('AccountLockoutThreshold', 0)]
194
195
Sivas SRR939b4b12019-06-26 00:01:59 -0500196Verify LDAP User With Read Privilege Able To Check Inventory
Sivas SRR6f8ac5d2019-08-27 01:09:52 -0500197 [Documentation] Verify that LDAP user with read privilege able to
Sivas SRR939b4b12019-06-26 00:01:59 -0500198 ... read firmware inventory.
199 [Tags] Verify_LDAP_User_With_Read_Privilege_Able_To_Check_Inventory
200 [Teardown] Run Keywords FFDC On Test Case Fail AND Restore LDAP Privilege
201 [Template] Set Read Privilege And Check Firmware Inventory
202
Prashanth Kattiedce4a92020-01-16 07:28:39 -0600203 ReadOnly
Sivas SRR939b4b12019-06-26 00:01:59 -0500204
205
206Verify LDAP User With Read Privilege Should Not Do Host Poweron
Sivas SRR6f8ac5d2019-08-27 01:09:52 -0500207 [Documentation] Verify that LDAP user with read privilege should not be
Sivas SRR939b4b12019-06-26 00:01:59 -0500208 ... allowed to power on the host.
209 [Tags] Verify_LDAP_User_With_Read_Privilege_Should_Not_Do_Host_Poweron
210 [Teardown] Run Keywords FFDC On Test Case Fail AND Restore LDAP Privilege
211 [Template] Set Read Privilege And Check Poweron
212
Prashanth Kattiedce4a92020-01-16 07:28:39 -0600213 ReadOnly
Sivas SRR939b4b12019-06-26 00:01:59 -0500214
215
Sivas SRRe9a47862019-08-05 07:13:43 -0500216Update LDAP Group Name And Verify Operations
Sivas SRR6f8ac5d2019-08-27 01:09:52 -0500217 [Documentation] Verify that LDAP group name update and able to do right
218 ... operations.
Sivas SRRe9a47862019-08-05 07:13:43 -0500219 [Tags] Update_LDAP_Group_Name_And_Verify_Operations
220 [Template] Update LDAP Config And Verify Set Host Name
221 [Teardown] Restore LDAP Privilege
222
223 # group_name group_privilege valid_status_codes
224 ${GROUP_NAME} Administrator [${HTTP_OK}]
225 ${GROUP_NAME} Operator [${HTTP_UNAUTHORIZED}, ${HTTP_FORBIDDEN}]
Prashanth Kattiedce4a92020-01-16 07:28:39 -0600226 ${GROUP_NAME} ReadOnly [${HTTP_UNAUTHORIZED}, ${HTTP_FORBIDDEN}]
227 ${GROUP_NAME} NoAccess [${HTTP_UNAUTHORIZED}, ${HTTP_FORBIDDEN}]
Sivas SRRe9a47862019-08-05 07:13:43 -0500228 Invalid_LDAP_Group_Name Administrator [${HTTP_UNAUTHORIZED}, ${HTTP_FORBIDDEN}]
229 Invalid_LDAP_Group_Name Operator [${HTTP_UNAUTHORIZED}, ${HTTP_FORBIDDEN}]
Prashanth Kattiedce4a92020-01-16 07:28:39 -0600230 Invalid_LDAP_Group_Name ReadOnly [${HTTP_UNAUTHORIZED}, ${HTTP_FORBIDDEN}]
231 Invalid_LDAP_Group_Name NoAccess [${HTTP_UNAUTHORIZED}, ${HTTP_FORBIDDEN}]
Sivas SRRe9a47862019-08-05 07:13:43 -0500232
233
Sivas SRRa031d2d2019-08-16 07:49:52 -0500234Verify LDAP BaseDN Update And LDAP Login
235 [Documentation] Update LDAP BaseDN of LDAP configuration and verify
Sivas SRR6f8ac5d2019-08-27 01:09:52 -0500236 ... that LDAP login works.
Sivas SRRa031d2d2019-08-16 07:49:52 -0500237 [Tags] Verify_LDAP_BaseDN_Update_And_LDAP_Login
238
239
240 ${body}= Catenate {'${LDAP_TYPE}': { 'LDAPService': {'SearchSettings':
241 ... {'BaseDistinguishedNames': ['${LDAP_BASE_DN}']}}}}
242 Redfish.Patch ${REDFISH_BASE_URI}AccountService body=${body}
243 Sleep 15s
244 Redfish Verify LDAP Login
245
246
247Verify LDAP BindDN Update And LDAP Login
248 [Documentation] Update LDAP BindDN of LDAP configuration and verify
Sivas SRR6f8ac5d2019-08-27 01:09:52 -0500249 ... that LDAP login works.
