2 # -*- coding: utf-8 -*-
3 # This is unit with tests for LDAP access checks
10 sys.path.append("bin/python")
12 samba.ensure_external_module("subunit", "subunit/python")
13 samba.ensure_external_module("testtools", "testtools")
15 import samba.getopt as options
18 SCOPE_BASE, LdbError, ERR_NO_SUCH_OBJECT,
19 ERR_UNWILLING_TO_PERFORM, ERR_INSUFFICIENT_ACCESS_RIGHTS)
20 from ldb import ERR_CONSTRAINT_VIOLATION
21 from ldb import Message, MessageElement, Dn
22 from ldb import FLAG_MOD_REPLACE, FLAG_MOD_DELETE
23 from samba.ndr import ndr_pack, ndr_unpack
24 from samba.dcerpc import security
26 from samba.auth import system_session
27 from samba import gensec
28 from samba.samdb import SamDB
29 from samba.credentials import Credentials
31 from subunit.run import SubunitTestRunner
34 parser = optparse.OptionParser("ldap [options] <host>")
35 sambaopts = options.SambaOptions(parser)
36 parser.add_option_group(sambaopts)
37 parser.add_option_group(options.VersionOptions(parser))
39 # use command line creds if available
40 credopts = options.CredentialsOptions(parser)
41 parser.add_option_group(credopts)
42 opts, args = parser.parse_args()
50 lp = sambaopts.get_loadparm()
51 creds = credopts.get_credentials(lp)
52 creds.set_gensec_features(creds.get_gensec_features() | gensec.FEATURE_SEAL)
58 class AclTests(samba.tests.TestCase):
60 def delete_force(self, ldb, dn):
63 except LdbError, (num, _):
64 self.assertEquals(num, ERR_NO_SUCH_OBJECT)
66 def find_basedn(self, ldb):
67 res = ldb.search(base="", expression="", scope=SCOPE_BASE,
68 attrs=["defaultNamingContext"])
69 self.assertEquals(len(res), 1)
70 return res[0]["defaultNamingContext"][0]
72 def find_domain_sid(self, ldb):
73 res = ldb.search(base=self.base_dn, expression="(objectClass=*)", scope=SCOPE_BASE)
74 return ndr_unpack(security.dom_sid,res[0]["objectSid"][0])
77 super(AclTests, self).setUp()
79 self.base_dn = self.find_basedn(self.ldb_admin)
80 self.domain_sid = self.find_domain_sid(self.ldb_admin)
81 self.user_pass = "samba123@"
82 print "baseDN: %s" % self.base_dn
84 def get_user_dn(self, name):
85 return "CN=%s,CN=Users,%s" % (name, self.base_dn)
87 def modify_desc(self, object_dn, desc):
88 """ Modify security descriptor using either SDDL string
89 or security.descriptor object
91 assert(isinstance(desc, str) or isinstance(desc, security.descriptor))
93 dn: """ + object_dn + """
95 replace: nTSecurityDescriptor
97 if isinstance(desc, str):
98 mod += "nTSecurityDescriptor: %s" % desc
99 elif isinstance(desc, security.descriptor):
100 mod += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
101 self.ldb_admin.modify_ldif(mod)
103 def add_group_member(self, _ldb, group_dn, member_dn):
104 """ Modify user to ge member of a group
105 e.g. User to be 'Doamin Admin' group member
108 dn: """ + group_dn + """
111 member: """ + member_dn
112 _ldb.modify_ldif(ldif)
114 def create_ou(self, _ldb, ou_dn, desc=None):
116 dn: """ + ou_dn + """
117 ou: """ + ou_dn.split(",")[0][3:] + """
118 objectClass: organizationalUnit
122 assert(isinstance(desc, str) or isinstance(desc, security.descriptor))
123 if isinstance(desc, str):
124 ldif += "nTSecurityDescriptor: %s" % desc
125 elif isinstance(desc, security.descriptor):
126 ldif += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
129 def create_active_user(self, _ldb, user_dn):
131 dn: """ + user_dn + """
132 sAMAccountName: """ + user_dn.split(",")[0][3:] + """
134 unicodePwd:: """ + base64.b64encode("\"samba123@\"".encode('utf-16-le')) + """
139 def create_test_user(self, _ldb, user_dn, desc=None):
141 dn: """ + user_dn + """
142 sAMAccountName: """ + user_dn.split(",")[0][3:] + """
144 userPassword: """ + self.user_pass + """
148 assert(isinstance(desc, str) or isinstance(desc, security.descriptor))
149 if isinstance(desc, str):
150 ldif += "nTSecurityDescriptor: %s" % desc
151 elif isinstance(desc, security.descriptor):
152 ldif += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
155 def create_group(self, _ldb, group_dn, desc=None):
157 dn: """ + group_dn + """
159 sAMAccountName: """ + group_dn.split(",")[0][3:] + """
164 assert(isinstance(desc, str) or isinstance(desc, security.descriptor))
165 if isinstance(desc, str):
166 ldif += "nTSecurityDescriptor: %s" % desc
167 elif isinstance(desc, security.descriptor):
168 ldif += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
171 def read_desc(self, object_dn):
172 res = self.ldb_admin.search(object_dn, SCOPE_BASE, None, ["nTSecurityDescriptor"])
173 desc = res[0]["nTSecurityDescriptor"][0]
174 return ndr_unpack(security.descriptor, desc)
176 def get_ldb_connection(self, target_username, target_password):
177 creds_tmp = Credentials()
178 creds_tmp.set_username(target_username)
179 creds_tmp.set_password(target_password)
180 creds_tmp.set_domain(creds.get_domain())
181 creds_tmp.set_realm(creds.get_realm())
182 creds_tmp.set_workstation(creds.get_workstation())
183 creds_tmp.set_gensec_features(creds_tmp.get_gensec_features()
184 | gensec.FEATURE_SEAL)
185 ldb_target = SamDB(url=host, credentials=creds_tmp, lp=lp)
188 def get_object_sid(self, object_dn):
189 res = self.ldb_admin.search(object_dn)
190 return ndr_unpack(security.dom_sid, res[0]["objectSid"][0])
192 def dacl_add_ace(self, object_dn, ace):
193 desc = self.read_desc(object_dn)
194 desc_sddl = desc.as_sddl(self.domain_sid)
197 if desc_sddl.find("(") >= 0:
198 desc_sddl = desc_sddl[:desc_sddl.index("(")] + ace + desc_sddl[desc_sddl.index("("):]
200 desc_sddl = desc_sddl + ace
201 self.modify_desc(object_dn, desc_sddl)
203 def get_desc_sddl(self, object_dn):
204 """ Return object nTSecutiryDescriptor in SDDL format
206 desc = self.read_desc(object_dn)
207 return desc.as_sddl(self.domain_sid)
209 # Test if we have any additional groups for users than default ones
210 def assert_user_no_group_member(self, username):
211 res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s)" % self.get_user_dn(username))
213 self.assertEqual(res[0]["memberOf"][0], "")
219 def create_enable_user(self, username):
220 self.create_active_user(self.ldb_admin, self.get_user_dn(username))
221 self.ldb_admin.enable_account("(sAMAccountName=" + username + ")")
223 #tests on ldap add operations
224 class AclAddTests(AclTests):
227 super(AclAddTests, self).setUp()
228 # Domain admin that will be creator of OU parent-child structure
229 self.usr_admin_owner = "acl_add_user1"
