Unverified Commit 012275a2 authored by Moraxyc's avatar Moraxyc
Browse files

nixosTests.pam-pgsql: init

parent 0b5235f8

nixos/tests/all-tests.nix

+1 −0
Original line number Diff line number Diff line
@@ -1195,6 +1195,7 @@ in 
  pam-file-contents = runTest ./pam/pam-file-contents.nix;

  pam-lastlog = runTest ./pam/pam-lastlog.nix;

  pam-oath-login = runTest ./pam/pam-oath-login.nix;

  pam-pgsql = runTest ./pam/pam-pgsql.nix;

  pam-u2f = runTest ./pam/pam-u2f.nix;

  pam-ussh = runTest ./pam/pam-ussh.nix;

  pam-zfs-key = runTest ./pam/zfs-key.nix;

nixos/tests/pam/pam-pgsql.nix

0 → 100644
+88 −0
Original line number Diff line number Diff line 
{ lib, ... }:

let

  dbName = "authdb";

  dbUser = "authuser";

in

{

  name = "pam-pgsql";

  meta.maintainers = with lib.maintainers; [ moraxyc ];



  nodes.machine =

    { lib, pkgs, ... }:

    {

      environment.systemPackages = with pkgs; [ pamtester ];

      environment.etc."pam_pgsql.conf".text = lib.generators.toKeyValue { } {

        connect = "host=/run/postgresql port=5432 dbname=${dbName} user=${dbUser} connect_timeout=15";

        auth_query = "select password from account where username = %u";

        acct_query = "select (expired = 'y' OR expired = '1'), (newtok = 'y' OR newtok = '1'), (password IS NULL OR password = '') from account where username = %u";

        pwd_query = "update account set password = %p where username = %u";

        pw_type = "crypt";

      };



      services.postgresql = {

        enable = true;

        authentication = ''

          local ${dbName} ${dbUser} trust

        '';

        initialScript =

          pkgs.writeText "init.psql"

            # sql

            ''

              CREATE USER ${dbUser};

              CREATE DATABASE ${dbName} OWNER ${dbUser};

              \c ${dbName}



              -- https://github.com/pam-pgsql/pam-pgsql/blob/master/sample.sql

              CREATE TABLE account (

                username varchar(256) UNIQUE NOT NULL,

                password varchar(200),

                expired  boolean,

                newtok   boolean

              );



              GRANT ALL PRIVILEGES ON TABLE account TO ${dbUser};



              CREATE EXTENSION IF NOT EXISTS pgcrypto;

              INSERT INTO account (username, password, expired, newtok)

              VALUES (

                  'alice',

                  crypt('secret', gen_salt('bf')),

                  false,

                  false

              );

            '';

      };

      security.pam.services.pgsql-test.text =

        let

          pam-pgsql-so = "${pkgs.pam-pgsql}/lib/security/pam_pgsql.so";

        in

        ''

          auth        required    ${pam-pgsql-so}

          account     required    ${pam-pgsql-so}

          password    required    ${pam-pgsql-so}

          session     required    ${pam-pgsql-so}

        '';

    };



  testScript =

    # python

    ''

      start_all()



      machine.wait_for_unit("postgresql-setup.service")



      with subtest("Testing successful login..."):

          machine.succeed("echo 'secret' | pamtester -v pgsql-test alice authenticate")



      with subtest("Testing failed login..."):

          machine.fail("echo 'wrongpass' | pamtester -v pgsql-test alice authenticate")



      with subtest("Testing non-existent user..."):

          machine.fail("echo 'secret' | pamtester -v pgsql-test bob authenticate")



      with subtest("Testing expired user..."):

          machine.succeed("psql -U ${dbUser} -d ${dbName} -c 'UPDATE account SET expired = TRUE;'")

          machine.succeed("echo 'secret' | pamtester -v pgsql-test alice authenticate")

          machine.fail("pamtester -v pgsql-test alice acct_mgmt")

    '';

}

pkgs/by-name/pa/pam-pgsql/package.nix

+5 −1
Original line number Diff line number Diff line
@@ -9,6 +9,7 @@ 
  pam,

  libxcrypt,

  unstableGitUpdater,

  nixosTests,

}:



stdenv.mkDerivation {
@@ -35,7 +36,10 @@ stdenv.mkDerivation { 
    libxcrypt

  ];



  passthru.updateScript = unstableGitUpdater { hardcodeZeroVersion = true; };

  passthru = {

    updateScript = unstableGitUpdater { hardcodeZeroVersion = true; };

    tests = { inherit (nixosTests) pam-pgsql; };

  };



  meta = {

    description = "Support to authenticate against PostgreSQL for PAM-enabled applications";