Sivas SRRa031d2d2019-08-16 07:49:52 -0500250 [Tags] Verify_LDAP_BindDN_Update_And_LDAP_Login
251
252 ${body}= Catenate {'${LDAP_TYPE}': { 'Authentication':
253 ... {'AuthenticationType':'UsernameAndPassword', 'Username':
254 ... '${LDAP_BIND_DN}'}}}
255 Redfish.Patch ${REDFISH_BASE_URI}AccountService body=${body}
256 Sleep 15s
257 Redfish Verify LDAP Login
258
259
260Verify LDAP BindDN Password Update And LDAP Login
261 [Documentation] Update LDAP BindDN password of LDAP configuration and
Sivas SRR6f8ac5d2019-08-27 01:09:52 -0500262 ... verify that LDAP login works.
Sivas SRRa031d2d2019-08-16 07:49:52 -0500263 [Tags] Verify_LDAP_BindDN_Passsword_Update_And_LDAP_Login
264
265
266 ${body}= Catenate {'${LDAP_TYPE}': { 'Authentication':
267 ... {'AuthenticationType':'UsernameAndPassword', 'Password':
268 ... '${LDAP_BIND_DN_PASSWORD}'}}}
269 Redfish.Patch ${REDFISH_BASE_URI}AccountService body=${body}
270 Sleep 15s
271 Redfish Verify LDAP Login
272
273
274Verify LDAP Type Update And LDAP Login
275 [Documentation] Update LDAP type of LDAP configuration and verify
Sivas SRR6f8ac5d2019-08-27 01:09:52 -0500276 ... that LDAP login works.
Sivas SRRa031d2d2019-08-16 07:49:52 -0500277 [Tags] Verify_LDAP_Type_Update_And_LDAP_Login
278
279 Disable Other LDAP
280 Redfish.Patch ${REDFISH_BASE_URI}AccountService
281 ... body={'${LDAP_TYPE}': {'ServiceEnabled': ${True}}}
282 Sleep 15s
283 Redfish Verify LDAP Login
284
285
Sivas SRR6f8ac5d2019-08-27 01:09:52 -0500286Verify Authorization With Null Privilege
287 [Documentation] Verify the failure of LDAP authorization with empty
288 ... privilege.
289 [Tags] Verify_LDAP_Authorization_With_Null_Privilege
Sivas SRR6f8ac5d2019-08-27 01:09:52 -0500290 [Teardown] Restore LDAP Privilege
291
292 Update LDAP Config And Verify Set Host Name ${GROUP_NAME} ${EMPTY}
293 ... [${HTTP_FORBIDDEN}]
294
295
296Verify Authorization With Invalid Privilege
297 [Documentation] Verify that LDAP user authorization with wrong privilege
298 ... fails.
299 [Tags] Verify_LDAP_Authorization_With_Invalid_Privilege
Sivas SRR6f8ac5d2019-08-27 01:09:52 -0500300 [Teardown] Restore LDAP Privilege
301
302 Update LDAP Config And Verify Set Host Name ${GROUP_NAME}
303 ... Invalid_Privilege [${HTTP_FORBIDDEN}]
304
305
306Verify LDAP Login With Invalid Data
307 [Documentation] Verify that LDAP login with Invalid LDAP data and
308 ... right LDAP user fails.
309 [Tags] Verify_LDAP_Login_With_Invalid_Data
310 [Teardown] Run Keywords FFDC On Test Case Fail AND
311 ... Create LDAP Configuration
312
313 Create LDAP Configuration ${LDAP_TYPE} Invalid_LDAP_Server_URI
314 ... Invalid_LDAP_BIND_DN LDAP_BIND_DN_PASSWORD
315 ... Invalid_LDAP_BASE_DN
316 Sleep 15s
317 Redfish Verify LDAP Login ${False}
318
319
320Verify LDAP Config Creation Without BASE_DN
321 [Documentation] Verify that LDAP login with LDAP configuration
322 ... created without BASE_DN fails.
