source4/torture/drs/python/repl_move.py

   1 #!/usr/bin/env python
   2 # -*- coding: utf-8 -*-
   3 #
   4 # Unix SMB/CIFS implementation.
   5 # Copyright (C) Kamen Mazdrashki <kamenim@samba.org> 2010
   6 # Copyright (C) Andrew Bartlett <abartlet@samba.org> 2016
   7 #
   8 # This program is free software; you can redistribute it and/or modify
   9 # it under the terms of the GNU General Public License as published by
  10 # the Free Software Foundation; either version 3 of the License, or
  11 # (at your option) any later version.
  12 #
  13 # This program is distributed in the hope that it will be useful,
  14 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  15 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16 # GNU General Public License for more details.
  17 #
  18 # You should have received a copy of the GNU General Public License
  19 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 #
  21
  22 #
  23 # Usage:
  24 #  export DC1=dc1_dns_name
  25 #  export DC2=dc2_dns_name
  26 #  export SUBUNITRUN=$samba4srcdir/scripting/bin/subunitrun
  27 #  PYTHONPATH="$PYTHONPATH:$samba4srcdir/torture/drs/python" $SUBUNITRUN repl_move -U"$DOMAIN/$DC_USERNAME"%"$DC_PASSWORD"
  28 #
  29
  30 from __future__ import print_function
  31 import time
  32 import uuid
  33 import samba.tests
  34
  35 from samba.ndr import ndr_unpack
  36 from samba.dcerpc import drsblobs
  37 from samba.dcerpc import misc
  38 from samba.drs_utils import drs_DsBind
  39
  40 from ldb import (
  41     SCOPE_BASE,
  42     SCOPE_SUBTREE,
  43 )
  44
  45 import drs_base
  46 import ldb
  47 from samba.dcerpc.drsuapi import *
  48
  49
  50 class DrsMoveObjectTestCase(drs_base.DrsBaseTestCase):
  51
  52     def _ds_bind(self, server_name):
  53         binding_str = "ncacn_ip_tcp:%s[print,seal]" % server_name
  54
  55         drs = drsuapi(binding_str, self.get_loadparm(), self.get_credentials())
  56         (drs_handle, supported_extensions) = drs_DsBind(drs)
  57         return (drs, drs_handle)
  58
  59     def setUp(self):
  60         super(DrsMoveObjectTestCase, self).setUp()
  61         # disable automatic replication temporary
  62         self._disable_all_repl(self.dnsname_dc1)
  63         self._disable_all_repl(self.dnsname_dc2)
  64
  65         # make sure DCs are synchronized before the test
  66         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
  67         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True)
  68
  69         self.top_ou = samba.tests.create_test_ou(self.ldb_dc1,
  70                                                  "replica_move")
  71
  72         self.ou1_dn = ldb.Dn(self.ldb_dc1, "OU=DrsOU1")
  73         self.ou1_dn.add_base(self.top_ou)
  74         ou1 = {}
  75         ou1["dn"] = self.ou1_dn
  76         ou1["objectclass"] = "organizationalUnit"
  77         ou1["ou"] = self.ou1_dn.get_component_value(0)
  78         self.ldb_dc1.add(ou1)
  79
  80         self.ou2_dn = ldb.Dn(self.ldb_dc1, "OU=DrsOU2")
  81         self.ou2_dn.add_base(self.top_ou)
  82         ou2 = {}
  83         ou2["dn"] = self.ou2_dn
  84         ou2["objectclass"] = "organizationalUnit"
  85         ou2["ou"] = self.ou2_dn.get_component_value(0)
  86         self.ldb_dc1.add(ou2)
  87
  88         # trigger replication from DC1 to DC2
  89         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
  90         self.dc1_guid = self.ldb_dc1.get_invocation_id()
  91         self.dc2_guid = self.ldb_dc2.get_invocation_id()
  92
  93         self.drs_dc1 = self._ds_bind(self.dnsname_dc1)
  94         self.drs_dc2 = self._ds_bind(self.dnsname_dc2)
  95
  96     def tearDown(self):
  97         try:
  98             self.ldb_dc1.delete(self.top_ou, ["tree_delete:1"])
  99         except ldb.LdbError as e:
 100             (enum, string) = e.args