230 # Second domain admin that will not be creator of OU parent-child structure
231 self.usr_admin_not_owner = "acl_add_user2"
233 self.regular_user = "acl_add_user3"
234 self.create_enable_user(self.usr_admin_owner)
235 self.create_enable_user(self.usr_admin_not_owner)
236 self.create_enable_user(self.regular_user)
238 # add admins to the Domain Admins group
239 self.add_group_member(self.ldb_admin, "CN=Domain Admins,CN=Users," + self.base_dn, \
240 self.get_user_dn(self.usr_admin_owner))
241 self.add_group_member(self.ldb_admin, "CN=Domain Admins,CN=Users," + self.base_dn, \
242 self.get_user_dn(self.usr_admin_not_owner))
244 self.ldb_owner = self.get_ldb_connection(self.usr_admin_owner, self.user_pass)
245 self.ldb_notowner = self.get_ldb_connection(self.usr_admin_not_owner, self.user_pass)
246 self.ldb_user = self.get_ldb_connection(self.regular_user, self.user_pass)
249 super(AclAddTests, self).tearDown()
250 self.delete_force(self.ldb_admin, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
251 self.delete_force(self.ldb_admin, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
252 self.delete_force(self.ldb_admin, "OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
253 self.delete_force(self.ldb_admin, "OU=test_add_ou1," + self.base_dn)
254 self.delete_force(self.ldb_admin, self.get_user_dn(self.usr_admin_owner))
255 self.delete_force(self.ldb_admin, self.get_user_dn(self.usr_admin_not_owner))
256 self.delete_force(self.ldb_admin, self.get_user_dn(self.regular_user))
258 # Make sure top OU is deleted (and so everything under it)
259 def assert_top_ou_deleted(self):
260 res = self.ldb_admin.search(self.base_dn,
261 expression="(distinguishedName=%s,%s)" % (
262 "OU=test_add_ou1", self.base_dn))
263 self.assertEqual(res, [])
265 def test_add_u1(self):
266 """Testing OU with the rights of Doman Admin not creator of the OU """
267 self.assert_top_ou_deleted()
268 # Change descriptor for top level OU
269 self.create_ou(self.ldb_owner, "OU=test_add_ou1," + self.base_dn)
270 self.create_ou(self.ldb_owner, "OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
271 user_sid = self.get_object_sid(self.get_user_dn(self.usr_admin_not_owner))
272 mod = "(D;CI;WPCC;;;%s)" % str(user_sid)
273 self.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
274 # Test user and group creation with another domain admin's credentials
275 self.create_test_user(self.ldb_notowner, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
276 self.create_group(self.ldb_notowner, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
277 # Make sure we HAVE created the two objects -- user and group
278 # !!! We should not be able to do that, but however beacuse of ACE ordering our inherited Deny ACE
279 # !!! comes after explicit (A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA) that comes from somewhere
280 res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s,%s)" % ("CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn))
281 self.assertTrue(len(res) > 0)
282 res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s,%s)" % ("CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn))
283 self.assertTrue(len(res) > 0)
285 def test_add_u2(self):
286 """Testing OU with the regular user that has no rights granted over the OU """
287 self.assert_top_ou_deleted()
288 # Create a parent-child OU structure with domain admin credentials
289 self.create_ou(self.ldb_owner, "OU=test_add_ou1," + self.base_dn)
290 self.create_ou(self.ldb_owner, "OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
291 # Test user and group creation with regular user credentials
293 self.create_test_user(self.ldb_user, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
294 self.create_group(self.ldb_user, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
295 except LdbError, (num, _):
296 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
299 # Make sure we HAVEN'T created any of two objects -- user or group
300 res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s,%s)" % ("CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn))
301 self.assertEqual(res, [])
302 res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s,%s)" % ("CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn))
303 self.assertEqual(res, [])
305 def test_add_u3(self):
306 """Testing OU with the rights of regular user granted the right 'Create User child objects' """
307 self.assert_top_ou_deleted()
308 # Change descriptor for top level OU
309 self.create_ou(self.ldb_owner, "OU=test_add_ou1," + self.base_dn)
310 user_sid = self.get_object_sid(self.get_user_dn(self.regular_user))
311 mod = "(OA;CI;CC;bf967aba-0de6-11d0-a285-00aa003049e2;;%s)" % str(user_sid)
312 self.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
313 self.create_ou(self.ldb_owner, "OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
314 # Test user and group creation with granted user only to one of the objects
315 self.create_test_user(self.ldb_user, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
317 self.create_group(self.ldb_user, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
318 except LdbError, (num, _):
319 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
322 # Make sure we HAVE created the one of two objects -- user
323 res = self.ldb_admin.search(self.base_dn,
324 expression="(distinguishedName=%s,%s)" %
325 ("CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1",
327 self.assertNotEqual(len(res), 0)
328 res = self.ldb_admin.search(self.base_dn,
329 expression="(distinguishedName=%s,%s)" %
330 ("CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1",
332 self.assertEqual(res, [])
334 def test_add_u4(self):
335 """ 4 Testing OU with the rights of Doman Admin creator of the OU"""
336 self.assert_top_ou_deleted()
337 self.create_ou(self.ldb_owner, "OU=test_add_ou1," + self.base_dn)
338 self.create_ou(self.ldb_owner, "OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
339 self.create_test_user(self.ldb_owner, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
340 self.create_group(self.ldb_owner, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
341 # Make sure we have successfully created the two objects -- user and group
342 res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s,%s)" % ("CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn))
343 self.assertTrue(len(res) > 0)
344 res = self.ldb_admin.search(self.base_dn,