323 [Tags] Verify_LDAP_Config_Creation_Without_BASE_DN
324 [Teardown] Run Keywords FFDC On Test Case Fail AND
325 ... Create LDAP Configuration
326
327 Create LDAP Configuration ${LDAP_TYPE} Invalid_LDAP_Server_URI
328 ... Invalid_LDAP_BIND_DN LDAP_BIND_DN_PASSWORD ${EMPTY}
329 Sleep 15s
330 Redfish Verify LDAP Login ${False}
331
332
333Verify LDAP Authentication Without Password
334 [Documentation] Verify that LDAP user authentication without LDAP
335 ... user password fails.
336 [Tags] Verify_LDAP_Authentication_Without_Password
Sivas SRR6f8ac5d2019-08-27 01:09:52 -0500337
338 ${status}= Run Keyword And Return Status Redfish.Login ${LDAP_USER}
339 Valid Value status [${False}]
340
341
Sivas SRRcde694c2019-09-09 12:20:34 -0500342Verify LDAP Login With Invalid BASE_DN
343 [Documentation] Verify that LDAP login with invalid BASE_DN and
344 ... valid LDAP user fails.
345 [Tags] Verify_LDAP_Login_With_Invalid_BASE_DN
346 [Teardown] Run Keywords FFDC On Test Case Fail AND
347 ... Create LDAP Configuration
348
349 Create LDAP Configuration ${LDAP_TYPE} ${LDAP_SERVER_URI}
350 ... ${LDAP_BIND_DN} ${LDAP_BIND_DN_PASSWORD} Invalid_LDAP_BASE_DN
351 Sleep 15s
352 Redfish Verify LDAP Login ${False}
353
354
355Verify LDAP Login With Invalid BIND_DN_PASSWORD
356 [Documentation] Verify that LDAP login with invalid BIND_DN_PASSWORD and
357 ... valid LDAP user fails.
358 [Tags] Verify_LDAP_Login_With_Invalid_BIND_DN_PASSWORD
359 [Teardown] Run Keywords FFDC On Test Case Fail AND
360 ... Create LDAP Configuration
361
362 Create LDAP Configuration ${LDAP_TYPE} ${LDAP_SERVER_URI}
363 ... ${LDAP_BIND_DN} INVALID_LDAP_BIND_DN_PASSWORD ${LDAP_BASE_DN}
364 Sleep 15s
365 Redfish Verify LDAP Login ${False}
366
367
368Verify LDAP Login With Invalid BASE_DN And Invalid BIND_DN
369 [Documentation] Verify that LDAP login with invalid BASE_DN and invalid
370 ... BIND_DN and valid LDAP user fails.
371 [Tags] Verify_LDAP_Login_With_Invalid_BASE_DN_And_Invalid_BIND_DN
372 [Teardown] Run Keywords FFDC On Test Case Fail AND
373 ... Create LDAP Configuration
374
375 Create LDAP Configuration ${LDAP_TYPE} ${LDAP_SERVER_URI}
376 ... INVALID_LDAP_BIND_DN ${LDAP_BIND_DN_PASSWORD} INVALID_LDAP_BASE_DN
377 Sleep 15s
378 Redfish Verify LDAP Login ${False}
379
380
381Verify Group Name And Group Privilege Able To Modify
382 [Documentation] Verify that LDAP group name and group privilege able to
383 ... modify.
384 [Tags] Verify_Group_Name_And_Group_Privilege_Able_To_Modify
Sivas SRR873de8e2019-09-26 00:37:53 -0500385 [Setup] Update LDAP Configuration with LDAP User Role And Group
Sivas SRRcde694c2019-09-09 12:20:34 -0500386 ... ${LDAP_TYPE} Operator ${GROUP_NAME}
387
388 Update LDAP Configuration with LDAP User Role And Group ${LDAP_TYPE}
389 ... Administrator ${GROUP_NAME}
390
391
392Verify LDAP Login With Invalid BIND_DN
393 [Documentation] Verify that LDAP login with invalid BIND_DN and
394 ... valid LDAP user fails.
395 [Tags] Verify_LDAP_Login_With_Invalid_BIND_DN
396 [Teardown] Run Keywords FFDC On Test Case Fail AND
397 ... Create LDAP Configuration
398
399 Create LDAP Configuration ${LDAP_TYPE} ${LDAP_SERVER_URI}
400 ... Invalid_LDAP_BIND_DN ${LDAP_BIND_DN_PASSWORD} ${LDAP_BASE_DN}
401 Sleep 15s
402 Redfish Verify LDAP Login ${False}
403
404
405Verify LDAP Authentication With Invalid LDAP User
406 [Documentation] Verify that LDAP user authentication for user not exist
407 ... in LDAP server and fails.
