ipaserver: Move /etc/httpd/ipa to /etc/ipa/httpd

.gitignore

@@ -155,7 +155,6 @@ install/custodia/ipa-custodia-dmldap
 install/custodia/ipa-custodia-pki-tomcat
 install/custodia/ipa-custodia-pki-tomcat-wrapped
 install/custodia/ipa-custodia-ra-agent
-install/oddjob/org.freeipa.server.config-enable-sid
 install/oddjob/org.freeipa.server.trust-enable-agent
 install/oddjob/com.redhat.idm.trust-fetch-domains
 install/oddjob/etc/oddjobd.conf.d/ipa-server.conf

Makefile.am

@@ -23,8 +23,6 @@ PYTHON_SCRIPT_SUBDIRS = \
         $(top_builddir)/install/tools \
         $(NULL)
 
-PRCI_DEFINITIONS_DIR = $(top_srcdir)/ipatests/prci_definitions
-
 AZURE_PYTHON_SCRIPT_SUBDIR = $(top_builddir)/ipatests/azure
 
 IPA_PLACEHOLDERS = freeipa ipa ipaserver ipatests
@@ -338,8 +336,6 @@ endif  # WITH_RPMLINT
 # There are Jinja yaml templates, which differ from reqular ones. These
 # files should be placed on skip list (YAML_TEMPLATE_FILES), otherwise
 # safe_load fails.
-# Also check PRCI definitions yaml files jobs format and content with
-# prci_checker script
 .PHONY: yamllint
 yamllint:
 	YAML_TEMPLATE_FILES="\
@@ -361,10 +357,7 @@ yamllint:
 		echo $${YAML}; \
 		$(PYTHON) -c "import yaml; f = open('$${YAML}'); yaml.safe_load(f); f.close()" || { echo Your YAML file: $${YAML} has a wrong syntax or this is a Jinja template. In the latter clause, consider to add your YAML file to the YAML_TEMPLATE_FILES list in Makefile.am.; exit 1; } \
 	done; \
-	echo -e "\nCheck PRCI definitions";
-	@echo "-----------"
-	$(PYTHON) $(PRCI_DEFINITIONS_DIR)/prci_checker.py -d $(PRCI_DEFINITIONS_DIR) -s $(PRCI_DEFINITIONS_DIR)/prci_jobs_spec.yaml;
-	@echo "-----------"
+	echo "-----------"
 
 # Build & lint documentation.
 #
@@ -396,7 +389,7 @@ pylint: $(GENERATED_PYTHON_FILES) ipasetup.py python_scripts
 		-name '*~' -o \
 		-name '*.py' -print -o \
 		-type f -exec grep -qsm1 '^#!.*\bpython' '{}' \; -print`; \
-	FILES=`echo -e "$${FILES}\n$(AZURE_PYTHON_SCRIPT_SUBDIR)\n$(PRCI_DEFINITIONS_DIR)"`; \
+	FILES=`echo -e "$${FILES}\n$(AZURE_PYTHON_SCRIPT_SUBDIR)"`; \
 	echo -e "Pylint on $(PYTHON) is running over files:\n$${FILES}\nPlease wait ...\n"; \
 	$(PYTHON) -m pylint --version; \
 	PYTHONPATH=$(top_srcdir) $(PYTHON) -m pylint \

VERSION.m4

@@ -21,7 +21,7 @@
 ########################################################
 define(IPA_VERSION_MAJOR, 4)
 define(IPA_VERSION_MINOR, 10)
-define(IPA_VERSION_RELEASE, 1)
+define(IPA_VERSION_RELEASE, 0)
 
 ########################################################
 # For 'pre' releases the version will be               #
@@ -49,7 +49,7 @@ define(IPA_VERSION_PRE_RELEASE, )
 # This option works only with GNU m4:                  #
 # it requires esyscmd m4 macro.                        #
 ########################################################
-define(IPA_VERSION_IS_GIT_SNAPSHOT, yes)
+define(IPA_VERSION_IS_GIT_SNAPSHOT, no)
 
 ########################################################
 # git development branch:                              #

daemons/ipa-slapi-plugins/ipa-graceperiod/ipa_graceperiod.c

@@ -359,8 +359,7 @@ static int ipagraceperiod_preop(Slapi_PBlock *pb)
     Slapi_ValueSet *values = NULL;
     long grace_limit = 0;
     int grace_user_time;
-    char *tmpstr = NULL;
-    time_t pwd_expiration;
+    char *pwd_expiration = NULL;
     int pwresponse_requested = 0;
     Slapi_PBlock *pbtm = NULL;
     Slapi_Mods *smods = NULL;
@@ -415,17 +414,12 @@ static int ipagraceperiod_preop(Slapi_PBlock *pb)
     }
     slapi_value_free(&objectclass);
 
-    tmpstr = slapi_entry_attr_get_charptr(target_entry, "krbPasswordExpiration");
-    if (tmpstr == NULL) {
+    pwd_expiration = slapi_entry_attr_get_charptr(target_entry, "krbPasswordExpiration");
+    if (pwd_expiration == NULL) {
         /* No expiration means nothing to do */
         LOG_TRACE("No krbPasswordExpiration for %s, nothing to do\n", dn);
         goto done;
     }
-    pwd_expiration = ipapwd_gentime_to_time_t(tmpstr);
-    if (pwd_expiration > time(NULL)) {
-        /* Not expired, nothing to see here */
-        goto done;
-    }
 
     ldrc = ipagraceperiod_getpolicy(target_entry, &policy_entry,
                                     &values, &actual_type_name,
@@ -479,7 +473,7 @@ static int ipagraceperiod_preop(Slapi_PBlock *pb)
         if (pwresponse_requested) {
             slapi_pwpolicy_make_response_control(pb, -1, grace_limit - grace_user_time , -1);
         }
-    } else if (grace_user_time >= grace_limit) {
+    } else if ((grace_limit > 0) && (grace_user_time >= grace_limit)) {
         LOG_TRACE("%s password is expired and out of grace limit\n", dn);
         errstr = "Password is expired.\n";
         ret = LDAP_INVALID_CREDENTIALS;

doc/Makefile

@@ -35,5 +35,4 @@ distclean: clean
 venv:
 	$(PYTHON) -m venv $(VENVDIR)
 	$(VENVDIR)/bin/python3 -m pip install -U pip setuptools
-	$(VENVDIR)/bin/python3 -m pip install -U -r ./requirements.txt \
-		-c constraints.txt
+	$(VENVDIR)/bin/python3 -m pip install -U -r ./requirements.txt

doc/constraints.txt

@@ -1 +0,0 @@
-docutils < 0.19

install/tools/man/ipa-replica-install.1

@@ -98,9 +98,6 @@ Configure SSSD as data source for subid.
 \fB\-\-skip\-conncheck\fR
 Skip connection check to remote master
 .TP
-\fB\-\-skip\-mem\-check\fR
-Skip checking for minimum required memory
-.TP
 \fB\-d\fR, \fB\-\-debug
 Enable debug logging when more verbose output is needed
 .TP

install/tools/man/ipa-server-install.1

@@ -83,9 +83,6 @@ Do not configure OpenSSH server.
 \fB\-\-subid\fR
 Configure SSSD as data source for subid.
 .TP
-\fB\-\-skip\-mem\-check\fR
-Skip checking for minimum required memory
-.TP
 \fB\-d\fR, \fB\-\-debug\fR
 Enable debug logging when more verbose output is needed.
 .TP

install/ui/src/freeipa/Application_controller.js

@@ -318,7 +318,6 @@ define([
                         $type: 'text',
                         name: 'pagination_size',
                         label: '@i18n:customization.table_pagination',
-                        required: true,
                         validators: ['positive_integer']
                     }
                 ]

install/ui/src/freeipa/policy.js

@@ -72,9 +72,6 @@ return {
                         {
                             name: 'cospriority',
                             required: true
-                        },
-                        {
-                            name: 'passwordgracelimit'
                         }
                     ]
                 }]

install/ui/src/freeipa/user.js

@@ -318,11 +318,6 @@ return {
                             label: '@mo-param:pwpolicy:krbpwdlockoutduration:label',
                             read_only: true,
                             measurement_unit: 'seconds'
-                        },
-                        {
-                            name: 'passwordgracelimit',
-                            label: '@mo-param:pwpolicy:passwordgracelimit:label',
-                            read_only: true
                         }
                     ]
                 },

ipalib/messages.py

@@ -18,7 +18,7 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 """
-Custom message (debug, info, warning) classes passed through RPC.
+Custom message (debug, info, wraning) classes passed through RPC.
 
 These are added to the "messages" entry in a RPC response, and printed to the
 user as log messages.
@@ -27,7 +27,7 @@ Each message class has a unique numeric "errno" attribute from the 10000-10999
 range, so that it does not clash with PublicError numbers.
 
 Messages also have the 'type' argument, set to one of 'debug', 'info',
-'warning', 'error'. This determines the severity of the message.
+'warning', 'error'. This determines the severity of themessage.
 """
 from __future__ import print_function
 
@@ -496,16 +496,6 @@ class LightweightCACertificateNotAvailable(PublicMessage):
     format = _("The certificate for %(ca)s is not available on this server.")
 
 
-class MissingTargetAttributesinPermission(PublicMessage):
-    """
-    **13032** A permission was added with no target attributes
-    """
-    errno = 13032
-    type = "warning"
-    format = _("The permission has %(right)s rights but no attributes "
-               "are set.")
-
-
 def iter_messages(variables, base):
     """Return a tuple with all subclasses
     """

ipapython/dnsutil.py

@@ -144,47 +144,6 @@ class DNSResolver(dns.resolver.Resolver):
             nameservers.remove(ipv4_loopback)
         self.nameservers = nameservers
 
-    @dns.resolver.Resolver.nameservers.setter
-    def nameservers(self, nameservers):
-        """
-        *nameservers*, a ``list`` of nameservers with optional ports:
-            "SERVER_IP port PORT_NUMBER".
-
-        Overloads dns.resolver.Resolver.nameservers setter to split off ports
-        into nameserver_ports after setting nameservers successfully with the
-        setter in dns.resolver.Resolver.
-        """
-        # Get nameserver_ports if it is already set
-        if hasattr(self, "nameserver_ports"):
-            nameserver_ports = self.nameserver_ports
-        else:
-            nameserver_ports = {}
-
-        # Check nameserver items in list and split out converted port number
-        # into nameserver_ports: { nameserver: port }
-        if isinstance(nameservers, list):
-            _nameservers = []
-            for nameserver in nameservers:
-                splits = nameserver.split()
-                if len(splits) == 3 and splits[1] == "port":
-                    nameserver = splits[0]
-                    try:
-                        port = int(splits[2])
-                        if port < 0 or port > 65535:
-                            raise ValueError()
-                    except ValueError:
-                        raise ValueError(
-                            "invalid nameserver: %s is not a valid port" %
-                            splits[2])
-                    nameserver_ports[nameserver] = port
-                _nameservers.append(nameserver)
-            nameservers = _nameservers
-
-        # Call dns.resolver.Resolver.nameservers setter
-        dns.resolver.Resolver.nameservers.__set__(self, nameservers)
-        # Set nameserver_ports after successfull call to setter
-        self.nameserver_ports = nameserver_ports
-
 
 class DNSZoneAlreadyExists(dns.exception.DNSException):
     supp_kwargs = {'zone', 'ns'}

ipaserver/install/installutils.py

@@ -1132,8 +1132,7 @@ def check_available_memory(ca=False):
     if available < minimum_suggested:
         raise ScriptError(
             "Less than the minimum 1.2GB of RAM is available, "
-            "%.2fGB available.  Use --skip-mem-check to suppress this check."
-            % (available / (1024 * 1024 * 1024))
+            "%.2fGB available" % (available / (1024 * 1024 * 1024))
         )
 
 def load_external_cert(files, ca_subject):

ipaserver/install/replication.py

@@ -1152,7 +1152,7 @@ class ReplicationManager:
             except (ValueError, TypeError, KeyError):
                 end = 0
             # incremental update is done if inprogress is false and end >= start
-            done = inprogress is not None and not inprogress and start <= end
+            done = inprogress and inprogress.lower() == 'false' and start <= end
             logger.info("Replication Update in progress: %s: status: %s: "
                         "start: %d: end: %d",
                         inprogress, status, start, end)

ipaserver/install/server/upgrade.py

@@ -1899,12 +1899,9 @@ def upgrade_configuration():
     custodia = custodiainstance.CustodiaInstance(api.env.host, api.env.realm)
     custodia.upgrade_instance()
 
