source4/lib/ldb/tests/python/acl.py

   1 #!/usr/bin/env python
   2 # -*- coding: utf-8 -*-
   3 # This is unit with tests for LDAP access checks
   4
   5 import optparse
   6 import sys
   7 import os
   8 import base64
   9 import re
  10
  11 sys.path.append("bin/python")
  12
  13 import samba.getopt as options
  14
  15 from ldb import (
  16     SCOPE_BASE, LdbError, ERR_NO_SUCH_OBJECT, ERR_INSUFFICIENT_ACCESS_RIGHTS)
  17
  18 from samba.ndr import ndr_pack, ndr_unpack
  19 from samba.dcerpc import security
  20
  21 from samba.auth import system_session
  22 from samba import Ldb
  23 from subunit.run import SubunitTestRunner
  24 import unittest
  25
  26 parser = optparse.OptionParser("ldap [options] <host>")
  27 sambaopts = options.SambaOptions(parser)
  28 parser.add_option_group(sambaopts)
  29 parser.add_option_group(options.VersionOptions(parser))
  30
  31 # use command line creds if available
  32 credopts = options.CredentialsOptions(parser)
  33 parser.add_option_group(credopts)
  34 opts, args = parser.parse_args()
  35
  36 if len(args) < 1:
  37     parser.print_usage()
  38     sys.exit(1)
  39
  40 host = args[0]
  41
  42 lp = sambaopts.get_loadparm()
  43 creds = credopts.get_credentials(lp)
  44
  45 #
  46 # Tests start here
  47 #
  48
  49 class AclTests(unittest.TestCase):
  50
  51     def delete_force(self, ldb, dn):
  52         try:
  53             ldb.delete(dn)
  54         except LdbError, (num, _):
  55             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
  56
  57     def find_basedn(self, ldb):
  58         res = ldb.search(base="", expression="", scope=SCOPE_BASE,
  59                          attrs=["defaultNamingContext"])
  60         self.assertEquals(len(res), 1)
  61         return res[0]["defaultNamingContext"][0]
  62
  63     def find_domain_sid(self, ldb):
  64         res = ldb.search(base=self.base_dn, expression="(objectClass=*)", scope=SCOPE_BASE)
  65         return ndr_unpack( security.dom_sid,res[0]["objectSid"][0])
  66
  67     def setUp(self):
  68         self.ldb_admin = ldb
  69         self.base_dn = self.find_basedn(self.ldb_admin)
  70         self.domain_sid = self.find_domain_sid(self.ldb_admin)
  71         self.user_pass = "samba123@"
  72         print "baseDN: %s" % self.base_dn
  73         self.SAMBA = False; self.WIN = False
  74         res = self.ldb_admin.search(base="",expression="", scope=SCOPE_BASE,
  75                                     attrs=["vendorName"])
  76         if res and "vendorName" in res[0].keys() and res[0]["vendorName"][0].find("Samba Team") != -1:
  77             self.SAMBA = True
  78         else:
  79             self.WIN = True
  80
  81     def get_user_dn(self, name):
  82         return "CN=%s,CN=Users,%s" % (name, self.base_dn)
  83
  84     def modify_desc(self, object_dn, desc):
  85         """ Modify security descriptor using either SDDL string
  86             or security.descriptor object
  87         """
  88         assert(isinstance(desc, str) or isinstance(desc, security.descriptor))
  89         mod = """
  90 dn: """ + object_dn + """
  91 changetype: modify
  92 replace: nTSecurityDescriptor
  93 """
  94         if isinstance(desc, str):
  95             mod += "nTSecurityDescriptor: %s" % desc
  96         elif isinstance(desc, security.descriptor):
  97             mod += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
  98         self.ldb_admin.modify_ldif(mod)
  99         return
 100         # Everything below is used in case of emergency or
 101         # double modify verification of some sort
 102         assert(isinstance(desc, security.descriptor))
 103         fn = "/tmp/tmpMod"
 104         f = open(fn, "w"); f.write(mod); f.close()
 105         cmd = "ldapmodify -x -h %s -D %s -w %s -f %s" \
 106                 % (host[7:], self.get_user_dn(creds.get_username()), creds.get_password(), fn)
 107         return os.system( cmd ) == 0
 108
 109     def add_group_member(self, _ldb, group_dn, member_dn):
 110         """ Modify user to ge member of a group
 111             e.g. User to be 'Doamin Admin' group member
 112         """
 113         ldif = """
 114 dn: """ + group_dn + """
 115 changetype: modify
 116 add: member
 117 member: """ + member_dn
 118         _ldb.modify_ldif(ldif)
 119
 120     def create_ou(self, _ldb, ou_dn, desc=None):
 121         ldif = """
 122 dn: """ + ou_dn + """
 123 ou: """ + ou_dn.split(",")[0][3:] + """
 124 objectClass: organizationalUnit
 125 url: www.example.com
 126 """
 127         if desc:
 128             assert(isinstance(desc, str) or isinstance(desc, security.descriptor))
 129             if isinstance(desc, str):
 130                 ldif += "nTSecurityDescriptor: %s" % desc
 131             elif isinstance(desc, security.descriptor):
 132                 ldif += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
 133         _ldb.add_ldif(ldif)
 134
 135     def create_user(self, _ldb, user_dn, desc=None):
 136         ldif = """
 137 dn: """ + user_dn + """
 138 sAMAccountName: """ + user_dn.split(",")[0][3:] + """
 139 objectClass: user
 140 userPassword: """ + self.user_pass + """
 141 url: www.example.com
 142 """
 143         if desc:
 144             assert(isinstance(desc, str) or isinstance(desc, security.descriptor))
 145             if isinstance(desc, str):
 146                 ldif += "nTSecurityDescriptor: %s" % desc
 147             elif isinstance(desc, security.descriptor):
 148                 ldif += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
 149         _ldb.add_ldif(ldif)
 150
 151     def create_group(self, _ldb, group_dn, desc=None):
 152         ldif = """
 153 dn: """ + group_dn + """
 154 objectClass: group
 155 sAMAccountName: """ + group_dn.split(",")[0][3:] + """
 156 groupType: 4
 157 url: www.example.com
 158 """
 159         if desc:
 160             assert(isinstance(desc, str) or isinstance(desc, security.descriptor))
 161             if isinstance(desc, str):
 162                 ldif += "nTSecurityDescriptor: %s" % desc
 163             elif isinstance(desc, security.descriptor):
 164                 ldif += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
 165         _ldb.add_ldif(ldif)
 166
 167     def read_desc(self, object_dn):
 168         res = self.ldb_admin.search(object_dn, SCOPE_BASE, None, ["nTSecurityDescriptor"])
 169         desc = res[0]["nTSecurityDescriptor"][0]
 170         return ndr_unpack( security.descriptor, desc )
 171
 172     def enable_account(self,  user_dn):
 173         """Enable an account.