345 expression="(distinguishedName=%s,%s)" % ("CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn))
346 self.assertTrue(len(res) > 0)
348 #tests on ldap modify operations
349 class AclModifyTests(AclTests):
352 super(AclModifyTests, self).setUp()
353 self.user_with_wp = "acl_mod_user1"
354 self.user_with_sm = "acl_mod_user2"
355 self.user_with_group_sm = "acl_mod_user3"
356 self.create_enable_user(self.user_with_wp)
357 self.create_enable_user(self.user_with_sm)
358 self.create_enable_user(self.user_with_group_sm)
359 self.ldb_user = self.get_ldb_connection(self.user_with_wp, self.user_pass)
360 self.ldb_user2 = self.get_ldb_connection(self.user_with_sm, self.user_pass)
361 self.ldb_user3 = self.get_ldb_connection(self.user_with_group_sm, self.user_pass)
362 self.user_sid = self.get_object_sid( self.get_user_dn(self.user_with_wp))
363 self.create_group(self.ldb_admin, "CN=test_modify_group2,CN=Users," + self.base_dn)
364 self.create_group(self.ldb_admin, "CN=test_modify_group3,CN=Users," + self.base_dn)
365 self.create_test_user(self.ldb_admin, self.get_user_dn("test_modify_user2"))
368 super(AclModifyTests, self).tearDown()
369 self.delete_force(self.ldb_admin, self.get_user_dn("test_modify_user1"))
370 self.delete_force(self.ldb_admin, "CN=test_modify_group1,CN=Users," + self.base_dn)
371 self.delete_force(self.ldb_admin, "CN=test_modify_group2,CN=Users," + self.base_dn)
372 self.delete_force(self.ldb_admin, "CN=test_modify_group3,CN=Users," + self.base_dn)
373 self.delete_force(self.ldb_admin, "OU=test_modify_ou1," + self.base_dn)
374 self.delete_force(self.ldb_admin, self.get_user_dn(self.user_with_wp))
375 self.delete_force(self.ldb_admin, self.get_user_dn(self.user_with_sm))
376 self.delete_force(self.ldb_admin, self.get_user_dn(self.user_with_group_sm))
377 self.delete_force(self.ldb_admin, self.get_user_dn("test_modify_user2"))
379 def test_modify_u1(self):
380 """5 Modify one attribute if you have DS_WRITE_PROPERTY for it"""
381 mod = "(OA;;WP;bf967953-0de6-11d0-a285-00aa003049e2;;%s)" % str(self.user_sid)
382 # First test object -- User
383 print "Testing modify on User object"
384 self.create_test_user(self.ldb_admin, self.get_user_dn("test_modify_user1"))
385 self.dacl_add_ace(self.get_user_dn("test_modify_user1"), mod)
387 dn: """ + self.get_user_dn("test_modify_user1") + """
390 displayName: test_changed"""
391 self.ldb_user.modify_ldif(ldif)
392 res = self.ldb_admin.search(self.base_dn,
393 expression="(distinguishedName=%s)" % self.get_user_dn("test_modify_user1"))
394 self.assertEqual(res[0]["displayName"][0], "test_changed")
395 # Second test object -- Group
396 print "Testing modify on Group object"
397 self.create_group(self.ldb_admin, "CN=test_modify_group1,CN=Users," + self.base_dn)
398 self.dacl_add_ace("CN=test_modify_group1,CN=Users," + self.base_dn, mod)
400 dn: CN=test_modify_group1,CN=Users,""" + self.base_dn + """
403 displayName: test_changed"""
404 self.ldb_user.modify_ldif(ldif)
405 res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s)" % str("CN=test_modify_group1,CN=Users," + self.base_dn))
406 self.assertEqual(res[0]["displayName"][0], "test_changed")
407 # Third test object -- Organizational Unit
408 print "Testing modify on OU object"
409 #self.delete_force(self.ldb_admin, "OU=test_modify_ou1," + self.base_dn)
410 self.create_ou(self.ldb_admin, "OU=test_modify_ou1," + self.base_dn)
411 self.dacl_add_ace("OU=test_modify_ou1," + self.base_dn, mod)
413 dn: OU=test_modify_ou1,""" + self.base_dn + """
416 displayName: test_changed"""
417 self.ldb_user.modify_ldif(ldif)
418 res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s)" % str("OU=test_modify_ou1," + self.base_dn))
419 self.assertEqual(res[0]["displayName"][0], "test_changed")
421 def test_modify_u2(self):
422 """6 Modify two attributes as you have DS_WRITE_PROPERTY granted only for one of them"""
423 mod = "(OA;;WP;bf967953-0de6-11d0-a285-00aa003049e2;;%s)" % str(self.user_sid)
424 # First test object -- User
425 print "Testing modify on User object"
426 #self.delete_force(self.ldb_admin, self.get_user_dn("test_modify_user1"))
427 self.create_test_user(self.ldb_admin, self.get_user_dn("test_modify_user1"))
428 self.dacl_add_ace(self.get_user_dn("test_modify_user1"), mod)
429 # Modify on attribute you have rights for
431 dn: """ + self.get_user_dn("test_modify_user1") + """
434 displayName: test_changed"""
435 self.ldb_user.modify_ldif(ldif)
436 res = self.ldb_admin.search(self.base_dn,
437 expression="(distinguishedName=%s)" %
438 self.get_user_dn("test_modify_user1"))
439 self.assertEqual(res[0]["displayName"][0], "test_changed")
440 # Modify on attribute you do not have rights for granted
442 dn: """ + self.get_user_dn("test_modify_user1") + """
445 url: www.samba.org"""
447 self.ldb_user.modify_ldif(ldif)
448 except LdbError, (num, _):
449 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
451 # This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
453 # Second test object -- Group
454 print "Testing modify on Group object"
455 self.create_group(self.ldb_admin, "CN=test_modify_group1,CN=Users," + self.base_dn)
456 self.dacl_add_ace("CN=test_modify_group1,CN=Users," + self.base_dn, mod)
458 dn: CN=test_modify_group1,CN=Users,""" + self.base_dn + """
461 displayName: test_changed"""
462 self.ldb_user.modify_ldif(ldif)
463 res = self.ldb_admin.search(self.base_dn,
464 expression="(distinguishedName=%s)" %
465 str("CN=test_modify_group1,CN=Users," + self.base_dn))
466 self.assertEqual(res[0]["displayName"][0], "test_changed")
467 # Modify on attribute you do not have rights for granted
469 dn: CN=test_modify_group1,CN=Users,""" + self.base_dn + """
472 url: www.samba.org"""
474 self.ldb_user.modify_ldif(ldif)
475 except LdbError, (num, _):
476 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
478 # This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
480 # Second test object -- Organizational Unit
481 print "Testing modify on OU object"
482 self.create_ou(self.ldb_admin, "OU=test_modify_ou1," + self.base_dn)
483 self.dacl_add_ace("OU=test_modify_ou1," + self.base_dn, mod)
485 dn: OU=test_modify_ou1,""" + self.base_dn + """
488 displayName: test_changed"""
489 self.ldb_user.modify_ldif(ldif)
490 res = self.ldb_admin.search(self.base_dn,
491 expression="(distinguishedName=%s)" % str("OU=test_modify_ou1,"
493 self.assertEqual(res[0]["displayName"][0], "test_changed")
494 # Modify on attribute you do not have rights for granted
