Skip to content

Commit e53b1eb

Browse files
korydraughnkorydraughn
committed
squash w/ 99b1ac6. test infra for pam
1 parent 2e166e3 commit e53b1eb

File tree

7 files changed

+360
-0
lines changed

7 files changed

+360
-0
lines changed

‎irods/src/test/resources/docker/docker-compose.pam.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
name: cyberduck-irods-testing
2+
3+
services:
4+
irods-catalog:
5+
build:
6+
context: irods_catalog
7+
environment:
8+
- POSTGRES_PASSWORD=testpassword
9+
restart: always
10+
11+
irods-catalog-provider:
12+
build:
13+
context: irods_catalog_provider_pam
14+
init: true
15+
ports:
16+
- "1347:1247"
17+
shm_size: 100mb
18+
healthcheck:
19+
test: ["CMD-SHELL", "su - irods -c 'ils || exit 1'"]
20+
interval: 10s
21+
timeout: 10s
22+
retries: 3
23+
start_period: 20s
24+
start_interval: 10s
25+
restart: always
26+
depends_on:
27+
- irods-catalog

‎irods/src/test/resources/docker/irods_catalog_provider/Dockerfile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
FROM ubuntu:24.04
22

3+
SHELL [ "/bin/bash", "-c" ]
34
ENV DEBIAN_FRONTEND=noninteractive
45

56
RUN apt-get update && \

‎irods/src/test/resources/docker/irods_catalog_provider_pam/Dockerfile‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
FROM ubuntu:24.04
2+
3+
SHELL [ "/bin/bash", "-c" ]
4+
ENV DEBIAN_FRONTEND=noninteractive
5+
6+
RUN apt-get update && \
7+
apt-get install -y \
8+
apt-transport-https \
9+
gnupg \
10+
wget \
11+
netcat-traditional \
12+
&& \
13+
apt-get clean && \
14+
rm -rf /var/lib/apt/lists/* /tmp/*
15+
16+
RUN mkdir -p /etc/apt/keyrings && \
17+
wget -qO - https://packages.irods.org/irods-signing-key.asc | \
18+
gpg \
19+
--no-options \
20+
--no-default-keyring \
21+
--no-auto-check-trustdb \
22+
--homedir /dev/null \
23+
--no-keyring \
24+
--import-options import-export \
25+
--output /etc/apt/keyrings/renci-irods-archive-keyring.pgp \
26+
--import \
27+
&& \
28+
echo "deb [signed-by=/etc/apt/keyrings/renci-irods-archive-keyring.pgp arch=amd64] https://packages.irods.org/apt/ noble main" | \
29+
tee /etc/apt/sources.list.d/renci-irods.list
30+
31+
RUN apt-get update && \
32+
apt-get install -y \
33+
libcurl4-gnutls-dev \
34+
python3 \
35+
python3-distro \
36+
python3-jsonschema \
37+
python3-pip \
38+
python3-psutil \
39+
python3-requests \
40+
rsyslog \
41+
unixodbc \
42+
&& \
43+
apt-get clean && \
44+
rm -rf /var/lib/apt/lists/* /tmp/*
45+
46+
ARG irods_version=5.0.2
47+
ARG irods_package_version_suffix=-0~noble
48+
ARG irods_package_version=${irods_version}${irods_package_version_suffix}
49+
50+
RUN apt-get update && \
51+
apt-get install -y \
52+
irods-database-plugin-postgres=${irods_package_version} \
53+
irods-runtime=${irods_package_version} \
54+
irods-server=${irods_package_version} \
55+
irods-icommands=${irods_package_version} \
56+
&& \
57+
apt-get clean && \
58+
rm -rf /var/lib/apt/lists/* /tmp/*
59+
60+
COPY unattended_install.json pam_password /
61+
COPY --chmod=755 entrypoint.sh /
62+
ENTRYPOINT ["./entrypoint.sh"]

‎irods/src/test/resources/docker/irods_catalog_provider_pam/entrypoint.sh‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
#! /bin/bash -e
2+
3+
echo "Waiting for iRODS catalog database to be ready"
4+
catalog_db_hostname=irods-catalog
5+
until pg_isready -h ${catalog_db_hostname} -d ICAT -U irods -q; do
6+
sleep 1
7+
done
8+
echo "iRODS catalog database is ready"
9+
10+
unattended_install_file=/unattended_install.json
11+
if [ -f "${unattended_install_file}" ]; then
12+
echo "Running iRODS setup"
13+
14+
# Configure the server with secure communication (TLS) disabled. This
15+
# avoids issues with setup (e.g. the post install test).
16+
17+
# Add generated hostname as a recognizable alias.
18+
sed -i "s/CONTAINER_HOSTNAME_ALIAS/${HOSTNAME}/g" ${unattended_install_file}
19+
python3 /var/lib/irods/scripts/setup_irods.py --json_configuration_file ${unattended_install_file}
20+
21+
# Move the input file used to configure the server out of the way so
22+
# the container is restartable.
23+
mv ${unattended_install_file} ${unattended_install_file}.processed
24+
25+
# Generate a self-signed certificate for the server.
26+
openssl genrsa -out /tmp/irods_server.key 2048
27+
openssl req -batch -new -x509 -key /tmp/irods_server.key -out /tmp/irods_server.crt -days 1
28+
openssl dhparam -2 -out /tmp/irods_dhparams.pem 2048
29+
chown irods:irods /tmp/irods_server.key
30+
31+
# Update the server's configuration to require secure communication.
32+
sed -i 's/="CS_NEG_REFUSE"/="CS_NEG_REQUIRE"/g' /etc/irods/core.re
33+
sed -i 's/CS_NEG_REFUSE/CS_NEG_REQUIRE/g' /etc/irods/server_config.json /var/lib/irods/.irods/irods_environment.json
34+
35+
# Configure PAM.
36+
ln -s /pam_password /etc/pam.d/irods
37+
38+
# Set up the test user, for PAM authentication.
39+
useradd -m john
40+
echo "john:=i;r@o\\d&s" | chpasswd
41+
fi
42+
43+
echo "Starting server"
44+
su - irods -c 'irodsServer --stdout'