 174         :param user_dn: Dn of the account to enable.
 175         """
 176         res = self.ldb_admin.search(user_dn, SCOPE_BASE, None, ["userAccountControl"])
 177         assert len(res) == 1
 178         userAccountControl = res[0]["userAccountControl"][0]
 179         userAccountControl = int(userAccountControl)
 180         if (userAccountControl & 0x2):
 181             userAccountControl = userAccountControl & ~0x2 # remove disabled bit
 182         if (userAccountControl & 0x20):
 183             userAccountControl = userAccountControl & ~0x20 # remove 'no password required' bit
 184         mod = """
 185 dn: """ + user_dn + """
 186 changetype: modify
 187 replace: userAccountControl
 188 userAccountControl: %s""" % userAccountControl
 189         if self.WIN:
 190             mod = re.sub("userAccountControl: \d.*", "userAccountControl: 544", mod)
 191         self.ldb_admin.modify_ldif(mod)
 192
 193     def get_ldb_connection(self, target_username):
 194         username_save = creds.get_username(); password_save = creds.get_password()
 195         creds.set_username(target_username)
 196         creds.set_password(self.user_pass)
 197         ldb_target = Ldb(host, credentials=creds, session_info=system_session(), lp=lp)
 198         creds.set_username(username_save); creds.set_password(password_save)
 199         return ldb_target
 200
 201     def get_object_sid(self, object_dn):
 202         res = self.ldb_admin.search(object_dn)
 203         return ndr_unpack( security.dom_sid, res[0]["objectSid"][0] )
 204
 205     def dacl_add_ace(self, object_dn, ace):
 206         desc = self.read_desc( object_dn )
 207         desc_sddl = desc.as_sddl( self.domain_sid )
 208         if ace in desc_sddl:
 209             return
 210         if desc_sddl.find("(") >= 0:
 211             desc_sddl = desc_sddl[:desc_sddl.index("(")] + ace + desc_sddl[desc_sddl.index("("):]
 212         else:
 213             desc_sddl = desc_sddl + ace
 214         self.modify_desc(object_dn, desc_sddl)
 215
 216     def get_desc_sddl(self, object_dn):
 217         """ Return object nTSecutiryDescriptor in SDDL format
 218         """
 219         desc = self.read_desc(object_dn)
 220         return desc.as_sddl(self.domain_sid)
 221
 222     # Test if we have any additional groups for users than default ones
 223     def assert_user_no_group_member(self, username):
 224         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 225                                          % self.get_user_dn(username) )
 226         try:
 227             self.assertEqual( res[0]["memberOf"][0], "" )
 228         except KeyError:
 229             pass
 230         else:
 231             self.fail()
 232
 233     def create_enable_user(self, username):
 234         self.create_user(self.ldb_admin, self.get_user_dn(username))
 235         self.enable_account(self.get_user_dn(username))
 236
 237 #tests on ldap add operations
 238 class AclAddTests(AclTests):
 239     def setUp(self):
 240         AclTests.setUp(self)
 241         # Domain admin that will be creator of OU parent-child structure
 242         self.usr_admin_owner = "acl_add_user1"
 243         # Second domain admin that will not be creator of OU parent-child structure
 244         self.usr_admin_not_owner = "acl_add_user2"
 245         # Regular user
 246         self.regular_user = "acl_add_user3"
 247         if self.SAMBA:
 248             self.create_enable_user(self.usr_admin_owner)
 249             self.create_enable_user(self.usr_admin_not_owner)
 250             self.create_enable_user(self.regular_user)
 251
 252         if self.WIN:
 253             self.assert_user_no_group_member(self.usr_admin_owner)
 254             self.assert_user_no_group_member(self.usr_admin_not_owner)
 255             self.assert_user_no_group_member(self.regular_user)
 256
 257         # add admins to the Domain Admins group
 258         self.add_group_member(self.ldb_admin, "CN=Domain Admins,CN=Users," + self.base_dn, \
 259                 self.get_user_dn(self.usr_admin_owner))
 260         self.add_group_member(self.ldb_admin, "CN=Domain Admins,CN=Users," + self.base_dn, \
 261                 self.get_user_dn(self.usr_admin_not_owner))
 262
 263         self.ldb_owner = self.get_ldb_connection(self.usr_admin_owner)
 264         self.ldb_notowner = self.get_ldb_connection(self.usr_admin_not_owner)
 265         self.ldb_user = self.get_ldb_connection(self.regular_user)
 266
 267     def tearDown(self):
 268         self.delete_force(self.ldb_admin, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
 269         self.delete_force(self.ldb_admin, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
 270         self.delete_force(self.ldb_admin, "OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
 271         self.delete_force(self.ldb_admin, "OU=test_add_ou1," + self.base_dn)
 272         if self.SAMBA:
 273             self.delete_force(self.ldb_admin, self.get_user_dn(self.usr_admin_owner))
 274             self.delete_force(self.ldb_admin, self.get_user_dn(self.usr_admin_not_owner))
 275             self.delete_force(self.ldb_admin, self.get_user_dn(self.regular_user))
 276
 277     # Make sure top OU is deleted (and so everything under it)
 278     def assert_top_ou_deleted(self):
 279         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s,%s)" \
 280                 % ("OU=test_add_ou1", self.base_dn) )
 281         self.assertEqual( res, [] )
 282
 283     def test_add_u1(self):
 284         """Testing OU with the rights of Doman Admin not creator of the OU """
 285         self.assert_top_ou_deleted()
 286         # Change descriptor for top level OU
 287         self.create_ou(self.ldb_owner, "OU=test_add_ou1," + self.base_dn)
 288         self.create_ou(self.ldb_owner, "OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
 289         user_sid = self.get_object_sid(self.get_user_dn(self.usr_admin_not_owner))