408 [Tags] Verify_LDAP_Authentication_With_Invalid_LDAP_User
Sivas SRRcde694c2019-09-09 12:20:34 -0500409
410 ${status}= Run Keyword And Return Status Redfish.Login INVALID_LDAP_USER
411 ... ${LDAP_USER_PASSWORD}
412 Valid Value status [${False}]
413
414
Prashanth Kattife798812020-01-31 07:04:26 -0600415Update LDAP User Roles And Verify Host Poweroff Operation
416 [Documentation] Update LDAP user roles and verify host poweroff operation.
417 [Tags] Update_LDAP_User_Roles_And_Verify_Host_Poweroff_Operation
418 [Teardown] Restore LDAP Privilege
419
420 [Template] Update LDAP User Role And Host Poweroff
421 # ldap_type group_privilege group_name valid_status_codes
422
423 # Verify LDAP user with NoAccess privilege not able to do host poweroff.
424 ${LDAP_TYPE} NoAccess ${GROUP_NAME} ${HTTP_FORBIDDEN}
425
426 # Verify LDAP user with ReadOnly privilege not able to do host poweroff.
427 ${LDAP_TYPE} ReadOnly ${GROUP_NAME} ${HTTP_FORBIDDEN}
428
429 # Verify LDAP user with Operator privilege able to do host poweroff.
430 ${LDAP_TYPE} Operator ${GROUP_NAME} ${HTTP_OK}
431
432 # Verify LDAP user with Administrator privilege able to do host poweroff.
433 ${LDAP_TYPE} Administrator ${GROUP_NAME} ${HTTP_OK}
434
435
Sivas SRR7d7bae32019-05-29 00:31:14 -0500436*** Keywords ***
Sivas SRRd21c9842019-06-21 05:41:18 -0500437
Sivas SRRa031d2d2019-08-16 07:49:52 -0500438Redfish Verify LDAP Login
439 [Documentation] LDAP user log into BMC.
Sivas SRR6f8ac5d2019-08-27 01:09:52 -0500440 [Arguments] ${valid_status}=${True}
441
442 # Description of argument(s):
443 # valid_status Expected status of LDAP login ("True" or "False").
Sivas SRRa031d2d2019-08-16 07:49:52 -0500444
445 # According to our repo coding rules, Redfish.Login is to be done in Suite
446 # Setup and Redfish.Logout is to be done in Suite Teardown. For any
447 # deviation from this rule (such as in this keyword), the deviant code
448 # must take steps to restore us to our original logged-in state.
449
Sivas SRR6f8ac5d2019-08-27 01:09:52 -0500450 ${status}= Run Keyword And Return Status Redfish.Login ${LDAP_USER}
451 ... ${LDAP_USER_PASSWORD}
452 Valid Value status [${valid_status}]
Sivas SRRa031d2d2019-08-16 07:49:52 -0500453 Redfish.Logout
454 Redfish.Login
455
456
Sivas SRRe9a47862019-08-05 07:13:43 -0500457Update LDAP Config And Verify Set Host Name
458 [Documentation] Update LDAP config and verify by attempting to set host name.
459 [Arguments] ${group_name} ${group_privilege}=Administrator
460 ... ${valid_status_codes}=[${HTTP_OK}]
461
462 # Description of argument(s):
463 # group_name The group name of user.
464 # group_privilege The group privilege ("Administrator",
465 # "Operator", "User" or "Callback").
466 # valid_status_codes Expected return code(s) from patch
467 # operation (e.g. "200") used to update
468 # HostName. See prolog of rest_request
469 # method in redfish_plut.py for details.
470 Update LDAP Configuration with LDAP User Role And Group ${LDAP_TYPE}
471 ... ${group_privilege} ${group_name}
472 Redfish.Login ${LDAP_USER} ${LDAP_USER_PASSWORD}
473 # Verify that the LDAP user in ${group_name} with the given privilege is
474 # allowed to change the hostname.
