minio/buildscripts/minio-iam-ldap-upgrade-import-test.sh

#!/bin/bash

# This script tests IAM migration from an old MinIO compatibility fixture into
# the current Silo server.
#
# To run it locally, start the LDAP server in github.com/minio/minio-iam-testing
# repo (e.g. make podman-run), and then run this script.
#
# This script assumes that LDAP server is at:
#
#   `localhost:389`
#
# if this is not the case, set the environment variable
# `_MINIO_LDAP_TEST_SERVER`.

OLD_VERSION=RELEASE.2024-03-26T22-10-45Z
OLD_BINARY_LINK=https://dl.min.io/server/minio/release/linux-amd64/archive/minio.${OLD_VERSION}
OLD_BINARY_SHA256=2050199d89e3057571620a1d453118fed5bd2de9d4f3b266b11365fdf984d676

__init__() {
	if which curl &>/dev/null; then
		echo "curl is already installed"
	else
		echo "Installing curl:"
		sudo apt install curl -y
	fi

	export GOPATH=/tmp/gopath
	export PATH="${PATH}":"${GOPATH}"/bin

	if [ ! -x "${GOPATH}/bin/mc" ]; then
		echo "Installing verified compatible client fixture"
		mkdir -p "${GOPATH}/bin"
		"$(git rev-parse --show-toplevel)/buildscripts/install-mcli.sh" "${GOPATH}/bin/mc"
	fi

	if [ ! -x ./minio.${OLD_VERSION} ]; then
		echo "Installing verified upstream compatibility fixture minio.${OLD_VERSION}"
		"$(git rev-parse --show-toplevel)/buildscripts/install-verified-fixture.sh" \
			"${OLD_BINARY_LINK}" "${OLD_BINARY_SHA256}" "minio.${OLD_VERSION}"
	fi

	if [ -z "$_MINIO_LDAP_TEST_SERVER" ]; then
		export _MINIO_LDAP_TEST_SERVER=localhost:389
		echo "Using default LDAP endpoint: $_MINIO_LDAP_TEST_SERVER"
	fi

	rm -rf /tmp/data
}

create_iam_content_in_old_minio() {
	echo "Creating IAM content in the old MinIO compatibility fixture."

	MINIO_CI_CD=1 ./minio.${OLD_VERSION} server /tmp/data/{1...4} &
	sleep 5

	set -x
	mc alias set old-minio http://localhost:9000 minioadmin minioadmin
	mc ready old-minio
	mc idp ldap add old-minio \
		server_addr=localhost:389 \
		server_insecure=on \
		lookup_bind_dn=cn=admin,dc=min,dc=io \
		lookup_bind_password=admin \
		user_dn_search_base_dn=dc=min,dc=io \
		user_dn_search_filter="(uid=%s)" \
		group_search_base_dn=ou=swengg,dc=min,dc=io \
		group_search_filter="(&(objectclass=groupOfNames)(member=%d))"
	mc admin service restart old-minio

	mc idp ldap policy attach old-minio readwrite --user=UID=dillon,ou=people,ou=swengg,dc=min,dc=io
	mc idp ldap policy attach old-minio readwrite --group=CN=project.c,ou=groups,ou=swengg,dc=min,dc=io

	mc idp ldap policy entities old-minio

	mc admin cluster iam export old-minio
	set +x

	mc admin service stop old-minio
}

import_iam_content_in_new_minio() {
	echo "Importing IAM content into the current Silo instance."
	# Assume the current Silo binary exists.
	MINIO_CI_CD=1 ./silo server /tmp/data/{1...4} &
	sleep 5

	set -x
	mc alias set new-minio http://localhost:9000 minioadmin minioadmin
	echo "BEFORE IMPORT mappings:"
	mc ready new-minio
	mc idp ldap policy entities new-minio
	mc admin cluster iam import new-minio ./old-minio-iam-info.zip
	echo "AFTER IMPORT mappings:"
	mc idp ldap policy entities new-minio
	set +x

	# mc admin service stop new-minio
}

verify_iam_content_in_new_minio() {
	output=$(mc idp ldap policy entities new-minio --json)

	groups=$(echo "$output" | jq -r '.result.policyMappings[] | select(.policy == "readwrite") | .groups[]')
	if [ "$groups" != "cn=project.c,ou=groups,ou=swengg,dc=min,dc=io" ]; then
		echo "Failed to verify groups: $groups"
		exit 1
	fi

	users=$(echo "$output" | jq -r '.result.policyMappings[] | select(.policy == "readwrite") | .users[]')
	if [ "$users" != "uid=dillon,ou=people,ou=swengg,dc=min,dc=io" ]; then
		echo "Failed to verify users: $users"
		exit 1
	fi

	mc admin service stop new-minio
}

main() {
	create_iam_content_in_old_minio

	import_iam_content_in_new_minio

	verify_iam_content_in_new_minio
}

(__init__ "$@" && main "$@")