Beta testplan

This document is supposed to give you some ideas how and what to test on ocis. It’s not meant to be an extensive list of all tests to be done, rather it should help you, as beta-tester, to get started and enable you to get creative and create your own test-cases. Derive from these examples, be creative, do unusual and unconventional things, to try to break things.

One option to create new test-cases and to stress the system is to examine what the API acceptance-tests or the web-UI does, examine the requests and do something a bit different with curl. This is also a good way to find out how APIs work that are not already fully documented.

Some cases have suggested setup steps, but feel free to use other setups. This can include:

• different deployment methods (e.g. running single binary, docker-container, docker-compose setup, individual services in own docker containers)
• different identity managers (e.g. different external LDAP, internal IDM)
• different reverse proxies (e.g. traefik)
• different OpenIDConnect IDPs (e.g builtin IDP, keycloak, AzureAD)
  • for some functionalities you will need an LDAP server where the IDP and oCIS both get the users from
  • keycloak example
  • service configuration
• different storage systems (decomposedFS on local POSIX (default), decomposedFS on NFS, S3 )

It’s a good idea to test ocis in the same environment where you are planning to use it later (with the LDAP server, storage system, etc. of your organisation).

For a quick start, please have a look into the getting started documentation of oCIS If you would like to access oCIS remotely please refer to the Basic Remote Setup section.

• to allow basic auth (e.g. to easily access oCIS using curl commands) you have to set PROXY_ENABLE_BASIC_AUTH=true environment variable
• if you cannot use real SSL Certificates set OCIS_INSECURE=true as environment variable

Prerequisite:

• connect ocis to your preferred LDAP server
• create users and groups in LDAP
• start ocis with basic auth

documentation resources:

• configure ocis with LDAP
• sharing API is compatible to ownCloud 10
• webDav operations

should be tried in various ways and in different environments

documentation resources:

• sharing API is compatible to ownCloud 10
• webDav operations

• configure ocis with LDAP
• setup oC10 and ocis in parallel
• create users and groups in LDAP

documentation resources:

• sharing API is compatible to ownCloud 10

Prerequisite:

• start ocis with basic auth
• variable declaration, for curl examples:

SERVER_URI=https://localhost:9200
GRAPH_API_PATH=graph/v1.0
SHARE_API_PATH=ocs/v2.php/apps/files_sharing/api/v1/shares
USER=admin
PASSWORD=admin

• create a new user curl -k -u $USER:$PASSWORD "$SERVER_URI/$GRAPH_API_PATH/users" -X POST -d'{"displayName":"Example User","mail":"example@example.org","onPremisesSamAccountName":"example","passwordProfile":{"password":"ThePassword"}}'
• give the user the “Space Admin” role
  1. get the id of the user: curl -k -u $USER:$PASSWORD $SERVER_URI/$GRAPH_API_PATH/users/<user-name> | jq '.id'
  2. assign role user to role: curl -k -u $USER:$PASSWORD $SERVER_URI/api/v0/settings/assignments-add -d'{"account_uuid":"<user-id>","role_id":"2aadd357-682c-406b-8874-293091995fdd"}
• create a space: curl -k -u $USER:$PASSWORD "$SERVER_URI/$GRAPH_API_PATH/drives" -X POST -d'{"Name":"Space for finance","driveType":"project", "description":"we need some space"}'
• list spaces: curl -k -u $USER:$PASSWORD $SERVER_URI/$GRAPH_API_PATH/me/drives
• disable a space: curl -k -u $USER:$PASSWORD $SERVER_URI/$GRAPH_API_PATH/drives/<space-id> -X DELETE
• delete a space: curl -k -u $USER:$PASSWORD $SERVER_URI/$GRAPH_API_PATH/drives/<space-id> -X DELETE -H'Purge: T'
• restore a space: curl -k -u $USER:$PASSWORD $SERVER_URI/$GRAPH_API_PATH/drives/<space-id> -X PATCH -d"{}" -H"Restore: true"
• rename the space: curl -k -u $USER:$PASSWORD $SERVER_URI/$GRAPH_API_PATH/drives/<space-id> -X PATCH -d'{"name":"नेपालि नाम"}'
• change description of the space: curl -k -u $USER:$PASSWORD $SERVER_URI/$GRAPH_API_PATH/drives/<space-id> -X PATCH -d'{"description":"this contains important data"}'
• change quota of the space curl -k -u $USER:$PASSWORD $SERVER_URI/$GRAPH_API_PATH/drives/<space-id> -X PATCH -d'{"quota":{"total":<bytes>}}'
• change image of space:
  1. upload an image file to the .spaces folder: curl -k -u $USER:$PASSWORD https://localhost:9200/dav/spaces/<space-id>/.space/<file-name> -T <path-of-local-image> -v
  2. note the id provided in the Oc-Fileid header
  3. set the image as “special-folder”: curl -k -u $USER:$PASSWORD $SERVER_URI/$GRAPH_API_PATH/drives/<space-id> -X PATCH -d'{"special":[{"specialFolder":{"name":"image"},"id":"<oc-fileid>"}]}'
• share a space: curl -k -u $USER:$PASSWORD $SERVER_URI/$SHARE_API_PATH -d'space_ref=<space-id>&shareType=7&shareWith=<receiver-username>&role=<role>'
  • Roles:
    • viewer
    • editor
    • manager
• share a resource within a space curl -k -u $USER:$PASSWORD $SERVER_URI/$SHARE_API_PATH -d'shareType=0&shareWith=<receiver-username>&space_ref=<space-id>%2F<resource>&permissions=<permissions>
  • possible permissions
    • 1 = read
    • 2 = update
    • 4 = create
    • 8 = delete
    • 15 = read/write
    • 16 = share
    • 31 = All permissions
• WebDAV
  • root: https://<server-uri>/dav/spaces/<space-id>
  • example commands for operations