‎irods/src/test/resources/docker/irods_catalog_provider_pam/pam_password‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# This file is for testing PAM authentication with iRODS
2+
# using the pam_password authentication scheme.
3+
4+
auth required pam_env.so
5+
auth sufficient pam_unix.so
6+
auth requisite pam_succeed_if.so uid >= 500 quiet
7+
auth required pam_deny.so

‎irods/src/test/resources/docker/irods_catalog_provider_pam/unattended_install.json‎

Lines changed: 180 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,180 @@
1+
{
2+
"admin_password": "rods",
3+
"default_resource_directory": "/var/lib/irods/Vault",
4+
"default_resource_name": "demoResc",
5+
"host_system_information": {
6+
"service_account_user_name": "irods",
7+
"service_account_group_name": "irods"
8+
},
9+
"service_account_environment": {
10+
"irods_client_server_policy": "CS_NEG_REFUSE",
11+
"irods_connection_pool_refresh_time_in_seconds": 300,
12+
"irods_cwd": "/tempZone/home/rods",
13+
"irods_default_hash_scheme": "SHA256",
14+
"irods_default_number_of_transfer_threads": 4,
15+
"irods_default_resource": "demoResc",
16+
"irods_encryption_algorithm": "AES-256-CBC",
17+
"irods_encryption_key_size": 32,
18+
"irods_encryption_num_hash_rounds": 16,
19+
"irods_encryption_salt_size": 8,
20+
"irods_home": "/tempZone/home/rods",
21+
"irods_host": "irods-catalog-provider",
22+
"irods_match_hash_policy": "compatible",
23+
"irods_maximum_size_for_single_buffer_in_megabytes": 32,
24+
"irods_port": 1247,
25+
"irods_ssl_ca_certificate_file": "/tmp/irods_server.crt",
26+
"irods_ssl_verify_server": "none",
27+
"irods_transfer_buffer_size_for_parallel_transfer_in_megabytes": 4,
28+
"irods_user_name": "rods",
29+
"irods_zone_name": "tempZone",
30+
"schema_name": "service_account_environment",
31+
"schema_version": "v5"
32+
},
33+
"server_config": {
34+
"advanced_settings": {
35+
"checksum_read_buffer_size_in_bytes": 1048576,
36+
"default_number_of_transfer_threads": 4,
37+
"default_temporary_password_lifetime_in_seconds": 120,
38+
"delay_rule_executors": [],
39+
"delay_server_sleep_time_in_seconds": 30,
40+
"dns_cache": {
41+
"eviction_age_in_seconds": 3600,
42+
"cache_clearer_sleep_time_in_seconds": 600,
43+
"shared_memory_size_in_bytes": 5000000
44+
},
45+
"hostname_cache": {
46+
"eviction_age_in_seconds": 3600,
47+
"cache_clearer_sleep_time_in_seconds": 600,
48+
"shared_memory_size_in_bytes": 2500000
49+
},
50+
"maximum_size_for_single_buffer_in_megabytes": 32,
51+
"maximum_size_of_delay_queue_in_bytes": 0,
52+
"maximum_temporary_password_lifetime_in_seconds": 1000,
53+
"migrate_delay_server_sleep_time_in_seconds": 5,
54+
"number_of_concurrent_delay_rule_executors": 4,
55+
"stacktrace_file_processor_sleep_time_in_seconds": 10,
56+
"transfer_buffer_size_for_parallel_transfer_in_megabytes": 4,
57+
"transfer_chunk_size_for_parallel_transfer_in_megabytes": 40
58+
},
59+
"catalog_provider_hosts": [
60+
"irods-catalog-provider"
61+
],
62+
"catalog_service_role": "provider",
63+
"client_server_policy": "CS_NEG_REFUSE",
64+
"connection_pool_refresh_time_in_seconds": 300,
65+
"controlled_user_connection_list": {
66+
"control_type": "denylist",
67+
"users": []
68+
},
69+
"default_dir_mode": "0750",
70+
"default_file_mode": "0600",
71+
"default_hash_scheme": "SHA256",
72+
"default_resource_name": "demoResc",
73+
"encryption": {
74+
"algorithm": "AES-256-CBC",
75+
"key_size": 32,
76+
"num_hash_rounds": 16,
77+
"salt_size": 8
78+
},
79+
"environment_variables": {},
80+
"federation": [],
81+
"graceful_shutdown_timeout_in_seconds": 30,
82+