 101             if enum == ldb.ERR_NO_SUCH_OBJECT:
 102                 pass
 103
 104         self._enable_all_repl(self.dnsname_dc1)
 105         self._enable_all_repl(self.dnsname_dc2)
 106         super(DrsMoveObjectTestCase, self).tearDown()
 107
 108     def _make_username(self):
 109         return "DrsMoveU_" + time.strftime("%s", time.gmtime())
 110
 111     def _check_metadata(self, user_dn, sam_ldb, drs, metadata, expected):
 112         repl = ndr_unpack(drsblobs.replPropertyMetaDataBlob, metadata[0])
 113
 114         self.assertEqual(len(repl.ctr.array), len(expected))
 115
 116         i = 0
 117         for o in repl.ctr.array:
 118             e = expected[i]
 119             (attid, orig_dsa, version) = e
 120             self.assertEquals(attid, o.attid,
 121                               "(LDAP) Wrong attid "
 122                               "for expected value %d, wanted 0x%08x got 0x%08x"
 123                               % (i, attid, o.attid))
 124             self.assertEquals(o.originating_invocation_id,
 125                               misc.GUID(orig_dsa),
 126                               "(LDAP) Wrong originating_invocation_id "
 127                               "for expected value %d, attid 0x%08x, wanted %s got %s"
 128                               % (i, o.attid,
 129                                  misc.GUID(orig_dsa),
 130                                  o.originating_invocation_id))
 131             # Allow version to be skipped when it does not matter
 132             if version is not None:
 133                 self.assertEquals(o.version, version,
 134                                   "(LDAP) Wrong version for expected value %d, "
 135                                   "attid 0x%08x, "
 136                                   "wanted %d got %d"
 137                                   % (i, o.attid,
 138                                      version, o.version))
 139             i = i + 1
 140
 141         if drs == None:
 142             return
 143
 144         req8 = DsGetNCChangesRequest8()
 145
 146         req8.source_dsa_invocation_id = misc.GUID(sam_ldb.get_invocation_id())
 147         req8.naming_context = DsReplicaObjectIdentifier()
 148         req8.naming_context.dn = str(user_dn)
 149         req8.highwatermark = DsReplicaHighWaterMark()
 150         req8.highwatermark.tmp_highest_usn = 0
 151         req8.highwatermark.reserved_usn = 0
 152         req8.highwatermark.highest_usn = 0
 153         req8.uptodateness_vector = None
 154         req8.replica_flags = DRSUAPI_DRS_SYNC_FORCED
 155         req8.max_object_count = 1
 156         req8.max_ndr_size = 402116
 157         req8.extended_op = DRSUAPI_EXOP_REPL_OBJ
 158         req8.fsmo_info = 0
 159         req8.partial_attribute_set = None
 160         req8.partial_attribute_set_ex = None
 161         req8.mapping_ctr.num_mappings = 0
 162         req8.mapping_ctr.mappings = None
 163
 164         (drs_conn, drs_handle) = drs
 165
 166         (level, drs_ctr) = drs_conn.DsGetNCChanges(drs_handle, 8, req8)
 167         self.assertEqual(level, 6)
 168         self.assertEqual(drs_ctr.object_count, 1)
 169
 170         self.assertEqual(len(drs_ctr.first_object.meta_data_ctr.meta_data), len(expected) - 1)
 171         att_idx = 0
 172         for o in drs_ctr.first_object.meta_data_ctr.meta_data:
 173             i = 0
 174             drs_attid = drs_ctr.first_object.object.attribute_ctr.attributes[att_idx]
 175             e = expected[i];
 176             (attid, orig_dsa, version) = e
 177
 178             # Skip the RDN from the expected set, it is not sent over DRS
 179             if (user_dn.get_rdn_name().upper() == "CN" \
 180                 and attid == DRSUAPI_ATTID_cn) \
 181                 or (user_dn.get_rdn_name().upper() == "OU" \
