Re: Add a test to ldapbindpasswd
On 2023-01-04 We 17:33, Andrew Dunstan wrote: > >> This version factors out the creation of the LDAP server into a separate >> perl Module. That makes both the existing test script and the new test >> script a lot shorter, and will be useful for the nearby patch for a hook >> for the ldapbindpassword. >> >> > Looks like I fat fingered this. Here's a version that works. > > pushed. cheers andrew -- Andrew Dunstan EDB: https://www.enterprisedb.com
Re: Add a test to ldapbindpasswd
On 2023-01-04 We 16:26, Andrew Dunstan wrote: > On 2023-01-02 Mo 09:45, Andrew Dunstan wrote: >> On 2023-01-01 Su 18:31, Andrew Dunstan wrote: >>> On 2023-01-01 Su 14:02, Thomas Munro wrote: On Mon, Jan 2, 2023 at 3:04 AM Andrew Dunstan wrote: > On 2022-12-19 Mo 11:16, Andrew Dunstan wrote: >> There is currently no test for the use of ldapbindpasswd in the >> pg_hba.conf file. This patch, mostly the work of John Naylor, remedies >> that. >> >> > This currently has failures on the cfbot for meson builds on FBSD13 and > Debian Bullseye, but it's not at all clear why. In both cases it fails > where the ldap server is started. I think it's failing when using meson. I guess it fails to fail on macOS only because you need to add a new path for Homebrew/ARM like commit 14d63dd2, so it's skipping (it'd be nice if we didn't need another copy of all that logic). Trying locally... it looks like slapd is failing silently, and with some tracing I can see it's sending an error message to my syslog daemon, which logged: 2023-01-02T07:50:20.853019+13:00 x1 slapd[153599]: main: TLS init def ctx failed: -1 Ah, it looks like this test is relying on "slapd-certs", which doesn't exist: tmunro@x1:~/projects/postgresql/build$ ls testrun/ldap/001_auth/data/ ldap.conf ldappassword openldap-data portlock slapd-certs slapd.conf tmunro@x1:~/projects/postgresql/build$ ls testrun/ldap/002_bindpasswd/data/ portlock slapd.conf I didn't look closely, but apparently there is something wrong in the part that copies certs from the ssl test? Not sure why it works for autoconf... >>> Let's see how we fare with this patch. >>> >>> >> Not so well :-(. This version tries to make the tests totally >> independent, as they should be. That's an attempt to get the cfbot to go >> green, but I am intending to refactor this code substantially so the >> common bits are in a module each test file will load. >> >> > This version factors out the creation of the LDAP server into a separate > perl Module. That makes both the existing test script and the new test > script a lot shorter, and will be useful for the nearby patch for a hook > for the ldapbindpassword. > > Looks like I fat fingered this. Here's a version that works. cheers andrew -- Andrew Dunstan EDB: https://www.enterprisedb.com diff --git a/src/test/ldap/LdapServer.pm b/src/test/ldap/LdapServer.pm new file mode 100644 index 00..0b538defbf --- /dev/null +++ b/src/test/ldap/LdapServer.pm @@ -0,0 +1,319 @@ + + +# +# LdapServer.pm +# +# Module to set up an LDAP server for testing pg_hba.conf ldap authentication +# +# Copyright (c) 2023, PostgreSQL Global Development Group +# + + +=pod + +=head1 NAME + +LdapServer - class for an LDAP server for testing pg_hba.conf authentication + +=head1 SYNOPSIS + + use LdapServer; + + # have we found openldap binaies suitable for setting up a server? + my $ldap_binaries_found = $LdapServer::setup; + + # create a server with the given root password and auth type + # (users or anonymous) + my $server = LdapServer->new($root_password, $auth_type); + + # Add the contents of an LDIF file to the server + $server->ldapadd_file ($path_to_ldif_data); + + # set the Ldap password for a user + $server->ldapsetpw($user, $password); + + # get details of some settings for the server + my @properties = $server->prop($propname1, $propname2, ...); + +=head1 DESCRIPTION + + LdapServer tests in its INIT phase for the presence of suitable openldap + binaries. Its constructor method sets up and runs an LDAP server, and any + servers that are set up are terminated during its END phase. + +=cut + +package LdapServer; + +use strict; +use warnings; + +use PostgreSQL::Test::Utils; +use Test::More; + +use File::Copy; +use File::Basename; + +# private variables +my ($slapd, $ldap_schema_dir, @servers); + +# visible variable +our ($setup); + +INIT +{ + $setup = 1; + if ($^O eq 'darwin' && -d '/opt/homebrew/opt/openldap') + { + # typical paths for Homebrew on ARM + $slapd = '/opt/homebrew/opt/openldap/libexec/slapd'; + $ldap_schema_dir = '/opt/homebrew/etc/openldap/schema'; + } + elsif ($^O eq 'darwin' && -d '/usr/local/opt/openldap') + { + # typical paths for Homebrew on Intel + $slapd = '/usr/local/opt/openldap/libexec/slapd'; + $ldap_schema_dir = '/usr/local/etc/openldap/schema'; + } + elsif ($^O eq 'darwin' && -d '/opt/local/etc/openldap') + { + # typical paths for MacPorts + $slapd = '/opt/local/libexec/slapd'; + $ldap_schema_dir = '/opt/local/etc/openldap/schema'; + } + elsif ($^O eq 'linux') + { + $slapd = '/usr/sbin/slapd'; + $ldap_schema_dir = '/etc/ldap/schema' if -d '/etc/ldap/schema'; + $ldap_schem
Re: Add a test to ldapbindpasswd
On 2023-01-02 Mo 09:45, Andrew Dunstan wrote: > On 2023-01-01 Su 18:31, Andrew Dunstan wrote: >> On 2023-01-01 Su 14:02, Thomas Munro wrote: >>> On Mon, Jan 2, 2023 at 3:04 AM Andrew Dunstan wrote: On 2022-12-19 Mo 11:16, Andrew Dunstan wrote: > There is currently no test for the use of ldapbindpasswd in the > pg_hba.conf file. This patch, mostly the work of John Naylor, remedies > that. > > This currently has failures on the cfbot for meson builds on FBSD13 and Debian Bullseye, but it's not at all clear why. In both cases it fails where the ldap server is started. >>> I think it's failing when using meson. I guess it fails to fail on >>> macOS only because you need to add a new path for Homebrew/ARM like >>> commit 14d63dd2, so it's skipping (it'd be nice if we didn't need >>> another copy of all that logic). Trying locally... it looks like >>> slapd is failing silently, and with some tracing I can see it's >>> sending an error message to my syslog daemon, which logged: >>> >>> 2023-01-02T07:50:20.853019+13:00 x1 slapd[153599]: main: TLS init def >>> ctx failed: -1 >>> >>> Ah, it looks like this test is relying on "slapd-certs", which doesn't >>> exist: >>> >>> tmunro@x1:~/projects/postgresql/build$ ls testrun/ldap/001_auth/data/ >>> ldap.conf ldappassword openldap-data portlock slapd-certs slapd.conf >>> tmunro@x1:~/projects/postgresql/build$ ls testrun/ldap/002_bindpasswd/data/ >>> portlock slapd.conf >>> >>> I didn't look closely, but apparently there is something wrong in the >>> part that copies certs from the ssl test? Not sure why it works for >>> autoconf... >> >> Let's see how we fare with this patch. >> >> > Not so well :-(. This version tries to make the tests totally > independent, as they should be. That's an attempt to get the cfbot to go > green, but I am intending to refactor this code substantially so the > common bits are in a module each test file will load. > > This version factors out the creation of the LDAP server into a separate perl Module. That makes both the existing test script and the new test script a lot shorter, and will be useful for the nearby patch for a hook for the ldapbindpassword. cheers andrew -- Andrew Dunstan EDB: https://www.enterprisedb.com diff --git a/src/test/ldap/LdapServer.pm b/src/test/ldap/LdapServer.pm new file mode 100644 index 00..a7198e06e5 --- /dev/null +++ b/src/test/ldap/LdapServer.pm @@ -0,0 +1,318 @@ + + +# +# LdapServer.pm +# +# Module to set up an LDAP server for testing pg_hba.conf ldap authentication +# +# Copyright (c) 2023, PostgreSQL Global Development Group +# + + +=pod + +=head1 NAME + +LdapServer - class for an LDAP server for testing pg_hba.conf authentication + +=head1 SYNOPSIS + + use LdapServer; + + # have we found openldap binaies suitable for setting up a server? + my $ldap_binaries_found = $LdapServer::setup; + + # create a server with the given root password and auth type + # (users or anonymous) + my $server = LdapServer->new($root_password, $auth_type); + + # Add the contents of an LDIF file to the server + $server->ldapadd_file ($path_to_ldif_data); + + # set the Ldap password for a user + $server->ldapsetpw($user, $password); + + # get details of some settings for the server + my @properties = $server->prop($propname1, $propname2, ...); + +=head1 DESCRIPTION + + LdapServer tests in its INIT phase for the presence of suitable openldap + binaries. Its constructor method sets up and runs an LDAP server, and any + servers that are set up are terminated during its END phase. + +=cut + +package LdapServer; + +use strict; +use warnings; + +use PostgreSQL::Test::Utils; +use Test::More; + +use File::Copy; +use File::Basename; + +# private variables +my ($slapd, $ldap_schema_dir, @servers); + +# visible variable +our ($setup); + +INIT +{ + $setup = 1; + if ($^O eq 'darwin' && -d '/opt/homebrew/opt/openldap') + { + # typical paths for Homebrew on ARM + $slapd = '/opt/homebrew/opt/openldap/libexec/slapd'; + $ldap_schema_dir = '/opt/homebrew/etc/openldap/schema'; + } + elsif ($^O eq 'darwin' && -d '/usr/local/opt/openldap') + { + # typical paths for Homebrew on Intel + $slapd = '/usr/local/opt/openldap/libexec/slapd'; + $ldap_schema_dir = '/usr/local/etc/openldap/schema'; + } + elsif ($^O eq 'darwin' && -d '/opt/local/etc/openldap') + { + # typical paths for MacPorts + $slapd = '/opt/local/libexec/slapd'; + $ldap_schema_dir = '/opt/local/etc/openldap/schema'; + } + elsif ($^O eq 'linux') + { + $slapd = '/usr/sbin/slapd'; + $ldap_schema_dir = '/etc/ldap/schema' if -d '/etc/ldap/schema'; + $ldap_schema_dir = '/etc/openldap/schema' if -d '/etc/openldap/schema'; + } + elsif ($^O eq 'freebsd') + { + $slapd = '/usr/local/libexec/slapd'; + $ldap_schema
Re: Add a test to ldapbindpasswd