-    # Don't include schema upgrades in restart consideration, see
-    # https://pagure.io/freeipa/issue/9204
-    ca_upgrade_schema(ca)
-
     ca_restart = any([
         ca_restart,
+        ca_upgrade_schema(ca),
         certificate_renewal_update(ca, kra, ds, http),
         ca_enable_pkix(ca),
         ca_configure_profiles_acl(ca),

ipaserver/plugins/permission.py

@@ -28,7 +28,6 @@ from .privilege import validate_permission_to_privilege
 from ipalib import errors
 from ipalib.parameters import Str, StrEnum, DNParam, Flag
 from ipalib import api, _, ngettext
-from ipalib import messages
 from ipalib.plugable import Registry
 from ipalib.capabilities import client_has_capability
 from ipalib.aci import ACI
@@ -554,7 +553,6 @@ class permission(baseldap.LDAPObject):
     def make_aci(self, entry):
         """Make an ACI string from the given permission entry"""
 
-        msg = None
         aci_parts = []
         name = entry.single_value['cn']
 
@@ -562,18 +560,6 @@ class permission(baseldap.LDAPObject):
         attrs = self.get_effective_attrs(entry)
         if attrs:
             aci_parts.append("(targetattr = \"%s\")" % ' || '.join(attrs))
-        else:
-            # If we are re-parsing an entry for validation then
-            # the effective attrs may be empty.
-            if entry.get('attrs') is None:
-                rights = set(['read', 'write', 'search', 'compare'])
-                permrights = set(entry['ipapermright'])
-                for right in ('add', 'delete'):
-                    permrights.discard(right)
-                if permrights and permrights.issubset(rights):
-                    msg = messages.MissingTargetAttributesinPermission(
-                        right=', '.join(sorted(entry['ipapermright']))
-                    )
 
         # target
         ipapermtarget = entry.single_value.get('ipapermtarget')
@@ -622,12 +608,12 @@ class permission(baseldap.LDAPObject):
         aci_parts.append('(version 3.0;acl "permission:%s";allow (%s) %s;)' % (
             name, ','.join(sorted(entry['ipapermright'])), bindrule))
 
-        return ''.join(aci_parts), msg
+        return ''.join(aci_parts)
 
     def add_aci(self, permission_entry):
         """Add the ACI coresponding to the given permission entry"""
         ldap = self.api.Backend.ldap2
-        acistring, _msg = self.make_aci(permission_entry)
+        acistring = self.make_aci(permission_entry)
         location = permission_entry.single_value.get('ipapermlocation',
                                                      self.api.env.basedn)
 
@@ -655,7 +641,7 @@ class permission(baseldap.LDAPObject):
             - entry
             - removed ACI string, or None if none existed previously
         """
-        new_acistring, _msg = self.make_aci(permission_entry)
+        new_acistring = self.make_aci(permission_entry)
         return self._replace_aci(permission_entry, old_name, new_acistring)
 
     def _replace_aci(self, permission_entry, old_name=None, new_acistring=None):
@@ -686,25 +672,6 @@ class permission(baseldap.LDAPObject):
             logger.debug('No changes to ACI')
         return acientry, acistring
 
-    def check_attrs(self, result, *keys, **options):
-        """Re-build the ACI to determine if there are rights that
-           only work when there are attributes defined."""
-        ldap = self.backend
-
-        dn = self.get_dn(*keys, **options)
-        entry = ldap.make_entry(dn, result['result'])
-        for old_name, new_name in _DEPRECATED_OPTION_ALIASES.items():
-            if old_name in entry:
-                entry[new_name] = entry[old_name]
-                del entry[old_name]
-        _acistring, msg = self.make_aci(entry)
-        if msg:
-            messages.add_message(
-                options['version'],
-                result,
-                msg,
-            )
-
     def _get_aci_entry_and_string(self, permission_entry, name=None,
                                   notfound_ok=False, cached_acientry=None):
         """Get the entry and ACI corresponding to the permission entry
@@ -809,7 +776,7 @@ class permission(baseldap.LDAPObject):
         target_entry['ipapermlocation'] = [self.api.env.basedn]
 
         # Make sure we're not losing *any info* by the upgrade
-        new_acistring, _msg = self.make_aci(target_entry)
+        new_acistring = self.make_aci(target_entry)
         if not ACI(new_acistring).isequal(aci):
             raise ValueError('Cannot convert ACI, %r != %r' % (new_acistring,
                                                                acistring))
@@ -1025,9 +992,7 @@ class permission_add(baseldap.LDAPCreate):
     # the whole command, not just the callbacks
     def execute(self, *keys, **options):
         self.obj.preprocess_options(options, merge_targetfilter=True)
-        result = super(permission_add, self).execute(*keys, **options)
-        self.obj.check_attrs(result, *keys, **options)
-        return result
+        return super(permission_add, self).execute(*keys, **options)
 
     def get_args(self):
         for arg in super(permission_add, self).get_args():
@@ -1129,9 +1094,7 @@ class permission_mod(baseldap.LDAPUpdate):
     def execute(self, *keys, **options):
         context.filter_ops = self.obj.preprocess_options(
             options, return_filter_ops=True)
-        result = super(permission_mod, self).execute(*keys, **options)
-        self.obj.check_attrs(result, *keys, **options)
-        return result
+        return super(permission_mod, self).execute(*keys, **options)
 
     def get_options(self):
         for opt in super(permission_mod, self).get_options():

ipatests/azure/azure_definitions/gating-fedora.yml

@@ -45,16 +45,15 @@ vms:
     - test_integration/test_external_ca.py::TestExternalCAInstall
 
 - vm_jobs:
-# Temporary disable - see https://pagure.io/freeipa/issue/9216
-#  - container_job: InstallDNSSECFirst
-#    containers:
-#      replicas: 1
-#      resources:
-#        replica:
-#          mem_limit: "2400m"
-#          memswap_limit: "3500m"
-#    tests:
-#    - test_integration/test_dnssec.py::TestInstallDNSSECFirst
+  - container_job: InstallDNSSECFirst
+    containers:
+      replicas: 1
+      resources:
+        replica:
+          mem_limit: "2400m"
+          memswap_limit: "3500m"
+    tests:
+    - test_integration/test_dnssec.py::TestInstallDNSSECFirst
 
   - container_job: simple_replication
     containers:
@@ -70,6 +69,14 @@ vms:
     tests:
     - test_integration/test_service_permissions.py
 
+  - container_job: netgroup
+    tests:
+    - test_integration/test_netgroup.py
+
+  - container_job: external_ca_ExternalCAProfileScenarios
+    tests:
+    - test_integration/test_external_ca.py::TestExternalCAProfileScenarios
+
 - vm_jobs:
   - container_job: sudo
     containers:
@@ -130,15 +137,6 @@ vms:
     tests:
     - test_integration/test_membermanager.py
 
-  - container_job: netgroup
-    tests:
-    - test_integration/test_netgroup.py
-
-  - container_job: external_ca_ExternalCAProfileScenarios
-    tests:
-    - test_integration/test_external_ca.py::TestExternalCAProfileScenarios
-
-
 - vm_jobs:
   - container_job: ServerReplicaCALessToCAFull
     tests:

ipatests/azure/scripts/setup_containers.py

@@ -12,7 +12,7 @@ from jinja2 import Template
 from typing import NamedTuple, TYPE_CHECKING
 
 if TYPE_CHECKING:
-    from typing import List, Tuple, Union, Dict
+    from typing import List, Tuple, Union
 
 logging.basicConfig(level=logging.INFO, format="%(levelname)s: %(message)s")
 
@@ -77,19 +77,14 @@ class Container:
         return self._ipv6
 
     def execute(
-        self,
-        args: Union[str, List[str]],
-        raiseonerr: bool = True,
-        env: Union[Dict[str, str], List[str], None] = None,
+        self, args: Union[str, List[str]], raiseonerr: bool = True
     ) -> ExecRunReturn:
         """
         Exec an arbitrary command within container
         """
         dcont = self.dclient.containers.get(self.name)
         logging.info("%s: run: %s", dcont.name, args)
-        result: ExecRunReturn = dcont.exec_run(
-            args, demux=True, environment=env
-        )
+        result: ExecRunReturn = dcont.exec_run(args, demux=True)
         if result.output[0] is not None:
             logging.info("%s: %s", dcont.name, result.output[0])
         logging.info("%s: result: %s", dcont.name, result.exit_code)
@@ -132,13 +127,13 @@ class ContainersGroup:
             for c in range(1, self.scale + 1)
         ]
 
-    def execute_all(self, args, env=None):
+    def execute_all(self, args):
         """
         Sequentially exec an arbitrary command within every container of group
         """
         results = []
         for cont in self.containers:
-            results.append(cont.execute(args, env=env))
+            results.append(cont.execute(args))
         return results
 
     def ips(self):
@@ -204,8 +199,7 @@ class ContainersGroup:
             cont.execute(cmd)
 
             cmd = ["hostnamectl", "set-hostname", cont.hostname]
-            # default timeout (25s) maybe not enough
-            cont.execute(cmd, env={"SYSTEMD_BUS_TIMEOUT": "50"})
+            cont.execute(cmd)
 
     def setup_resolvconf(self):
         """
@@ -337,7 +331,7 @@ class Controller(Container):
 
         return self._master_container
 
-    def execute(self, args, env=None):
+    def execute(self, args):
         """
         Execute a command on controller (either master or local machine)
         """
@@ -345,7 +339,7 @@ class Controller(Container):
             proc = subprocess.run(args, check=True, capture_output=True)
             return [proc.stdout.decode().rstrip().strip("'")]
 
-        return self.master_container.execute(args, env=env)
+        return self.master_container.execute(args)
 
     def setup_hosts(self):
         """

ipatests/azure/templates/test-jobs.yml

@@ -4,11 +4,6 @@ steps:
     env | sort
   displayName: Print Host Enviroment
 
-- script: |
-    set -e
-    sudo apt list --installed
-  displayName: Show Host's installed packages
-
 - script: |
     set -e
     sudo apt-get update
@@ -21,21 +16,6 @@ steps:
         python3-docker
   displayName: Install Host's tests requirements
 
-- script: |
-    set -e
-    sudo systemctl
-  displayName: Show Host's systemd status
-
-- script: |
-    set -e
-    # most of the time systemd killed hostnamed with SIGKILL on timeout
-    # kill without waiting for graceful termination
-    sudo systemctl kill -s SIGKILL azsecd ||:
-    sudo systemctl disable --now azsecmond ||:
-    sudo systemctl disable --now azsecd ||:
-    sudo systemctl disable --now clamav-freshclam ||:
-  displayName: Disable azsec services (clamav)
-
 - script: |
     set -e
     printf "AppArmor status\n"
@@ -72,16 +52,6 @@ steps:
 
 - template: setup-test-environment.yml
 
-- script: |
-    set -eu
-    sudo top -b -o +%MEM n 1
-  displayName: Show Host's top
-
-- script: |
-    set -eu
-    sudo ps -auxf
-  displayName: Show Host's processes
-
 - template: run-test.yml
 