 182                     and attid == DRSUAPI_ATTID_ou):
 183                 i = i + 1
 184                 e = expected[i];
 185                 (attid, orig_dsa, version) = e
 186
 187             self.assertEquals(attid, drs_attid.attid,
 188                               "(DRS) Wrong attid "
 189                               "for expected value %d, wanted 0x%08x got 0x%08x"
 190                               % (i, attid, drs_attid.attid))
 191
 192             self.assertEquals(o.originating_invocation_id,
 193                               misc.GUID(orig_dsa),
 194                               "(DRS) Wrong originating_invocation_id "
 195                               "for expected value %d, attid 0x%08x, wanted %s got %s"
 196                               % (i, attid,
 197                                  misc.GUID(orig_dsa),
 198                                  o.originating_invocation_id))
 199             # Allow version to be skipped when it does not matter
 200             if version is not None:
 201                 self.assertEquals(o.version, version,
 202                                   "(DRS) Wrong version for expected value %d, "
 203                                   "attid 0x%08x, "
 204                                   "wanted %d got %d"
 205                                   % (i, attid, version, o.version))
 206                 break
 207             i = i + 1
 208             att_idx = att_idx + 1
 209
 210     # now also used to check the group
 211     def _check_obj(self, sam_ldb, obj_orig, is_deleted, expected_metadata=None, drs=None):
 212         # search the user by guid as it may be deleted
 213         guid_str = self._GUID_string(obj_orig["objectGUID"][0])
 214         res = sam_ldb.search(base='<GUID=%s>' % guid_str,
 215                              controls=["show_deleted:1"],
 216                              attrs=["*", "parentGUID",
 217                                     "replPropertyMetaData"])
 218         self.assertEquals(len(res), 1)
 219         user_cur = res[0]
 220         rdn_orig = obj_orig[user_cur.dn.get_rdn_name()][0]
 221         rdn_cur  = user_cur[user_cur.dn.get_rdn_name()][0]
 222         name_orig = obj_orig["name"][0]
 223         name_cur  = user_cur["name"][0]
 224         dn_orig = obj_orig["dn"]
 225         dn_cur  = user_cur["dn"]
 226         # now check properties of the user
 227         if is_deleted:
 228             self.assertTrue("isDeleted" in user_cur)
 229             self.assertEquals(rdn_cur.split('\n')[0], rdn_orig)
 230             self.assertEquals(name_cur.split('\n')[0], name_orig)
 231             self.assertEquals(dn_cur.get_rdn_value().split('\n')[0],
 232                               dn_orig.get_rdn_value())
 233             self.assertEqual(name_cur, rdn_cur)
 234         else:
 235             self.assertFalse("isDeleted" in user_cur)
 236             self.assertEquals(rdn_cur, rdn_orig)
 237             self.assertEquals(name_cur, name_orig)
 238             self.assertEquals(dn_cur, dn_orig)
 239             self.assertEqual(name_cur, rdn_cur)
 240             parent_cur  = user_cur["parentGUID"][0]
 241             try:
 242                 parent_orig = obj_orig["parentGUID"][0]
 243                 self.assertEqual(parent_orig, parent_cur)
 244             except KeyError:
 245                 pass
 246         self.assertEqual(name_cur, user_cur.dn.get_rdn_value())
 247
 248         if expected_metadata is not None:
 249             self._check_metadata(dn_cur, sam_ldb, drs, user_cur["replPropertyMetaData"],
 250                                  expected_metadata)
 251
 252         return user_cur
 253
 254     def test_ReplicateMoveObject1(self):
 255         """Verifies how a moved container with a user inside is replicated between two DCs.
