Re: Add a test to ldapbindpasswd
On 2023-01-04 We 17:33, Andrew Dunstan wrote: > >> This version factors out the creation of the LDAP server into a separate >> perl Module. That makes both the existing test script and the new test >> script a lot shorter, and will be useful for the nearby patch for a hook >> for the ldapbindpassword. >> >> > Looks like I fat fingered this. Here's a version that works. > > pushed. cheers andrew -- Andrew Dunstan EDB: https://www.enterprisedb.com
Re: Add a test to ldapbindpasswd
On 2023-01-04 We 16:26, Andrew Dunstan wrote:
> On 2023-01-02 Mo 09:45, Andrew Dunstan wrote:
>> On 2023-01-01 Su 18:31, Andrew Dunstan wrote:
>>> On 2023-01-01 Su 14:02, Thomas Munro wrote:
On Mon, Jan 2, 2023 at 3:04 AM Andrew Dunstan wrote:
> On 2022-12-19 Mo 11:16, Andrew Dunstan wrote:
>> There is currently no test for the use of ldapbindpasswd in the
>> pg_hba.conf file. This patch, mostly the work of John Naylor, remedies
>> that.
>>
>>
> This currently has failures on the cfbot for meson builds on FBSD13 and
> Debian Bullseye, but it's not at all clear why. In both cases it fails
> where the ldap server is started.
I think it's failing when using meson. I guess it fails to fail on
macOS only because you need to add a new path for Homebrew/ARM like
commit 14d63dd2, so it's skipping (it'd be nice if we didn't need
another copy of all that logic). Trying locally... it looks like
slapd is failing silently, and with some tracing I can see it's
sending an error message to my syslog daemon, which logged:
2023-01-02T07:50:20.853019+13:00 x1 slapd[153599]: main: TLS init def
ctx failed: -1
Ah, it looks like this test is relying on "slapd-certs", which doesn't
exist:
tmunro@x1:~/projects/postgresql/build$ ls testrun/ldap/001_auth/data/
ldap.conf ldappassword openldap-data portlock slapd-certs slapd.conf
tmunro@x1:~/projects/postgresql/build$ ls testrun/ldap/002_bindpasswd/data/
portlock slapd.conf
I didn't look closely, but apparently there is something wrong in the
part that copies certs from the ssl test? Not sure why it works for
autoconf...
>>> Let's see how we fare with this patch.
>>>
>>>
>> Not so well :-(. This version tries to make the tests totally
>> independent, as they should be. That's an attempt to get the cfbot to go
>> green, but I am intending to refactor this code substantially so the
>> common bits are in a module each test file will load.
>>
>>
> This version factors out the creation of the LDAP server into a separate
> perl Module. That makes both the existing test script and the new test
> script a lot shorter, and will be useful for the nearby patch for a hook
> for the ldapbindpassword.
>
>
Looks like I fat fingered this. Here's a version that works.
cheers
andrew
--
Andrew Dunstan
EDB: https://www.enterprisedb.com
diff --git a/src/test/ldap/LdapServer.pm b/src/test/ldap/LdapServer.pm
new file mode 100644
index 00..0b538defbf
--- /dev/null
+++ b/src/test/ldap/LdapServer.pm
@@ -0,0 +1,319 @@
+
+
+#
+# LdapServer.pm
+#
+# Module to set up an LDAP server for testing pg_hba.conf ldap authentication
+#
+# Copyright (c) 2023, PostgreSQL Global Development Group
+#
+
+
+=pod
+
+=head1 NAME
+
+LdapServer - class for an LDAP server for testing pg_hba.conf authentication
+
+=head1 SYNOPSIS
+
+ use LdapServer;
+
+ # have we found openldap binaies suitable for setting up a server?
+ my $ldap_binaries_found = $LdapServer::setup;
+
+ # create a server with the given root password and auth type
+ # (users or anonymous)
+ my $server = LdapServer->new($root_password, $auth_type);
+
+ # Add the contents of an LDIF file to the server
+ $server->ldapadd_file ($path_to_ldif_data);
+
+ # set the Ldap password for a user
+ $server->ldapsetpw($user, $password);
+
+ # get details of some settings for the server
+ my @properties = $server->prop($propname1, $propname2, ...);
+
+=head1 DESCRIPTION
+
+ LdapServer tests in its INIT phase for the presence of suitable openldap
+ binaries. Its constructor method sets up and runs an LDAP server, and any
+ servers that are set up are terminated during its END phase.
