From 32ef12092845beeb7f4fb1779b3197467ae59269 Mon Sep 17 00:00:00 2001
From: Joachim Wiberg <troglobit@gmail.com>
Date: Sun, 16 Jun 2024 23:50:30 +0200
Subject: [PATCH] test: verify admin user default password in running and
 operational

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
 test/case/ietf_system/user_admin.py | 66 ++++++++++++++++++++++-------
 1 file changed, 50 insertions(+), 16 deletions(-)

diff --git a/test/case/ietf_system/user_admin.py b/test/case/ietf_system/user_admin.py
index 4dba86ac..3454b546 100755
--- a/test/case/ietf_system/user_admin.py
+++ b/test/case/ietf_system/user_admin.py
@@ -1,10 +1,13 @@
 #!/usr/bin/env python3
 """
-  Add a non-admin user and verify they have no privs
-  Add user to admin group and recheck privileges
+  - Add a non-admin user and verify they have no privs
+  - Add user to admin group and recheck privileges
+  - Test admin user, verify $factory$ password in running
+    and active password in operational datastore
 """
 
 import infamy
+import infamy.ssh as ssh
 from passlib.hash import sha256_crypt
 
 with infamy.Test() as test:
@@ -12,6 +15,8 @@ with infamy.Test() as test:
         env = infamy.Env(infamy.std_topology("1x1"))
         target = env.attach("target", "mgmt")
         tgtssh = env.attach("target", "mgmt", "ssh")
+        factory = env.get_password("target")
+        address = target.address()
 
     with test.step("Add new user"):
         USER = "jacky"
@@ -53,20 +58,13 @@ with infamy.Test() as test:
             test.fail()
 
     with test.step(f"Add {USER} user to admin group"):
-        target.put_config_dict("ietf-netconf-acm", {
-            "nacm": {
-                "groups": {
-                    "group": [
-                        {
-                            "name": "admin",
-                            "user-name": [
-                                "admin",
-                                "jacky"
-                            ]
-                        }
-                    ]
-                }
-            }})
+        # Don't presume 'admin' user exists, only group
+        nacm = target.get_config_dict("/ietf-netconf-acm:nacm")
+        for group in nacm["nacm"]["groups"]["group"]:
+            if group["name"] == "admin":
+                if USER not in group["user-name"]:
+                    group["user-name"].append(USER)
+        target.put_config_dict("ietf-netconf-acm", nacm)
 
     with test.step(f"Verify user {USER} is now in wheel group ..."):
         if not tgtssh.runsh(f"grep wheel /etc/group | grep '{USER}'"):
@@ -77,4 +75,40 @@ with infamy.Test() as test:
         if "bash" not in user:
             test.fail()
 
+    with test.step(f"Change user {USER} to $factory$ password ..."):
+        running = target.get_config_dict("/ietf-system:system")
+        users = running["system"]["authentication"]["user"]
+
+        for user in users:
+            if user['name'] == USER:
+                user['password'] = "$factory$"
+                break
+        target.put_config_dict("ietf-system", running)
+
+    with test.step(f"Verify user {USER} exists and has new password ..."):
+        operational = target.get_data("/ietf-system:system/authentication")
+        users = operational["system"]["authentication"]["user"]
+
+        found = None
+        for user in users:
+            if user['name'] == USER:
+                found = user
+                break
+
+        if found is None:
+            test.fail()
+        if found['password'] == "$factory$":
+            test.fail()
+        if found['password'] == PASS:
+            test.fail()
+
+    with test.step(f"Verify user {USER} can log in with SSH ..."):
+        conn = ssh.Device(ssh.Location(address, factory, USER))
+        try:
+            pwd = conn.runsh(f"cat /etc/passwd | grep {USER}").stdout
+            print(f"Found {pwd.rstrip()}")
+        except Exception as err:
+            print(f"Failed connecting to target as {USER}: {err}")
+            test.fail()
+
     test.succeed()