496 dn: OU=test_modify_ou1,""" + self.base_dn + """
499 url: www.samba.org"""
501 self.ldb_user.modify_ldif(ldif)
502 except LdbError, (num, _):
503 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
505 # This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
508 def test_modify_u3(self):
509 """7 Modify one attribute as you have no what so ever rights granted"""
510 # First test object -- User
511 print "Testing modify on User object"
512 self.create_test_user(self.ldb_admin, self.get_user_dn("test_modify_user1"))
513 # Modify on attribute you do not have rights for granted
515 dn: """ + self.get_user_dn("test_modify_user1") + """
518 url: www.samba.org"""
520 self.ldb_user.modify_ldif(ldif)
521 except LdbError, (num, _):
522 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
524 # This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
527 # Second test object -- Group
528 print "Testing modify on Group object"
529 self.create_group(self.ldb_admin, "CN=test_modify_group1,CN=Users," + self.base_dn)
530 # Modify on attribute you do not have rights for granted
532 dn: CN=test_modify_group1,CN=Users,""" + self.base_dn + """
535 url: www.samba.org"""
537 self.ldb_user.modify_ldif(ldif)
538 except LdbError, (num, _):
539 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
541 # This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
544 # Second test object -- Organizational Unit
545 print "Testing modify on OU object"
546 #self.delete_force(self.ldb_admin, "OU=test_modify_ou1," + self.base_dn)
547 self.create_ou(self.ldb_admin, "OU=test_modify_ou1," + self.base_dn)
548 # Modify on attribute you do not have rights for granted
550 dn: OU=test_modify_ou1,""" + self.base_dn + """
553 url: www.samba.org"""
555 self.ldb_user.modify_ldif(ldif)
556 except LdbError, (num, _):
557 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
559 # This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
563 def test_modify_u4(self):
564 """11 Grant WP to PRINCIPAL_SELF and test modify"""
566 dn: """ + self.get_user_dn(self.user_with_wp) + """
568 add: adminDescription
569 adminDescription: blah blah blah"""
571 self.ldb_user.modify_ldif(ldif)
572 except LdbError, (num, _):
573 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
575 # This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
578 mod = "(OA;;WP;bf967919-0de6-11d0-a285-00aa003049e2;;PS)"
579 self.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
580 # Modify on attribute you have rights for
581 self.ldb_user.modify_ldif(ldif)
582 res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s)" \
583 % self.get_user_dn(self.user_with_wp), attrs=["adminDescription"] )
584 self.assertEqual(res[0]["adminDescription"][0], "blah blah blah")
586 def test_modify_u5(self):
587 """12 test self membership"""
589 dn: CN=test_modify_group2,CN=Users,""" + self.base_dn + """
592 Member: """ + self.get_user_dn(self.user_with_sm)
593 #the user has no rights granted, this should fail
595 self.ldb_user2.modify_ldif(ldif)
596 except LdbError, (num, _):
597 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
599 # This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
602 #grant self-membership, should be able to add himself
603 user_sid = self.get_object_sid(self.get_user_dn(self.user_with_sm))
604 mod = "(OA;;SW;bf9679c0-0de6-11d0-a285-00aa003049e2;;%s)" % str(user_sid)
605 self.dacl_add_ace("CN=test_modify_group2,CN=Users," + self.base_dn, mod)
606 self.ldb_user2.modify_ldif(ldif)
607 res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
608 % ("CN=test_modify_group2,CN=Users," + self.base_dn), attrs=["Member"])
609 self.assertEqual(res[0]["Member"][0], self.get_user_dn(self.user_with_sm))
612 dn: CN=test_modify_group2,CN=Users,""" + self.base_dn + """
615 Member: CN=test_modify_user2,CN=Users,""" + self.base_dn
617 self.ldb_user2.modify_ldif(ldif)
618 except LdbError, (num, _):
619 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
623 def test_modify_u6(self):
624 """13 test self membership"""
626 dn: CN=test_modify_group2,CN=Users,""" + self.base_dn + """
629 Member: """ + self.get_user_dn(self.user_with_sm) + """
630 Member: CN=test_modify_user2,CN=Users,""" + self.base_dn
632 #grant self-membership, should be able to add himself but not others at the same time
633 user_sid = self.get_object_sid(self.get_user_dn(self.user_with_sm))
634 mod = "(OA;;SW;bf9679c0-0de6-11d0-a285-00aa003049e2;;%s)" % str(user_sid)
635 self.dacl_add_ace("CN=test_modify_group2,CN=Users," + self.base_dn, mod)
637 self.ldb_user2.modify_ldif(ldif)
638 except LdbError, (num, _):
639 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
643 def test_modify_u7(self):
644 """13 User with WP modifying Member"""
645 #a second user is given write property permission
646 user_sid = self.get_object_sid(self.get_user_dn(self.user_with_wp))
647 mod = "(A;;WP;;;%s)" % str(user_sid)
648 self.dacl_add_ace("CN=test_modify_group2,CN=Users," + self.base_dn, mod)
650 dn: CN=test_modify_group2,CN=Users,""" + self.base_dn + """
653 Member: """ + self.get_user_dn(self.user_with_wp)
654 self.ldb_user.modify_ldif(ldif)
655 res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
656 % ("CN=test_modify_group2,CN=Users," + self.base_dn), attrs=["Member"])
657 self.assertEqual(res[0]["Member"][0], self.get_user_dn(self.user_with_wp))
659 dn: CN=test_modify_group2,CN=Users,""" + self.base_dn + """
662 self.ldb_user.modify_ldif(ldif)
664 dn: CN=test_modify_group2,CN=Users,""" + self.base_dn + """
667 Member: CN=test_modify_user2,CN=Users,""" + self.base_dn
668 self.ldb_user.modify_ldif(ldif)
669 res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
670 % ("CN=test_modify_group2,CN=Users," + self.base_dn), attrs=["Member"])
671 self.assertEqual(res[0]["Member"][0], "CN=test_modify_user2,CN=Users," + self.base_dn)
673 #enable these when we have search implemented
674 class AclSearchTests(AclTests):
677 super(AclTests, self).setUp()
678 self.regular_user = "acl_search_user1"
679 self.create_enable_user(self.regular_user)
680 self.ldb_user = self.get_ldb_connection(self.regular_user, self.user_pass)
683 super(AclSearchTests, self).tearDown()
684 self.delete_force(self.ldb_admin, "CN=test_search_user1,OU=test_search_ou1," + self.base_dn)
685 self.delete_force(self.ldb_admin, "OU=test_search_ou1," + self.base_dn)
686 self.delete_force(self.ldb_admin, self.get_user_dn(self.regular_user))