Sivas SRRe9a47862019-08-05 07:13:43 -0500475 Redfish.Patch ${REDFISH_NW_PROTOCOL_URI} body={'HostName': '${hostname}'}
476 ... valid_status_codes=${valid_status_codes}
477 Redfish.Logout
478 Redfish.Login
479
480
Sivas SRR73379bc2019-07-22 10:21:45 -0500481Disable Other LDAP
482 [Documentation] Disable other LDAP configuration.
483
484 # First disable other LDAP.
485 ${inverse_ldap_type}= Set Variable If '${LDAP_TYPE}' == 'LDAP' ActiveDirectory LDAP
486 Redfish.Patch ${REDFISH_BASE_URI}AccountService
487 ... body={'${inverse_ldap_type}': {'ServiceEnabled': ${False}}}
488 Sleep 15s
489
490
Sivas SRRb1b85752019-07-04 01:28:28 -0500491Create LDAP Configuration
492 [Documentation] Create LDAP configuration.
493 [Arguments] ${ldap_type}=${LDAP_TYPE} ${ldap_server_uri}=${LDAP_SERVER_URI}
494 ... ${ldap_bind_dn}=${LDAP_BIND_DN} ${ldap_bind_dn_password}=${LDAP_BIND_DN_PASSWORD}
495 ... ${ldap_base_dn}=${LDAP_BASE_DN}
496
497 # Description of argument(s):
498 # ldap_type The LDAP type ("ActiveDirectory" or "LDAP").
499 # ldap_server_uri LDAP server uri (e.g. ldap://XX.XX.XX.XX).
500 # ldap_bind_dn The LDAP bind distinguished name.
501 # ldap_bind_dn_password The LDAP bind distinguished name password.
502 # ldap_base_dn The LDAP base distinguished name.
503
George Keishing2d0804e2019-12-12 22:27:05 -0600504 ${body}= Catenate {'${ldap_type}':
505 ... {'ServiceEnabled': ${True},
506 ... 'ServiceAddresses': ['${ldap_server_uri}'],
507 ... 'Authentication':
508 ... {'AuthenticationType': 'UsernameAndPassword',
509 ... 'Username':'${ldap_bind_dn}',
510 ... 'Password': '${ldap_bind_dn_password}'},
511 ... 'LDAPService':
512 ... {'SearchSettings':
513 ... {'BaseDistinguishedNames': ['${ldap_base_dn}']}}}}
514
515 Redfish.Patch ${REDFISH_BASE_URI}AccountService body=${body}
Sivas SRRb1b85752019-07-04 01:28:28 -0500516 Sleep 15s
Sivas SRR73379bc2019-07-22 10:21:45 -0500517
518
519Config LDAP URL
520 [Documentation] Config LDAP URL.
Prashanth Katti7d38a092020-01-10 06:01:09 -0600521 [Arguments] ${ldap_server_uri}=${LDAP_SERVER_URI} ${expected_status}=${TRUE}
Sivas SRR73379bc2019-07-22 10:21:45 -0500522
523 # Description of argument(s):
524 # ldap_server_uri LDAP server uri (e.g. "ldap://XX.XX.XX.XX/").
525
Sivas SRRb1b85752019-07-04 01:28:28 -0500526 Redfish.Patch ${REDFISH_BASE_URI}AccountService
527 ... body={'${ldap_type}': {'ServiceAddresses': ['${ldap_server_uri}']}}
528 Sleep 15s
Sivas SRR73379bc2019-07-22 10:21:45 -0500529 # After update, LDAP login.
Prashanth Katti7d38a092020-01-10 06:01:09 -0600530 ${status}= Run Keyword And Return Status Redfish.Login ${LDAP_USER} ${LDAP_USER_PASSWORD}
531 Valid Value status [${expected_status}]
532
Sivas SRR73379bc2019-07-22 10:21:45 -0500533 Redfish.Logout
534 Redfish.Login
535
536
537Restore LDAP URL
538 [Documentation] Restore LDAP URL.
539
540 # Restoring the working LDAP server uri.
Sivas SRRb1b85752019-07-04 01:28:28 -0500541 Redfish.Patch ${REDFISH_BASE_URI}AccountService
Sivas SRR73379bc2019-07-22 10:21:45 -0500542 ... body={'${ldap_type}': {'ServiceAddresses': ['${LDAP_SERVER_URI}']}}
Sivas SRRb1b85752019-07-04 01:28:28 -0500543 Sleep 15s
544
545
Sivas SRRd21c9842019-06-21 05:41:18 -0500546Restore AccountLockout Attributes
547 [Documentation] Restore AccountLockout Attributes.