 256            This test should verify that:
 257             - the OU is replicated properly
 258             - the OU is renamed
 259             - We verify that after replication,
 260               that the user has the correct DN (under OU2)
 261             - the OU is deleted
 262             - the OU is modified on DC2
 263             - We verify that after replication,
 264               that the user has the correct DN (deleted) and has not description
 265
 266            """
 267         # work-out unique username to test with
 268         username = self._make_username()
 269
 270         # create user on DC1
 271         self.ldb_dc1.newuser(username=username,
 272                              userou="ou=%s,ou=%s"
 273                              % (self.ou1_dn.get_component_value(0),
 274                                 self.top_ou.get_component_value(0)),
 275                              password=None, setpassword=False)
 276         ldb_res = self.ldb_dc1.search(base=self.ou1_dn,
 277                                       scope=SCOPE_SUBTREE,
 278                                       expression="(samAccountName=%s)" % username,
 279                                       attrs=["*", "parentGUID"])
 280         self.assertEquals(len(ldb_res), 1)
 281         user_orig = ldb_res[0]
 282         user_dn   = ldb_res[0]["dn"]
 283
 284         # check user info on DC1
 285         print("Testing for %s with GUID %s" % (username, self._GUID_string(user_orig["objectGUID"][0])))
 286         initial_metadata = [
 287             (DRSUAPI_ATTID_objectClass, self.dc1_guid, 1),
 288             (DRSUAPI_ATTID_cn, self.dc1_guid, 1),
 289             (DRSUAPI_ATTID_instanceType, self.dc1_guid, 1),
 290             (DRSUAPI_ATTID_whenCreated, self.dc1_guid, 1),
 291             (DRSUAPI_ATTID_ntSecurityDescriptor, self.dc1_guid, 1),
 292             (DRSUAPI_ATTID_name, self.dc1_guid, 1),
 293             (DRSUAPI_ATTID_userAccountControl, self.dc1_guid, None),
 294             (DRSUAPI_ATTID_codePage, self.dc1_guid, 1),
 295             (DRSUAPI_ATTID_countryCode, self.dc1_guid, 1),
 296             (DRSUAPI_ATTID_dBCSPwd, self.dc1_guid, 1),
 297             (DRSUAPI_ATTID_logonHours, self.dc1_guid, 1),
 298             (DRSUAPI_ATTID_unicodePwd, self.dc1_guid, 1),
 299             (DRSUAPI_ATTID_ntPwdHistory, self.dc1_guid, 1),
 300             (DRSUAPI_ATTID_pwdLastSet, self.dc1_guid, 1),
 301             (DRSUAPI_ATTID_primaryGroupID, self.dc1_guid, 1),
 302             (DRSUAPI_ATTID_objectSid, self.dc1_guid, 1),
 303             (DRSUAPI_ATTID_accountExpires, self.dc1_guid, 1),
 304             (DRSUAPI_ATTID_lmPwdHistory, self.dc1_guid, 1),
 305             (DRSUAPI_ATTID_sAMAccountName, self.dc1_guid, 1),
 306             (DRSUAPI_ATTID_sAMAccountType, self.dc1_guid, 1),
 307             (DRSUAPI_ATTID_userPrincipalName, self.dc1_guid, 1),
 308             (DRSUAPI_ATTID_objectCategory, self.dc1_guid, 1)]
 309
 310         self._check_obj(sam_ldb=self.ldb_dc1, drs=self.drs_dc1,
 311                         obj_orig=user_orig, is_deleted=False,
 312                         expected_metadata=initial_metadata)
 313
 314         new_dn = ldb.Dn(self.ldb_dc1, "CN=%s" % username)
 315         new_dn.add_base(self.ou2_dn)
