diff options
-rw-r--r-- | .github/workflows/smb-kerberos.yml | 78 | ||||
-rwxr-xr-x | apps/files_external/tests/setup-krb.sh | 33 |
2 files changed, 111 insertions, 0 deletions
diff --git a/.github/workflows/smb-kerberos.yml b/.github/workflows/smb-kerberos.yml new file mode 100644 index 00000000000..2875a7f4fbd --- /dev/null +++ b/.github/workflows/smb-kerberos.yml @@ -0,0 +1,78 @@ +name: Samba Kerberos SSO +on: + push: + branches: + - master + - stable* + paths: + - 'apps/files_external/**' + pull_request: + paths: + - 'apps/files_external/**' + +jobs: + smb-kerberos-tests: + runs-on: ubuntu-latest + + strategy: + fail-fast: false + matrix: + php-versions: ['7.4', '8.0'] + + name: php${{ matrix.php-versions }}-${{ matrix.ftpd }} + + steps: + - name: Checkout server + uses: actions/checkout@v2 + with: + submodules: true + - name: Pull images + run: | + docker pull icewind1991/samba-krb-test-dc + docker pull icewind1991/samba-krb-test-apache + docker pull icewind1991/samba-krb-test-client + - name: Setup AD-DC + run: | + mkdir data + sudo chown -R 33 data apps config + apps/files_external/tests/setup-krb.sh + - name: Set up Nextcloud + run: | + docker exec --user 33 apache ./occ maintenance:install --verbose --database=sqlite --database-name=nextcloud --database-host=127.0.0.1 --database-user=root --database-pass=rootpassword --admin-user admin --admin-pass password + docker exec --user 33 apache ./occ config:system:set trusted_domains 1 --value 'httpd.domain.test' + + # setup user_saml + docker exec --user 33 apache ./occ app:enable user_saml --force + docker exec --user 33 apache ./occ config:app:set user_saml type --value 'environment-variable' + docker exec --user 33 apache ./occ config:app:set user_saml general-uid_mapping --value REMOTE_USER + + # setup external storage + docker exec --user 33 apache ./occ app:enable files_external --force + docker exec --user 33 apache ./occ files_external:create smb smb smb::kerberosapache + docker exec --user 33 apache ./occ files_external:config 1 host krb.domain.test + docker exec --user 33 apache ./occ files_external:config 1 share netlogon + docker exec --user 33 apache ./occ files_external:list + - name: Test SSO + run: | + mkdir cookies + chmod 0777 cookies + + DC_IP=$(docker inspect dc --format '{{.NetworkSettings.IPAddress}}') + docker run --rm --name client -v $PWD/cookies:/cookies -v /tmp/shared:/shared --dns $DC_IP --hostname client.domain.test icewind1991/samba-krb-test-client \ + curl -c /cookies/jar -s --negotiate -u testuser@DOMAIN.TEST: --delegation always http://httpd.domain.test/index.php/apps/user_saml/saml/login + CONTENT=$(docker run --rm --name client -v $PWD/cookies:/cookies -v /tmp/shared:/shared --dns $DC_IP --hostname client.domain.test icewind1991/samba-krb-test-client \ + curl -b /cookies/jar -s --negotiate -u testuser@DOMAIN.TEST: --delegation always http://httpd.domain.test/remote.php/webdav/smb/test.txt) + echo $CONTENT + CONTENT=$(echo $CONTENT | tr -d '[:space:]') + [[ $CONTENT == "testfile" ]] + + + smb-kerberos-summary: + runs-on: ubuntu-latest + needs: smb-kerberos-tests + + if: always() + + steps: + - name: Summary status + run: if ${{ needs.smb-kerberos-tests.result != 'success' }}; then exit 1; fi diff --git a/apps/files_external/tests/setup-krb.sh b/apps/files_external/tests/setup-krb.sh new file mode 100755 index 00000000000..968ba80529e --- /dev/null +++ b/apps/files_external/tests/setup-krb.sh @@ -0,0 +1,33 @@ +#!/bin/bash + +function getContainerHealth { + docker inspect --format "{{.State.Health.Status}}" $1 +} + +function waitContainer { + while STATUS=$(getContainerHealth $1); [ $STATUS != "healthy" ]; do + if [ $STATUS == "unhealthy" ]; then + echo "Failed!" + exit -1 + fi + printf . + lf=$'\n' + sleep 1 + done + printf "$lf" +} + +mkdir /tmp/shared + +# start the dc +docker run -dit --name dc -v /tmp/shared:/shared --hostname krb.domain.test --cap-add SYS_ADMIN icewind1991/samba-krb-test-dc +DC_IP=$(docker inspect dc --format '{{.NetworkSettings.IPAddress}}') + +waitContainer dc + +# start apache +docker run -d --name apache -v $PWD:/var/www/html -v /tmp/shared:/shared --dns $DC_IP --hostname httpd.domain.test icewind1991/samba-krb-test-apache +APACHE_IP=$(docker inspect apache --format '{{.NetworkSettings.IPAddress}}') + +# add the dns record for apache +docker exec dc samba-tool dns add krb.domain.test domain.test httpd A $APACHE_IP -U administrator --password=passwOrd1 |