Trigger Kerberos CI from package pipeline

eng/pipelines/ci/kerberos/linux-setup-step.yml

@@ -0,0 +1,110 @@
+####################################################################################################
+# Licensed to the .NET Foundation under one or more agreements.  The .NET Foundation licenses this
+# file to you under the MIT license.  See the LICENSE file in the project root for more information.
+####################################################################################################
+
+# Configures a Linux agent, joins it to the domain, acquires a Kerberos ticket, and verifies SQL
+# connectivity before running integration tests.
+
+parameters:
+
+  - name: kerberosDomain
+    type: string
+
+  - name: kerberosDomainOU
+    type: string
+
+  - name: kerberosDomainUser
+    type: string
+
+  - name: kerberosDomainPassword
+    type: string
+
+steps:
+
+  - pwsh: |
+      $jdata = Get-Content -Raw "config.default.jsonc" | ConvertFrom-Json
+      foreach ($p in $jdata) {
+          $p.TCPConnectionString = $env:REMOTE_TCP_CONN_STRING
+          $p.NPConnectionString = $env:REMOTE_NP_CONN_STRING
+          $p.SupportsIntegratedSecurity = $true
+      }
+      $jdata | Add-Member -NotePropertyName "KerberosDomainUser" -NotePropertyValue $env:KERBEROS_DOMAIN_USER -Force
+      $jdata | Add-Member -NotePropertyName "KerberosDomainPassword" -NotePropertyValue $env:KERBEROS_DOMAIN_PASSWORD -Force
+      $jdata | ConvertTo-Json | Set-Content "config.jsonc"
+    workingDirectory: src/Microsoft.Data.SqlClient/tests/tools/Microsoft.Data.SqlClient.TestUtilities
+    displayName: Update test config.jsonc (Kerberos)
+    env:
+      REMOTE_TCP_CONN_STRING: $(REMOTE_TCP_CONN_STRING)
+      REMOTE_NP_CONN_STRING: $(REMOTE_NP_CONN_STRING)
+      KERBEROS_DOMAIN_USER: ${{ parameters.kerberosDomainUser }}
+      KERBEROS_DOMAIN_PASSWORD: ${{ parameters.kerberosDomainPassword }}
+
+  - bash: |
+      set -euo pipefail
+
+      DOMAIN="${{ parameters.kerberosDomain }}"
+      DOMAIN_OU="${{ parameters.kerberosDomainOU }}"
+      DOMAIN_USER="${{ parameters.kerberosDomainUser }}"
+      DOMAIN_UPPER=$(echo "$DOMAIN" | tr '[:lower:]' '[:upper:]')
+
+      echo "Domain:   $DOMAIN"
+      echo "Realm:    $DOMAIN_UPPER"
+      echo "User:     $DOMAIN_USER"
+      echo "OU:       $DOMAIN_OU"
+
+      if [ -z "$DOMAIN_PASSWORD" ]; then
+        echo "##vso[task.logissue type=error]KerberosDomainPassword is empty"
+        exit 1
+      fi
+
+      echo 'debconf debconf/frontend select Noninteractive' | sudo debconf-set-selections
+
+      sudo apt-get -y update
+      sudo apt-get install -y dialog apt-utils
+      sudo apt-get install -y \
+        krb5-user samba sssd sssd-tools libnss-sss libpam-sss \
+        ntp ntpdate realmd adcli
+
+      CURRENT_HOSTNAME="$(hostname)"
+      if [ "$CURRENT_HOSTNAME" = "$DOMAIN" ] || [[ "$CURRENT_HOSTNAME" == *".$DOMAIN" ]]; then
+        echo "Hostname already uses domain suffix '.$DOMAIN': $CURRENT_HOSTNAME"
+      else
+        sudo hostnamectl set-hostname "$CURRENT_HOSTNAME.$DOMAIN"
+      fi
+
+      if ! sudo grep -Fqx "server $DOMAIN" /etc/ntp.conf; then
+        echo "server $DOMAIN" | sudo tee -a /etc/ntp.conf
+      fi
+      sudo systemctl stop ntp
+      sudo ntpdate "$DOMAIN"
+      sudo systemctl start ntp
+
+      echo "[libdefaults]
+              default_realm = $DOMAIN_UPPER
+              rdns = false" | sudo tee /etc/krb5.conf
+
+      sudo realm discover "$DOMAIN_UPPER"
+
+      echo "$DOMAIN_PASSWORD" | sudo realm join --verbose "$DOMAIN_UPPER" \
+        -U "$DOMAIN_USER@$DOMAIN_UPPER" \
+        --computer-ou "OU=$DOMAIN_OU"
+
+      realm list
+
+      echo "$DOMAIN_PASSWORD" | kinit "$DOMAIN_USER@$DOMAIN_UPPER"
+
+      klist
+      sudo ip addr
+      sudo ip route
+    displayName: Initialize Kerberos (domain join + kinit)
+    env:
+      DOMAIN_PASSWORD: ${{ parameters.kerberosDomainPassword }}
+
+  - pwsh: |
+      Install-Module -Name SqlServer -Force -Confirm:$false
+      Import-Module SqlServer
+      Invoke-Sqlcmd -Query "SELECT @@VERSION, @@SERVERNAME" -ConnectionString $env:REMOTE_TCP_CONN_STRING
+    displayName: Verify SQL connectivity
+    env:
+      REMOTE_TCP_CONN_STRING: $(REMOTE_TCP_CONN_STRING)

eng/pipelines/ci/kerberos/linux-cleanup-step.yml → eng/pipelines/ci/kerberos/linux-teardown-step.yml

@@ -4,9 +4,9 @@
 # See the LICENSE file in the project root for more information.                #
 #################################################################################
 
-# This template leaves the Active Directory domain and destroys Kerberos
-# credentials.  It should be referenced at the end of any job that called
-# linux-init-step.yml.
+# This template tears down the Linux Kerberos environment by leaving the Active Directory domain
+# and destroying credentials. It should be referenced at the end of any job that called
+# linux-setup-step.yml.
 #
 # All steps use condition: always() so that cleanup runs even when previous
 # steps fail.