环境配置测试前提配置好可与BMC连通的LDAP服务端tools目录的generate_argumentfile.sh已添加对应的参数支持tox进行测试。tox.ini配置示例[testenv:e2ps23]deps {[testenv]deps}setenv {[testenv]setenv}OPENBMC_HOST10.9.9.9HTTPS_PORT443SSH_PORT22IPMI_PORT623LDAP_BASE_DNdcopenbmc,dccomLDAP_BIND_DNcnadmin,dcopenbmc,dccomLDAP_SERVER_URIldap://10.9.9.8:389/LDAP_BIND_DN_PASSWORDldapopenbmc!1LDAP_TYPELDAPLDAP_USERtestLDAP_USER_PASSWORDopenbmc.GROUP_NAMEopenbmcGROUP_PRIVILEGEAdministratorcommands {[testenv]commands}python3 -m robot.run --argumentfile {env:ARG_FILE} {posargs}测试用例执行示例tox -e e2ps23 -- redfish/account_service/test_ldap_configuration.robot测试失败用例分析Chassis ID变量没给对数值11Verify LDAP Login Works After BMC Reboot❌失败12Verify LDAP User With Admin Privilege Able To Do BMC Reboot❌失败这两个用例需要对BMC做复位复位用的关键字中需要用到正确的chassis id 可以在测试之前导入或者通过get命令获取。例如在整个测试套件测试之前设置好全套件的全局变量Redfish Get Chassis ID[Documentation] Redfish get Chassis ID and update the global variable.${chassis_id} Get Chassis ID ${CHASSIS_ID}Set Suite Variable ${CHASSIS_ID} ${chassis_id}Log CHASSIS_ID: ${CHASSIS_ID}LDAP用户无法通过redfish接口给某个组分配null/invalid权限23Verify LDAP Authorization With Null Privilege❌失败24Verify LDAP Authorization With Invalid Privilege❌失败原有的测试用例的目的肯定是patch Invalid role空的或者不合法的且这patch操作是可以成功的但是BMC后端默程序此时默认给分配的是readonly权限这样的话登录以后肯定修改hostname返回了403。 我猜测最开始可能是这样的。这里失败的原因是给LDAP用户的组分配权限的时候会执行一个redfish patch操作https://bmc_ip/redfish/v1/AccountServicepayload是类似于{LDAP: {RemoteRoleMapping: [{RemoteGroup: openbmc,LocalRole: not_valid_role}]}}这里执行会失败并返回404状态码{error: {Message.ExtendedInfo: [{MessageId: Base.1.19.PropertyValueNotInList,Message: The value ... for the property RemoteRoleMapping/0/LocalRole is not in the list of acceptable values.}]}}这是因为redfish-core/lib/account_service.hpp中已经明确了只能传入三类合法参数inline std::string getPrivilegeFromRoleId(std::string_view role){if (role Administrator){return priv-admin;}if (role ReadOnly){return priv-user;}if (role Operator){return priv-operator;}return ;}if (localRole){std::string priv getPrivilegeFromRoleId(*localRole);if (priv.empty()){messages::propertyValueNotInList(asyncResp-res, *localRole,std::format(RemoteRoleMapping/{}/LocalRole, index));return;}setDbusProperty(...);}只有AdministratorReadOnlyOperator是合法的想设置为空或者不合法的参数这个操作本身就会失败因此根本没有去执行后续的登录操作和登录之后执行的只有管理员才能进行的特权操作修改bmc的hostname)。问题一既然无法设置一个非法的roleempty设置空权限和其它不存在的role字段都是非法的那就不配置或者配置一个role合法但是测试用户不在的远程用户组或者一个不存在的远程组。这样测试用例就是在测试不显式配置合法参数时LDAP用户的权限映射情况。即payload设置成这样{LDAP: {RemoteRoleMapping: [null]}}或者这样{LDAP: {RemoteRoleMapping: [{RemoteGroup: user not in or do not exist,LocalRole: Administrator}]}}问题二部分BMC固件版本不配置的时候默认就是获得只读用户权限这样BMC还是能登录成功的但是执行不了修改BMC hostname的操作。但是社区后续是打算在不配置的时候不让BMC登录所以测试用例的后续登录预期就可能还需要做修改https://gerrit.openbmc.org/c/openbmc/bmcweb//91970测试用例修改版本Verify LDAP PATCH Rejects Empty LocalRole[Documentation] Verify that PATCH with empty LocalRole is rejected.[Tags] Verify_LDAP_PATCH_Rejects_Empty_LocalRole[Teardown] Restore LDAP Privilege${local_role_remote_group} Create Dictionary LocalRole${EMPTY} RemoteGroup${GROUP_NAME}${remote_role_mapping} Create List ${local_role_remote_group}${ldap_data} Create Dictionary RemoteRoleMapping${remote_role_mapping}${payload} Create Dictionary ${LDAP_TYPE}${ldap_data}Log To Console PATCH payload (empty): ${payload}${resp} Redfish.Patch ${REDFISH_BASE_URI}AccountService body{payload}... valid_status_codes[${HTTP_BAD_REQUEST}]Should Contain ${resp.text} PropertyValueNotInListShould Contain ${resp.text} RemoteRoleMapping/0/LocalRoleVerify LDAP PATCH Rejects Invalid LocalRole[Documentation] Verify that PATCH with invalid LocalRole is rejected.