Hi, On Mon, Jan 02, 2023 at 09:45:27AM -0500, Andrew Dunstan wrote: > > On 2023-01-01 Su 18:31, Andrew Dunstan wrote: > > Let's see how we fare with this patch. > > > > > > Not so well :-(. This version tries to make the tests totally > independent, as they should be. That's an attempt to get the cfbot to go > green, but I am intending to refactor this code substantially so the > common bits are in a module each test file will load. FTR you can run the same set of CI tests using your own GH account rather than sedning patches, see src/tools/ci/README/
Re: Add a test to ldapbindpasswd
On 2023-01-01 Su 18:31, Andrew Dunstan wrote: > On 2023-01-01 Su 14:02, Thomas Munro wrote: >> On Mon, Jan 2, 2023 at 3:04 AM Andrew Dunstan wrote: >>> On 2022-12-19 Mo 11:16, Andrew Dunstan wrote: There is currently no test for the use of ldapbindpasswd in the pg_hba.conf file. This patch, mostly the work of John Naylor, remedies that. >>> This currently has failures on the cfbot for meson builds on FBSD13 and >>> Debian Bullseye, but it's not at all clear why. In both cases it fails >>> where the ldap server is started. >> I think it's failing when using meson. I guess it fails to fail on >> macOS only because you need to add a new path for Homebrew/ARM like >> commit 14d63dd2, so it's skipping (it'd be nice if we didn't need >> another copy of all that logic). Trying locally... it looks like >> slapd is failing silently, and with some tracing I can see it's >> sending an error message to my syslog daemon, which logged: >> >> 2023-01-02T07:50:20.853019+13:00 x1 slapd[153599]: main: TLS init def >> ctx failed: -1 >> >> Ah, it looks like this test is relying on "slapd-certs", which doesn't exist: >> >> tmunro@x1:~/projects/postgresql/build$ ls testrun/ldap/001_auth/data/ >> ldap.conf ldappassword openldap-data portlock slapd-certs slapd.conf >> tmunro@x1:~/projects/postgresql/build$ ls testrun/ldap/002_bindpasswd/data/ >> portlock slapd.conf >> >> I didn't look closely, but apparently there is something wrong in the >> part that copies certs from the ssl test? Not sure why it works for >> autoconf... > > > Let's see how we fare with this patch. > > Not so well :-(. This version tries to make the tests totally independent, as they should be. That's an attempt to get the cfbot to go green, but I am intending to refactor this code substantially so the common bits are in a module each test file will load. cheers andrew -- Andrew Dunstan EDB: https://www.enterprisedb.com From c2bedfd8a5b326ffb563da49b7b4b4006ddac361 Mon Sep 17 00:00:00 2001 From: Andrew Dunstan Date: Mon, 2 Jan 2023 09:41:06 -0500 Subject: [PATCH] Add a test for ldapbindpasswd The existing LDAP tests don't cover the use of ldapbindpasswd in pg_hba.conf, so remedy that. Authors: John Naylor and Andrew Dunstan --- src/test/ldap/meson.build | 1 + src/test/ldap/t/002_bindpasswd.pl | 223 ++ 2 files changed, 224 insertions(+) create mode 100644 src/test/ldap/t/002_bindpasswd.pl diff --git a/src/test/ldap/meson.build b/src/test/ldap/meson.build index 90d88138e7..7628a9c7c6 100644 --- a/src/test/ldap/meson.build +++ b/src/test/ldap/meson.build @@ -7,6 +7,7 @@ tests += { 'tap': { 'tests': [ 't/001_auth.pl', + 't/002_bindpasswd.pl', ], 'env': { 'with_ldap': ldap.found() ? 'yes' : 'no', diff --git a/src/test/ldap/t/002_bindpasswd.pl b/src/test/ldap/t/002_bindpasswd.pl new file mode 100644 index 00..330a2b7dad --- /dev/null +++ b/src/test/ldap/t/002_bindpasswd.pl @@ -0,0 +1,223 @@ + +# Copyright (c) 2022, PostgreSQL Global Development Group + +use strict; +use warnings; +use File::Copy; +use File::Basename; +use PostgreSQL::Test::Utils; +use PostgreSQL::Test::Cluster; +use Test::More; + + +my ($slapd, $ldap_bin_dir, $ldap_schema_dir); + +$ldap_bin_dir = undef;# usually in PATH + +if ($ENV{with_ldap} ne 'yes') +{ + plan skip_all => 'LDAP not supported by this build'; +} +elsif ($ENV{PG_TEST_EXTRA} !