 290         mod = "(D;CI;WPCC;;;%s)" % str(user_sid)
 291         self.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
 292         # Test user and group creation with another domain admin's credentials
 293         self.create_user(self.ldb_notowner, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
 294         self.create_group(self.ldb_notowner, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
 295         # Make sure we HAVE created the two objects -- user and group
 296         # !!! We should not be able to do that, but however beacuse of ACE ordering our inherited Deny ACE
 297         # !!! comes after explicit (A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA) that comes from somewhere
 298         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s,%s)" \
 299                 % ("CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn) )
 300         self.assertTrue( len(res) > 0 )
 301         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s,%s)" \
 302                 % ("CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn) )
 303         self.assertTrue( len(res) > 0 )
 304
 305     def test_add_u2(self):
 306         """Testing OU with the regular user that has no rights granted over the OU """
 307         self.assert_top_ou_deleted()
 308         # Create a parent-child OU structure with domain admin credentials
 309         self.create_ou(self.ldb_owner, "OU=test_add_ou1," + self.base_dn)
 310         self.create_ou(self.ldb_owner, "OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
 311         # Test user and group creation with regular user credentials
 312         try:
 313             self.create_user(self.ldb_user, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
 314             self.create_group(self.ldb_user, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
 315         except LdbError, (num, _):
 316             self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
 317         else:
 318             self.fail()
 319         # Make sure we HAVEN'T created any of two objects -- user or group
 320         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s,%s)" \
 321                 % ("CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn) )
 322         self.assertEqual( res, [])
 323         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s,%s)" \
 324                 % ("CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn) )
 325         self.assertEqual( res, [])
 326
 327     def test_add_u3(self):
 328         """Testing OU with the rights of regular user granted the right 'Create User child objects' """
 329         self.assert_top_ou_deleted()
 330         # Change descriptor for top level OU
 331         self.create_ou(self.ldb_owner, "OU=test_add_ou1," + self.base_dn)
 332         user_sid = self.get_object_sid(self.get_user_dn(self.regular_user))
 333         mod = "(OA;CI;CC;bf967aba-0de6-11d0-a285-00aa003049e2;;%s)" % str(user_sid)
 334         self.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
 335         self.create_ou(self.ldb_owner, "OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
 336         # Test user and group creation with granted user only to one of the objects
 337         self.create_user(self.ldb_user, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
 338         try:
 339             self.create_group(self.ldb_user, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
 340         except LdbError, (num, _):
 341             self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
 342         else:
 343             self.fail()
 344         # Make sure we HAVE created the one of two objects -- user
 345         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s,%s)" \
 346                 % ("CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn) )
 347         self.assertNotEqual( len(res), 0 )
 348         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s,%s)" \
 349                 % ("CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn) )
 350         self.assertEqual( res, [])
 351
 352     def test_add_u4(self):
 353         """ 4 Testing OU with the rights of Doman Admin creator of the OU"""
 354         self.assert_top_ou_deleted()
 355         self.create_ou(self.ldb_owner, "OU=test_add_ou1," + self.base_dn)
 356         self.create_ou(self.ldb_owner, "OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
 357         self.create_user(self.ldb_owner, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
 358         self.create_group(self.ldb_owner, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
 359         # Make sure we have successfully created the two objects -- user and group
 360         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s,%s)" \
 361                 % ("CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn) )
 362         self.assertTrue( len(res) > 0 )
 363         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s,%s)" \
 364                 % ("CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn) )
 365         self.assertTrue( len(res) > 0 )
 366
 367 #tests on ldap modify operations
 368 class AclModifyTests(AclTests):
 369
 370     def setUp(self):
 371         AclTests.setUp(self)
 372         self.user_with_wp = "acl_mod_user1"
 373
 374         if self.SAMBA:
 375             # Create regular user
 376             self.create_enable_user(self.user_with_wp)
 377         if self.WIN:
 378             self.assert_user_no_group_member(self.user_with_wp)
 379
 380         self.ldb_user = self.get_ldb_connection(self.user_with_wp)
 381         self.user_sid = self.get_object_sid( self.get_user_dn(self.user_with_wp))
 382
 383     def tearDown(self):
 384         self.delete_force(self.ldb_admin, self.get_user_dn("test_modify_user1"))
 385         self.delete_force(self.ldb_admin, "CN=test_modify_group1,CN=Users," + self.base_dn)