+
+=cut
+
+package LdapServer;
+
+use strict;
+use warnings;
+
+use PostgreSQL::Test::Utils;
+use Test::More;
+
+use File::Copy;
+use File::Basename;
+
+# private variables
+my ($slapd, $ldap_schema_dir, @servers);
+
+# visible variable
+our ($setup);
+
+INIT
+{
+ $setup = 1;
+ if ($^O eq 'darwin' && -d '/opt/homebrew/opt/openldap')
+ {
+ # typical paths for Homebrew on ARM
+ $slapd = '/opt/homebrew/opt/openldap/libexec/slapd';
+ $ldap_schema_dir = '/opt/homebrew/etc/openldap/schema';
+ }
+ elsif ($^O eq 'darwin' && -d '/usr/local/opt/openldap')
+ {
+ # typical paths for Homebrew on Intel
+ $slapd = '/usr/local/opt/openldap/libexec/slapd';
+ $ldap_schema_dir = '/usr/local/etc/openldap/schema';
+ }
+ elsif ($^O eq 'darwin' && -d '/opt/local/etc/openldap')
+ {
+ # typical paths for MacPorts
+ $slapd = '/opt/local/libexec/slapd';
+ $ldap_schema_dir = '/opt/local/etc/openldap/schema';
+ }
+ elsif ($^O eq 'linux')
+ {
+ $slapd = '/usr/sbin/slapd';
+ $ldap_schema_dir = '/etc/ldap/schema' if -d '/etc/ldap/schema';
+
Re: Add a test to ldapbindpasswd
On 2023-01-02 Mo 09:45, Andrew Dunstan wrote:
> On 2023-01-01 Su 18:31, Andrew Dunstan wrote:
>> On 2023-01-01 Su 14:02, Thomas Munro wrote:
>>> On Mon, Jan 2, 2023 at 3:04 AM Andrew Dunstan wrote:
On 2022-12-19 Mo 11:16, Andrew Dunstan wrote:
> There is currently no test for the use of ldapbindpasswd in the
> pg_hba.conf file. This patch, mostly the work of John Naylor, remedies
> that.
>
>
This currently has failures on the cfbot for meson builds on FBSD13 and
Debian Bullseye, but it's not at all clear why. In both cases it fails
where the ldap server is started.
>>> I think it's failing when using meson. I guess it fails to fail on
>>> macOS only because you need to add a new path for Homebrew/ARM like
>>> commit 14d63dd2, so it's skipping (it'd be nice if we didn't need
>>> another copy of all that logic). Trying locally... it looks like
>>> slapd is failing silently, and with some tracing I can see it's
>>> sending an error message to my syslog daemon, which logged:
>>>
>>> 2023-01-02T07:50:20.853019+13:00 x1 slapd[153599]: main: TLS init def
>>> ctx failed: -1
>>>
>>> Ah, it looks like this test is relying on "slapd-certs", which doesn't
>>> exist:
>>>
>>> tmunro@x1:~/projects/postgresql/build$ ls testrun/ldap/001_auth/data/
>>> ldap.conf ldappassword openldap-data portlock slapd-certs slapd.conf
>>> tmunro@x1:~/projects/postgresql/build$ ls testrun/ldap/002_bindpasswd/data/
>>> portlock slapd.conf
>>>
>>> I didn't look closely, but apparently there is something wrong in the
>>> part that copies certs from the ssl test? Not sure why it works for
>>> autoconf...
>>
>> Let's see how we fare with this patch.
>>
>>
> Not so well :-(. This version tries to make the tests totally
> independent, as they should be. That's an attempt to get the cfbot to go
> green, but I am intending to refactor this code substantially so the
> common bits are in a module each test file will load.