 - script: |

ipatests/prci_definitions/gating.yaml

@@ -21,7 +21,7 @@ topologies:
     memory: 2400
 
 jobs:
-  fedora-latest-ipa-4-10/build:
+  fedora-latest/build:
     requires: []
     priority: 150
     job:
@@ -29,284 +29,284 @@ jobs:
       args:
         git_repo: '{git_repo}'
         git_refspec: '{git_refspec}'
-        template: &ci-ipa-4-10-latest
-          name: freeipa/ci-ipa-4-10-f36
-          version: 0.0.1
+        template: &ci-master-latest
+          name: freeipa/ci-master-f36
+          version: 0.0.7
         timeout: 1800
         topology: *build
 
-  fedora-latest-ipa-4-10/test_installation_TestInstallMaster:
-    requires: [fedora-latest-ipa-4-10/build]
+  fedora-latest/test_installation_TestInstallMaster:
+    requires: [fedora-latest/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest-ipa-4-10/build_url}'
+        build_url: '{fedora-latest/build_url}'
         test_suite: test_integration/test_installation.py::TestInstallMaster
-        template: *ci-ipa-4-10-latest
+        template: *ci-master-latest
         timeout: 7200
         topology: *master_1repl
 
-  fedora-latest-ipa-4-10/simple_replication:
-    requires: [fedora-latest-ipa-4-10/build]
+  fedora-latest/simple_replication:
+    requires: [fedora-latest/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest-ipa-4-10/build_url}'
+        build_url: '{fedora-latest/build_url}'
         test_suite: test_integration/test_simple_replication.py
-        template: *ci-ipa-4-10-latest
+        template: *ci-master-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest-ipa-4-10/test_caless_TestServerReplicaCALessToCAFull:
-    requires: [fedora-latest-ipa-4-10/build]
+  fedora-latest/test_caless_TestServerReplicaCALessToCAFull:
+    requires: [fedora-latest/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest-ipa-4-10/build_url}'
+        build_url: '{fedora-latest/build_url}'
         test_suite: test_integration/test_caless.py::TestServerReplicaCALessToCAFull
-        template: *ci-ipa-4-10-latest
+        template: *ci-master-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest-ipa-4-10/test_external_ca_TestExternalCA:
-    requires: [fedora-latest-ipa-4-10/build]
+  fedora-latest/test_external_ca_TestExternalCA:
+    requires: [fedora-latest/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest-ipa-4-10/build_url}'
+        build_url: '{fedora-latest/build_url}'
         test_suite: test_integration/test_external_ca.py::TestExternalCA test_integration/test_external_ca.py::TestExternalCAConstraints
-        template: *ci-ipa-4-10-latest
+        template: *ci-master-latest
         timeout: 4800
         topology: *master_1repl_1client
 
-  fedora-latest-ipa-4-10/test_external_ca_TestSelfExternalSelf:
-    requires: [fedora-latest-ipa-4-10/build]
+  fedora-latest/test_external_ca_TestSelfExternalSelf:
+    requires: [fedora-latest/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest-ipa-4-10/build_url}'
+        build_url: '{fedora-latest/build_url}'
         test_suite: test_integration/test_external_ca.py::TestSelfExternalSelf test_integration/test_external_ca.py::TestExternalCAInstall
-        template: *ci-ipa-4-10-latest
+        template: *ci-master-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest-ipa-4-10/external_ca_templates:
-    requires: [fedora-latest-ipa-4-10/build]
+  fedora-latest/external_ca_templates:
+    requires: [fedora-latest/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest-ipa-4-10/build_url}'
+        build_url: '{fedora-latest/build_url}'
         test_suite: test_integration/test_external_ca.py::TestExternalCAProfileScenarios
-        template: *ci-ipa-4-10-latest
+        template: *ci-master-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest-ipa-4-10/test_topologies:
-    requires: [fedora-latest-ipa-4-10/build]
+  fedora-latest/test_topologies:
+    requires: [fedora-latest/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest-ipa-4-10/build_url}'
+        build_url: '{fedora-latest/build_url}'
         test_suite: test_integration/test_topologies.py
-        template: *ci-ipa-4-10-latest
+        template: *ci-master-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest-ipa-4-10/test_sudo:
-    requires: [fedora-latest-ipa-4-10/build]
+  fedora-latest/test_sudo:
+    requires: [fedora-latest/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest-ipa-4-10/build_url}'
+        build_url: '{fedora-latest/build_url}'
         test_suite: test_integration/test_sudo.py
-        template: *ci-ipa-4-10-latest
+        template: *ci-master-latest
         timeout: 4800
         topology: *master_1repl_1client
 
-  fedora-latest-ipa-4-10/test_commands:
-    requires: [fedora-latest-ipa-4-10/build]
+  fedora-latest/test_commands:
+    requires: [fedora-latest/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest-ipa-4-10/build_url}'
+        build_url: '{fedora-latest/build_url}'
         test_suite: test_integration/test_commands.py
-        template: *ci-ipa-4-10-latest
+        template: *ci-master-latest
         timeout: 5400
         topology: *master_1repl_1client
 
-  fedora-latest-ipa-4-10/test_kerberos_flags:
-    requires: [fedora-latest-ipa-4-10/build]
+  fedora-latest/test_kerberos_flags:
+    requires: [fedora-latest/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest-ipa-4-10/build_url}'
+        build_url: '{fedora-latest/build_url}'
         test_suite: test_integration/test_kerberos_flags.py
-        template: *ci-ipa-4-10-latest
+        template: *ci-master-latest
         timeout: 3600
         topology: *master_1repl_1client
 
-  fedora-latest-ipa-4-10/test_forced_client_enrolment:
-    requires: [fedora-latest-ipa-4-10/build]
+  fedora-latest/test_forced_client_enrolment:
+    requires: [fedora-latest/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest-ipa-4-10/build_url}'
+        build_url: '{fedora-latest/build_url}'
         test_suite: test_integration/test_forced_client_reenrollment.py
-        template: *ci-ipa-4-10-latest
+        template: *ci-master-latest
         timeout: 4800
         topology: *master_1repl_1client
 
-  fedora-latest-ipa-4-10/test_advise:
-    requires: [fedora-latest-ipa-4-10/build]
+  fedora-latest/test_advise:
+    requires: [fedora-latest/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest-ipa-4-10/build_url}'
+        build_url: '{fedora-latest/build_url}'
         test_suite: test_integration/test_advise.py
-        template: *ci-ipa-4-10-latest
+        template: *ci-master-latest
         timeout: 3600
         topology: *master_1repl_1client
 
-  fedora-latest-ipa-4-10/test_testconfig:
-    requires: [fedora-latest-ipa-4-10/build]
+  fedora-latest/test_testconfig:
+    requires: [fedora-latest/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest-ipa-4-10/build_url}'
+        build_url: '{fedora-latest/build_url}'
         test_suite: test_integration/test_testconfig.py
-        template: *ci-ipa-4-10-latest
+        template: *ci-master-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest-ipa-4-10/test_service_permissions:
-    requires: [fedora-latest-ipa-4-10/build]
+  fedora-latest/test_service_permissions:
+    requires: [fedora-latest/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest-ipa-4-10/build_url}'
+        build_url: '{fedora-latest/build_url}'
         test_suite: test_integration/test_service_permissions.py
-        template: *ci-ipa-4-10-latest
+        template: *ci-master-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest-ipa-4-10/test_netgroup:
-    requires: [fedora-latest-ipa-4-10/build]
+  fedora-latest/test_netgroup:
+    requires: [fedora-latest/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest-ipa-4-10/build_url}'
+        build_url: '{fedora-latest/build_url}'
         test_suite: test_integration/test_netgroup.py
-        template: *ci-ipa-4-10-latest
+        template: *ci-master-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest-ipa-4-10/test_authconfig:
-    requires: [fedora-latest-ipa-4-10/build]
+  fedora-latest/test_authconfig:
+    requires: [fedora-latest/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest-ipa-4-10/build_url}'
+        build_url: '{fedora-latest/build_url}'
         test_suite: test_integration/test_authselect.py
-        template: *ci-ipa-4-10-latest
+        template: *ci-master-latest
         timeout: 4800
         topology: *master_1repl_1client
 
-  fedora-latest-ipa-4-10/test_replica_promotion_TestSubCAkeyReplication:
-    requires: [fedora-latest-ipa-4-10/build]
+  fedora-latest/test_replica_promotion_TestSubCAkeyReplication:
+    requires: [fedora-latest/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest-ipa-4-10/build_url}'
+        build_url: '{fedora-latest/build_url}'
         test_suite: test_integration/test_replica_promotion.py::TestSubCAkeyReplication
-        template: *ci-ipa-4-10-latest
+        template: *ci-master-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest-ipa-4-10/test_dnssec_TestInstallDNSSECFirst:
-    requires: [fedora-latest-ipa-4-10/build]
+  fedora-latest/test_dnssec_TestInstallDNSSECFirst:
+    requires: [fedora-latest/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest-ipa-4-10/build_url}'
+        build_url: '{fedora-latest/build_url}'
         test_suite: test_integration/test_dnssec.py::TestInstallDNSSECFirst
-        template: *ci-ipa-4-10-latest
+        template: *ci-master-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest-ipa-4-10/test_membermanager:
-    requires: [fedora-latest-ipa-4-10/build]
+  fedora-latest/test_membermanager:
+    requires: [fedora-latest/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest-ipa-4-10/build_url}'
+        build_url: '{fedora-latest/build_url}'
         test_suite: test_integration/test_membermanager.py
-        template: *ci-ipa-4-10-latest
+        template: *ci-master-latest
         timeout: 1800
         topology: *master_1repl
 
-  fedora-latest-ipa-4-10/test_adtrust_install:
-    requires: [fedora-latest-ipa-4-10/build]
+  fedora-latest/test_adtrust_install:
+    requires: [fedora-latest/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest-ipa-4-10/build_url}'
+        build_url: '{fedora-latest/build_url}'
         test_suite: test_integration/test_adtrust_install.py
-        template: *ci-ipa-4-10-latest
+        template: *ci-master-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest-ipa-4-10/test_cert:
-    requires: [fedora-latest-ipa-4-10/build]
+  fedora-latest/test_cert:
+    requires: [fedora-latest/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest-ipa-4-10/build_url}'
+        build_url: '{fedora-latest/build_url}'
         test_suite: test_integration/test_cert.py
-        template: *ci-ipa-4-10-latest
+        template: *ci-master-latest
         timeout: 5400
         topology: *master_1repl_1client
 
-  fedora-latest-ipa-4-10/test_upgrade:
-    requires: [fedora-latest-ipa-4-10/build]
+  fedora-latest/test_upgrade:
+    requires: [fedora-latest/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest-ipa-4-10/build_url}'
+        build_url: '{fedora-latest/build_url}'
         test_suite: test_integration/test_upgrade.py
-        template: *ci-ipa-4-10-latest
+        template: *ci-master-latest
         timeout: 3600
         topology: *master_1repl
 