~ /\bldap\b/) +{ + plan skip_all => 'Potentially unsafe test LDAP not enabled in PG_TEST_EXTRA'; +} +elsif ($^O eq 'darwin' && -d '/opt/homebrew/opt/openldap') +{ + # typical paths for Homebrew on ARM + $slapd = '/opt/homebrew/opt/openldap/libexec/slapd'; + $ldap_schema_dir = '/opt/homebrew/etc/openldap/schema'; +} +elsif ($^O eq 'darwin' && -d '/usr/local/opt/openldap') +{ + # typical paths for Homebrew on Intel + $slapd = '/usr/local/opt/openldap/libexec/slapd'; + $ldap_schema_dir = '/usr/local/etc/openldap/schema'; +} +elsif ($^O eq 'darwin' && -d '/opt/local/etc/openldap') +{ + # typical paths for MacPorts + $slapd = '/opt/local/libexec/slapd'; + $ldap_schema_dir = '/opt/local/etc/openldap/schema'; +} +elsif ($^O eq 'linux') +{ + $slapd = '/usr/sbin/slapd'; + $ldap_schema_dir = '/etc/ldap/schema' if -d '/etc/ldap/schema'; + $ldap_schema_dir = '/etc/openldap/schema' if -d '/etc/openldap/schema'; +} +elsif ($^O eq 'freebsd') +{ + $slapd = '/usr/local/libexec/slapd'; + $ldap_schema_dir = '/usr/local/etc/openldap/schema'; +} +elsif ($^O eq 'openbsd') +{ + $slapd = '/usr/local/libexec/slapd'; + $ldap_schema_dir = '/usr/local/share/examples/openldap/schema'; +} +else +{ + plan skip_all => + "ldap tests not supported on $^O or dependencies not installed"; +} + +# make your own edits here +#$slapd = ''; +#$ldap_bin_dir = ''; +#$ldap_schema_dir = ''; + +$ENV{PATH} = "$ldap_bin_dir:$ENV{PATH}" if $ldap_bin_dir; + +my $tst_name = basename(__FILE__,'.pl'); +my $test_temp = Po
Re: Add a test to ldapbindpasswd
On 2023-01-01 Su 14:02, Thomas Munro wrote: > On Mon, Jan 2, 2023 at 3:04 AM Andrew Dunstan wrote: >> On 2022-12-19 Mo 11:16, Andrew Dunstan wrote: >>> There is currently no test for the use of ldapbindpasswd in the >>> pg_hba.conf file. This patch, mostly the work of John Naylor, remedies that. >>> >>> >> This currently has failures on the cfbot for meson builds on FBSD13 and >> Debian Bullseye, but it's not at all clear why. In both cases it fails >> where the ldap server is started. > I think it's failing when using meson. I guess it fails to fail on > macOS only because you need to add a new path for Homebrew/ARM like > commit 14d63dd2, so it's skipping (it'd be nice if we didn't need > another copy of all that logic). Trying locally... it looks like > slapd is failing silently, and with some tracing I can see it's > sending an error message to my syslog daemon, which logged: > > 2023-01-02T07:50:20.853019+13:00 x1 slapd[153599]: main: TLS init def > ctx failed: -1 > > Ah, it looks like this test is relying on "slapd-certs", which doesn't exist: > > tmunro@x1:~/projects/postgresql/build$ ls testrun/ldap/001_auth/data/ > ldap.conf ldappassword openldap-data portlock slapd-certs slapd.conf > tmunro@x1:~/projects/postgresql/build$ ls testrun/ldap/002_bindpasswd/data/ > portlock slapd.conf > > I didn't look closely, but apparently there is something wrong in the > part that copies certs from the ssl test? Not sure why it works for > autoconf... Let's see how we fare with this patch. cheers andrew -- Andrew Dunstan