>
>
This version factors out the creation of the LDAP server into a separate
perl Module. That makes both the existing test script and the new test
script a lot shorter, and will be useful for the nearby patch for a hook
for the ldapbindpassword.
cheers
andrew
--
Andrew Dunstan
EDB: https://www.enterprisedb.com
diff --git a/src/test/ldap/LdapServer.pm b/src/test/ldap/LdapServer.pm
new file mode 100644
index 00..a7198e06e5
--- /dev/null
+++ b/src/test/ldap/LdapServer.pm
@@ -0,0 +1,318 @@
+
+
+#
+# LdapServer.pm
+#
+# Module to set up an LDAP server for testing pg_hba.conf ldap authentication
+#
+# Copyright (c) 2023, PostgreSQL Global Development Group
+#
+
+
+=pod
+
+=head1 NAME
+
+LdapServer - class for an LDAP server for testing pg_hba.conf authentication
+
+=head1 SYNOPSIS
+
+ use LdapServer;
+
+ # have we found openldap binaies suitable for setting up a server?
+ my $ldap_binaries_found = $LdapServer::setup;
+
+ # create a server with the given root password and auth type
+ # (users or anonymous)
+ my $server = LdapServer->new($root_password, $auth_type);
+
+ # Add the contents of an LDIF file to the server
+ $server->ldapadd_file ($path_to_ldif_data);
+
+ # set the Ldap password for a user
+ $server->ldapsetpw($user, $password);
+
+ # get details of some settings for the server
+ my @properties = $server->prop($propname1, $propname2, ...);
+
+=head1 DESCRIPTION
+
+ LdapServer tests in its INIT phase for the presence of suitable openldap
+ binaries. Its constructor method sets up and runs an LDAP server, and any
+ servers that are set up are terminated during its END phase.
+
+=cut
+
+package LdapServer;
+
+use strict;
+use warnings;
+
+use PostgreSQL::Test::Utils;
+use Test::More;
+
+use File::Copy;
+use File::Basename;
+
+# private variables
+my ($slapd, $ldap_schema_dir, @servers);
+
+# visible variable
+our ($setup);
+
+INIT
+{
+ $setup = 1;
+ if ($^O eq 'darwin' && -d '/opt/homebrew/opt/openldap')
+ {
+ # typical paths for Homebrew on ARM
+ $slapd = '/opt/homebrew/opt/openldap/libexec/slapd';
+ $ldap_schema_dir = '/opt/homebrew/etc/openldap/schema';
+ }
+ elsif ($^O eq 'darwin' && -d '/usr/local/opt/openldap')
+ {
+ # typical paths for Homebrew on Intel
+ $slapd = '/usr/local/opt/openldap/libexec/slapd';
+ $ldap_schema_dir = '/usr/local/etc/openldap/schema';
+ }
+ elsif ($^O eq 'darwin' && -d '/opt/local/etc/openldap')
+ {
+ # typical paths for MacPorts
+ $slapd = '/opt/local/libexec/slapd';
+ $ldap_schema_dir = '/opt/local/etc/openldap/schema';
+ }
+ elsif ($^O eq 'linux')
+ {
+ $slapd = '/usr/sbin/slapd';
+ $ldap_schema_dir = '/etc/ldap/schema' if -d '/etc/ldap/schema';
+ $ldap_schema_dir = '/etc/openldap/schema' if -d '/etc/openldap/schema';
+ }
+ elsif ($^O eq 'freebsd')
+ {
+ $slapd = '/usr/local/libexec/slapd';
+
Re: Add a test to ldapbindpasswd
Hi, On Mon, Jan 02, 2023 at 09:45:27AM -0500, Andrew Dunstan wrote: > > On 2023-01-01 Su 18:31, Andrew Dunstan wrote: > > Let's see how we fare with this patch. > > > > > > Not so well :-(. This version tries to make the tests totally > independent, as they should be. That's an attempt to get the cfbot to go > green, but I am intending to refactor this code substantially so the > common bits are in a module each test file will load. FTR you can run the same set of CI tests using your own GH account rather than sedning patches, see src/tools/ci/README/
Re: Add a test to ldapbindpasswd
On 2023-01-01 Su 18:31, Andrew Dunstan wrote:
> On 2023-01-01 Su 14:02, Thomas Munro wrote:
>> On Mon, Jan 2, 2023 at 3:04 AM Andrew Dunstan wrote:
>>> On 2022-12-19 Mo 11:16, Andrew Dunstan wrote:
There is currently no test for the use of ldapbindpasswd in the
pg_hba.conf file. This patch, mostly the work of John Naylor, remedies
that.