688 def test_search_u1(self):
689 """See if can prohibit user to read another User object"""
690 ou_dn = "OU=test_search_ou1," + self.base_dn
691 user_dn = "CN=test_search_user1," + ou_dn
693 self.delete_force(self.ldb_admin, ou_dn)
694 self.create_ou(self.ldb_admin, ou_dn)
695 desc = self.read_desc(ou_dn)
696 desc_sddl = desc.as_sddl(self.domain_sid)
697 # Parse descriptor's SDDL and remove all inherited ACEs reffering
698 # to 'Registered Users' or 'Authenticated Users'
699 desc_aces = re.findall("\(.*?\)", desc_sddl)
700 for ace in desc_aces:
701 if ("I" in ace) and (("RU" in ace) or ("AU" in ace)):
702 desc_sddl = desc_sddl.replace(ace, "")
703 # Add 'P' in the DACL so it breaks further inheritance
704 desc_sddl = desc_sddl.replace("D:AI(", "D:PAI(")
705 # Create a security descriptor object and OU with that descriptor
706 desc = security.descriptor.from_sddl(desc_sddl, self.domain_sid)
707 self.delete_force(self.ldb_admin, ou_dn)
708 self.create_ou(self.ldb_admin, ou_dn, desc)
710 self.delete_force(self.ldb_admin, user_dn)
711 self.create_test_user(self.ldb_admin, user_dn)
712 desc = self.read_desc(user_dn)
713 desc_sddl = desc.as_sddl(self.domain_sid)
714 # Parse security descriptor SDDL and remove all 'Read' ACEs
716 desc_aces = re.findall("\(.*?\)", desc_sddl)
717 for ace in desc_aces:
718 if ("AU" in ace) and ("R" in ace):
719 desc_sddl = desc_sddl.replace(ace, "")
720 # Create user with the edited descriptor
721 desc = security.descriptor.from_sddl(desc_sddl, self.domain_sid)
722 self.delete_force(self.ldb_admin, user_dn)
723 self.create_test_user(self.ldb_admin, user_dn, desc)
725 res = self.ldb_user.search(self.base_dn,
726 expression="(distinguishedName=%s)" % user_dn)
727 self.assertEqual(res, [])
729 def test_search_u2(self):
730 """User's group ACEs cleared and after that granted RIGHT_DS_READ_PROPERTY to another User object"""
731 ou_dn = "OU=test_search_ou1," + self.base_dn
732 user_dn = "CN=test_search_user1," + ou_dn
734 self.delete_force(self.ldb_admin, ou_dn)
735 self.create_ou(self.ldb_admin, ou_dn)
736 desc = self.read_desc(ou_dn)
737 desc_sddl = desc.as_sddl(self.domain_sid)
738 # Parse descriptor's SDDL and remove all inherited ACEs reffering
739 # to 'Registered Users' or 'Authenticated Users'
740 desc_aces = re.findall("\(.*?\)", desc_sddl)
741 for ace in desc_aces:
742 if ("I" in ace) and (("RU" in ace) or ("AU" in ace)):
743 desc_sddl = desc_sddl.replace(ace, "")
744 # Add 'P' in the DACL so it breaks further inheritance
745 desc_sddl = desc_sddl.replace("D:AI(", "D:PAI(")
746 # Create a security descriptor object and OU with that descriptor
747 desc = security.descriptor.from_sddl(desc_sddl, self.domain_sid)
748 self.delete_force(self.ldb_admin, ou_dn)
749 self.create_ou(self.ldb_admin, ou_dn, desc)
751 self.delete_force(self.ldb_admin, user_dn)
752 self.create_test_user(self.ldb_admin, user_dn)
753 # Parse security descriptor SDDL and remove all 'Read' ACEs
755 desc_aces = re.findall("\(.*?\)", desc_sddl)
756 for ace in desc_aces:
757 if ("AU" in ace) and ("R" in ace):
758 desc_sddl = desc_sddl.replace(ace, "")
759 #mod = "(OA;;RP;e48d0154-bcf8-11d1-8702-00c04fb96050;;AU)"
761 self.dacl_add_ace(user_dn, mod)
762 res = self.ldb_user.search(self.base_dn,
763 expression="(distinguishedName=%s)" % user_dn)
764 self.assertNotEqual(res, [])
766 #tests on ldap delete operations
767 class AclDeleteTests(AclTests):
770 super(AclDeleteTests, self).setUp()
771 self.regular_user = "acl_delete_user1"
772 # Create regular user
773 self.create_enable_user(self.regular_user)
774 self.ldb_user = self.get_ldb_connection(self.regular_user, self.user_pass)
777 super(AclDeleteTests, self).tearDown()
778 self.delete_force(self.ldb_admin, self.get_user_dn("test_delete_user1"))
779 self.delete_force(self.ldb_admin, self.get_user_dn(self.regular_user))
781 def test_delete_u1(self):
782 """User is prohibited by default to delete another User object"""
783 # Create user that we try to delete
784 self.create_test_user(self.ldb_admin, self.get_user_dn("test_delete_user1"))
785 # Here delete User object should ALWAYS through exception
787 self.ldb_user.delete(self.get_user_dn("test_delete_user1"))
788 except LdbError, (num, _):
789 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
793 def test_delete_u2(self):
794 """User's group has RIGHT_DELETE to another User object"""
795 user_dn = self.get_user_dn("test_delete_user1")
796 # Create user that we try to delete
797 self.create_test_user(self.ldb_admin, user_dn)
799 self.dacl_add_ace(user_dn, mod)
800 # Try to delete User object
801 self.ldb_user.delete(user_dn)
802 res = self.ldb_admin.search(self.base_dn,
803 expression="(distinguishedName=%s)" % user_dn)
804 self.assertEqual(res, [])
806 def test_delete_u3(self):
807 """User indentified by SID has RIGHT_DELETE to another User object"""
808 user_dn = self.get_user_dn("test_delete_user1")
809 # Create user that we try to delete
810 self.create_test_user(self.ldb_admin, user_dn)
811 mod = "(A;;SD;;;%s)" % self.get_object_sid(self.get_user_dn(self.regular_user))
812 self.dacl_add_ace(user_dn, mod)
813 # Try to delete User object
814 self.ldb_user.delete(user_dn)
815 res = self.ldb_admin.search(self.base_dn,
816 expression="(distinguishedName=%s)" % user_dn)
817 self.assertEqual(res, [])
819 #tests on ldap rename operations
820 class AclRenameTests(AclTests):
823 super(AclRenameTests, self).setUp()
824 self.regular_user = "acl_rename_user1"
826 # Create regular user
827 self.create_enable_user(self.regular_user)
828 self.ldb_user = self.get_ldb_connection(self.regular_user, self.user_pass)
831 super(AclRenameTests, self).tearDown()
833 self.delete_force(self.ldb_admin, "CN=test_rename_user1,OU=test_rename_ou3,OU=test_rename_ou2," + self.base_dn)
834 self.delete_force(self.ldb_admin, "CN=test_rename_user2,OU=test_rename_ou3,OU=test_rename_ou2," + self.base_dn)
835 self.delete_force(self.ldb_admin, "CN=test_rename_user5,OU=test_rename_ou3,OU=test_rename_ou2," + self.base_dn)
836 self.delete_force(self.ldb_admin, "OU=test_rename_ou3,OU=test_rename_ou2," + self.base_dn)
838 self.delete_force(self.ldb_admin, "CN=test_rename_user1,OU=test_rename_ou2," + self.base_dn)
839 self.delete_force(self.ldb_admin, "CN=test_rename_user2,OU=test_rename_ou2," + self.base_dn)
840 self.delete_force(self.ldb_admin, "CN=test_rename_user5,OU=test_rename_ou2," + self.base_dn)