-  fedora-latest-ipa-4-10/test_subids:
-    requires: [fedora-latest-ipa-4-10/build]
+  fedora-latest/test_subids:
+    requires: [fedora-latest/build]
     priority: 100
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest-ipa-4-10/build_url}'
+        build_url: '{fedora-latest/build_url}'
         test_suite: test_integration/test_subids.py
-        template: *ci-ipa-4-10-latest
+        template: *ci-master-latest
         timeout: 3600
-        topology: *master_1repl_1client
+        topology: *master_1repl

ipatests/prci_definitions/nightly_latest_389ds.yaml

@@ -0,0 +1,658 @@
+topologies:
+  build: &build
+    name: build
+    cpu: 2
+    memory: 3800
+  master_1repl: &master_1repl
+    name: master_1repl
+    cpu: 4
+    memory: 6450
+  master_1repl_1client: &master_1repl_1client
+    name: master_1repl_1client
+    cpu: 4
+    memory: 7400
+  ipaserver: &ipaserver
+    name: ipaserver
+    cpu: 2
+    memory: 2400
+  master_2repl_1client: &master_2repl_1client
+    name: master_2repl_1client
+    cpu: 5
+    memory: 10150
+  master_3repl_1client: &master_3repl_1client
+    name: master_3repl_1client
+    cpu: 6
+    memory: 12900
+
+jobs:
+  389ds-fedora/build:
+    requires: []
+    priority: 100
+    job:
+      class: Build
+      args:
+        copr: '@389ds/389-ds-base-nightly'
+        git_repo: '{git_repo}'
+        git_refspec: '{git_refspec}'
+        template: &ci-master-latest
+          name: freeipa/ci-master-f36
+          version: 0.0.7
+        timeout: 1800
+        topology: *build
+
+  389ds-fedora/simple_replication:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_simple_replication.py
+        template: *ci-master-latest
+        timeout: 3600
+        topology: *master_1repl
+
+  389ds-fedora/test_commands:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_commands.py
+        template: *ci-master-latest
+        timeout: 5400
+        topology: *master_1repl_1client
+
+  389ds-fedora/test_server_del:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_server_del.py
+        template: *ci-master-latest
+        timeout: 10800
+        topology: *master_2repl_1client
+
+  389ds-fedora/test_installation_TestInstallWithCA1:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_installation.py::TestInstallWithCA1
+        template: *ci-master-latest
+        timeout: 10800
+        topology: *master_3repl_1client
+
+  389ds-fedora/test_caless_TestServerInstall:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_caless.py::TestServerInstall
+        template: *ci-master-latest
+        timeout: 12000
+        topology: *master_1repl
+
+  389ds-fedora/test_caless_TestReplicaInstall:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_caless.py::TestReplicaInstall
+        template: *ci-master-latest
+        timeout: 7200
+        topology: *master_1repl
+
+  389ds-fedora/test_caless_TestClientInstall:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_caless.py::TestClientInstall
+        template: *ci-master-latest
+        timeout: 5400
+        # actually master_1client
+        topology: *master_1repl_1client
+
+  389ds-fedora/test_caless_TestCertInstall:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_caless.py::TestCertInstall
+        template: *ci-master-latest
+        timeout: 5400
+        topology: *master_1repl
+
+  389ds-fedora/test_backup_and_restore_TestUserRootFilesOwnershipPermission:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_backup_and_restore.py::TestUserRootFilesOwnershipPermission
+        template: *ci-master-latest
+        timeout: 7200
+        topology: *master_1repl
+
+  389ds-fedora/test_backup_and_restore_TestBackupAndRestore:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_backup_and_restore.py::TestBackupAndRestore
+        template: *ci-master-latest
+        timeout: 7200
+        topology: *master_1repl
+
+  389ds-fedora/test_backup_and_restore_TestBackupAndRestoreWithDNSSEC:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_backup_and_restore.py::TestBackupAndRestoreWithDNSSEC
+        template: *ci-master-latest
+        timeout: 7200
+        topology: *master_1repl
+
+  389ds-fedora/test_backup_and_restore_TestBackupReinstallRestoreWithDNSSEC:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_backup_and_restore.py::TestBackupReinstallRestoreWithDNSSEC
+        template: *ci-master-latest
+        timeout: 7200
+        topology: *master_1repl
+
+  389ds-fedora/test_backup_and_restore_TestBackupAndRestoreWithDNS:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_backup_and_restore.py::TestBackupAndRestoreWithDNS
+        template: *ci-master-latest
+        timeout: 7200
+        topology: *master_1repl
+
+  389ds-fedora/test_backup_and_restore_TestBackupReinstallRestoreWithDNS:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_backup_and_restore.py::TestBackupReinstallRestoreWithDNS
+        template: *ci-master-latest
+        timeout: 7200
+        topology: *master_1repl
+
+  389ds-fedora/test_backup_and_restore_TestBackupAndRestoreWithKRA:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_backup_and_restore.py::TestBackupAndRestoreWithKRA
+        template: *ci-master-latest
+        timeout: 7200
+        topology: *master_1repl
+
+  389ds-fedora/test_backup_and_restore_TestBackupReinstallRestoreWithKRA:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_backup_and_restore.py::TestBackupReinstallRestoreWithKRA
+        template: *ci-master-latest
+        timeout: 7200
+        topology: *master_1repl
+
+  389ds-fedora/test_backup_and_restore_TestBackupAndRestoreWithReplica:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_backup_and_restore.py::TestBackupAndRestoreWithReplica
+        template: *ci-master-latest
+        timeout: 7200
+        topology: *master_2repl_1client
+
+  389ds-fedora/test_backup_and_restore_TestBackupAndRestoreDMPassword:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_backup_and_restore.py::TestBackupAndRestoreDMPassword
+        template: *ci-master-latest
+        timeout: 7200
+        topology: *master_1repl
+
+  389ds-fedora/test_backup_and_restore_TestReplicaInstallAfterRestore:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_backup_and_restore.py::TestReplicaInstallAfterRestore
+        template: *ci-master-latest
+        timeout: 7200
+        topology: *master_2repl_1client
+
+  389ds-fedora/test_dnssec:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_dnssec.py
+        template: *ci-master-latest
+        timeout: 10800
+        topology: *master_2repl_1client
+
+  389ds-fedora/test_replica_promotion_TestReplicaPromotionLevel1:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_replica_promotion.py::TestReplicaPromotionLevel1
+        template: *ci-master-latest
+        timeout: 7200
+        topology: *master_1repl
+
+  389ds-fedora/test_replica_promotion_TestProhibitReplicaUninstallation:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_replica_promotion.py::TestProhibitReplicaUninstallation
+        template: *ci-master-latest
+        timeout: 7200
+        topology: *master_2repl_1client
+
+  389ds-fedora/test_replica_promotion_TestHiddenReplicaPromotion:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_replica_promotion.py::TestHiddenReplicaPromotion
+        template: *ci-master-latest
+        timeout: 7200
+        topology: *master_2repl_1client
+
+  389ds-fedora/test_upgrade:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_upgrade.py
+        template: *ci-master-latest
+        timeout: 7200
+        topology: *master_1repl
+
+  389ds-fedora/test_topology_TestCASpecificRUVs:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_topology.py::TestCASpecificRUVs
+        template: *ci-master-latest
+        timeout: 7200
+        topology: *master_3repl_1client
+
+  389ds-fedora/test_topology_TestTopologyOptions:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_topology.py::TestTopologyOptions
+        template: *ci-master-latest
+        timeout: 7200
+        topology: *master_3repl_1client
+
+  389ds-fedora/test_replication_layouts_TestLineTopologyWithoutCA:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_replication_layouts.py::TestLineTopologyWithoutCA
+        template: *ci-master-latest
+        timeout: 7200
+        topology: *master_3repl_1client
+
+  389ds-fedora/test_replication_layouts_TestLineTopologyWithCA:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_replication_layouts.py::TestLineTopologyWithCA
+        template: *ci-master-latest
+        timeout: 10800
+        topology: *master_3repl_1client
+
+  389ds-fedora/test_replication_layouts_TestLineTopologyWithCAKRA:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_replication_layouts.py::TestLineTopologyWithCAKRA
+        template: *ci-master-latest
+        timeout: 10800
+        topology: *master_3repl_1client
+
+  389ds-fedora/test_replication_layouts.py_TestStarTopologyWithoutCA:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_replication_layouts.py::TestStarTopologyWithoutCA
+        template: *ci-master-latest
+        timeout: 7200
+        topology: *master_3repl_1client
+
+  389ds-fedora/test_replication_layouts_TestStarTopologyWithCA:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_replication_layouts.py::TestStarTopologyWithCA
+        template: *ci-master-latest
+        timeout: 7200
+        topology: *master_3repl_1client
+
+  389ds-fedora/test_replication_layouts_TestStarTopologyWithCAKRA:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_replication_layouts.py::TestStarTopologyWithCAKRA
+        template: *ci-master-latest
+        timeout: 10800
+        topology: *master_3repl_1client
+
+  389ds-fedora/test_replication_layouts_TestCompleteTopologyWithoutCA:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_replication_layouts.py::TestCompleteTopologyWithoutCA
+        template: *ci-master-latest
+        timeout: 7200
+        topology: *master_3repl_1client
+
+  389ds-fedora/test_replication_layouts_TestCompleteTopologyWithCA:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_replication_layouts.py::TestCompleteTopologyWithCA
+        template: *ci-master-latest
+        timeout: 7200
+        topology: *master_3repl_1client
+
+  389ds-fedora/test_replication_layouts_TestCompleteTopologyWithCAKRA:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_replication_layouts.py::TestCompleteTopologyWithCAKRA
+        template: *ci-master-latest
+        timeout: 7200
+        topology: *master_3repl_1client
+
+  389ds-fedora/test_client_uninstallation:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_uninstallation.py
+        template: *ci-master-latest
+        timeout: 7200
+        topology: *master_1repl_1client
+
+  389ds-fedora/customized_ds_config_install:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_customized_ds_config_install.py
+        template: *ci-master-latest
+        timeout: 3600
+        topology: *master_1repl
+
+  389ds-fedora/dns_locations:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_dns_locations.py
+        template: *ci-master-latest
+        timeout: 3600
+        topology: *master_2repl_1client
+
+  389ds-fedora/external_ca_TestExternalCAdirsrvStop:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_external_ca.py::TestExternalCAdirsrvStop
+        template: *ci-master-latest
+        timeout: 3600
+        topology: *master_1repl
+
+  389ds-fedora/mask:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_installation.py::TestMaskInstall
+        template: *ci-master-latest
+        timeout: 3600
+        topology: *master_1repl
+
+  389ds-fedora/automember:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_automember.py
+        template: *ci-master-latest
+        timeout: 3600
+        topology: *master_1repl
+
+  389ds-fedora/test_fips:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_fips.py
+        template: *ci-master-latest
+        timeout: 7200
+        topology: *master_1repl_1client
+
+  389ds-fedora/test_pwpolicy:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_pwpolicy.py
+        template: *ci-master-latest
+        timeout: 3600
+        topology: *master_1repl
+
+  389ds-fedora/test_external_idp:
+    requires: [389ds-fedora/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{389ds-fedora/build_url}'
+        update_packages: True
+        copr: '@389ds/389-ds-base-nightly'
+        test_suite: test_integration/test_idp.py
+        template: *ci-master-latest
+        timeout: 5000
+        topology: *master_2repl_1client

ipatests/prci_definitions/prci_checker.py

@@ -1,433 +0,0 @@
-#! /usr/bin/python3
-import os
-import glob
-import sys
-import argparse
-from argparse import RawTextHelpFormatter
-import yaml
-
-# Get default DIR from script location
-DEFAULT_DIR = os.path.dirname(os.path.abspath(__file__))
-# Default jobs specification file name and path
-JOBS_SPEC_YAML = "prci_jobs_spec.yaml"
-JOBS_SPEC_PATH = os.path.join(DEFAULT_DIR, JOBS_SPEC_YAML)
-# Files to ignore on check
-IGNORE_FILES = {JOBS_SPEC_YAML, "temp_commit.yaml"}
-
-
-def load_yaml(path):
-    """Load YAML file into Python object."""
-    with open(path, "r") as file_data:
-        data = yaml.safe_load(file_data)
-
-    return data
-
-
-def print_error(msg):
-    """Helper function to print error messages"""
-    print("ERROR: " + msg)
-
-
-def print_warning(msg):
-    """Helper function to print warning messages"""
-    print("WARNING: " + msg)
-
-
-def print_hint(msg):
-    """Helper function to print hint messages"""
-    print("HINT: " + msg)
-
-
-def print_field_error(
-    jobname, fieldname=None, expected_value=None, custom_msg=None
-):
-    """Helper function to print field errors"""
-    msg = f"In job '{jobname}':\n"
-    if custom_msg:
-        msg += f"  {custom_msg}"
-    elif fieldname and expected_value:
-        msg += (
-            f'  Job field "{fieldname}" should be defined as: '
-            f'"{fieldname}: {expected_value}"'
-        )
-    else:
-        msg = f"In job '{jobname}'."
-    print_error(msg)
-
-
-def check_jobs(filename, jobs_def, topologies, current_spec, supported_classes):
-    """
-    Check if given job definition file has all jobs correctly defined according
-    to specification file.
-
-    :param filename: file name of the definition file to be checked
-    :param jobs_def: definition file jobs as a dict object
-    :param topologies: list of dicts of predefined topologies
-    :param jobs_spec: PRCI specification file containing correct definitions
-    :param supported_classes: List of supported test-run classes
-
-    :returns: Boolean with the checks result
-    """
-    correct_fields = True
-
-    try:
-        job_prefix = current_spec["job_prefix"]
-    except KeyError as e:
-        print_error(
-            "Specification file has bad format "
-            f"and '{filename}' could not be analyzed.\n"
-            f"  KeyError: {e} in '{filename}'"
-        )
-        return False
-
-    requires = [f"{job_prefix}build"]
-    build_url = f"{{{job_prefix}build_url}}"
-
-    # Get template from build job
-    build_job_name = job_prefix + "build"
-    build_job = jobs_def.get(build_job_name)
-    if not build_job:
-        print_error(
-            " Build job is not defined or has incorrect name.\n"
-            f"  Name should be: '{build_job_name}'"
-        )
-        return False
-    build_args = build_job["job"]["args"]
-    template = build_args["template"]
-
-    copr = build_args.get("copr")
-    copr_defined = current_spec.get("copr_defined", False)
-
-    update_packages = current_spec.get("update_packages", False)
-    selinux = current_spec.get("selinux_enforcing", False)
-    enable_testing_repo = current_spec.get("enable_testing_repo", False)
-
-    for job_name, params in jobs_def.items():
-        # Checks for all kind of jobs
-        args = params.get("job").get("args")
-        if not job_name.startswith(job_prefix):
-            msg = f"Job name should start with prefix '{job_prefix}'"
-            print_field_error(job_name, custom_msg=msg)
-            correct_fields = False
-        if args.get("template") != template:
-            print_field_error(job_name, "template", template)
-            correct_fields = False
-        if "timeout" not in args:
-            msg = "'timeout' field should be defined in args section"
-            print_field_error(job_name, custom_msg=msg)
-        if args.get("topology") not in topologies:
-            msg = (
-                "'topology' field should be defined with one of the "
-                "pre-defined topologies"
-            )
-            print_field_error(job_name, custom_msg=msg)
-            correct_fields = False
-        if args.get("enable_testing_repo", False) != enable_testing_repo:
-            if enable_testing_repo:
-                print_field_error(
-                    job_name, "enable_testing_repo", enable_testing_repo
-                )
-            else:
-                msg = (
-                    "'enable_testing_repo' field should be set to false or not"
-                    " defined"
-                )
-                print_field_error(job_name, custom_msg=msg)
-            correct_fields = False
-
-        # Checks for build job
-        if job_name == build_job_name:
-            if copr_defined and not copr:
-                msg = "'copr' field should be defined for the build job"
-                print_field_error(job_name, custom_msg=msg)
-                correct_fields = False
-            elif not copr_defined and copr:
-                msg = "'copr' field should NOT be defined for the build job"
-                print_field_error(job_name, custom_msg=msg)
-                correct_fields = False
-            if params.get("job").get("class") != "Build":
-                print_field_error(job_name, "class", "Build")
-                correct_fields = False
-            continue
-
-        # Checks only for non-build jobs
-        if params.get("requires") != requires:
-            print_field_error(job_name, "requires", requires)
-            correct_fields = False
-        if params.get("job").get("class") not in supported_classes:
-            msg = (
-                "'class' field should be defined with one of the "
-                f"supported: {supported_classes}"
-            )
-            print_field_error(job_name, custom_msg=msg)
-            correct_fields = False
-        if args.get("build_url") != build_url:
-            print_field_error(job_name, "build_url", f"'{build_url}'")
-            correct_fields = False
-        if "test_suite" not in args:
-            msg = "'test_suite' field should be defined in args section"
-            print_field_error(job_name, custom_msg=msg)
-            correct_fields = False
-        # Check template field against build target
-        if args.get("template") != template:
-            print_field_error(job_name, "template", template)
-            correct_fields = False
-        if "timeout" not in args:
-            msg = "'timeout' field should be defined in args section"
-            print_field_error(job_name, custom_msg=msg)
-            correct_fields = False
-        # If build target has a copr repo, check that the job also defines it
-        if args.get("copr") != copr:
-            if copr and copr_defined:
-                print_field_error(job_name, "copr", copr)
-            elif not copr and not copr_defined:
-                msg = "'copr' field should not be defined"
-                print_field_error(job_name, custom_msg=msg)
-            correct_fields = False
-        if args.get("update_packages", False) != update_packages:
-            if update_packages:
-                print_field_error(job_name, "update_packages", update_packages)
-            else:
-                msg = (
-                    "'update_packages' field should be set to false or not"
-                    " defined"
-                )
-                print_field_error(job_name, custom_msg=msg)
-            correct_fields = False
-        if args.get("selinux_enforcing", False) != selinux:
-            if selinux:
-                print_field_error(job_name, "selinux_enforcing", selinux)
-            else:
-                msg = (
-                    "'selinux_enforcing' field should be set to false or not"
-                    " defined"
-                )
-                print_field_error(job_name, custom_msg=msg)
-            correct_fields = False
-
-    return correct_fields
-
-
-def process_def_file(file, jobs_spec, supported_classes):
-    """Function to process PRCI definition file
-
-    :param file: name of the definition file to be
-                 processed (extension included)
-    :param jobs_spec: PRCI specification file containing correct definitions
-    :param supported_classes: List of supported test-run classes
-
-    :returns: Boolean with the checks result, filename,
-              and number of jobs in the definition
-              file (-1 when error / warning)
-    """
-    # File base name without extension
-    filename = os.path.splitext(os.path.basename(file))[0]
-    try:
-        def_suite = load_yaml(file)
-    except FileNotFoundError as e:
-        print(e)
-        print_error(f"File '{file}' was not found.")
-        sys.exit(1)
-    except yaml.composer.ComposerError as e:
-        print_error(str(e))
-        print_hint(
-            "You probably defined a wrong alias "
-            "in the newly added or modified job."
-        )
-        sys.exit(1)
-    except yaml.YAMLError as e:
-        print(e)
-        print_error(f"Error loading YAML definition file {file}")
-        sys.exit(1)
-
-    # Get spec for file to be analyzed
-    current_spec = jobs_spec.get(filename)
-    if current_spec is None:
-        print_warning(
-            f"'{filename}' file is not defined in the PRCI "
-            "specification file and "
-            "could not be analyzed."
-        )
-        return True, "", -1
-
-    jobs_def = def_suite.get("jobs")
-    if jobs_def is None:
-        print_error(
-            f"'{filename}' file doesn't have a jobs section following "
-            "the format."
-        )
-        return False, "", -1
-
-    # Get list of pre-defined topologies
-    topologies_def = def_suite.get("topologies")
-    if topologies_def is None:
-        print_error(
-            f"'{filename}' file doesn't have a topologies section following "
-            "the format."
-        )
-        return False, "", -1
-    topologies = list(topologies_def.values())
-
-    # Print file to be analyzed and its number of jobs
-    n_jobs = len(jobs_def)
-    print("[File] " + filename + " [Jobs] " + str(n_jobs))
-
-    result = check_jobs(
-        filename, jobs_def, topologies, current_spec, supported_classes
-    )
-    return result, filename, n_jobs
-
-
-def process_spec_file(filepath):
-    """Function to process jobs specification file
-
-    :param filepath: Filepath for spec file
-
-    :returns: Definition specification dict, supported classes and
-              list of files that should contain the same number of jobs
-    """
-    try:
-        spec_root = load_yaml(filepath)
-    except FileNotFoundError as e:
-        print(e)
-        print_error(f"Jobs specification file '{filepath}' not found.")
-        sys.exit(1)
-    except yaml.YAMLError as e:
-        print(e)
-        print_error(f"Error loading YAML specification file '{filepath}'")
-        sys.exit(1)
-
-    jobs_spec = spec_root.get("prci_job_spec")
-    if not jobs_spec:
-        print_error(
-            f"Specification definition not found in spec file '{filepath}'\n"
-            "  Key 'prci_job_spec' is not present."
-        )
-        sys.exit(1)
-
-    supported_classes = spec_root.get("classes")
-    if not supported_classes:
-        print_error(
-            f"Supported classes not defined in spec file '{filepath}'\n"
-            "  Key 'classes' is not present."
-        )
-        sys.exit(1)
-
-    f_fixed_jobs = spec_root.get("fixed_n_jobs")
-
-    return jobs_spec, supported_classes, f_fixed_jobs
-
-
-def check_n_jobs(defs_n_jobs):
-    """
-    Function to check if definition files have the same number of jobs
-
-    :param defs_n_jobs: Dict of definition filenames as keys and number
-                        of jobs as values
-
-    :returns: Boolean, if definitions have the same number of jobs
-    """
-    if not defs_n_jobs:  # Spec not defined to check num of jobs
-        return True
-    elif len(set(defs_n_jobs.values())) == 1:
-        return True
-    else:
-        print_error(
-            "Following PRCI definitions should have the same number of jobs:"
-            f" {list(defs_n_jobs.keys())}"
-        )
-        return False
-
-
-def parse_arguments(description):
-    """Parse and return arguments if specified"""
-    parser = argparse.ArgumentParser(
-        description=description, formatter_class=RawTextHelpFormatter
-    )
-    group = parser.add_mutually_exclusive_group()
-    group.add_argument(
-        "-f", "--file", help="Specify YAML definition file to be analyzed"
-    )
-    group.add_argument(
-        "-d",
-        "--defs",
-        default=DEFAULT_DIR,
-        help="Specify directory for definition files to be analyzed",
-    )
-    parser.add_argument(
-        "-s",
-        "--spec",
-        default=JOBS_SPEC_PATH,
-        help="Specify path for specification file",
-    )
-    return parser.parse_args()
-
-
-def main():
-    """
-    Checker script for prci definition files.\n
-    This script checks whether jobs in a prci definition file have the correct
-    naming format, requirements, and arguments, which are defined in the
-    specification file.
-
-    If no defition file, definition directory or spec file is specified,
-    script will look for them in its own dir location.
-
-    Examples of the usage for the tool:\n
-    # Check all yaml definition files in default dir\n
-    python3 prci_checker.py\n
-    # Check only specified file\n
-    python3 prci_checker.py -f gating.yaml\n
-    # Check with custom path for spec file\n
-    python3 prci_checker.py -s ../../alternative_spec.yaml
-    # Check with custom path for spec file\n
-    python3 prci_checker.py -d ./definitions
-    """
-    args = parse_arguments(main.__doc__)
-
-    print("BEGINNING PRCI JOB DEFINITIONS CHECKS")
-
-    # Get data from jobs specification file
-    jobs_spec, supported_classes, f_fixed_jobs = process_spec_file(args.spec)
-
-    if args.file:
-        result = process_def_file(args.file, jobs_spec, supported_classes)
-    else:
-        # Get all yaml files in default dir, except those in IGNORE_FILES
-        def_files_dir = os.path.join(args.defs, "*.y*ml")
-        defs_files = glob.glob(def_files_dir)
-        ignore_files_paths = {
-            os.path.join(args.defs, ignore_file) for ignore_file in IGNORE_FILES
-        }
-        defs_files = set(defs_files) - ignore_files_paths
-        if not defs_files:
-            print_warning(
-                "No yaml job definition files found to analyze "
-                "in specified directory."
-            )
-            return
-
-        result = True
-        defs_n_jobs = {}
-
-        for def_file in defs_files:
-            result_file, filename, n_jobs = process_def_file(
-                def_file, jobs_spec, supported_classes
-            )
-            if not result_file:
-                result = False
-                continue
-            if n_jobs > -1 and f_fixed_jobs and filename in f_fixed_jobs:
-                defs_n_jobs[filename] = n_jobs
-
-        result = result and check_n_jobs(defs_n_jobs)
-
-    if not result:
-        print("CHECKS FINISHED WITH ERRORS")
-        sys.exit(1)
-
-    print("CHECKS FINISHED SUCCESSFULLY")
-
-
-if __name__ == "__main__":
-    main()

ipatests/prci_definitions/prci_jobs_spec.yaml

@@ -1,32 +0,0 @@
-# Specification file for PRCI definitions used by prci_checker script
-
-# List of supported test-run classes for non-build jobs
-classes:
-  - "RunPytest"
-  - "RunPytest2"
-  - "RunPytest3"
-  - "RunWebuiTests"
-  - "RunADTests"
-
-# (Optional) Definition files that should contain the same number of jobs
-fixed_n_jobs:
-  - nightly_ipa-4-10_latest
-  - nightly_ipa-4-10_latest_selinux
-  - nightly_ipa-4-10_previous
-
-# Info specific to prci definition files
-# 'job_prefix' field is mandatory
-# 'update_packages', 'selinux_enforcing', 'enable_testing_repo' and
-# 'copr_defined' are optional boolean fields (if not specified,
-# false value is assumed).
-# New definitions specifications may be added anytime
-prci_job_spec:
-  gating:
-    job_prefix: 'fedora-latest-ipa-4-10/'
-  nightly_ipa-4-10_latest:
-    job_prefix: 'fedora-latest-ipa-4-10/'
-  nightly_ipa-4-10_latest_selinux:
-    job_prefix: 'fedora-latest-ipa-4-10/'
-    selinux_enforcing: True
-  nightly_ipa-4-10_previous:
-    job_prefix: 'fedora-previous-ipa-4-10/'

ipatests/prci_definitions/temp_commit.yaml

@@ -47,7 +47,7 @@ topologies:
     memory: 14500
 
 jobs:
-  fedora-latest-ipa-4-10/build:
+  fedora-latest/build:
     requires: []
     priority: 100
     job:
@@ -55,20 +55,20 @@ jobs:
       args:
         git_repo: '{git_repo}'
         git_refspec: '{git_refspec}'
-        template: &ci-ipa-4-10-latest
-          name: freeipa/ci-ipa-4-10-f36
-          version: 0.0.1
+        template: &ci-master-latest
+          name: freeipa/ci-master-f36
+          version: 0.0.7
         timeout: 1800
         topology: *build
 
-  fedora-latest-ipa-4-10/temp_commit:
-    requires: [fedora-latest-ipa-4-10/build]
+  fedora-latest/temp_commit:
+    requires: [fedora-latest/build]
     priority: 50
     job:
       class: RunPytest
       args:
-        build_url: '{fedora-latest-ipa-4-10/build_url}'
+        build_url: '{fedora-latest/build_url}'
         test_suite: test_integration/test_REPLACEME.py
-        template: *ci-ipa-4-10-latest
+        template: *ci-master-latest
         timeout: 3600
         topology: *master_1repl_1client

ipatests/test_integration/test_caless.py

@@ -122,15 +122,6 @@ def replica_install_teardown(func):
 
 
 class CALessBase(IntegrationTest):
-    # The teardown method is called even if all the tests are skipped
-    # since the required PKI version is not present.
-    # The teardown is trying to remove a non-existent directory.
-    # Currently the cert_dir attribute is only present if IPA installation was
-    # done. If IPA was not installed the attribute does not exist.
-    # In order that the uninstall code finds the attribute a class attribute
-    # is added.
-    cert_dir = None
-
     @classmethod
     def install(cls, mh):
         cls.cert_dir = tempfile.mkdtemp(prefix="ipatest-")
@@ -173,8 +164,7 @@ class CALessBase(IntegrationTest):
     @classmethod
     def uninstall(cls, mh):
         # Remove the NSS database
-        if cls.cert_dir:
-            shutil.rmtree(cls.cert_dir)
+        shutil.rmtree(cls.cert_dir)
         super(CALessBase, cls).uninstall(mh)
 
     @classmethod

ipatests/test_integration/test_ipahealthcheck.py

@@ -340,31 +340,6 @@ class TestIpaHealthCheck(IntegrationTest):
         assert returncode == 0
         assert output == "No issues found."
 
-    def test_ipa_healthcheck_fips_enabled(self):
-        """
-        Test if FIPS is enabled and the check exists.
-
-        https://pagure.io/freeipa/issue/8951
-        """
-        returncode, check = run_healthcheck(self.master,
-                                            source="ipahealthcheck.meta.core",
-                                            check="MetaCheck",
-                                            output_type="json",
-                                            failures_only=False)
-        assert returncode == 0
-
-        cmd = self.master.run_command(['fips-mode-setup', '--is-enabled'],
-                                      raiseonerr=False)
-        returncode = cmd.returncode
-
-        # If this produces IndexError, the check does not exist
-        if check[0]["kw"]["fips"] == "disabled":
-            assert returncode == 2
-        elif check[0]["kw"]["fips"] == "enabled":
-            assert returncode == 0
-        else:
-            assert returncode == 1
-
     def test_ipa_healthcheck_after_certupdate(self):
         """
         Verify that ipa-certupdate hasn't messed up tracking

ipatests/test_integration/test_pwpolicy.py

@@ -36,7 +36,7 @@ class TestPWPolicy(IntegrationTest):
         cls.master.run_command(['ipa', 'group-add-member', POLICY,
                                 '--users', USER])
         cls.master.run_command(['ipa', 'pwpolicy-add', POLICY,
-                                '--priority', '1', '--gracelimit', '-1'])
+                                '--priority', '1'])
         cls.master.run_command(['ipa', 'passwd', USER],
                                stdin_text='{password}\n{password}\n'.format(
                                password=PASSWORD
@@ -265,6 +265,7 @@ class TestPWPolicy(IntegrationTest):
 
     def test_graceperiod_expired(self):
         """Test the LDAP bind grace period"""
+        str(self.master.domain.basedn)
         dn = "uid={user},cn=users,cn=accounts,{base_dn}".format(
              user=USER, base_dn=str(self.master.domain.basedn))
 
@@ -307,6 +308,7 @@ class TestPWPolicy(IntegrationTest):
 
     def test_graceperiod_not_replicated(self):
         """Test that the grace period is reset on password reset"""
+        str(self.master.domain.basedn)
         dn = "uid={user},cn=users,cn=accounts,{base_dn}".format(
              user=USER, base_dn=str(self.master.domain.basedn))
 
@@ -339,54 +341,3 @@ class TestPWPolicy(IntegrationTest):
         )
         assert 'passwordgraceusertime: 0' in result.stdout_text.lower()
         self.reset_password(self.master)
-
-    def test_graceperiod_zero(self):
-        """Test the LDAP bind with zero grace period"""
-        dn = "uid={user},cn=users,cn=accounts,{base_dn}".format(
-             user=USER, base_dn=str(self.master.domain.basedn))
-
-        self.master.run_command(
-            ["ipa", "pwpolicy-mod", POLICY, "--gracelimit", "0", ],
-        )
-
-        # Resetting the password will mark it as expired
-        self.reset_password(self.master)
-
-        # Now grace is done and binds should fail.
-        result = self.master.run_command(
-            ["ldapsearch", "-e", "ppolicy", "-D", dn,
-             "-w", PASSWORD, "-b", dn], raiseonerr=False
-        )
-        assert result.returncode == 49
-
-        assert 'Password is expired' in result.stderr_text
-        assert 'Password expired, 0 grace logins remain' in result.stderr_text
-
-    def test_graceperiod_disabled(self):
-        """Test the LDAP bind with grace period disabled (-1)"""
-        str(self.master.domain.basedn)
-        dn = "uid={user},cn=users,cn=accounts,{base_dn}".format(
-             user=USER, base_dn=str(self.master.domain.basedn))
-
-        # This can fail if gracelimit is already -1 so ignore it
-        self.master.run_command(
-            ["ipa", "pwpolicy-mod", POLICY, "--gracelimit", "-1",],
-            raiseonerr=False,
-        )
-
-        # Ensure the password is expired
-        self.reset_password(self.master)
-
-        result = self.kinit_as_user(self.master, PASSWORD, PASSWORD)
-
-        for _i in range(0, 10):
-            result = self.master.run_command(
-                ["ldapsearch", "-e", "ppolicy", "-D", dn,
-                 "-w", PASSWORD, "-b", dn]
-            )
-
-        # With graceperiod disabled it should not increment
-        result = tasks.ldapsearch_dm(
-            self.master, dn, ['passwordgraceusertime',],
-        )
-        assert 'passwordgraceusertime: 0' in result.stdout_text.lower()

ipatests/test_integration/test_random_serial_numbers.py

@@ -4,15 +4,12 @@
 
 import pytest
 
-from ipaplatform.paths import paths
-
-from ipatests.pytest_ipa.integration import tasks
 from ipatests.test_integration.test_installation import (
     TestInstallWithCA_DNS1,
     TestInstallWithCA_KRA1,
 )
 from ipatests.test_integration.test_caless import TestServerCALessToExternalCA
-from ipatests.test_integration.test_vault import TestInstallKRA
+
 from ipatests.test_integration.test_commands import TestIPACommand
 
 
@@ -29,18 +26,6 @@ def pki_supports_RSNv3(host):
     return False
 
 
-def check_pki_config_params(host):
-    # Check CS.cfg
-    try:
-        cs_cfg = host.get_file_contents(paths.CA_CS_CFG_PATH)
-        kra_cfg = host.get_file_contents(paths.KRA_CS_CFG_PATH)
-        assert "dbs.cert.id.generator=random".encode() in cs_cfg
-        assert "dbs.request.id.generator=random".encode() in cs_cfg
-        assert "dbs.key.id.generator=random".encode() in kra_cfg
-    except IOError:
-        pytest.skip("PKI config not present.Skipping test")
-
-
 class TestInstallWithCA_DNS1_RSN(TestInstallWithCA_DNS1):
     random_serial = True
 
@@ -79,43 +64,3 @@ class TestServerCALessToExternalCA_RSN(TestServerCALessToExternalCA):
         if not pki_supports_RSNv3(mh.master):
             raise pytest.skip("RNSv3 not supported")
         super(TestServerCALessToExternalCA_RSN, cls).install(mh)
-
-    @classmethod
-    def uninstall(cls, mh):
-        if not pki_supports_RSNv3(mh.master):
-            raise pytest.skip("RSNv3 not supported")
-        super(TestServerCALessToExternalCA_RSN, cls).uninstall(mh)
-
-
-class TestRSNPKIConfig(TestInstallWithCA_KRA1):
-    random_serial = True
-    num_replicas = 3
-
-    @classmethod
-    def install(cls, mh):
-        if not pki_supports_RSNv3(mh.master):
-            raise pytest.skip("RSNv3 not supported")
-        super(TestRSNPKIConfig, cls).install(mh)
-
-    def test_check_pki_config(self):
-        check_pki_config_params(self.master)
-        check_pki_config_params(self.replicas[0])
-        check_pki_config_params(self.replicas[1])
-
-    def test_check_rsn_version(self):
-        tasks.kinit_admin(self.master)
-        res = self.master.run_command(['ipa', 'ca-find'])
-        assert 'RSN Version: 3' in res.stdout_text
-        tasks.kinit_admin(self.replicas[0])
-        res = self.replicas[0].run_command(['ipa', 'ca-find'])
-        assert 'RSN Version: 3' in res.stdout_text
-
-
-class TestRSNVault(TestInstallKRA):
-    random_serial = True
-
-    @classmethod
-    def install(cls, mh):
-        if not pki_supports_RSNv3(mh.master):
-            raise pytest.skip("RSNv3 not supported")
-        super(TestRSNVault, cls).install(mh)

ipatests/test_integration/test_subids.py

@@ -17,7 +17,6 @@ from ipatests.test_integration.base import IntegrationTest
 
 class TestSubordinateId(IntegrationTest):
     num_replicas = 0
-    num_clients = 1
     topology = "star"
 
     def _parse_result(self, result):
@@ -269,40 +268,3 @@ class TestSubordinateId(IntegrationTest):
                                           f"--subuid={subuid}"])
         owner = self._parse_result(result)["owner"]
         assert owner == uid
-
-    def test_nsswitch_doesnot_contain_subid_entry(self):
-        """
-        This testcase checks that when ipa-client-install
-        is installed without subid option, the nsswitch.conf
-        does not contain subid entry or does not use sss as
-        source for subid
-        """
-        cmd = self.clients[0].run_command(
-            ["grep", "^subid", "/etc/nsswitch.conf"],
-            raiseonerr=False
-        )
-        # a source is defined for the subid database.
-        # Ensure it is not "sss"
-        if cmd.returncode == 0:
-            assert 'sss' not in cmd.stdout_text
-        else:
-            # grep command returncode 1 means no matching line
-            # was found = no source is defined for the subid database,
-            # which is valid other return codes would
-            # mean an error occurred
-            assert cmd.returncode == 1
-
-    def test_nsswitch_is_updated_with_subid_entry(self):
-        """
-        This test case checks that when ipa-client-install
-        is installed with --subid option, the nsswitch.conf
-        file is modified with the entry 'subid: sss'
-        """
-        tasks.uninstall_client(self.clients[0])
-        tasks.install_client(self.master, self.clients[0],
-                             extra_args=['--subid'])
-        cmd = self.clients[0].run_command(
-            ["grep", "^subid", "/etc/nsswitch.conf"]
-        )
-        subid = cmd.stdout_text.split()
-        assert ['subid:', 'sss'] == subid

ipatests/test_integration/test_vault.py

@@ -33,9 +33,7 @@ class TestInstallKRA(IntegrationTest):
 
     @classmethod
     def install(cls, mh):
-        tasks.install_master(cls.master,
-                             setup_kra=True,
-                             random_serial=cls.random_serial)
+        tasks.install_master(cls.master, setup_kra=True)
         # do not install KRA on replica, it is part of test
         tasks.install_replica(cls.master, cls.replicas[0], setup_kra=False)
 

ipatests/test_ipapython/test_dnsutil.py

@@ -101,43 +101,3 @@ class TestSortURI:
         assert dnsutil.sort_prio_weight([h3, h2, h1]) == [h1, h2, h3]
         assert dnsutil.sort_prio_weight([h3, h3, h3]) == [h3]
         assert dnsutil.sort_prio_weight([h2, h2, h1, h1]) == [h1, h2]
-
-
-class TestDNSResolver:
-    def test_nameservers(self):
-        res = dnsutil.DNSResolver()
-        res.nameservers = ["4.4.4.4", "8.8.8.8"]
-        assert res.nameservers == ["4.4.4.4", "8.8.8.8"]
-
-    def test_nameservers_with_ports(self):
-        res = dnsutil.DNSResolver()
-        res.nameservers = ["4.4.4.4 port 53", "8.8.8.8 port 8053"]
-        assert res.nameservers == ["4.4.4.4", "8.8.8.8"]
-        assert res.nameserver_ports == {"4.4.4.4": 53, "8.8.8.8": 8053}
-
-        res.nameservers = ["4.4.4.4 port 53", "8.8.8.8  port  8053"]
-        assert res.nameservers == ["4.4.4.4", "8.8.8.8"]
-        assert res.nameserver_ports == {"4.4.4.4": 53, "8.8.8.8": 8053}
-
-    def test_nameservers_with_bad_ports(self):
-        res = dnsutil.DNSResolver()
-        try:
-            res.nameservers = ["4.4.4.4 port a"]
-        except ValueError:
-            pass
-        else:
-            pytest.fail("No fail on bad port a")
-
-        try:
-            res.nameservers = ["4.4.4.4 port -1"]
-        except ValueError:
-            pass
-        else:
-            pytest.fail("No fail on bad port -1")
-
-        try:
-            res.nameservers = ["4.4.4.4 port 65536"]
-        except ValueError:
-            pass
-        else:
-            pytest.fail("No fail on bad port 65536")

ipatests/test_webui/test_misc_cases.py

@@ -11,11 +11,6 @@ from ipatests.test_webui.ui_driver import screenshot
 import pytest
 import re
 
-try:
-    from selenium.webdriver.common.by import By
-except ImportError:
-    pass
-
 
 @pytest.mark.tier1
 class TestMiscCases(UI_driver):
@@ -31,17 +26,3 @@ class TestMiscCases(UI_driver):
         ver_re = re.compile('version: .*')
         assert re.search(ver_re, about_text), 'Version not found'
         self.dialog_button_click('ok')
-
-    @screenshot
-    def test_customization_pagination_input_required(self):
-        """Test if 'pagination size' is required when submitting the form."""
-        self.init_app()
-
-        self.profile_menu_action('configuration')
-        self.fill_input('pagination_size', '')
-        self.dialog_button_click('save')
-
-        pagination_size_elem = self.find(
-            ".widget[name='pagination_size']", By.CSS_SELECTOR)
-
-        self.assert_field_validation_required(parent=pagination_size_elem)

ipatests/test_webui/test_subid.py

@@ -7,15 +7,7 @@ from ipatests.test_webui.ui_driver import UI_driver
 import ipatests.test_webui.data_config as config_data
 import ipatests.test_webui.data_user as user_data
 from ipatests.test_webui.ui_driver import screenshot
-
 import re
-import pytest
-
-try:
-    from selenium.common.exceptions import NoSuchElementException
-    from selenium.webdriver.common.by import By
-except ImportError:
-    pass
 
 
 class test_subid(UI_driver):
@@ -133,26 +125,3 @@ class test_subid(UI_driver):
         self.assert_no_error_dialog()
         after_count = self.get_rows()
         assert len(before_count) < len(after_count)
-
-    @screenshot
-    def test_subid_range_deletion_not_allowed(self):
-        """
-        Test to check that subid range delete is not
-        allowed from WebUI i.e Delete button is not available.
-        """
-        self.init_app()
-        self.navigate_to_entity('subid', facet='search')
-        self.facet_button_click('add')
-        self.select_combobox('ipaowner', 'admin')
-        self.dialog_button_click('add')
-        self.wait(0.3)
-        self.assert_no_error_dialog()
-        self.get_field_checked('ipauniqueid')
-        with pytest.raises(NoSuchElementException):
-            self.facet_button_click('remove')
-        buttons_s = 'div.control-buttons button'
-        facet_buttons = self.find(buttons_s, By.CSS_SELECTOR,
-                                  many=True, strict=True)
-        assert len(facet_buttons) == 2
-        assert facet_buttons[0].get_attribute('name') in ['add', 'refresh']
-        assert facet_buttons[1].get_attribute('name') in ['add', 'refresh']

ipatests/test_xmlrpc/test_old_permission_plugin.py

@@ -152,18 +152,6 @@ class test_old_permission(Declarative):
             expected=dict(
                 value=permission1,
                 summary=u'Added permission "%s"' % permission1,
-                messages=(
-                    {
-                        'message': ('The permission has write rights but no '
-                                    'attributes are set.'),
-                        'code': 13032,
-                        'type': 'warning',
-                        'name': 'MissingTargetAttributesinPermission',
-                        'data': {
-                            'right': 'write',
-                        }
-                    },
-                ),
                 result=dict(
                     dn=permission1_dn,
                     cn=[permission1],
@@ -505,18 +493,6 @@ class test_old_permission(Declarative):
             expected=dict(
                 value=permission2,
                 summary=u'Added permission "%s"' % permission2,
-                messages=(
-                    {
-                        'message': ('The permission has write rights but no '
-                                    'attributes are set.'),
-                        'code': 13032,
-                        'type': 'warning',
-                        'name': 'MissingTargetAttributesinPermission',
-                        'data': {
-                            'right': 'write',
-                        }
-                    },
-                ),
                 result=dict(
                     dn=permission2_dn,
                     cn=[permission2],
@@ -825,18 +801,6 @@ class test_old_permission(Declarative):
             expected=dict(
                 value=permission1,
                 summary=u'Modified permission "%s"' % permission1,
-                messages=(
-                    {
-                        'message': ('The permission has read rights but no '
-                                    'attributes are set.'),
-                        'code': 13032,
-                        'type': 'warning',
-                        'name': 'MissingTargetAttributesinPermission',
-                        'data': {
-                            'right': 'read',
-                        }
-                    },
-                ),
                 result=dict(
                     dn=permission1_dn,
                     cn=[permission1],
@@ -957,18 +921,6 @@ class test_old_permission(Declarative):
             expected=dict(
                 value=permission1_renamed,
                 summary=u'Modified permission "%s"' % permission1_renamed,
-                messages=(
-                    {
-                        'message': ('The permission has write rights but no '
-                                    'attributes are set.'),
-                        'code': 13032,
-                        'type': 'warning',
-                        'name': 'MissingTargetAttributesinPermission',
-                        'data': {
-                            'right': 'write',
-                        }
-                    },
-                ),
                 result={
                     'dn': permission1_renamed_ucase_dn,
                     'cn': [permission1_renamed_ucase],
@@ -995,18 +947,6 @@ class test_old_permission(Declarative):
             expected=dict(
                 value=permission1_renamed_ucase,
                 summary=u'Modified permission "%s"' % permission1_renamed_ucase,
-                messages=(
-                    {
-                        'message': ('The permission has write rights but no '
-                                    'attributes are set.'),
-                        'code': 13032,
-                        'type': 'warning',
-                        'name': 'MissingTargetAttributesinPermission',
-                        'data': {
-                            'right': 'write',
-                        }
-                    },
-                ),
                 result=dict(
                     dn=permission1_renamed_ucase_dn,
                     cn=[permission1_renamed_ucase],
@@ -1235,18 +1175,6 @@ class test_old_permission(Declarative):
             expected=dict(
                 value=permission1,
                 summary=u'Added permission "%s"' % permission1,
-                messages=(
-                    {
-                        'message': ('The permission has write rights but no '
-                                    'attributes are set.'),
-                        'code': 13032,
-                        'type': 'warning',
-                        'name': 'MissingTargetAttributesinPermission',
-                        'data': {
-                            'right': 'write',
-                        }
-                    },
-                ),
                 result=dict(
                     dn=permission1_dn,
                     cn=[permission1],
@@ -1278,18 +1206,6 @@ class test_old_permission(Declarative):
             expected=dict(
                 value=permission1,
                 summary=u'Modified permission "%s"' % permission1,
-                messages=(
-                    {
-                        'message': ('The permission has write rights but no '
-                                    'attributes are set.'),
-                        'code': 13032,
-                        'type': 'warning',
-                        'name': 'MissingTargetAttributesinPermission',
-                        'data': {
-                            'right': 'write',
-                        }
-                    },
-                ),
                 result=dict(
                     dn=permission1_dn,
                     cn=[permission1],
@@ -1313,18 +1229,6 @@ class test_old_permission(Declarative):
             ),
             expected=dict(
                 summary=u'Modified permission "%s"' % permission1,
-                messages=(
-                    {
-                        'message': ('The permission has write rights but no '
-                                    'attributes are set.'),
-                        'code': 13032,
-                        'type': 'warning',
-                        'name': 'MissingTargetAttributesinPermission',
-                        'data': {
-                            'right': 'write',
-                        }
-                    },
-                ),
                 value=permission1,
                 result=dict(
                     dn=permission1_dn,
@@ -1362,18 +1266,6 @@ class test_old_permission(Declarative):
             expected=dict(
                 value=permission1,
                 summary=u'Added permission "%s"' % permission1,
-                messages=(
-                    {
-                        'message': ('The permission has write rights but no '
-                                    'attributes are set.'),
-                        'code': 13032,
-                        'type': 'warning',
-                        'name': 'MissingTargetAttributesinPermission',
-                        'data': {
-                            'right': 'write',
-                        }
-                    },
-                ),
                 result=dict(
                     dn=permission1_dn,
                     cn=[permission1],