Sivas SRR73379bc2019-07-22 10:21:45 -0500548
Sivas SRRd21c9842019-06-21 05:41:18 -0500549 Return From Keyword If &{old_account_service} == &{EMPTY}
550 Redfish.Patch ${REDFISH_BASE_URI}AccountService
551 ... body=[('AccountLockoutDuration', ${old_account_service['AccountLockoutDuration']})]
552 Redfish.Patch ${REDFISH_BASE_URI}AccountService
553 ... body=[('AccountLockoutDuration', ${old_account_service['AccountLockoutThreshold']})]
554
555
Sivas SRR7d7bae32019-05-29 00:31:14 -0500556Suite Setup Execution
557 [Documentation] Do suite setup tasks.
Sivas SRR73379bc2019-07-22 10:21:45 -0500558
Michael Walshe7edb222019-08-19 17:39:38 -0500559 Valid Value LDAP_TYPE valid_values=["ActiveDirectory", "LDAP"]
560 Valid Value LDAP_USER
561 Valid Value LDAP_USER_PASSWORD
562 Valid Value GROUP_PRIVILEGE
563 Valid Value GROUP_NAME
564 Valid Value LDAP_SERVER_URI
565 Valid Value LDAP_BIND_DN_PASSWORD
566 Valid Value LDAP_BIND_DN
567 Valid Value LDAP_BASE_DN
Sivas SRRe9a47862019-08-05 07:13:43 -0500568
Sivas SRRf4ec6492019-06-16 01:59:30 -0500569 Redfish.Login
Sivas SRR73379bc2019-07-22 10:21:45 -0500570 # Call 'Get LDAP Configuration' to verify that LDAP configuration exists.
571 Get LDAP Configuration ${LDAP_TYPE}
Sivas SRR939b4b12019-06-26 00:01:59 -0500572 ${old_ldap_privilege}= Get LDAP Privilege
Prashanth Kattife798812020-01-31 07:04:26 -0600573 Set Suite Variable ${old_ldap_privilege}
Sivas SRRcde694c2019-09-09 12:20:34 -0500574 Disable Other LDAP
Sivas SRR873de8e2019-09-26 00:37:53 -0500575 Create LDAP Configuration
576 ${hostname}= Redfish.Get Attribute ${REDFISH_NW_PROTOCOL_URI} HostName
Sivas SRR7d7bae32019-05-29 00:31:14 -0500577
578
Sivas SRR939b4b12019-06-26 00:01:59 -0500579Set Read Privilege And Check Firmware Inventory
580 [Documentation] Set read privilege and check firmware inventory.
581 [Arguments] ${read_privilege}
582
583 # Description of argument(s):
584 # read_privilege The read privilege role (e.g. "User" / "Callback").
585
586 Update LDAP Configuration with LDAP User Role And Group ${LDAP_TYPE}
587 ... ${read_privilege} ${GROUP_NAME}
588
589 Redfish.Login ${LDAP_USER} ${LDAP_USER_PASSWORD}
590 # Verify that the LDAP user with read privilege is able to read inventory.
591 ${resp}= Redfish.Get /redfish/v1/UpdateService/FirmwareInventory
592 Should Be True ${resp.dict["Members@odata.count"]} >= ${1}
593 Length Should Be ${resp.dict["Members"]} ${resp.dict["Members@odata.count"]}
Sivas SRRd21c9842019-06-21 05:41:18 -0500594 Redfish.Logout
Sivas SRR939b4b12019-06-26 00:01:59 -0500595 Redfish.Login
596
597
598Set Read Privilege And Check Poweron
599 [Documentation] Set read privilege and power on should not be possible.
600 [Arguments] ${read_privilege}
601
602 # Description of argument(s):
603 # read_privilege The read privilege role (e.g. "User" / "Callback").
604
605 Update LDAP Configuration with LDAP User Role And Group ${LDAP_TYPE}
606 ... ${read_privilege} ${GROUP_NAME}
607 Redfish.Login ${LDAP_USER} ${LDAP_USER_PASSWORD}
608 Redfish.Post ${REDFISH_POWER_URI}
609 ... body={'ResetType': 'On'} valid_status_codes=[401, 403]
610 Redfish.Logout
611 Redfish.Login
Sivas SRRd21c9842019-06-21 05:41:18 -0500612
613
Sivas SRR7d7bae32019-05-29 00:31:14 -0500614Get LDAP Configuration
615 [Documentation] Retrieve LDAP Configuration.
