Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adcli: adding class and methods for adcli #145

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

shridhargadekar
Copy link

Adding adcli class, and methods including info, discovery, join

def _join(
self,
*,
domain: str| None = None,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There should be probably either domain or domain_controller.
The manual page states that it expects domain so I would go with that.
Getting both None or both populated is a recipe for a disaster.

Copy link
Member

@pbrezina pbrezina left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd like to bring in Sumit as well.

I don't really know if we have use for this in SSSD, I don't really think so. I'm fine with including the patch though. However, in this case, operation that changes something must be also able to revert that change. In this case join, so this should be MultihostReentrantUtility.

self.fs: LinuxFileSystem = fs
"""Filesystem utils."""

def _info(
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why do you use underscores on the methods name? Those should be all public methods, right?

self,
*,
domain: str | None = None,
domain_controller: str | None,
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

default to None as well?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

modified

Comment on lines 72 to 103
def _join(
self,
*,
domain: str| None = None,
domain_controller: str| None = None,
domain_realm: str| None = None,
host_fqdn: str| None = None,
host_keytab: str| None = None,
computer_name: str| None = None,
login_ccache: str| None = None,
login_user: str| None = None,
login_type: str| None = None,
domain_ou: str| None = None,
service_name: str| None = None,
os_name: str| None = None,
os_version: str| None = None,
os_service_pack: str| None = None,
user_principal: str| None = None,
trusted_for_delegation: str| None = None,
dont_expire_password: str| None = None,
add_service_principal: str| None = None,
description: str| None = None,
setattrs: str| None = None,
no_password: str| None = None,
promp_password: str| None = None,
stdin_password: str| None = None,
one_time_password: str| None = None,
show_password: str| None = None,
show_details: str| None = None,
add_samba_data: str| None = None,
samba_data_tool: str| None = None,
ldap_passwd: str| None = None,
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Use **kwargs or *args to handle additional argument and keep only required arguments here. Otherwise it would be difficult to maintain.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ack

@pbrezina pbrezina requested a review from sumit-bose January 15, 2025 12:27
@sumit-bose
Copy link
Contributor

I'd like to bring in Sumit as well.

I don't really know if we have use for this in SSSD, I don't really think so. I'm fine with including the patch though. However, in this case, operation that changes something must be also able to revert that change. In this case join, so this should be MultihostReentrantUtility.

Hi,

on which level the revert should work. E.g. before calling adcli join we can save the current keytab and restore it afterwards. But since the state on AD/Samba DC will be changed as well they keys from the old keytab won't work anymore. So it might be better to keep the new keytab or do a leave/join cycle with fixed options to get back into a defined state?

bye,
Sumit

Adding adcli class, and methods including info, discovery, join
@pbrezina
Copy link
Member

I'd like to bring in Sumit as well.
I don't really know if we have use for this in SSSD, I don't really think so. I'm fine with including the patch though. However, in this case, operation that changes something must be also able to revert that change. In this case join, so this should be MultihostReentrantUtility.

Hi,

on which level the revert should work. E.g. before calling adcli join we can save the current keytab and restore it afterwards. But since the state on AD/Samba DC will be changed as well they keys from the old keytab won't work anymore. So it might be better to keep the new keytab or do a leave/join cycle with fixed options to get back into a defined state?

bye, Sumit

It's a question of how is it going to be used.

Right now, in sssd-test-framework, we have this: https://github.com/SSSD/sssd-test-framework/blob/master/sssd_test_framework/topology_controllers.py#L74

  • pytest_setup -> each host performs a backup (only once at start)
  • topology_setup -> run realmd join (only once when entering topology)
  • topology teardown -> restore from the host backup (only once when leaving topology)

In adcli, I assume that Shridar is going to call adcli.join() insinde a test. So the logic should be:

MultihostUtility (cannot be used in MultihostHost objects, only in MultihostRole objects inside tests):

  • utility.setup: do nothing or backup what is needed
  • inside test: adcli.join
  • utility.teardown: adcli.leave and clean up possible leftovers

MultihostReentrantUtility (cannot be used in MultihostHost objects and in MultihostRole objects):

  • utility.__enter__: enter new setup level, do nothing or backup what is needed
  • inside test or topology setup: adcli.join
  • utility.__exit__: adcli.leave and clean up possible leftovers

Docs: https://pytest-mh.readthedocs.io/en/latest/articles/extending/multihost-utilities.html

Other way would be to rely on the backup/restore mechanisms to make sure everything is reverted after each test. But in this case, it needs to be thoroughly documented so the expectation is clear. That might be enough.

So it really depends on how is it going to be used.

@jakub-vavra-cz
Copy link
Contributor

@pbrezina, @shridhargadekar : We will probably need a way to either skip topology setup/teardown (no enrolling) so we can join ourselves or create topologies like KnownTopology.UnjoinedAD that will have the machines but not enrolled client. We can use these for example for tests like ldap sasl authid that needs a specific setup (--user-principal=host/name@REALM) to work correctly.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants