all tests in test012_pam_interactive_multistep.bats now pass

Author: d-w-moore

irods/test/scripts/test011_pam_interactive.bats

@@ -19,7 +19,7 @@ setup() {
       jq '.irods_client_server_policy="CS_NEG_REFUSE"' >$CLIENT_JSON.$$ <$CLIENT_JSON && \
       mv  $CLIENT_JSON.$$ $CLIENT_JSON
 
-      sudo apt install irods-auth-plugin-pam-interactive-{client,server}
+      sudo apt install -y irods-auth-plugin-pam-interactive-{client,server}
 
       setup_pam_login_for_user "rods" alice
 

irods/test/scripts/test012_pam_interactive_multistep.bats

@@ -10,6 +10,7 @@ SKIP_IINIT_FOR_PASSWORD=yes
 export TESTUSER="john"
 export FIRST_PASSWORD="=i;r@o\\d&s" # somerods
 export SECOND_PASSWORD="otherrods"
+export CLIENT_AUTH_ERROR_EXITCODE=123
 
 ssl_hash() {
   openssl passwd -6 "$1"
@@ -32,7 +33,7 @@ setup() {
       jq '.irods_client_server_policy="CS_NEG_REFUSE"' >$CLIENT_JSON.$$ <$CLIENT_JSON && \
       mv  $CLIENT_JSON.$$ $CLIENT_JSON
 
-      sudo apt install irods-auth-plugin-pam-interactive-{client,server}
+      sudo apt install -y irods-auth-plugin-pam-interactive-{client,server}
       SERVER_CONFIG=server_config.json
 
       sudo -s <<-EOF
@@ -57,11 +58,6 @@ setup() {
       sudo cp $BATS_TEST_DIRNAME/files_for_test012/pam_interactive /etc/pam.d/
       sudo mkdir /t012 && sudo gcc -o /t012/pam_clear_token.so -fno-stack-protector -shared -fPIC $BATS_TEST_DIRNAME/files_for_test012/pam_clear_token.c
 
-      db_file=/t012/pam_userdb.db
-      sudo db_load -T -t hash "$db_file" <<<"${TESTUSER}"$'\n'"$(ssl_hash _${SECOND_PASSWORD})"
-      sudo chown root:root "$db_file"
-      sudo chmod 600 "$db_file"
-
       # Tests require only the irods_environment.json
       rm -f ~/.irods/.irodsA
 
@@ -72,14 +68,20 @@ setup() {
   touch /tmp/test012_flag
 }
 
-@test "pam_interactive_test_multistep_with_correct_passwords" {
-:
-echo "
+encode_2nd_password() {
+      db_file=/t012/pam_userdb.db
+      sudo db_load -T -t hash "$db_file" <<<"${TESTUSER}"$'\n'"$(ssl_hash ${1})"
+      sudo chown root:root "$db_file"
+      sudo chmod 600 "$db_file"
+}
+
+SCRIPT="
 import getpass
-import irods
 import os
+
+import irods
+from irods.auth import  ClientAuthError
 from unittest.mock import patch
-from irods.auth import FORCE_PASSWORD_PROMPT
 
 def getpass_new_callable(answers=()):
     class iterate_answers:
@@ -96,26 +98,55 @@ def getpass_new_callable(answers=()):
 
 home = None
 
+pw_count = 0
+
 with patch(
     'getpass.getpass',
     new_callable=getpass_new_callable(answers=[os.environ['FIRST_PASSWORD'],os.environ['SECOND_PASSWORD']])
 ) as m:
     try:
-     sess = irods.helpers.make_session(test_server_version=False)
-     sess.set_auth_option_for_scheme('pam_interactive', FORCE_PASSWORD_PROMPT, True)
-     home = sess.collections.get(f'/{sess.zone}/home/{sess.username}')
+        sess = irods.helpers.make_session(test_server_version=False)
+        sess.set_auth_option_for_scheme('pam_interactive', irods.auth.FORCE_PASSWORD_PROMPT, True)
+        home = sess.collections.get(f'/{sess.zone}/home/{sess.username}')
+    except ClientAuthError as exc:
+        # Note:  The write to stdout, and the specific exit code, are necessary for the test assertions.
+        # in test "pam_interactive_test_multistep_with_incorrect_2nd_password" below.
+        print(f'ERROR: {exc!r}')
+        exit(int(os.environ['CLIENT_AUTH_ERROR_EXITCODE']))
     finally:
-     pw_count = m.count
+        pw_count = m.count
+
+# Assert both passwords were prompted for.
+if pw_count < 2:
+    print(f'************************ {pw_count = } < 2')
+    exit(3)
 
-#if pw_count < 2:
-#   print(f'************************ {pw_count = } < 2')
-#   exit(3)
+# Assert home is defined, ie a session was successfully created and used to retrieve a collection object
 if home is None:
     exit(2)
+
 username = os.environ['TESTUSER']
+
+# Assert home contains the expected username.
 if not home.path.endswith(f'/{username}'):
     exit(1)
-" >/tmp/test012.py
-###############################
-python /tmp/test012.py >&3 2>&1
+"
+
+@test "pam_interactive_test_multistep_with_incorrect_2nd_password" {
+
+    # We are using a deliberately munged password.
+    encode_2nd_password "_${SECOND_PASSWORD}"
+    local STATUS=""
+    OUTPUT=$(python -c "$SCRIPT" 2>&1) || STATUS=$?
+
+    # Here, we assert the process's exit and output conform to expectation. We want to
+    # enforce that the stdout output stream contains the thrown exception name ("ClientAuthError")
+    # as well as that the process exits with a particular error status.
+    [ $STATUS = $CLIENT_AUTH_ERROR_EXITCODE ]
+    [[ $OUTPUT =~ ClientAuthError ]]
+}
+
+@test "pam_interactive_test_multistep_with_correct_2nd_password" {
+    encode_2nd_password "${SECOND_PASSWORD}"
+    python -c "$SCRIPT"
 }