[Tags] Verify_LDAP_PATCH_Rejects_Invalid_LocalRole[Teardown] Restore LDAP Privilege${local_role_remote_group} Create Dictionary LocalRoleInvalid_Privilege RemoteGroup${GROUP_NAME}${remote_role_mapping} Create List ${local_role_remote_group}${ldap_data} Create Dictionary RemoteRoleMapping${remote_role_mapping}${payload} Create Dictionary ${LDAP_TYPE}${ldap_data}Log To Console PATCH payload (invalid): ${payload}${resp} Redfish.Patch ${REDFISH_BASE_URI}AccountService body{payload}... valid_status_codes[${HTTP_BAD_REQUEST}]Should Contain ${resp.text} PropertyValueNotInListShould Contain ${resp.text} RemoteRoleMapping/0/LocalRoleVerify LDAP Authorization With Empty Role Mapping[Documentation] Verify that LDAP user with empty role mapping cannot perform privileged operations.[Tags] Verify_LDAP_Authorization_With_Empty_Role_Mapping[Teardown] Restore LDAP Privilege# Step 1: 清空 RemoteRoleMapping${clear_payload} Create Dictionary ${LDAP_TYPE}${{{RemoteRoleMapping: [None]}}}Log To Console Clear mappings payload: ${clear_payload}Redfish.Patch ${REDFISH_BASE_URI}AccountService body${clear_payload}... valid_status_codes[${HTTP_OK}, ${HTTP_NO_CONTENT}]Sleep 5s# Step 2: 尝试 LDAP 登录${login_status} Run Keyword And Return Status Redfish.Login ${LDAP_USER} ${LDAP_USER_PASSWORD}IF ${login_status}# 登录成功验证无权限修改主机名预期 403${hostname} Redfish.Get Attribute ${REDFISH_NW_PROTOCOL_URI} HostNameRedfish.Patch ${REDFISH_NW_ETH0_URI} body{HostName: ${hostname}}... valid_status_codes[${HTTP_FORBIDDEN}]Redfish.LogoutELSE# 登录失败可能 401也视为通过Log LDAP login failed as expected for unmapped user (likely 401).END# 恢复管理员会话供后续用例Redfish.LoginVerify LDAP Authorization With NonMatching Group [Documentation] Verify that LDAP user not in the configured group cannot perform privileged operations. [Tags] Verify_LDAP_Authorization_With_NonMatching_Group [Teardown] Restore LDAP Privilege # Step 1: 配置有效角色 测试用户不存在的组 ${local_role_remote_group} Create Dictionary ... LocalRoleAdministrator ... RemoteGroupnon-matching-group ${remote_role_mapping} Create List ${local_role_remote_group} ${ldap_data} Create Dictionary RemoteRoleMapping${remote_role_mapping} ${payload} Create Dictionary ${LDAP_TYPE}${ldap_data} Log To Console PATCH payload (non-matching group): ${payload} Redfish.Patch ${REDFISH_BASE_URI}AccountService body{payload} ... valid_status_codes[${HTTP_OK}, ${HTTP_NO_CONTENT}] Sleep 5s # Step 2: 尝试 LDAP 登录 ${login_status} Run Keyword And Return Status Redfish.Login ${LDAP_USER} ${LDAP_USER_PASSWORD} IF ${login_status} ${hostname} Redfish.Get Attribute ${REDFISH_NW_PROTOCOL_URI} HostName Redfish.Patch ${REDFISH_NW_ETH0_URI} body{HostName: ${hostname}} ... valid_status_codes[${HTTP_FORBIDDEN}] Redfish.Logout ELSE Log LDAP login failed as expected for non-matching group user (likely 401). END Redfish.Login替换说明在test_ldap_configuration.robot中删除原有的两个用例Verify LDAP Authorization With Null PrivilegeVerify LDAP Authorization With Invalid Privilege然后添加上面四个用例即可。其他部分如Restore LDAP Privilege、变量定义等无需修改。测试覆盖总结用例测试内容预期结果Verify LDAP PATCH Rejects Empty LocalRolePATCH 空 LocalRole400PropertyValueNotInListVerify LDAP PATCH Rejects Invalid LocalRolePATCH 无效 LocalRole400PropertyValueNotInListVerify LDAP Authorization With Empty Role Mapping清空所有映射后LDAP 用户无权限204 → 登录 → 403/401Verify LDAP Authorization With NonMatching Group测试用户不属于配置的组因此无法获得任何角色权限204 → 登录 → 403/401从复用角度也可以不自己重新构造用已有的关键字完成第一第二个测试用例Run Keyword And Expect Error *PropertyValueNotInList* Update LDAP Configuration With LDAP User Role And Group ${LDAP_TYPE} ${EMPTY} ${GROUP_NAME}