>>> This currently has failures on the cfbot for meson builds on FBSD13 and
>>> Debian Bullseye, but it's not at all clear why. In both cases it fails
>>> where the ldap server is started.
>> I think it's failing when using meson. I guess it fails to fail on
>> macOS only because you need to add a new path for Homebrew/ARM like
>> commit 14d63dd2, so it's skipping (it'd be nice if we didn't need
>> another copy of all that logic). Trying locally... it looks like
>> slapd is failing silently, and with some tracing I can see it's
>> sending an error message to my syslog daemon, which logged:
>>
>> 2023-01-02T07:50:20.853019+13:00 x1 slapd[153599]: main: TLS init def
>> ctx failed: -1
>>
>> Ah, it looks like this test is relying on "slapd-certs", which doesn't exist:
>>
>> tmunro@x1:~/projects/postgresql/build$ ls testrun/ldap/001_auth/data/
>> ldap.conf ldappassword openldap-data portlock slapd-certs slapd.conf
>> tmunro@x1:~/projects/postgresql/build$ ls testrun/ldap/002_bindpasswd/data/
>> portlock slapd.conf
>>
>> I didn't look closely, but apparently there is something wrong in the
>> part that copies certs from the ssl test? Not sure why it works for
>> autoconf...
>
>
> Let's see how we fare with this patch.
>
>
Not so well :-(. This version tries to make the tests totally
independent, as they should be. That's an attempt to get the cfbot to go
green, but I am intending to refactor this code substantially so the
common bits are in a module each test file will load.
cheers
andrew
--
Andrew Dunstan
EDB: https://www.enterprisedb.com
From c2bedfd8a5b326ffb563da49b7b4b4006ddac361 Mon Sep 17 00:00:00 2001
From: Andrew Dunstan
Date: Mon, 2 Jan 2023 09:41:06 -0500
Subject: [PATCH] Add a test for ldapbindpasswd
The existing LDAP tests don't cover the use of ldapbindpasswd in
pg_hba.conf, so remedy that.
Authors: John Naylor and Andrew Dunstan
---
src/test/ldap/meson.build | 1 +
src/test/ldap/t/002_bindpasswd.pl | 223 ++
2 files changed, 224 insertions(+)
create mode 100644 src/test/ldap/t/002_bindpasswd.pl
diff --git a/src/test/ldap/meson.build b/src/test/ldap/meson.build
index 90d88138e7..7628a9c7c6 100644
--- a/src/test/ldap/meson.build
+++ b/src/test/ldap/meson.build
@@ -7,6 +7,7 @@ tests += {
'tap': {
'tests': [
't/001_auth.pl',
+ 't/002_bindpasswd.pl',
],
'env': {
'with_ldap': ldap.found() ? 'yes' : 'no',
diff --git a/src/test/ldap/t/002_bindpasswd.pl b/src/test/ldap/t/002_bindpasswd.pl
new file mode 100644
index 00..330a2b7dad
--- /dev/null
+++ b/src/test/ldap/t/002_bindpasswd.pl
@@ -0,0 +1,223 @@
+
+# Copyright (c) 2022, PostgreSQL Global Development Group
+
+use strict;
+use warnings;
+use File::Copy;
+use File::Basename;
+use PostgreSQL::Test::Utils;
+use PostgreSQL::Test::Cluster;
+use Test::More;
+
+
+my ($slapd, $ldap_bin_dir, $ldap_schema_dir);
+
+$ldap_bin_dir = undef;# usually in PATH
+
+if ($ENV{with_ldap} ne 'yes')
+{
+ plan skip_all => 'LDAP not supported by this build';
+}
+elsif ($ENV{PG_TEST_EXTRA} !~ /\bldap\b/)
+{
+ plan skip_all => 'Potentially unsafe test LDAP not enabled in PG_TEST_EXTRA';
+}
+elsif ($^O eq 'darwin' && -d '/opt/homebrew/opt/openldap')
+{
+ # typical paths for Homebrew on ARM