841 self.delete_force(self.ldb_admin, "OU=test_rename_ou2," + self.base_dn)
843 self.delete_force(self.ldb_admin, "CN=test_rename_user1,OU=test_rename_ou1," + self.base_dn)
844 self.delete_force(self.ldb_admin, "CN=test_rename_user2,OU=test_rename_ou1," + self.base_dn)
845 self.delete_force(self.ldb_admin, "CN=test_rename_user5,OU=test_rename_ou1," + self.base_dn)
846 self.delete_force(self.ldb_admin, "OU=test_rename_ou3,OU=test_rename_ou1," + self.base_dn)
847 self.delete_force(self.ldb_admin, "OU=test_rename_ou1," + self.base_dn)
848 self.delete_force(self.ldb_admin, self.get_user_dn(self.regular_user))
850 def test_rename_u1(self):
851 """Regular user fails to rename 'User object' within single OU"""
852 # Create OU structure
853 self.create_ou(self.ldb_admin, "OU=test_rename_ou1," + self.base_dn)
854 self.create_test_user(self.ldb_admin, "CN=test_rename_user1,OU=test_rename_ou1," + self.base_dn)
856 self.ldb_user.rename("CN=test_rename_user1,OU=test_rename_ou1," + self.base_dn, \
857 "CN=test_rename_user5,OU=test_rename_ou1," + self.base_dn)
858 except LdbError, (num, _):
859 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
863 def test_rename_u2(self):
864 """Grant WRITE_PROPERTY to AU so regular user can rename 'User object' within single OU"""
865 ou_dn = "OU=test_rename_ou1," + self.base_dn
866 user_dn = "CN=test_rename_user1," + ou_dn
867 rename_user_dn = "CN=test_rename_user5," + ou_dn
868 # Create OU structure
869 self.create_ou(self.ldb_admin, ou_dn)
870 self.create_test_user(self.ldb_admin, user_dn)
872 self.dacl_add_ace(user_dn, mod)
873 # Rename 'User object' having WP to AU
874 self.ldb_user.rename(user_dn, rename_user_dn)
875 res = self.ldb_admin.search(self.base_dn,
876 expression="(distinguishedName=%s)" % user_dn)
877 self.assertEqual(res, [])
878 res = self.ldb_admin.search(self.base_dn,
879 expression="(distinguishedName=%s)" % rename_user_dn)
880 self.assertNotEqual(res, [])
882 def test_rename_u3(self):
883 """Test rename with rights granted to 'User object' SID"""
884 ou_dn = "OU=test_rename_ou1," + self.base_dn
885 user_dn = "CN=test_rename_user1," + ou_dn
886 rename_user_dn = "CN=test_rename_user5," + ou_dn
887 # Create OU structure
888 self.create_ou(self.ldb_admin, ou_dn)
889 self.create_test_user(self.ldb_admin, user_dn)
890 sid = self.get_object_sid(self.get_user_dn(self.regular_user))
891 mod = "(A;;WP;;;%s)" % str(sid)
892 self.dacl_add_ace(user_dn, mod)
893 # Rename 'User object' having WP to AU
894 self.ldb_user.rename(user_dn, rename_user_dn)
895 res = self.ldb_admin.search(self.base_dn,
896 expression="(distinguishedName=%s)" % user_dn)
897 self.assertEqual(res, [])
898 res = self.ldb_admin.search(self.base_dn,
899 expression="(distinguishedName=%s)" % rename_user_dn)
900 self.assertNotEqual(res, [])
902 def test_rename_u4(self):
903 """Rename 'User object' cross OU with WP, SD and CC right granted on reg. user to AU"""
904 ou1_dn = "OU=test_rename_ou1," + self.base_dn
905 ou2_dn = "OU=test_rename_ou2," + self.base_dn
906 user_dn = "CN=test_rename_user2," + ou1_dn
907 rename_user_dn = "CN=test_rename_user5," + ou2_dn
908 # Create OU structure
909 self.create_ou(self.ldb_admin, ou1_dn)
910 self.create_ou(self.ldb_admin, ou2_dn)
911 self.create_test_user(self.ldb_admin, user_dn)
912 mod = "(A;;WPSD;;;AU)"
913 self.dacl_add_ace(user_dn, mod)
915 self.dacl_add_ace(ou2_dn, mod)
916 # Rename 'User object' having SD and CC to AU
917 self.ldb_user.rename(user_dn, rename_user_dn)
918 res = self.ldb_admin.search(self.base_dn,
919 expression="(distinguishedName=%s)" % user_dn)
920 self.assertEqual(res, [])
921 res = self.ldb_admin.search(self.base_dn,
922 expression="(distinguishedName=%s)" % rename_user_dn)
923 self.assertNotEqual(res, [])
925 def test_rename_u5(self):
926 """Test rename with rights granted to 'User object' SID"""
927 ou1_dn = "OU=test_rename_ou1," + self.base_dn
928 ou2_dn = "OU=test_rename_ou2," + self.base_dn
929 user_dn = "CN=test_rename_user2," + ou1_dn
930 rename_user_dn = "CN=test_rename_user5," + ou2_dn
931 # Create OU structure
932 self.create_ou(self.ldb_admin, ou1_dn)
933 self.create_ou(self.ldb_admin, ou2_dn)
934 self.create_test_user(self.ldb_admin, user_dn)
935 sid = self.get_object_sid(self.get_user_dn(self.regular_user))
936 mod = "(A;;WPSD;;;%s)" % str(sid)
937 self.dacl_add_ace(user_dn, mod)
938 mod = "(A;;CC;;;%s)" % str(sid)
939 self.dacl_add_ace(ou2_dn, mod)
940 # Rename 'User object' having SD and CC to AU
941 self.ldb_user.rename(user_dn, rename_user_dn)
942 res = self.ldb_admin.search(self.base_dn,
943 expression="(distinguishedName=%s)" % user_dn)
944 self.assertEqual(res, [])
945 res = self.ldb_admin.search(self.base_dn,
946 expression="(distinguishedName=%s)" % rename_user_dn)
947 self.assertNotEqual(res, [])
949 def test_rename_u6(self):
950 """Rename 'User object' cross OU with WP, DC and CC right granted on OU & user to AU"""
951 ou1_dn = "OU=test_rename_ou1," + self.base_dn
952 ou2_dn = "OU=test_rename_ou2," + self.base_dn
953 user_dn = "CN=test_rename_user2," + ou1_dn
954 rename_user_dn = "CN=test_rename_user2," + ou2_dn
955 # Create OU structure
956 self.create_ou(self.ldb_admin, ou1_dn)
957 self.create_ou(self.ldb_admin, ou2_dn)
958 #mod = "(A;CI;DCWP;;;AU)"
960 self.dacl_add_ace(ou1_dn, mod)
962 self.dacl_add_ace(ou2_dn, mod)
963 self.create_test_user(self.ldb_admin, user_dn)
965 self.dacl_add_ace(user_dn, mod)
966 # Rename 'User object' having SD and CC to AU
967 self.ldb_user.rename(user_dn, rename_user_dn)
968 res = self.ldb_admin.search(self.base_dn,
969 expression="(distinguishedName=%s)" % user_dn)
970 self.assertEqual(res, [])
971 res = self.ldb_admin.search(self.base_dn,
972 expression="(distinguishedName=%s)" % rename_user_dn)
973 self.assertNotEqual(res, [])
975 def test_rename_u7(self):
976 """Rename 'User object' cross OU (second level) with WP, DC and CC right granted on OU to AU"""
977 ou1_dn = "OU=test_rename_ou1," + self.base_dn
978 ou2_dn = "OU=test_rename_ou2," + self.base_dn
979 ou3_dn = "OU=test_rename_ou3," + ou2_dn
980 user_dn = "CN=test_rename_user2," + ou1_dn
981 rename_user_dn = "CN=test_rename_user5," + ou3_dn
982 # Create OU structure
983 self.create_ou(self.ldb_admin, ou1_dn)
984 self.create_ou(self.ldb_admin, ou2_dn)
985 self.create_ou(self.ldb_admin, ou3_dn)
986 mod = "(A;CI;WPDC;;;AU)"
987 self.dacl_add_ace(ou1_dn, mod)
989 self.dacl_add_ace(ou3_dn, mod)
990 self.create_test_user(self.ldb_admin, user_dn)
