ApiDocumentationTest failure: Undefined property: AuthPlugin::$boundAs
Closed, ResolvedPublic

Description

Caused by changes in AuthPlugin?

16:01:47 There were 2 errors:
16:01:47 
16:01:47 1) ApiDocumentationTest::testDocumentationExists with data set "Module query+novainstances with MiserMode=false, AllowCategorizedRecentChanges=false" ('query+novainstances', array(false, false))
16:01:47 Undefined property: AuthPlugin::$boundAs
16:01:47 
16:01:47 /mnt/jenkins-workspace/workspace/mwext-testextension-php53/src/extensions/OpenStackManager/nova/OpenStackNovaLdapConnection.php:20
16:01:47 /mnt/jenkins-workspace/workspace/mwext-testextension-php53/src/extensions/OpenStackManager/nova/OpenStackNovaProject.php:692
16:01:47 /mnt/jenkins-workspace/workspace/mwext-testextension-php53/src/extensions/OpenStackManager/nova/OpenStackNovaProject.php:671
16:01:47 /mnt/jenkins-workspace/workspace/mwext-testextension-php53/src/extensions/OpenStackManager/api/ApiListNovaInstances.php:84
16:01:47 /mnt/jenkins-workspace/workspace/mwext-testextension-php53/src/includes/api/ApiBase.php:2245
16:01:47 /mnt/jenkins-workspace/workspace/mwext-testextension-php53/src/tests/phpunit/includes/TestingAccessWrapper.php:34
16:01:47 /mnt/jenkins-workspace/workspace/mwext-testextension-php53/src/tests/phpunit/structure/ApiDocumentationTest.php:80
16:01:47 /mnt/jenkins-workspace/workspace/mwext-testextension-php53/src/tests/phpunit/structure/ApiDocumentationTest.php:80
16:01:47 /mnt/jenkins-workspace/workspace/mwext-testextension-php53/src/tests/phpunit/MediaWikiTestCase.php:137
16:01:47 
16:01:47 2) ApiDocumentationTest::testDocumentationExists with data set "Module query+novainstances with MiserMode=true, AllowCategorizedRecentChanges=true" ('query+novainstances', array(true, true))
16:01:47 Undefined property: AuthPlugin::$boundAs
16:01:47 
16:01:47 /mnt/jenkins-workspace/workspace/mwext-testextension-php53/src/extensions/OpenStackManager/nova/OpenStackNovaLdapConnection.php:20
16:01:47 /mnt/jenkins-workspace/workspace/mwext-testextension-php53/src/extensions/OpenStackManager/nova/OpenStackNovaProject.php:692
16:01:47 /mnt/jenkins-workspace/workspace/mwext-testextension-php53/src/extensions/OpenStackManager/nova/OpenStackNovaProject.php:671
16:01:47 /mnt/jenkins-workspace/workspace/mwext-testextension-php53/src/extensions/OpenStackManager/api/ApiListNovaInstances.php:84
16:01:47 /mnt/jenkins-workspace/workspace/mwext-testextension-php53/src/includes/api/ApiBase.php:2245
16:01:47 /mnt/jenkins-workspace/workspace/mwext-testextension-php53/src/tests/phpunit/includes/TestingAccessWrapper.php:34
16:01:47 /mnt/jenkins-workspace/workspace/mwext-testextension-php53/src/tests/phpunit/structure/ApiDocumentationTest.php:80
16:01:47 /mnt/jenkins-workspace/workspace/mwext-testextension-php53/src/tests/phpunit/structure/ApiDocumentationTest.php:80
16:01:47 /mnt/jenkins-workspace/workspace/mwext-testextension-php53/src/tests/phpunit/MediaWikiTestCase.php:137

https://integration.wikimedia.org/ci/job/mwext-testextension-php53/498/console

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJan 24 2016, 5:14 PM
	public function getAllowedParams() {
		return array(
			'project' => array(
				ApiBase::PARAM_TYPE => OpenStackNovaProject::getAllProjectNames(),
				ApiBase::PARAM_REQUIRED => true,
			),
			'region' => array(
				ApiBase::PARAM_TYPE => $this->getRegions(),
				ApiBase::PARAM_REQUIRED => true,
			)
		);
	}

The first OpenStackNovaProject::getAllProjectNames() requires a connection to ldap presumably, which doesn't exist in the test environment...