+ $slapd = '/opt/homebrew/opt/openldap/libexec/slapd';
+ $ldap_schema_dir = '/opt/homebrew/etc/openldap/schema';
+}
+elsif ($^O eq 'darwin' && -d '/usr/local/opt/openldap')
+{
+ # typical paths for Homebrew on Intel
+ $slapd = '/usr/local/opt/openldap/libexec/slapd';
+ $ldap_schema_dir = '/usr/local/etc/openldap/schema';
+}
+elsif ($^O eq 'darwin' && -d '/opt/local/etc/openldap')
+{
+ # typical paths for MacPorts
+ $slapd = '/opt/local/libexec/slapd';
+ $ldap_schema_dir = '/opt/local/etc/openldap/schema';
+}
+elsif ($^O eq 'linux')
+{
+ $slapd = '/usr/sbin/slapd';
+ $ldap_schema_dir = '/etc/ldap/schema' if -d '/etc/ldap/schema';
+ $ldap_schema_dir = '/etc/openldap/schema' if -d '/etc/openldap/schema';
+}
+elsif ($^O eq 'freebsd')
+{
+ $slapd = '/usr/local/libexec/slapd';
+ $ldap_schema_dir = '/usr/local/etc/openldap/schema';
+}
+elsif ($^O eq 'openbsd')
+{
+ $slapd = '/usr/local/libexec/slapd';
+ $ldap_schema_dir = '/usr/local/share/examples/openldap/schema';
+}
+else
+{
+ plan skip_all =>
+ "ldap tests not supported on $^O or dependencies not installed";
+}
+
+# make your own edits here
+#$slapd = '';
+#$ldap_bin_dir = '';
+#$ldap_schema_dir = '';
+
+$ENV{PATH} = "$ldap_bin_dir:$ENV{PATH}" if $ldap_bin_dir;
+
+my $tst_name = basename(__FILE__,'.pl');
+my $test_temp =
Re: Add a test to ldapbindpasswd
On 2023-01-01 Su 14:02, Thomas Munro wrote:
> On Mon, Jan 2, 2023 at 3:04 AM Andrew Dunstan wrote:
>> On 2022-12-19 Mo 11:16, Andrew Dunstan wrote:
>>> There is currently no test for the use of ldapbindpasswd in the
>>> pg_hba.conf file. This patch, mostly the work of John Naylor, remedies that.
>>>
>>>
>> This currently has failures on the cfbot for meson builds on FBSD13 and
>> Debian Bullseye, but it's not at all clear why. In both cases it fails
>> where the ldap server is started.
> I think it's failing when using meson. I guess it fails to fail on
> macOS only because you need to add a new path for Homebrew/ARM like
> commit 14d63dd2, so it's skipping (it'd be nice if we didn't need
> another copy of all that logic). Trying locally... it looks like
> slapd is failing silently, and with some tracing I can see it's
> sending an error message to my syslog daemon, which logged:
>
> 2023-01-02T07:50:20.853019+13:00 x1 slapd[153599]: main: TLS init def
> ctx failed: -1
>
> Ah, it looks like this test is relying on "slapd-certs", which doesn't exist:
>
> tmunro@x1:~/projects/postgresql/build$ ls testrun/ldap/001_auth/data/
> ldap.conf ldappassword openldap-data portlock slapd-certs slapd.conf
> tmunro@x1:~/projects/postgresql/build$ ls testrun/ldap/002_bindpasswd/data/
> portlock slapd.conf
>
> I didn't look closely, but apparently there is something wrong in the
> part that copies certs from the ssl test? Not sure why it works for
> autoconf...
Let's see how we fare with this patch.
cheers
andrew
--
Andrew Dunstan
EDB: https://www.enterprisedb.com
From dace23df29efb43aa5e4bddc99098203c0e5ed00 Mon Sep 17 00:00:00 2001
From: Andrew Dunstan
Date: Sun, 1 Jan 2023 18:27:30 -0500
Subject: [PATCH] Add a test for ldapbindpasswd
The existing LDAP tests don't cover the use of ldapbindpasswd in
pg_hba.conf, so remedy that.