EDB: https://www.enterprisedb.com From dace23df29efb43aa5e4bddc99098203c0e5ed00 Mon Sep 17 00:00:00 2001 From: Andrew Dunstan Date: Sun, 1 Jan 2023 18:27:30 -0500 Subject: [PATCH] Add a test for ldapbindpasswd The existing LDAP tests don't cover the use of ldapbindpasswd in pg_hba.conf, so remedy that. Author: John Naylor --- src/test/ldap/meson.build | 1 + src/test/ldap/t/002_bindpasswd.pl | 207 ++ 2 files changed, 208 insertions(+) create mode 100644 src/test/ldap/t/002_bindpasswd.pl diff --git a/src/test/ldap/meson.build b/src/test/ldap/meson.build index 90d88138e7..7628a9c7c6 100644 --- a/src/test/ldap/meson.build +++ b/src/test/ldap/meson.build @@ -7,6 +7,7 @@ tests += { 'tap': { 'tests': [ 't/001_auth.pl', + 't/002_bindpasswd.pl', ], 'env': { 'with_ldap': ldap.found() ? 'yes' : 'no', diff --git a/src/test/ldap/t/002_bindpasswd.pl b/src/test/ldap/t/002_bindpasswd.pl new file mode 100644 index 00..8296864209 --- /dev/null +++ b/src/test/ldap/t/002_bindpasswd.pl @@ -0,0 +1,207 @@ + +# Copyright (c) 2022, PostgreSQL Global Development Group + +use strict; +use warnings; +use File::Copy; +use PostgreSQL::Test::Utils; +use PostgreSQL::Test::Cluster; +use Test::More; + + +my ($slapd, $ldap_bin_dir, $ldap_schema_dir); + +$ldap_bin_dir = undef;# usually in PATH + +if ($ENV{with_ldap} ne 'yes') +{ + plan skip_all => 'LDAP not supported by this build'; +} +elsif ($ENV{PG_TEST_EXTRA} !~ /\bldap\b/) +{ + plan skip_all => 'Potentially unsafe test LDAP not enabled in PG_TEST_EXTRA'; +} +elsif ($^O eq 'darwin' && -d '/usr/local/opt/openldap') +{ + # typical paths for Homebrew + $slapd = '/usr/local/opt/openldap/libexec/slapd'; + $ldap_schema_dir = '/usr/local/etc/openldap/schema'; +} +elsif ($^O eq 'darwin' && -d '/opt/homebrew/opt/openldap') +{ + # typical paths for Homebrew on ARM + $slapd = '/opt/homebrew/opt/openldap/libexec/slapd'; + $ldap_schema_dir = '/opt/homebrew/etc/openldap/schema'; +} +elsif ($^O eq 'darwin' && -d '/opt/local/etc/openldap') +{ + # typical paths for MacPorts + $slapd = '/opt/local/libexec/slapd'; + $ldap_schema_dir = '/opt/local/etc/openldap/schema'; +} +elsif ($^O eq 'linux') +{ + $slapd = '/usr/sbin/slapd'; + $ldap_schema_dir = '/etc/ldap/schema' if -d '/etc/ldap/schema'; + $ldap_schema_dir = '/etc/openldap/schema' if -d '/etc/openldap/schema'; +} +elsif ($^O eq 'freebsd') +{ + $slapd = '/usr/local/libexec/slapd'; + $ldap_schema_dir = '/usr/local/etc/openldap/schema'; +} +elsif ($^O eq 'openbsd') +{ + $slapd = '/usr/local/libexec/slapd'; + $ldap_schema_dir = '/usr/local/share/examples/openldap/schema'; +} +else +{ + plan skip_all => "ldap tests not supported on $^O or dependencies not installed"; +} + +# make your own edits here +#$slapd = ''; +#$ldap_bin_dir = ''; +#$ldap_schema_dir = ''; + +$ENV{PATH} = "$ldap_bin_dir:$ENV{PATH}" if $ldap_bin_dir; + +my $ldap_datadir = "${PostgreSQL::Test::Utils::tmp_check}/openldap-data"; +my $slapd_certs = "${PostgreSQL::Test::Utils::tmp_check}/slapd-certs"; +my $slapd_conf= "${PostgreSQL::Test::Utils::tmp_check}/slapd.conf"; +my $slapd_pidfile = "${PostgreSQL::Test::Utils::tmp_check}/slapd.pid"; +my $slapd_logfile = "${PostgreSQL::Test::Utils::log_path}/slapd.log"; +my $ldap_conf = "${PostgreSQL::Test::Utils::tmp_check}/ldap.conf"; +my $ldap_server = '
Re: Add a test to ldapbindpasswd