991 # Rename 'User object' having SD and CC to AU
992 self.ldb_user.rename(user_dn, rename_user_dn)
993 res = self.ldb_admin.search(self.base_dn,
994 expression="(distinguishedName=%s)" % user_dn)
995 self.assertEqual(res, [])
996 res = self.ldb_admin.search(self.base_dn,
997 expression="(distinguishedName=%s)" % rename_user_dn)
998 self.assertNotEqual(res, [])
1000 def test_rename_u8(self):
1001 """Test rename on an object with and without modify access on the RDN attribute"""
1002 ou1_dn = "OU=test_rename_ou1," + self.base_dn
1003 ou2_dn = "OU=test_rename_ou2," + ou1_dn
1004 ou3_dn = "OU=test_rename_ou3," + ou1_dn
1005 # Create OU structure
1006 self.create_ou(self.ldb_admin, ou1_dn)
1007 self.create_ou(self.ldb_admin, ou2_dn)
1008 sid = self.get_object_sid(self.get_user_dn(self.regular_user))
1009 mod = "(OA;;WP;bf967a0e-0de6-11d0-a285-00aa003049e2;;%s)" % str(sid)
1010 self.dacl_add_ace(ou2_dn, mod)
1011 mod = "(OD;;WP;bf9679f0-0de6-11d0-a285-00aa003049e2;;%s)" % str(sid)
1012 self.dacl_add_ace(ou2_dn, mod)
1014 self.ldb_user.rename(ou2_dn, ou3_dn)
1015 except LdbError, (num, _):
1016 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
1018 # This rename operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
1020 sid = self.get_object_sid(self.get_user_dn(self.regular_user))
1021 mod = "(A;;WP;bf9679f0-0de6-11d0-a285-00aa003049e2;;%s)" % str(sid)
1022 self.dacl_add_ace(ou2_dn, mod)
1023 self.ldb_user.rename(ou2_dn, ou3_dn)
1024 res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s)" % ou2_dn)
1025 self.assertEqual(res, [])
1026 res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s)" % ou3_dn)
1027 self.assertNotEqual(res, [])
1029 #tests on Control Access Rights
1030 class AclCARTests(AclTests):
1033 super(AclCARTests, self).setUp()
1034 self.user_with_wp = "acl_car_user1"
1035 self.user_with_pc = "acl_car_user2"
1036 self.create_enable_user(self.user_with_wp)
1037 self.create_enable_user(self.user_with_pc)
1038 self.ldb_user = self.get_ldb_connection(self.user_with_wp, self.user_pass)
1039 self.ldb_user2 = self.get_ldb_connection(self.user_with_pc, self.user_pass)
1042 super(AclCARTests, self).tearDown()
1043 self.delete_force(self.ldb_admin, self.get_user_dn(self.user_with_wp))
1044 self.delete_force(self.ldb_admin, self.get_user_dn(self.user_with_pc))
1046 def test_change_password1(self):
1047 """Try a password change operation without any CARs given"""
1048 #users have change password by default - remove for negative testing
1049 desc = self.read_desc(self.get_user_dn(self.user_with_wp))
1050 sddl = desc.as_sddl(self.domain_sid)
1051 sddl = sddl.replace("(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD)", "")
1052 sddl = sddl.replace("(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;PS)", "")
1053 self.modify_desc(self.get_user_dn(self.user_with_wp), sddl)
1055 self.ldb_user.modify_ldif("""
1056 dn: """ + self.get_user_dn(self.user_with_wp) + """
1059 unicodePwd:: """ + base64.b64encode("\"samba123@\"".encode('utf-16-le')) + """
1061 unicodePwd:: """ + base64.b64encode("\"thatsAcomplPASS2\"".encode('utf-16-le')) + """
1063 except LdbError, (num, _):
1064 self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
1066 # for some reason we get constraint violation instead of insufficient access error
1069 def test_change_password2(self):
1070 """Make sure WP has no influence"""
1071 desc = self.read_desc(self.get_user_dn(self.user_with_wp))
1072 sddl = desc.as_sddl(self.domain_sid)
1073 sddl = sddl.replace("(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD)", "")
1074 sddl = sddl.replace("(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;PS)", "")
1075 self.modify_desc(self.get_user_dn(self.user_with_wp), sddl)
1076 mod = "(A;;WP;;;PS)"
1077 self.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
1078 desc = self.read_desc(self.get_user_dn(self.user_with_wp))
1079 sddl = desc.as_sddl(self.domain_sid)
1081 self.ldb_user.modify_ldif("""
1082 dn: """ + self.get_user_dn(self.user_with_wp) + """
1085 unicodePwd:: """ + base64.b64encode("\"samba123@\"".encode('utf-16-le')) + """
1087 unicodePwd:: """ + base64.b64encode("\"thatsAcomplPASS2\"".encode('utf-16-le')) + """
1089 except LdbError, (num, _):
1090 self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
1092 # for some reason we get constraint violation instead of insufficient access error
1095 def test_change_password3(self):
1096 """Make sure WP has no influence"""
1097 mod = "(D;;WP;;;PS)"
1098 self.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
1099 desc = self.read_desc(self.get_user_dn(self.user_with_wp))
1100 sddl = desc.as_sddl(self.domain_sid)
1101 self.ldb_user.modify_ldif("""
1102 dn: """ + self.get_user_dn(self.user_with_wp) + """
1105 unicodePwd:: """ + base64.b64encode("\"samba123@\"".encode('utf-16-le')) + """
1107 unicodePwd:: """ + base64.b64encode("\"thatsAcomplPASS2\"".encode('utf-16-le')) + """
1110 def test_change_password5(self):
1111 """Make sure rights have no influence on dBCSPwd"""
1112 desc = self.read_desc(self.get_user_dn(self.user_with_wp))
1113 sddl = desc.as_sddl(self.domain_sid)
1114 sddl = sddl.replace("(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD)", "")
1115 sddl = sddl.replace("(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;PS)", "")
1116 self.modify_desc(self.get_user_dn(self.user_with_wp), sddl)
1117 mod = "(D;;WP;;;PS)"
1118 self.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
1120 self.ldb_user.modify_ldif("""
1121 dn: """ + self.get_user_dn(self.user_with_wp) + """
1124 dBCSPwd: XXXXXXXXXXXXXXXX
1126 dBCSPwd: YYYYYYYYYYYYYYYY
1128 except LdbError, (num, _):
1129 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1133 def test_change_password6(self):
1134 """Test uneven delete/adds"""
1136 self.ldb_user.modify_ldif("""
1137 dn: """ + self.get_user_dn(self.user_with_wp) + """
1139 delete: userPassword
1140 userPassword: thatsAcomplPASS1
1141 delete: userPassword
1142 userPassword: thatsAcomplPASS1
1144 userPassword: thatsAcomplPASS2
1146 except LdbError, (num, _):
1147 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
1150 mod = "(OA;;CR;00299570-246d-11d0-a768-00aa006e0529;;PS)"
1151 self.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
1153 self.ldb_user.modify_ldif("""
1154 dn: """ + self.get_user_dn(self.user_with_wp) + """
1156 delete: userPassword
1157 userPassword: thatsAcomplPASS1
1158 delete: userPassword