Author: John Naylor
---
src/test/ldap/meson.build | 1 +
src/test/ldap/t/002_bindpasswd.pl | 207 ++
2 files changed, 208 insertions(+)
create mode 100644 src/test/ldap/t/002_bindpasswd.pl
diff --git a/src/test/ldap/meson.build b/src/test/ldap/meson.build
index 90d88138e7..7628a9c7c6 100644
--- a/src/test/ldap/meson.build
+++ b/src/test/ldap/meson.build
@@ -7,6 +7,7 @@ tests += {
'tap': {
'tests': [
't/001_auth.pl',
+ 't/002_bindpasswd.pl',
],
'env': {
'with_ldap': ldap.found() ? 'yes' : 'no',
diff --git a/src/test/ldap/t/002_bindpasswd.pl b/src/test/ldap/t/002_bindpasswd.pl
new file mode 100644
index 00..8296864209
--- /dev/null
+++ b/src/test/ldap/t/002_bindpasswd.pl
@@ -0,0 +1,207 @@
+
+# Copyright (c) 2022, PostgreSQL Global Development Group
+
+use strict;
+use warnings;
+use File::Copy;
+use PostgreSQL::Test::Utils;
+use PostgreSQL::Test::Cluster;
+use Test::More;
+
+
+my ($slapd, $ldap_bin_dir, $ldap_schema_dir);
+
+$ldap_bin_dir = undef;# usually in PATH
+
+if ($ENV{with_ldap} ne 'yes')
+{
+ plan skip_all => 'LDAP not supported by this build';
+}
+elsif ($ENV{PG_TEST_EXTRA} !~ /\bldap\b/)
+{
+ plan skip_all => 'Potentially unsafe test LDAP not enabled in PG_TEST_EXTRA';
+}
+elsif ($^O eq 'darwin' && -d '/usr/local/opt/openldap')
+{
+ # typical paths for Homebrew
+ $slapd = '/usr/local/opt/openldap/libexec/slapd';
+ $ldap_schema_dir = '/usr/local/etc/openldap/schema';
+}
+elsif ($^O eq 'darwin' && -d '/opt/homebrew/opt/openldap')
+{
+ # typical paths for Homebrew on ARM
+ $slapd = '/opt/homebrew/opt/openldap/libexec/slapd';
+ $ldap_schema_dir = '/opt/homebrew/etc/openldap/schema';
+}
+elsif ($^O eq 'darwin' && -d '/opt/local/etc/openldap')
+{
+ # typical paths for MacPorts
+ $slapd = '/opt/local/libexec/slapd';
+ $ldap_schema_dir = '/opt/local/etc/openldap/schema';
+}
+elsif ($^O eq 'linux')
+{
+ $slapd = '/usr/sbin/slapd';
+ $ldap_schema_dir = '/etc/ldap/schema' if -d '/etc/ldap/schema';
+ $ldap_schema_dir = '/etc/openldap/schema' if -d '/etc/openldap/schema';
+}
+elsif ($^O eq 'freebsd')
+{
+ $slapd = '/usr/local/libexec/slapd';
+ $ldap_schema_dir = '/usr/local/etc/openldap/schema';
+}
+elsif ($^O eq 'openbsd')
+{
+ $slapd = '/usr/local/libexec/slapd';
+ $ldap_schema_dir = '/usr/local/share/examples/openldap/schema';
+}
+else
+{
+ plan skip_all => "ldap tests not supported on $^O or dependencies not installed";
+}
+
+# make your own edits here
+#$slapd = '';
+#$ldap_bin_dir = '';
+#$ldap_schema_dir = '';
+
+$ENV{PATH} = "$ldap_bin_dir:$ENV{PATH}" if $ldap_bin_dir;
+
+my $ldap_datadir = "${PostgreSQL::Test::Utils::tmp_check}/openldap-data";
+my $slapd_certs = "${PostgreSQL::Test::Utils::tmp_check}/slapd-certs";
+my $slapd_conf= "${PostgreSQL::Test::Utils::tmp_check}/slapd.conf";
+my $slapd_pidfile = "${PostgreSQL::Test::Utils::tmp_check}/slapd.pid";
+my $slapd_logfile = "${PostgreSQL::Test::Utils::log_path}/slapd.log";
+my $ldap_conf = "${PostgreSQL::Test::Utils::tmp_check}/ldap.conf";
+my $ldap_server =
Re: Add a test to ldapbindpasswd