 386         self.delete_force(self.ldb_admin, "OU=test_modify_ou1," + self.base_dn)
 387         if self.SAMBA:
 388             self.delete_force(self.ldb_admin, self.get_user_dn(self.user_with_wp))
 389
 390     def test_modify_u1(self):
 391         """5 Modify one attribute if you have DS_WRITE_PROPERTY for it"""
 392         mod = "(OA;;WP;bf967953-0de6-11d0-a285-00aa003049e2;;%s)" % str(self.user_sid)
 393         # First test object -- User
 394         print "Testing modify on User object"
 395         #self.delete_force(self.ldb_admin, self.get_user_dn("test_modify_user1"))
 396         self.create_user(self.ldb_admin, self.get_user_dn("test_modify_user1"))
 397         self.dacl_add_ace(self.get_user_dn("test_modify_user1"), mod)
 398         ldif = """
 399 dn: """ + self.get_user_dn("test_modify_user1") + """
 400 changetype: modify
 401 replace: displayName
 402 displayName: test_changed"""
 403         self.ldb_user.modify_ldif(ldif)
 404         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 405                                     % self.get_user_dn("test_modify_user1") )
 406         self.assertEqual(res[0]["displayName"][0], "test_changed")
 407         # Second test object -- Group
 408         print "Testing modify on Group object"
 409         #self.delete_force(self.ldb_admin, "CN=test_modify_group1,CN=Users," + self.base_dn)
 410         self.create_group(self.ldb_admin, "CN=test_modify_group1,CN=Users," + self.base_dn)
 411         self.dacl_add_ace("CN=test_modify_group1,CN=Users," + self.base_dn, mod)
 412         ldif = """
 413 dn: CN=test_modify_group1,CN=Users,""" + self.base_dn + """
 414 changetype: modify
 415 replace: displayName
 416 displayName: test_changed"""
 417         self.ldb_user.modify_ldif(ldif)
 418         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 419                                     % str("CN=test_modify_group1,CN=Users," + self.base_dn) )
 420         self.assertEqual(res[0]["displayName"][0], "test_changed")
 421         # Third test object -- Organizational Unit
 422         print "Testing modify on OU object"
 423         #self.delete_force(self.ldb_admin, "OU=test_modify_ou1," + self.base_dn)
 424         self.create_ou(self.ldb_admin, "OU=test_modify_ou1," + self.base_dn)
 425         self.dacl_add_ace("OU=test_modify_ou1," + self.base_dn, mod)
 426         ldif = """
 427 dn: OU=test_modify_ou1,""" + self.base_dn + """
 428 changetype: modify
 429 replace: displayName
 430 displayName: test_changed"""
 431         self.ldb_user.modify_ldif(ldif)
 432         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 433                                     % str("OU=test_modify_ou1," + self.base_dn) )
 434         self.assertEqual(res[0]["displayName"][0], "test_changed")
 435
 436     def test_modify_u2(self):
 437         """6 Modify two attributes as you have DS_WRITE_PROPERTY granted only for one of them"""
 438         mod = "(OA;;WP;bf967953-0de6-11d0-a285-00aa003049e2;;%s)" % str(self.user_sid)
 439         # First test object -- User
 440         print "Testing modify on User object"
 441         #self.delete_force(self.ldb_admin, self.get_user_dn("test_modify_user1"))
 442         self.create_user(self.ldb_admin, self.get_user_dn("test_modify_user1"))
 443         self.dacl_add_ace(self.get_user_dn("test_modify_user1"), mod)
 444         # Modify on attribute you have rights for
 445         ldif = """
 446 dn: """ + self.get_user_dn("test_modify_user1") + """
 447 changetype: modify
 448 replace: displayName
 449 displayName: test_changed"""
 450         self.ldb_user.modify_ldif(ldif)
 451         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 452                                     % self.get_user_dn("test_modify_user1") )
 453         self.assertEqual(res[0]["displayName"][0], "test_changed")
 454         # Modify on attribute you do not have rights for granted
 455         ldif = """
 456 dn: """ + self.get_user_dn("test_modify_user1") + """
 457 changetype: modify
 458 replace: url
 459 url: www.samba.org"""
 460         try:
 461             self.ldb_user.modify_ldif(ldif)
 462         except LdbError, (num, _):
 463             self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
 464         else:
 465             # This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
 466             self.fail()
 467         # Second test object -- Group
 468         print "Testing modify on Group object"
 469         self.create_group(self.ldb_admin, "CN=test_modify_group1,CN=Users," + self.base_dn)
 470         self.dacl_add_ace("CN=test_modify_group1,CN=Users," + self.base_dn, mod)
 471         ldif = """
 472 dn: CN=test_modify_group1,CN=Users,""" + self.base_dn + """
 473 changetype: modify
 474 replace: displayName
 475 displayName: test_changed"""
 476         self.ldb_user.modify_ldif(ldif)
 477         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 478                                     % str("CN=test_modify_group1,CN=Users," + self.base_dn) )
 479         self.assertEqual(res[0]["displayName"][0], "test_changed")
 480         # Modify on attribute you do not have rights for granted
 481         ldif = """
 482 dn: CN=test_modify_group1,CN=Users,""" + self.base_dn + """
 483 changetype: modify
 484 replace: url
 485 url: www.samba.org"""
 486         try:
 487             self.ldb_user.modify_ldif(ldif)
 488         except LdbError, (num, _):
 489             self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
 490         else:
 491             # This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
 492             self.fail()
 493         # Second test object -- Organizational Unit
 494         print "Testing modify on OU object"
 495         self.create_ou(self.ldb_admin, "OU=test_modify_ou1," + self.base_dn)
 496         self.dacl_add_ace("OU=test_modify_ou1," + self.base_dn, mod)
 497         ldif = """
 498 dn: OU=test_modify_ou1,""" + self.base_dn + """