616 [Arguments] ${ldap_type}
617
618 # Description of argument(s):
619 # ldap_type The LDAP type ("ActiveDirectory" or "LDAP").
620
621 ${ldap_config}= Redfish.Get Properties ${REDFISH_BASE_URI}AccountService
622 [Return] ${ldap_config["${ldap_type}"]}
Sivas SRR108f9d32019-06-03 10:05:34 -0500623
624
625Update LDAP Configuration with LDAP User Role And Group
626 [Documentation] Update LDAP configuration update with LDAP user Role and group.
627 [Arguments] ${ldap_type} ${group_privilege} ${group_name}
628
629 # Description of argument(s):
630 # ldap_type The LDAP type ("ActiveDirectory" or "LDAP").
631 # group_privilege The group privilege ("Administrator", "Operator", "User" or "Callback").
632 # group_name The group name of user.
633
634 ${local_role_remote_group}= Create Dictionary LocalRole=${group_privilege} RemoteGroup=${group_name}
635 ${remote_role_mapping}= Create List ${local_role_remote_group}
636 ${ldap_data}= Create Dictionary RemoteRoleMapping=${remote_role_mapping}
637 ${payload}= Create Dictionary ${ldap_type}=${ldap_data}
638 Redfish.Patch ${REDFISH_BASE_URI}AccountService body=&{payload}
Sivas SRR939b4b12019-06-26 00:01:59 -0500639 # Provide adequate time for LDAP daemon to restart after the update.
Sivas SRR73379bc2019-07-22 10:21:45 -0500640 Sleep 15s
Sivas SRR108f9d32019-06-03 10:05:34 -0500641
Sivas SRRf4ec6492019-06-16 01:59:30 -0500642
643Get LDAP Privilege
644 [Documentation] Get LDAP privilege and return it.
Sivas SRR73379bc2019-07-22 10:21:45 -0500645
Sivas SRRf4ec6492019-06-16 01:59:30 -0500646 ${ldap_config}= Get LDAP Configuration ${LDAP_TYPE}
Sivas SRRe9a47862019-08-05 07:13:43 -0500647 ${num_list_entries}= Get Length ${ldap_config["RemoteRoleMapping"]}
648 Return From Keyword If ${num_list_entries} == ${0} @{EMPTY}
649
Sivas SRRf4ec6492019-06-16 01:59:30 -0500650 [Return] ${ldap_config["RemoteRoleMapping"][0]["LocalRole"]}
651
652
653Restore LDAP Privilege
654 [Documentation] Restore the LDAP privilege to its original value.
Sivas SRR73379bc2019-07-22 10:21:45 -0500655
Sivas SRR939b4b12019-06-26 00:01:59 -0500656 Return From Keyword If '${old_ldap_privilege}' == '${EMPTY}'
657 # Log back in to restore the original privilege.
Sivas SRRf4ec6492019-06-16 01:59:30 -0500658 Update LDAP Configuration with LDAP User Role And Group ${LDAP_TYPE}
659 ... ${old_ldap_privilege} ${GROUP_NAME}
Prashanth Kattife798812020-01-31 07:04:26 -0600660
661 Sleep 18s
662
663
664Update LDAP User Role And Host Poweroff
665 [Documentation] Update LDAP user role and do host poweroff.
666 [Arguments] ${ldap_type} ${group_privilege} ${group_name} ${valid_status_code}
667 [Teardown] Run Keywords Restore LDAP Privilege AND Redfish.Logout AND Redfish.Login
668
669 # Description of argument(s):
670 # ldap_type The LDAP type ("ActiveDirectory" or "LDAP").
671 # group_privilege The group privilege ("Administrator", "Operator", "ReadOnly" or "NoAccess").
672 # group_name The group name of user.
673 # valid_status_code The expected valid status code.
674
675 Update LDAP Configuration with LDAP User Role And Group ${ldap_type}
676 ... ${group_privilege} ${group_name}
677
678 Redfish.Login ${LDAP_USER} ${LDAP_USER_PASSWORD}
679
680 Redfish.Post ${REDFISH_POWER_URI}
681 ... body={'ResetType': 'ForceOff'} valid_status_codes=[${valid_status_code}]
682
683