> On Jan 1, 2023, at 2:03 PM, Thomas Munro wrote: > > On Mon, Jan 2, 2023 at 3:04 AM Andrew Dunstan wrote: >>> On 2022-12-19 Mo 11:16, Andrew Dunstan wrote: >>> There is currently no test for the use of ldapbindpasswd in the >>> pg_hba.conf file. This patch, mostly the work of John Naylor, remedies that. >>> >>> >> >> This currently has failures on the cfbot for meson builds on FBSD13 and >> Debian Bullseye, but it's not at all clear why. In both cases it fails >> where the ldap server is started. > > I think it's failing when using meson. I guess it fails to fail on > macOS only because you need to add a new path for Homebrew/ARM like > commit 14d63dd2, so it's skipping (it'd be nice if we didn't need > another copy of all that logic). Trying locally... it looks like > slapd is failing silently, and with some tracing I can see it's > sending an error message to my syslog daemon, which logged: > > 2023-01-02T07:50:20.853019+13:00 x1 slapd[153599]: main: TLS init def > ctx failed: -1 > > Ah, it looks like this test is relying on "slapd-certs", which doesn't exist: > > tmunro@x1:~/projects/postgresql/build$ ls testrun/ldap/001_auth/data/ > ldap.conf ldappassword openldap-data portlock slapd-certs slapd.conf > tmunro@x1:~/projects/postgresql/build$ ls testrun/ldap/002_bindpasswd/data/ > portlock slapd.conf > > I didn't look closely, but apparently there is something wrong in the > part that copies certs from the ssl test? Not sure why it works for > autoconf... Thanks, I see the problem. Will post a revised patch shortly Cheers Andrew
Re: Add a test to ldapbindpasswd
On Mon, Jan 2, 2023 at 3:04 AM Andrew Dunstan wrote: > On 2022-12-19 Mo 11:16, Andrew Dunstan wrote: > > There is currently no test for the use of ldapbindpasswd in the > > pg_hba.conf file. This patch, mostly the work of John Naylor, remedies that. > > > > > > This currently has failures on the cfbot for meson builds on FBSD13 and > Debian Bullseye, but it's not at all clear why. In both cases it fails > where the ldap server is started. I think it's failing when using meson. I guess it fails to fail on macOS only because you need to add a new path for Homebrew/ARM like commit 14d63dd2, so it's skipping (it'd be nice if we didn't need another copy of all that logic). Trying locally... it looks like slapd is failing silently, and with some tracing I can see it's sending an error message to my syslog daemon, which logged: 2023-01-02T07:50:20.853019+13:00 x1 slapd[153599]: main: TLS init def ctx failed: -1 Ah, it looks like this test is relying on "slapd-certs", which doesn't exist: tmunro@x1:~/projects/postgresql/build$ ls testrun/ldap/001_auth/data/ ldap.conf ldappassword openldap-data portlock slapd-certs slapd.conf tmunro@x1:~/projects/postgresql/build$ ls testrun/ldap/002_bindpasswd/data/ portlock slapd.conf I didn't look closely, but apparently there is something wrong in the part that copies certs from the ssl test? Not sure why it works for autoconf...
Re: Add a test to ldapbindpasswd
On 2022-12-19 Mo 11:16, Andrew Dunstan wrote: > There is currently no test for the use of ldapbindpasswd in the > pg_hba.conf file. This patch, mostly the work of John Naylor, remedies that. > > This currently has failures on the cfbot for meson builds on FBSD13 and Debian Bullseye, but it's not at all clear why. In both cases it fails where the ldap server is started. cheers andrew -- Andrew Dunstan EDB: https://www.enterprisedb.com