1159 userPassword: thatsAcomplPASS1
1161 userPassword: thatsAcomplPASS2
1163 except LdbError, (num, _):
1164 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1168 def test_change_password7(self):
1169 """Try a password change operation without any CARs given"""
1170 #users have change password by default - remove for negative testing
1171 desc = self.read_desc(self.get_user_dn(self.user_with_wp))
1172 sddl = desc.as_sddl(self.domain_sid)
1173 self.modify_desc(self.get_user_dn(self.user_with_wp), sddl)
1174 #first change our own password
1175 self.ldb_user2.modify_ldif("""
1176 dn: """ + self.get_user_dn(self.user_with_pc) + """
1179 unicodePwd:: """ + base64.b64encode("\"samba123@\"".encode('utf-16-le')) + """
1181 unicodePwd:: """ + base64.b64encode("\"thatsAcomplPASS1\"".encode('utf-16-le')) + """
1183 #then someone else's
1184 self.ldb_user2.modify_ldif("""
1185 dn: """ + self.get_user_dn(self.user_with_wp) + """
1188 unicodePwd:: """ + base64.b64encode("\"samba123@\"".encode('utf-16-le')) + """
1190 unicodePwd:: """ + base64.b64encode("\"thatsAcomplPASS2\"".encode('utf-16-le')) + """
1193 def test_reset_password1(self):
1194 """Try a user password reset operation (unicodePwd) before and after granting CAR"""
1196 self.ldb_user.modify_ldif("""
1197 dn: """ + self.get_user_dn(self.user_with_wp) + """
1200 unicodePwd:: """ + base64.b64encode("\"thatsAcomplPASS1\"".encode('utf-16-le')) + """
1202 except LdbError, (num, _):
1203 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
1206 mod = "(OA;;CR;00299570-246d-11d0-a768-00aa006e0529;;PS)"
1207 self.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
1208 self.ldb_user.modify_ldif("""
1209 dn: """ + self.get_user_dn(self.user_with_wp) + """
1212 unicodePwd:: """ + base64.b64encode("\"thatsAcomplPASS1\"".encode('utf-16-le')) + """
1215 def test_reset_password2(self):
1216 """Try a user password reset operation (userPassword) before and after granting CAR"""
1218 self.ldb_user.modify_ldif("""
1219 dn: """ + self.get_user_dn(self.user_with_wp) + """
1221 replace: userPassword
1222 userPassword: thatsAcomplPASS1
1224 except LdbError, (num, _):
1225 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
1228 mod = "(OA;;CR;00299570-246d-11d0-a768-00aa006e0529;;PS)"
1229 self.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
1230 self.ldb_user.modify_ldif("""
1231 dn: """ + self.get_user_dn(self.user_with_wp) + """
1233 replace: userPassword
1234 userPassword: thatsAcomplPASS1
1237 def test_reset_password3(self):
1238 """Grant WP and see what happens (unicodePwd)"""
1239 mod = "(A;;WP;;;PS)"
1240 self.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
1242 self.ldb_user.modify_ldif("""
1243 dn: """ + self.get_user_dn(self.user_with_wp) + """
1246 unicodePwd:: """ + base64.b64encode("\"thatsAcomplPASS1\"".encode('utf-16-le')) + """
1248 except LdbError, (num, _):
1249 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
1253 def test_reset_password4(self):
1254 """Grant WP and see what happens (userPassword)"""
1255 mod = "(A;;WP;;;PS)"
1256 self.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
1258 self.ldb_user.modify_ldif("""
1259 dn: """ + self.get_user_dn(self.user_with_wp) + """
1261 replace: userPassword
1262 userPassword: thatsAcomplPASS1
1264 except LdbError, (num, _):
1265 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
1269 def test_reset_password5(self):
1270 """Explicitly deny WP but grant CAR (unicodePwd)"""
1271 mod = "(D;;WP;;;PS)(OA;;CR;00299570-246d-11d0-a768-00aa006e0529;;PS)"
1272 self.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
1273 self.ldb_user.modify_ldif("""
1274 dn: """ + self.get_user_dn(self.user_with_wp) + """
1277 unicodePwd:: """ + base64.b64encode("\"thatsAcomplPASS1\"".encode('utf-16-le')) + """
1280 def test_reset_password6(self):
1281 """Explicitly deny WP but grant CAR (userPassword)"""
1282 mod = "(D;;WP;;;PS)(OA;;CR;00299570-246d-11d0-a768-00aa006e0529;;PS)"
1283 self.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
1284 self.ldb_user.modify_ldif("""
1285 dn: """ + self.get_user_dn(self.user_with_wp) + """
1287 replace: userPassword
1288 userPassword: thatsAcomplPASS1
1291 # Important unit running information
1293 if not "://" in host:
1294 host = "ldap://%s" % host
1295 ldb = SamDB(host, credentials=creds, session_info=system_session(), lp=lp)
1297 # Gets back the configuration basedn
1298 res = ldb.search(base="", expression="", scope=SCOPE_BASE,
1299 attrs=["configurationNamingContext"])
1300 configuration_dn = res[0]["configurationNamingContext"][0]
1302 # Gets back the cbasedn
1303 res = ldb.search(base="", expression="", scope=SCOPE_BASE,
1304 attrs=["defaultNamingContext"])
1305 base_dn = res[0]["defaultNamingContext"][0]
1307 # Get the old "dSHeuristics" if it was set
1308 res = ldb.search("CN=Directory Service, CN=Windows NT, CN=Services, "
1309 + configuration_dn, scope=SCOPE_BASE, attrs=["dSHeuristics"])
1310 if "dSHeuristics" in res[0]:
1311 dsheuristics = res[0]["dSHeuristics"][0]
1315 # Set the "dSHeuristics" to have the tests run against Windows Server
1317 m.dn = Dn(ldb, "CN=Directory Service, CN=Windows NT, CN=Services, "
1319 m["dSHeuristics"] = MessageElement("000000001", FLAG_MOD_REPLACE,
1323 # Get the current minPwdAge
1324 res = ldb.search(base_dn, scope=SCOPE_BASE, attrs=["minPwdAge"])
1325 minPwdAge = res[0]["minPwdAge"][0]
1327 #set minPwdAge to 0 so password tests can against Windows server
1329 m.dn = Dn(ldb, base_dn)
1330 m["minPwdAge"] = MessageElement("0", FLAG_MOD_REPLACE, "minPwdAge")
1333 runner = SubunitTestRunner()
1335 if not runner.run(unittest.makeSuite(AclAddTests)).wasSuccessful():
1337 if not runner.run(unittest.makeSuite(AclModifyTests)).wasSuccessful():
1339 if not runner.run(unittest.makeSuite(AclDeleteTests)).wasSuccessful():
1341 if not runner.run(unittest.makeSuite(AclRenameTests)).wasSuccessful():
1343 if not runner.run(unittest.makeSuite(AclCARTests)).wasSuccessful():
1346 # Reset the "dSHeuristics" as they were before
1348 m.dn = Dn(ldb, "CN=Directory Service, CN=Windows NT, CN=Services, "
1350 if dsheuristics is not None:
1351 m["dSHeuristics"] = MessageElement(dsheuristics, FLAG_MOD_REPLACE,
1354 m["dSHeuristics"] = MessageElement([], FLAG_MOD_DELETE, "dsHeuristics")
1357 # Reset minPwdAge as before
1359 m.dn = Dn(ldb, base_dn)
1360 m["minPwdAge"] = MessageElement(minPwdAge, FLAG_MOD_REPLACE, "minPwdAge")