 499 changetype: modify
 500 replace: displayName
 501 displayName: test_changed"""
 502         self.ldb_user.modify_ldif(ldif)
 503         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 504                                     % str("OU=test_modify_ou1," + self.base_dn) )
 505         self.assertEqual(res[0]["displayName"][0], "test_changed")
 506         # Modify on attribute you do not have rights for granted
 507         ldif = """
 508 dn: OU=test_modify_ou1,""" + self.base_dn + """
 509 changetype: modify
 510 replace: url
 511 url: www.samba.org"""
 512         try:
 513             self.ldb_user.modify_ldif(ldif)
 514         except LdbError, (num, _):
 515             self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
 516         else:
 517             # This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
 518             self.fail()
 519
 520     def test_modify_u3(self):
 521         """7 Modify one attribute as you have no what so ever rights granted"""
 522         # First test object -- User
 523         print "Testing modify on User object"
 524         self.create_user(self.ldb_admin, self.get_user_dn("test_modify_user1"))
 525         # Modify on attribute you do not have rights for granted
 526         ldif = """
 527 dn: """ + self.get_user_dn("test_modify_user1") + """
 528 changetype: modify
 529 replace: url
 530 url: www.samba.org"""
 531         try:
 532             self.ldb_user.modify_ldif(ldif)
 533         except LdbError, (num, _):
 534             self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
 535         else:
 536             # This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
 537             self.fail()
 538
 539         # Second test object -- Group
 540         print "Testing modify on Group object"
 541         self.create_group(self.ldb_admin, "CN=test_modify_group1,CN=Users," + self.base_dn)
 542         # Modify on attribute you do not have rights for granted
 543         ldif = """
 544 dn: CN=test_modify_group1,CN=Users,""" + self.base_dn + """
 545 changetype: modify
 546 replace: url
 547 url: www.samba.org"""
 548         try:
 549             self.ldb_user.modify_ldif(ldif)
 550         except LdbError, (num, _):
 551             self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
 552         else:
 553             # This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
 554             self.fail()
 555
 556         # Second test object -- Organizational Unit
 557         print "Testing modify on OU object"
 558         #self.delete_force(self.ldb_admin, "OU=test_modify_ou1," + self.base_dn)
 559         self.create_ou(self.ldb_admin, "OU=test_modify_ou1," + self.base_dn)
 560         # Modify on attribute you do not have rights for granted
 561         ldif = """
 562 dn: OU=test_modify_ou1,""" + self.base_dn + """
 563 changetype: modify
 564 replace: url
 565 url: www.samba.org"""
 566         try:
 567             self.ldb_user.modify_ldif(ldif)
 568         except LdbError, (num, _):
 569             self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
 570         else:
 571             # This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
 572             self.fail()
 573
 574
 575     def test_modify_u4(self):
 576         """11 Grant WP to PRINCIPAL_SELF and test modify"""
 577         ldif = """
 578 dn: """ + self.get_user_dn(self.user_with_wp) + """
 579 changetype: modify
 580 add: adminDescription
 581 adminDescription: blah blah blah"""
 582         try:
 583             self.ldb_user.modify_ldif(ldif)
 584         except LdbError, (num, _):
 585             self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
 586         else:
 587             # This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
 588             self.fail()
 589
 590         mod = "(OA;;WP;bf967919-0de6-11d0-a285-00aa003049e2;;PS)"
 591         self.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
 592         # Modify on attribute you have rights for
 593         self.ldb_user.modify_ldif(ldif)
 594         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 595                                     % self.get_user_dn(self.user_with_wp), attrs=["adminDescription"] )
 596         self.assertEqual(res[0]["adminDescription"][0], "blah blah blah")
 597
 598
 599 #enable these when we have search implemented
 600 class AclSearchTests(AclTests):
 601
 602     def setUp(self):
 603         AclTests.setUp(self)
 604         self.regular_user = "acl_search_user1"
 605
 606         if self.SAMBA:
 607             # Create regular user
 608             self.create_enable_user(self.regular_user)
 609         if self.WIN:
 610             self.assert_user_no_group_member(self.regular_user)
 611
 612         self.ldb_user = self.get_ldb_connection(self.regular_user)
 613
 614     def tearDown(self):
 615         self.delete_force(self.ldb_admin, "CN=test_search_user1,OU=test_search_ou1," + self.base_dn)
 616         self.delete_force(self.ldb_admin, "OU=test_search_ou1," + self.base_dn)
 617         if self.SAMBA:
 618             self.delete_force(self.ldb_admin, self.get_user_dn(self.regular_user))
 619
 620     def test_search_u1(self):
 621         """See if can prohibit user to read another User object"""
 622         ou_dn = "OU=test_search_ou1," + self.base_dn
 623         user_dn = "CN=test_search_user1," + ou_dn
 624         # Create clean OU
 625         self.delete_force(self.ldb_admin, ou_dn)
 626         self.create_ou(self.ldb_admin, ou_dn)
 627         desc = self.read_desc( ou_dn )
 628         desc_sddl = desc.as_sddl( self.domain_sid )
 629         # Parse descriptor's SDDL and remove all inherited ACEs reffering
 630         # to 'Registered Users' or 'Authenticated Users'
 631         desc_aces = re.findall("\(.*?\)", desc_sddl)
 632         for ace in desc_aces:
 633             if ("I" in ace) and (("RU" in ace) or ("AU" in ace)):