Could we set the test environment up to use the proxyagent credentials to log in to LDAP?

Do not make it connect to LDAP, notably the Nodepool disposable instances do not connect to LDAP. Having to get yet another backend service to maintain is going to a be a pity though an integration test with LDAP would be nice.


The job passed January 20th https://gerrit.wikimedia.org/r/#/c/265018/ . The ApiDocumentationTest got reintroduced in MediaWiki by f7eed53ff8dff31836c12a8d491f1bbe78a4b367 on January 21st 08am :

$ git lg tests/phpunit/structure/ApiDocumentationTest.php
* f7eed53 - Revert "Revert "API: Add a unit test to check all modules' i18n"" (6 days ago) <Anomie>
* 7076a79 - Revert "API: Add a unit test to check all modules' i18n" (5 weeks ago) <Krinkle>
* 0d3712d - API: Add a unit test to check all modules' i18n (5 weeks ago) <Brad Jorsch>

Since the ApiDocumentationTest executes code and random API relies on backend we are screwed. We would need to severely refactor the OpenStackManager API classes so we could injects stub/mocks.

Easiest way to fix: revert again the mediawiki/core patch, or maybe it can be enhanced to catch such exceptions and report somehow.


The property boundAs comes from OpenStackNovaLdapConnection::connect():

static function connect() {
    global $wgAuth;
    global $wgOpenStackManagerLDAPUser, $wgOpenStackManagerLDAPUserPassword;
    global $wgOpenStackManagerLDAPDomain;

    // Only reconnect/rebind if we aren't alredy bound
    if ( $wgAuth->boundAs !== $wgOpenStackManagerLDAPUser ) {
        $wgAuth->connect( $wgOpenStackManagerLDAPDomain );
        $wgAuth->bindAs( $wgOpenStackManagerLDAPUser, $wgOpenStackManagerLDAPUserPassword );
    }
}

Potentially we could have OpenStackManager to define a stub $wgAuth whenever it runs under Jenkins via isset( $wgWikimediaJenkinsCI ) && $wgWikimediaJenkinsCI === true.

The API invokes OpenStackNovaProject::getAllProjectNames() which does:

OpenStackNovaLdapConnection::connect();
$result = LdapAuthenticationPlugin::ldap_list( $wgAuth->ldapconn, $wgOpenStackManagerLDAPProjectBaseDN, '(objectclass=groupofnames)' );

And the ldap_list(). If the stub $wgAuth had a ldapconn property that is accepted, it would return null/false and that would skip the whole getAllProjects().

Until we can decouple OpenStackManager from LdapAuthentication and inject a stub/mock of LdapAuthentication :-(

Change 266942 had a related patch set uploaded (by Alex Monk):
Check isset( $wgAuth->boundAs )

https://gerrit.wikimedia.org/r/266942

Surely the CI environment can stub out calls and make those ldap calls return a ready-made list?

Change 267147 had a related patch set uploaded (by Hashar):
[OpenStackManager] depends on LdapAuthentication

https://gerrit.wikimedia.org/r/267147

Change 267147 merged by jenkins-bot:
[OpenStackManager] depends on LdapAuthentication

https://gerrit.wikimedia.org/r/267147

Change 267152 had a related patch set uploaded (by Hashar):
Inject $wgAuth = LdapAuthenticationPlugin on WMF CI

https://gerrit.wikimedia.org/r/267152

So to get it fixed we need:

  • LdapAuthentication injected as a dependency by CI
  • set $wgAuth = LdapAuthenticationPlugin on CI https://gerrit.wikimedia.org/r/267152
  • Get php5-ldap (did salt '*slave-precise*' cmd.run 'apt-get install php5-ldap').

Patch pass!

hashar claimed this task.Jan 28 2016, 10:31 PM
hashar moved this task from Backlog to Archive on the Continuous-Integration-Config board.

Change 267152 merged by Andrew Bogott:
Inject $wgAuth = LdapAuthenticationPlugin on WMF CI

https://gerrit.wikimedia.org/r/267152

Andrew closed this task as "Resolved".Jan 28 2016, 10:41 PM

@Andrew if you ever have to backport patches to the wmf branches, https://gerrit.wikimedia.org/r/267152 would have to be cherry picked to them for CI to pass.

Change 266942 abandoned by Reedy:
Check isset( $wgAuth->boundAs )

https://gerrit.wikimedia.org/r/266942