"host": "irods-catalog-provider",
83+
"host_access_control": {
84+
"access_entries": []
85+
},
86+
"host_resolution": {
87+
"host_entries": [
88+
{
89+
"address_type": "local",
90+
"addresses": [
91+
"irods-catalog-provider",
92+
"CONTAINER_HOSTNAME_ALIAS"
93+
]
94+
}
95+
]
96+
},
97+
"log_level": {
98+
"agent": "info",
99+
"agent_factory": "info",
100+
"api": "info",
101+
"authentication": "info",
102+
"database": "info",
103+
"delay_server": "info",
104+
"genquery1": "info",
105+
"genquery2": "info",
106+
"legacy": "info",
107+
"microservice": "info",
108+
"network": "info",
109+
"resource": "info",
110+
"rule_engine": "info",
111+
"server": "info",
112+
"sql": "info"
113+
},
114+
"match_hash_policy": "compatible",
115+
"negotiation_key": "32_byte_server_negotiation_key__",
116+
"plugin_configuration": {
117+
"authentication": {},
118+
"database": {
119+
"technology": "postgres",
120+
"host": "irods-catalog",
121+
"name": "ICAT",
122+
"odbc_driver": "PostgreSQL ANSI",
123+
"password": "testpassword",
124+
"port": 5432,
125+
"username": "irods"
126+
},
127+
"network": {},
128+
"resource": {},
129+
"rule_engines": [
130+
{
131+
"instance_name": "irods_rule_engine_plugin-irods_rule_language-instance",
132+
"plugin_name": "irods_rule_engine_plugin-irods_rule_language",
133+
"plugin_specific_configuration": {
134+
"re_data_variable_mapping_set": [
135+
"core"
136+
],
137+
"re_function_name_mapping_set": [
138+
"core"
139+
],
140+
"re_rulebase_set": [
141+
"core"
142+
],
143+
"regexes_for_supported_peps": [
144+
"ac[^ ]*",
145+
"msi[^ ]*",
146+
"[^ ]*pep_[^ ]*_(pre|post|except|finally)"
147+
]
148+
},
149+
"shared_memory_instance": "irods_rule_language_rule_engine"
150+
},
151+
{
152+
"instance_name": "irods_rule_engine_plugin-cpp_default_policy-instance",
153+
"plugin_name": "irods_rule_engine_plugin-cpp_default_policy",
154+
"plugin_specific_configuration": {}
155+
}
156+
]
157+
},
158+
"rule_engine_namespaces": [
159+
""
160+
],
161+
"schema_name": "server_config",
162+
"schema_version": "v5",
163+
"server_port_range_end": 20199,
164+
"server_port_range_start": 20000,
165+
"tls_client": {
166+
"ca_certificate_file": "/tmp/irods_server.crt",
167+
"verify_server": "none"
168+
},
169+
"tls_server": {
170+
"certificate_chain_file": "/tmp/irods_server.crt",
171+
"certificate_key_file": "/tmp/irods_server.key",
172+
"dh_params_file": "/tmp/irods_dhparams.pem"
173+
},
174+
"zone_auth_scheme": "native",
175+
"zone_key": "TEMPORARY_ZONE_KEY",
176+
"zone_name": "tempZone",
177+
"zone_port": 1247,
178+
"zone_user": "rods"
179+
}
180+
}

‎irods/src/test/resources/iRODS_pam.cyberduckprofile‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
3+
<plist version="1.0">
4+
<dict>
5+
<key>Protocol</key>
6+
<string>irods</string>
7+
<key>Vendor</key>
8+
<string>iRODS Consortium</string>
9+
<key>Description</key>
10+
<string>iRODS (Integrated Rule-Oriented Data System)</string>
11+
12+
<key>Hostname Configurable</key>
13+
<false/>
14+
<key>Port Configurable</key>
15+
<false/>
16+
17+
<key>Default Hostname</key>
18+
<string>localhost</string>
19+
<key>Default Port</key>
20+
<string>1347</string>
21+
22+
<key>Username Placeholder</key>
23+
<string>iRODS username</string>
24+
<key>Password Placeholder</key>
25+
<string>iRODS password</string>
26+
27+
<key>Region</key>
28+
<string>tempZone</string>
29+
30+
<key>Authorization</key>
31+
<string>pam_password</string>
32+
33+
<key>Properties</key>
34+
<dict>
35+
<key>Client Server Negotiation</key>
36+
<string>CS_NEG_REQUIRE</string>
37+
</dict>
38+
</dict>
39+
</plist>

0 commit comments

Comments
 (0)