Prerequisite:

• connect ocis to your preferred LDAP server
• create users and groups in LDAP
• Use your preferred browser (Firefox 94-96, Chrome 92-97, Opera 81-82, Edge 96-97, Safari 14-15) to access the built-in webUI (by default: https://localhost:9200)

Prerequisite:

• install the desktop client on your preferred OS
• start ocis
• connect a new account in the desktop client to ocis e.g. https://localhost:9200 if you are running the server and the client on the same machine
• accept the self-signed certificate
• you will be redirected to the browser, accept the certificate there also
• login as any user
• allow the “ownCloud desktop app” to access ocis
• select a folder to sync

Prerequisite:

• install the ownCloud app on your mobile
• start oCIS as described in Basic Remote Setup
• connect a new account in the mobile client to ocis
• accept the self-signed certificate
• you will be redirected to the browser, accept the certificate there also
• login as any user
• allow the mobile app to access ocis

Prerequisite:

• start ocis with basic auth

WebDav is accessible under different path

• old: https://<ocis-server>/remote.php/webdav
• new: https://<ocis-server>/remote.php/dav/files/<username>
• spaces: https://<ocis-server>/dav/spaces/<space-id>

WebDav specifications can be found on http://webdav.org/

here some general WebDav request examples:

variable declaration:

SERVER_URI=https://localhost:9200
API_PATH=remote.php/webdav
USER=admin
PASSWORD=admin

• list content of root folder: curl -k -u $USER:$PASSWORD "$SERVER_URI/$API_PATH/" -X PROPFIND
• list content of sub-folder: curl -k -u $USER:$PASSWORD "$SERVER_URI/$API_PATH/f1" -X PROPFIND
• create a folder: curl -k -u $USER:$PASSWORD "$SERVER_URI/$API_PATH/folder" -X MKCOL
• delete a resource: curl -k -u $USER:$PASSWORD "$SERVER_URI/$API_PATH/folder" -X DELETE
• rename / move a resource: curl -k -u $USER:$PASSWORD "$SERVER_URI/$API_PATH/folder" -X MOVE -H "Destination: $SERVER_URI/$API_PATH/renamed"
• copy a resource: curl -k -u $USER:$PASSWORD "$SERVER_URI/$API_PATH/folder" -X COPY -H "Destination: $SERVER_URI/$API_PATH/folder-copy"

To decode the HTTPS traffic we need the keys that were used to encrypt the traffic. Those keys are kept secret by the clients, but we can request the clients to save them in a specific file, so that wireshark can use them to decrypt the traffic again.

1. create key file: touch /tmp/sslkey.log
2. start wireshark
3. set log filename
   • navigate to Edit=>Preferences=>Protocols=>TLS
   • in the field (Pre)-Master-Secret log filename enter /tmp/sslkey.log
4. decode as HTTP
   • navigate to Analyze=>Decode As…
   • click the + button
   • set Field: TLS Port; Value=9200; Type: Integer, base 10; Default (none); Current HTTP (adjust the port if you are using another one than 9200)
5. start recording
   • use port 9200 as capture filter to only record ocis packages
   • use http as display filter to see only decoded traffic
6. run test-software with SSLKEYLOGFILE=/tmp/sslkey.log as env. variable e.g.
   • curl: SSLKEYLOGFILE=/tmp/sslkey.log curl -k -u admin:admin https://localhost:9200/ocs/v1.php/cloud/users
   • Browser: SSLKEYLOGFILE=/tmp/sslkey.log firefox
   • LibreOffice: SSLKEYLOGFILE=/tmp/sslkey.log libreoffice
   • acceptance tests: SSLKEYLOGFILE=/tmp/sslkey.log make test-acceptance-api ...

• piping xml results to xmllint gives you nice formats. E.g. curl -k --user marie:radioactivity "https://localhost:9200/ocs/v1.php/apps/files_sharing/api/v1/shares" | xmllint --format -
• piping json results to jq gives you nice formats. E.g. curl -k --user marie:radioactivity "https://localhost:9200/ocs/v1.php/apps/files_sharing/api/v1/shares?format=json" | jq

• Big List of Naughty Strings