> On Jan 1, 2023, at 2:03 PM, Thomas Munro wrote: > > On Mon, Jan 2, 2023 at 3:04 AM Andrew Dunstan wrote: >>> On 2022-12-19 Mo 11:16, Andrew Dunstan wrote: >>> There is currently no test for the use of ldapbindpasswd in the >>> pg_hba.conf file. This patch, mostly the work of John Naylor, remedies that. >>> >>> >> >> This currently has failures on the cfbot for meson builds on FBSD13 and >> Debian Bullseye, but it's not at all clear why. In both cases it fails >> where the ldap server is started. > > I think it's failing when using meson. I guess it fails to fail on > macOS only because you need to add a new path for Homebrew/ARM like > commit 14d63dd2, so it's skipping (it'd be nice if we didn't need > another copy of all that logic). Trying locally... it looks like > slapd is failing silently, and with some tracing I can see it's > sending an error message to my syslog daemon, which logged: > > 2023-01-02T07:50:20.853019+13:00 x1 slapd[153599]: main: TLS init def > ctx failed: -1 > > Ah, it looks like this test is relying on "slapd-certs", which doesn't exist: > > tmunro@x1:~/projects/postgresql/build$ ls testrun/ldap/001_auth/data/ > ldap.conf ldappassword openldap-data portlock slapd-certs slapd.conf > tmunro@x1:~/projects/postgresql/build$ ls testrun/ldap/002_bindpasswd/data/ > portlock slapd.conf > > I didn't look closely, but apparently there is something wrong in the > part that copies certs from the ssl test? Not sure why it works for > autoconf... Thanks, I see the problem. Will post a revised patch shortly Cheers Andrew
Re: Add a test to ldapbindpasswd
On Mon, Jan 2, 2023 at 3:04 AM Andrew Dunstan wrote: > On 2022-12-19 Mo 11:16, Andrew Dunstan wrote: > > There is currently no test for the use of ldapbindpasswd in the > > pg_hba.conf file. This patch, mostly the work of John Naylor, remedies that. > > > > > > This currently has failures on the cfbot for meson builds on FBSD13 and > Debian Bullseye, but it's not at all clear why. In both cases it fails > where the ldap server is started. I think it's failing when using meson. I guess it fails to fail on macOS only because you need to add a new path for Homebrew/ARM like commit 14d63dd2, so it's skipping (it'd be nice if we didn't need another copy of all that logic). Trying locally... it looks like slapd is failing silently, and with some tracing I can see it's sending an error message to my syslog daemon, which logged: 2023-01-02T07:50:20.853019+13:00 x1 slapd[153599]: main: TLS init def ctx failed: -1 Ah, it looks like this test is relying on "slapd-certs", which doesn't exist: tmunro@x1:~/projects/postgresql/build$ ls testrun/ldap/001_auth/data/ ldap.conf ldappassword openldap-data portlock slapd-certs slapd.conf tmunro@x1:~/projects/postgresql/build$ ls testrun/ldap/002_bindpasswd/data/ portlock slapd.conf I didn't look closely, but apparently there is something wrong in the part that copies certs from the ssl test? Not sure why it works for autoconf...
Re: Add a test to ldapbindpasswd
On 2022-12-19 Mo 11:16, Andrew Dunstan wrote: > There is currently no test for the use of ldapbindpasswd in the > pg_hba.conf file. This patch, mostly the work of John Naylor, remedies that. > > This currently has failures on the cfbot for meson builds on FBSD13 and Debian Bullseye, but it's not at all clear why. In both cases it fails where the ldap server is started. cheers andrew -- Andrew Dunstan EDB: https://www.enterprisedb.com