 634                 desc_sddl = desc_sddl.replace(ace, "")
 635         # Add 'P' in the DACL so it breaks further inheritance
 636         desc_sddl = desc_sddl.replace("D:AI(", "D:PAI(")
 637         # Create a security descriptor object and OU with that descriptor
 638         desc = security.descriptor.from_sddl( desc_sddl, self.domain_sid )
 639         self.delete_force(self.ldb_admin, ou_dn)
 640         self.create_ou(self.ldb_admin, ou_dn, desc)
 641         # Create clean user
 642         self.delete_force(self.ldb_admin, user_dn)
 643         self.create_user(self.ldb_admin, user_dn)
 644         desc = self.read_desc( user_dn )
 645         desc_sddl = desc.as_sddl( self.domain_sid )
 646         # Parse security descriptor SDDL and remove all 'Read' ACEs
 647         # reffering to AU
 648         desc_aces = re.findall("\(.*?\)", desc_sddl)
 649         for ace in desc_aces:
 650             if ("AU" in ace) and ("R" in ace):
 651                 desc_sddl = desc_sddl.replace(ace, "")
 652         # Create user with the edited descriptor
 653         desc = security.descriptor.from_sddl( desc_sddl, self.domain_sid )
 654         self.delete_force(self.ldb_admin, user_dn)
 655         self.create_user(self.ldb_admin, user_dn, desc)
 656
 657         res = ldb_user.search( self.base_dn, expression="(distinguishedName=%s)" \
 658                                     % user_dn )
 659         self.assertEqual( res, [] )
 660
 661     def test_search_u2(self):
 662         """User's group ACEs cleared and after that granted RIGHT_DS_READ_PROPERTY to another User object"""
 663         ou_dn = "OU=test_search_ou1," + self.base_dn
 664         user_dn = "CN=test_search_user1," + ou_dn
 665         # Create clean OU
 666         self.delete_force(self.ldb_admin, ou_dn)
 667         self.create_ou(self.ldb_admin, ou_dn)
 668         desc = self.read_desc( ou_dn )
 669         desc_sddl = desc.as_sddl( self.domain_sid )
 670         # Parse descriptor's SDDL and remove all inherited ACEs reffering
 671         # to 'Registered Users' or 'Authenticated Users'
 672         desc_aces = re.findall("\(.*?\)", desc_sddl)
 673         for ace in desc_aces:
 674             if ("I" in ace) and (("RU" in ace) or ("AU" in ace)):
 675                 desc_sddl = desc_sddl.replace(ace, "")
 676         # Add 'P' in the DACL so it breaks further inheritance
 677         desc_sddl = desc_sddl.replace("D:AI(", "D:PAI(")
 678         # Create a security descriptor object and OU with that descriptor
 679         desc = security.descriptor.from_sddl( desc_sddl, self.domain_sid )
 680         self.delete_force(self.ldb_admin, ou_dn)
 681         self.create_ou(self.ldb_admin, ou_dn, desc)
 682         # Create clean user
 683         self.delete_force(self.ldb_admin, user_dn)
 684         self.create_user(self.ldb_admin, user_dn)
 685         # Parse security descriptor SDDL and remove all 'Read' ACEs
 686         # reffering to AU
 687         desc_aces = re.findall("\(.*?\)", desc_sddl)
 688         for ace in desc_aces:
 689             if ("AU" in ace) and ("R" in ace):
 690                 desc_sddl = desc_sddl.replace(ace, "")
 691         #mod = "(OA;;RP;e48d0154-bcf8-11d1-8702-00c04fb96050;;AU)"
 692         mod = "(A;;RP;;;AU)"
 693         self.dacl_add_ace(user_dn, mod)
 694         res = self.ldb_user.search( self.base_dn, expression="(distinguishedName=%s)" \
 695                                     % user_dn )
 696         self.assertNotEqual( res, [] )
 697
 698 #tests on ldap delete operations
 699 class AclDeleteTests(AclTests):
 700
 701     def setUp(self):
 702         AclTests.setUp(self)
 703         self.regular_user = "acl_delete_user1"
 704
 705         if self.SAMBA:
 706             # Create regular user
 707             self.create_enable_user(self.regular_user)
 708         if self.WIN:
 709             self.assert_user_no_group_member(self.regular_user)
 710
 711         self.ldb_user = self.get_ldb_connection(self.regular_user)
 712
 713     def tearDown(self):
 714         self.delete_force(self.ldb_admin, self.get_user_dn("test_delete_user1"))
 715         if self.SAMBA:
 716             self.delete_force(self.ldb_admin, self.get_user_dn(self.regular_user))
 717
 718     def test_delete_u1(self):
 719         """User is prohibited by default to delete another User object"""
 720         # Create user that we try to delete
 721         self.create_user(self.ldb_admin, self.get_user_dn("test_delete_user1"))
 722         # Here delete User object should ALWAYS through exception
 723         try:
 724             self.ldb_user.delete(self.get_user_dn("test_delete_user1"))
 725         except LdbError, (num, _):
 726             self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
 727         else:
 728             self.fail()
 729
 730     def test_delete_u2(self):
 731         """User's group has RIGHT_DELETE to another User object"""
 732         user_dn = self.get_user_dn("test_delete_user1")
 733         # Create user that we try to delete
 734         self.create_user(self.ldb_admin, user_dn)
 735         mod = "(A;;SD;;;AU)"
 736         self.dacl_add_ace(user_dn, mod)
 737         # Try to delete User object
 738         self.ldb_user.delete( user_dn )
 739         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 740                 % user_dn )
 741         self.assertEqual( res, [] )
 742
 743     def test_delete_u3(self):
 744         """User indentified by SID has RIGHT_DELETE to another User object"""
 745         user_dn = self.get_user_dn("test_delete_user1")
 746         # Create user that we try to delete
 747         self.create_user(self.ldb_admin, user_dn)
 748         mod = "(A;;SD;;;%s)" % str( self.get_object_sid(self.get_user_dn(self.regular_user)))
 749         self.dacl_add_ace(user_dn, mod)
 750         # Try to delete User object
 751         self.ldb_user.delete( user_dn )
 752         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 753                 % user_dn )