ipatests/test_xmlrpc/test_permission_plugin.py

@@ -3167,18 +3167,6 @@ class test_permission_bindtype(Declarative):
             expected=dict(
                 value=permission1,
                 summary=u'Added permission "%s"' % permission1,
-                messages=(
-                    {
-                        'message': ('The permission has write rights but no '
-                                    'attributes are set.'),
-                        'code': 13032,
-                        'type': 'warning',
-                        'name': 'MissingTargetAttributesinPermission',
-                        'data': {
-                            'right': 'write',
-                        }
-                    },
-                ),
                 result=dict(
                     dn=permission1_dn,
                     cn=[permission1],
@@ -3240,18 +3228,6 @@ class test_permission_bindtype(Declarative):
             expected=dict(
                 value=permission1,
                 summary=u'Modified permission "%s"' % permission1,
-                messages=(
-                    {
-                        'message': ('The permission has write rights but no '
-                                    'attributes are set.'),
-                        'code': 13032,
-                        'type': 'warning',
-                        'name': 'MissingTargetAttributesinPermission',
-                        'data': {
-                            'right': 'write',
-                        }
-                    },
-                ),
                 result=dict(
                     dn=permission1_dn,
                     cn=[permission1],
@@ -3343,18 +3319,6 @@ class test_permission_bindtype(Declarative):
             expected=dict(
                 value=permission1,
                 summary=u'Modified permission "%s"' % permission1,
-                messages=(
-                    {
-                        'message': ('The permission has write rights but no '
-                                    'attributes are set.'),
-                        'code': 13032,
-                        'type': 'warning',
-                        'name': 'MissingTargetAttributesinPermission',
-                        'data': {
-                            'right': 'write',
-                        }
-                    },
-                ),
                 result=dict(
                     dn=permission1_renamed_dn,
                     cn=[permission1_renamed],
@@ -3386,18 +3350,6 @@ class test_permission_bindtype(Declarative):
             expected=dict(
                 value=permission1_renamed,
                 summary=u'Modified permission "%s"' % permission1_renamed,
-                messages=(
-                    {
-                        'message': ('The permission has write rights but no '
-                                    'attributes are set.'),
-                        'code': 13032,
-                        'type': 'warning',
-                        'name': 'MissingTargetAttributesinPermission',
-                        'data': {
-                            'right': 'write',
-                        }
-                    },
-                ),
                 result=dict(
                     dn=permission1_renamed_dn,
                     cn=[permission1_renamed],
@@ -3427,18 +3379,6 @@ class test_permission_bindtype(Declarative):
             expected=dict(
                 value=permission1_renamed,
                 summary=u'Modified permission "%s"' % permission1_renamed,
-                messages=(
-                    {
-                        'message': ('The permission has write rights but no '
-                                    'attributes are set.'),
-                        'code': 13032,
-                        'type': 'warning',
-                        'name': 'MissingTargetAttributesinPermission',
-                        'data': {
-                            'right': 'write',
-                        }
-                    },
-                ),
                 result=dict(
                     dn=permission1_dn,
                     cn=[permission1],
@@ -4070,18 +4010,6 @@ class test_permission_filters(Declarative):
             expected=dict(
                 value=permission1,
                 summary=u'Added permission "%s"' % permission1,
-                messages=(
-                    {
-                        'message': ('The permission has write rights but no '
-                                    'attributes are set.'),
-                        'code': 13032,
-                        'type': 'warning',
-                        'name': 'MissingTargetAttributesinPermission',
-                        'data': {
-                            'right': 'write',
-                        }
-                    },
-                ),
                 result=dict(
                     dn=permission1_dn,
                     cn=[permission1],
@@ -4126,18 +4054,6 @@ class test_permission_filters(Declarative):
             expected=dict(
                 value=permission1,
                 summary=u'Modified permission "%s"' % permission1,
-                messages=(
-                    {
-                        'message': ('The permission has write rights but no '
-                                    'attributes are set.'),
-                        'code': 13032,
-                        'type': 'warning',
-                        'name': 'MissingTargetAttributesinPermission',
-                        'data': {
-                            'right': 'write',
-                        }
-                    },
-                ),
                 result=dict(
                     dn=permission1_dn,
                     cn=[permission1],
@@ -4177,18 +4093,6 @@ class test_permission_filters(Declarative):
             expected=dict(
                 value=permission1,
                 summary=u'Modified permission "%s"' % permission1,
-                messages=(
-                    {
-                        'message': ('The permission has write rights but no '
-                                    'attributes are set.'),
-                        'code': 13032,
-                        'type': 'warning',
-                        'name': 'MissingTargetAttributesinPermission',
-                        'data': {
-                            'right': 'write',
-                        }
-                    },
-                ),
                 result=dict(
                     dn=permission1_dn,
                     cn=[permission1],
@@ -4228,18 +4132,6 @@ class test_permission_filters(Declarative):
             expected=dict(
                 value=permission1,
                 summary=u'Modified permission "%s"' % permission1,
-                messages=(
-                    {
-                        'message': ('The permission has write rights but no '
-                                    'attributes are set.'),
-                        'code': 13032,
-                        'type': 'warning',
-                        'name': 'MissingTargetAttributesinPermission',
-                        'data': {
-                            'right': 'write',
-                        }
-                    },
-                ),
                 result=dict(
                     dn=permission1_dn,
                     cn=[permission1],
@@ -4280,18 +4172,6 @@ class test_permission_filters(Declarative):
             expected=dict(
                 value=permission1,
                 summary=u'Modified permission "%s"' % permission1,
-                messages=(
-                    {
-                        'message': ('The permission has write rights but no '
-                                    'attributes are set.'),
-                        'code': 13032,
-                        'type': 'warning',
-                        'name': 'MissingTargetAttributesinPermission',
-                        'data': {
-                            'right': 'write',
-                        }
-                    },
-                ),
                 result=dict(
                     dn=permission1_dn,
                     cn=[permission1],
@@ -4325,18 +4205,6 @@ class test_permission_filters(Declarative):
             expected=dict(
                 value=permission1,
                 summary=u'Modified permission "%s"' % permission1,
-                messages=(
-                    {
-                        'message': ('The permission has write rights but no '
-                                    'attributes are set.'),
-                        'code': 13032,
-                        'type': 'warning',
-                        'name': 'MissingTargetAttributesinPermission',
-                        'data': {
-                            'right': 'write',
-                        }
-                    },
-                ),
                 result=dict(
                     dn=permission1_dn,
                     cn=[permission1],
@@ -4386,18 +4254,6 @@ class test_permission_filters(Declarative):
             expected=dict(
                 value=permission1,
                 summary=u'Added permission "%s"' % permission1,
-                messages=(
-                    {
-                        'message': ('The permission has write rights but no '
-                                    'attributes are set.'),
-                        'code': 13032,
-                        'type': 'warning',
-                        'name': 'MissingTargetAttributesinPermission',
-                        'data': {
-                            'right': 'write',
-                        }
-                    },
-                ),
                 result=dict(
                     dn=permission1_dn,
                     cn=[permission1],

ipatests/test_xmlrpc/test_privilege_plugin.py

@@ -255,18 +255,6 @@ class test_privilege(Declarative):
             expected=dict(
                 value=permission2,
                 summary=u'Added permission "%s"' % permission2,
-                messages=(
-                    {
-                        'message': ('The permission has write rights but no '
-                                    'attributes are set.'),
-                        'code': 13032,
-                        'type': 'warning',
-                        'name': 'MissingTargetAttributesinPermission',
-                        'data': {
-                            'right': 'write',
-                        }
-                    },
-                ),
                 result=dict(
                     dn=permission2_dn,
                     cn=[permission2],

ipatests/test_xmlrpc/test_user_plugin.py

@@ -125,9 +125,7 @@ def user_npg(request, group):
     del tracker.attrs['mepmanagedentry']
     tracker.attrs.update(
         description=[], memberof_group=[group.cn],
-        objectclass=fuzzy_set_optional_oc(
-            objectclasses.user_base, 'ipantuserattrs'
-        ),
+        objectclass=objectclasses.user_base + [u'ipantuserattrs'],
     )
     return tracker.make_fixture(request)
 
@@ -141,9 +139,7 @@ def user_npg2(request, group):
     del tracker.attrs['mepmanagedentry']
     tracker.attrs.update(
         gidnumber=[u'1000'], description=[], memberof_group=[group.cn],
-        objectclass=fuzzy_set_optional_oc(
-            objectclasses.user_base, 'ipantuserattrs'
-        ),
+        objectclass=objectclasses.user_base + [u'ipantuserattrs'],
     )
     return tracker.make_fixture(request)
 
@@ -155,9 +151,8 @@ def user_radius(request, xmlrpc_setup):
                           sn=u'radiususer1',
                           ipatokenradiususername=u'radiususer')
     tracker.track_create()
-    tracker.attrs.update(objectclass=fuzzy_set_optional_oc(
-        objectclasses.user + [u'ipatokenradiusproxyuser'],
-        'ipantuserattrs'),
+    tracker.attrs.update(
+        objectclass=objectclasses.user + [u'ipatokenradiusproxyuser']
     )
     return tracker.make_fixture(request)
 
@@ -652,8 +647,7 @@ class TestCreate(XMLRPC_test):
         testuser.attrs.update(gidnumber=[u'1000'])
         testuser.attrs.update(
             description=[],
-            objectclass=fuzzy_set_optional_oc(
-                objectclasses.user_base, 'ipantuserattrs'),
+            objectclass=objectclasses.user_base + [u'ipantuserattrs']
         )
         command = testuser.make_create_command()
         result = command()
@@ -871,9 +865,7 @@ class TestUserWithUPGDisabled(XMLRPC_test):
         testuser.attrs.update(gidnumber=[u'1000'])
         testuser.attrs.update(
             description=[],
-            objectclass=fuzzy_set_optional_oc(
-                objectclasses.user_base, 'ipantuserattrs'
-            ),
+            objectclass=objectclasses.user_base + [u'ipantuserattrs'],
         )
         command = testuser.make_create_command()
         result = command()

makeaci.in

@@ -61,7 +61,7 @@ def generate_aci_lines(api):
             anonymous_read_aci=None,
             is_new=True,
         )
-        aci, _msg = perm_plugin.make_aci(entry)
+        aci = perm_plugin.make_aci(entry)
         yield 'dn: %s\n' % entry.single_value['ipapermlocation']
         yield f'aci: {aci}\n'
 

tox.ini

@@ -62,4 +62,4 @@ exclude=.git,.venv,build,_build,rpmbuild,2_49,2_114,2_156,2_164
 filename=*.py,*.in
 
 [pytest]
-addopts = -ra -v --ignore=prci_definitions/prci_checker.py
+addopts = -ra -v