 754         self.assertEqual( res, [] )
 755
 756 #tests on ldap rename operations
 757 class AclRenameTests(AclTests):
 758
 759     def setUp(self):
 760         AclTests.setUp(self)
 761         self.regular_user = "acl_rename_user1"
 762
 763         if self.SAMBA:
 764             # Create regular user
 765             self.create_enable_user(self.regular_user)
 766         if self.WIN:
 767             self.assert_user_no_group_member(self.regular_user)
 768
 769         self.ldb_user = self.get_ldb_connection(self.regular_user)
 770
 771     def tearDown(self):
 772         # Rename OU3
 773         self.delete_force(self.ldb_admin, "CN=test_rename_user1,OU=test_rename_ou3,OU=test_rename_ou2," + self.base_dn)
 774         self.delete_force(self.ldb_admin, "CN=test_rename_user2,OU=test_rename_ou3,OU=test_rename_ou2," + self.base_dn)
 775         self.delete_force(self.ldb_admin, "CN=test_rename_user5,OU=test_rename_ou3,OU=test_rename_ou2," + self.base_dn)
 776         self.delete_force(self.ldb_admin, "OU=test_rename_ou3,OU=test_rename_ou2," + self.base_dn)
 777         # Rename OU2
 778         self.delete_force(self.ldb_admin, "CN=test_rename_user1,OU=test_rename_ou2," + self.base_dn)
 779         self.delete_force(self.ldb_admin, "CN=test_rename_user2,OU=test_rename_ou2," + self.base_dn)
 780         self.delete_force(self.ldb_admin, "CN=test_rename_user5,OU=test_rename_ou2," + self.base_dn)
 781         self.delete_force(self.ldb_admin, "OU=test_rename_ou2," + self.base_dn)
 782         # Rename OU1
 783         self.delete_force(self.ldb_admin, "CN=test_rename_user1,OU=test_rename_ou1," + self.base_dn)
 784         self.delete_force(self.ldb_admin, "CN=test_rename_user2,OU=test_rename_ou1," + self.base_dn)
 785         self.delete_force(self.ldb_admin, "CN=test_rename_user5,OU=test_rename_ou1," + self.base_dn)
 786         self.delete_force(self.ldb_admin, "OU=test_rename_ou3,OU=test_rename_ou1," + self.base_dn)
 787         self.delete_force(self.ldb_admin, "OU=test_rename_ou1," + self.base_dn)
 788         if self.SAMBA:
 789             self.delete_force(self.ldb_admin, self.get_user_dn(self.regular_user))
 790
 791     def test_rename_u1(self):
 792         """Regular user fails to rename 'User object' within single OU"""
 793         # Create OU structure
 794         self.create_ou(self.ldb_admin, "OU=test_rename_ou1," + self.base_dn)
 795         self.create_user(self.ldb_admin, "CN=test_rename_user1,OU=test_rename_ou1," + self.base_dn)
 796         try:
 797             self.ldb_user.rename("CN=test_rename_user1,OU=test_rename_ou1," + self.base_dn, \
 798                     "CN=test_rename_user5,OU=test_rename_ou1," + self.base_dn)
 799         except LdbError, (num, _):
 800             self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
 801         else:
 802             self.fail()
 803
 804     def test_rename_u2(self):
 805         """Grant WRITE_PROPERTY to AU so regular user can rename 'User object' within single OU"""
 806         ou_dn = "OU=test_rename_ou1," + self.base_dn
 807         user_dn = "CN=test_rename_user1," + ou_dn
 808         rename_user_dn = "CN=test_rename_user5," + ou_dn
 809         # Create OU structure
 810         self.create_ou(self.ldb_admin, ou_dn)
 811         self.create_user(self.ldb_admin, user_dn)
 812         mod = "(A;;WP;;;AU)"
 813         self.dacl_add_ace(user_dn, mod)
 814         # Rename 'User object' having WP to AU
 815         self.ldb_user.rename(user_dn, rename_user_dn)
 816         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 817                 % user_dn )
 818         self.assertEqual( res, [] )
 819         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 820                 % rename_user_dn )
 821         self.assertNotEqual( res, [] )
 822
 823     def test_rename_u3(self):
 824         """Test rename with rights granted to 'User object' SID"""
 825         ou_dn = "OU=test_rename_ou1," + self.base_dn
 826         user_dn = "CN=test_rename_user1," + ou_dn
 827         rename_user_dn = "CN=test_rename_user5," + ou_dn
 828         # Create OU structure
 829         self.create_ou(self.ldb_admin, ou_dn)
 830         self.create_user(self.ldb_admin, user_dn)
 831         sid = self.get_object_sid(self.get_user_dn(self.regular_user))
 832         mod = "(A;;WP;;;%s)" % str(sid)
 833         self.dacl_add_ace(user_dn, mod)
 834         # Rename 'User object' having WP to AU
 835         self.ldb_user.rename(user_dn, rename_user_dn)
 836         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 837                 % user_dn )
 838         self.assertEqual( res, [] )
 839         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 840                 % rename_user_dn )
 841         self.assertNotEqual( res, [] )
 842
 843     def test_rename_u4(self):
 844         """Rename 'User object' cross OU with WP, SD and CC right granted on reg. user to AU"""
 845         ou1_dn = "OU=test_rename_ou1," + self.base_dn
 846         ou2_dn = "OU=test_rename_ou2," + self.base_dn
 847         user_dn = "CN=test_rename_user2," + ou1_dn
 848         rename_user_dn = "CN=test_rename_user5," + ou2_dn
 849         # Create OU structure
 850         self.create_ou(self.ldb_admin, ou1_dn)
 851         self.create_ou(self.ldb_admin, ou2_dn)
 852         self.create_user(self.ldb_admin, user_dn)
 853         mod = "(A;;WPSD;;;AU)"
 854         self.dacl_add_ace(user_dn, mod)
 855         mod = "(A;;CC;;;AU)"
 856         self.dacl_add_ace(ou2_dn, mod)
 857         # Rename 'User object' having SD and CC to AU
 858         self.ldb_user.rename(user_dn, rename_user_dn)
 859         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 860                 % user_dn )
 861         self.assertEqual( res, [] )
 862         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 863                 % rename_user_dn )
 864         self.assertNotEqual( res, [] )
 865
 866     def test_rename_u5(self):
 867         """Test rename with rights granted to 'User object' SID"""
 868         ou1_dn = "OU=test_rename_ou1," + self.base_dn
 869         ou2_dn = "OU=test_rename_ou2," + self.base_dn
 870         user_dn = "CN=test_rename_user2," + ou1_dn
 871         rename_user_dn = "CN=test_rename_user5," + ou2_dn
 872         # Create OU structure
 873         self.create_ou(self.ldb_admin, ou1_dn)
 874         self.create_ou(self.ldb_admin, ou2_dn)
 875         self.create_user(self.ldb_admin, user_dn)
 876         sid = self.get_object_sid(self.get_user_dn(self.regular_user))
 877         mod = "(A;;WPSD;;;%s)" % str(sid)
 878         self.dacl_add_ace(user_dn, mod)
 879         mod = "(A;;CC;;;%s)" % str(sid)
 880         self.dacl_add_ace(ou2_dn, mod)
 881         # Rename 'User object' having SD and CC to AU
 882         self.ldb_user.rename(user_dn, rename_user_dn)
 883         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 884                 % user_dn )
 885         self.assertEqual( res, [] )
 886         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 887                 % rename_user_dn )
 888         self.assertNotEqual( res, [] )
 889
 890     def test_rename_u6(self):
 891         """Rename 'User object' cross OU with WP, DC and CC right granted on OU & user to AU"""
 892         ou1_dn = "OU=test_rename_ou1," + self.base_dn
 893         ou2_dn = "OU=test_rename_ou2," + self.base_dn
 894         user_dn = "CN=test_rename_user2," + ou1_dn
 895         rename_user_dn = "CN=test_rename_user2," + ou2_dn
 896         # Create OU structure
 897         self.create_ou(self.ldb_admin, ou1_dn)
 898         self.create_ou(self.ldb_admin, ou2_dn)
 899         #mod = "(A;CI;DCWP;;;AU)"
 900         mod = "(A;;DC;;;AU)"
 901         self.dacl_add_ace(ou1_dn, mod)
 902         mod = "(A;;CC;;;AU)"
 903         self.dacl_add_ace(ou2_dn, mod)
 904         self.create_user(self.ldb_admin, user_dn)
 905         mod = "(A;;WP;;;AU)"
 906         self.dacl_add_ace(user_dn, mod)
 907         # Rename 'User object' having SD and CC to AU
 908         self.ldb_user.rename(user_dn, rename_user_dn)
 909         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 910                 % user_dn )
 911         self.assertEqual( res, [] )
 912         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 913                 % rename_user_dn )
 914         self.assertNotEqual( res, [] )
 915
 916     def test_rename_u7(self):
 917         """Rename 'User object' cross OU (second level) with WP, DC and CC right granted on OU to AU"""
 918         ou1_dn = "OU=test_rename_ou1," + self.base_dn
 919         ou2_dn = "OU=test_rename_ou2," + self.base_dn
 920         ou3_dn = "OU=test_rename_ou3," + ou2_dn
 921         user_dn = "CN=test_rename_user2," + ou1_dn
 922         rename_user_dn = "CN=test_rename_user5," + ou3_dn
 923         # Create OU structure
 924         self.create_ou(self.ldb_admin, ou1_dn)
 925         self.create_ou(self.ldb_admin, ou2_dn)
 926         self.create_ou(self.ldb_admin, ou3_dn)
 927         mod = "(A;CI;WPDC;;;AU)"
 928         self.dacl_add_ace(ou1_dn, mod)
 929         mod = "(A;;CC;;;AU)"
 930         self.dacl_add_ace(ou3_dn, mod)
 931         self.create_user(self.ldb_admin, user_dn)
 932         # Rename 'User object' having SD and CC to AU
 933         self.ldb_user.rename(user_dn, rename_user_dn)
 934         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 935                 % user_dn )
 936         self.assertEqual( res, [] )
 937         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 938                 % rename_user_dn )
 939         self.assertNotEqual( res, [] )
 940
 941     def test_rename_u8(self):
 942         """Test rename on an object with and without modify access on the RDN attribute"""
 943         ou1_dn = "OU=test_rename_ou1," + self.base_dn
 944         ou2_dn = "OU=test_rename_ou2," + ou1_dn
 945         ou3_dn = "OU=test_rename_ou3," + ou1_dn
 946         # Create OU structure
 947         self.create_ou(self.ldb_admin, ou1_dn)
 948         self.create_ou(self.ldb_admin, ou2_dn)
 949         sid = self.get_object_sid(self.get_user_dn(self.regular_user))
 950         mod = "(OA;;WP;bf967a0e-0de6-11d0-a285-00aa003049e2;;%s)" % str(sid)
 951         self.dacl_add_ace(ou2_dn, mod)
 952         mod = "(OD;;WP;bf9679f0-0de6-11d0-a285-00aa003049e2;;%s)" % str(sid)
 953         self.dacl_add_ace(ou2_dn, mod)
 954         try:
 955             self.ldb_user.rename(ou2_dn, ou3_dn)
 956         except LdbError, (num, _):
 957             self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
 958         else:
 959             # This rename operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
 960             self.fail()
 961         sid = self.get_object_sid(self.get_user_dn(self.regular_user))
 962         mod = "(A;;WP;bf9679f0-0de6-11d0-a285-00aa003049e2;;%s)" % str(sid)
 963         self.dacl_add_ace(ou2_dn, mod)
 964         self.ldb_user.rename(ou2_dn, ou3_dn)
 965         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 966                 % ou2_dn )
 967         self.assertEqual( res, [] )
 968         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 969                 % ou3_dn )
 970         self.assertNotEqual( res, [] )
 971
 972 # Important unit running information
 973
 974 if not "://" in host:
 975     host = "ldap://%s" % host
 976 ldb = Ldb(host, credentials=creds, session_info=system_session(), lp=lp)
 977
 978 runner = SubunitTestRunner()
 979 rc = 0
 980 if not runner.run(unittest.makeSuite(AclAddTests)).wasSuccessful():
 981     rc = 1
 982 if not runner.run(unittest.makeSuite(AclModifyTests)).wasSuccessful():
 983     rc = 1
 984 if not runner.run(unittest.makeSuite(AclDeleteTests)).wasSuccessful():
 985     rc = 1
 986 if not runner.run(unittest.makeSuite(AclRenameTests)).wasSuccessful():
 987     rc = 1
 988 sys.exit(rc)