 316         self.ldb_dc1.rename(user_dn, new_dn)
 317         ldb_res = self.ldb_dc1.search(base=self.ou2_dn,
 318                                       scope=SCOPE_SUBTREE,
 319                                       expression="(samAccountName=%s)" % username,
 320                                       attrs=["*", "parentGUID"])
 321         self.assertEquals(len(ldb_res), 1)
 322
 323         user_moved_orig = ldb_res[0]
 324         user_moved_dn   = ldb_res[0]["dn"]
 325
 326         moved_metadata = [
 327             (DRSUAPI_ATTID_objectClass, self.dc1_guid, 1),
 328             (DRSUAPI_ATTID_cn, self.dc1_guid, 1),
 329             (DRSUAPI_ATTID_instanceType, self.dc1_guid, 1),
 330             (DRSUAPI_ATTID_whenCreated, self.dc1_guid, 1),
 331             (DRSUAPI_ATTID_ntSecurityDescriptor, self.dc1_guid, 1),
 332             (DRSUAPI_ATTID_name, self.dc1_guid, 2),
 333             (DRSUAPI_ATTID_userAccountControl, self.dc1_guid, None),
 334             (DRSUAPI_ATTID_codePage, self.dc1_guid, 1),
 335             (DRSUAPI_ATTID_countryCode, self.dc1_guid, 1),
 336             (DRSUAPI_ATTID_dBCSPwd, self.dc1_guid, 1),
 337             (DRSUAPI_ATTID_logonHours, self.dc1_guid, 1),
 338             (DRSUAPI_ATTID_unicodePwd, self.dc1_guid, 1),
 339             (DRSUAPI_ATTID_ntPwdHistory, self.dc1_guid, 1),
 340             (DRSUAPI_ATTID_pwdLastSet, self.dc1_guid, 1),
 341             (DRSUAPI_ATTID_primaryGroupID, self.dc1_guid, 1),
 342             (DRSUAPI_ATTID_objectSid, self.dc1_guid, 1),
 343             (DRSUAPI_ATTID_accountExpires, self.dc1_guid, 1),
 344             (DRSUAPI_ATTID_lmPwdHistory, self.dc1_guid, 1),
 345             (DRSUAPI_ATTID_sAMAccountName, self.dc1_guid, 1),
 346             (DRSUAPI_ATTID_sAMAccountType, self.dc1_guid, 1),
 347             (DRSUAPI_ATTID_userPrincipalName, self.dc1_guid, 1),
 348             (DRSUAPI_ATTID_objectCategory, self.dc1_guid, 1)]
 349
 350         # check user info on DC1 after rename - should be valid user
 351         user_cur = self._check_obj(sam_ldb=self.ldb_dc1, drs=self.drs_dc1,
 352                                    obj_orig=user_moved_orig,
 353                                    is_deleted=False,
 354                                    expected_metadata=moved_metadata)
 355
 356         # trigger replication from DC1 to DC2
 357         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
 358         moved_metadata_dc2 = [
 359             (DRSUAPI_ATTID_objectClass, self.dc1_guid, 1),
 360             (DRSUAPI_ATTID_cn, self.dc2_guid, 1),
 361             (DRSUAPI_ATTID_instanceType, self.dc1_guid, 1),
 362             (DRSUAPI_ATTID_whenCreated, self.dc1_guid, 1),
 363             (DRSUAPI_ATTID_ntSecurityDescriptor, self.dc1_guid, 1),
 364             (DRSUAPI_ATTID_name, self.dc1_guid, 2),
 365             (DRSUAPI_ATTID_userAccountControl, self.dc1_guid, None),
 366             (DRSUAPI_ATTID_codePage, self.dc1_guid, 1),
 367             (DRSUAPI_ATTID_countryCode, self.dc1_guid, 1),
 368             (DRSUAPI_ATTID_dBCSPwd, self.dc1_guid, 1),
 369             (DRSUAPI_ATTID_logonHours, self.dc1_guid, 1),
 370             (DRSUAPI_ATTID_unicodePwd, self.dc1_guid, 1),
 371             (DRSUAPI_ATTID_ntPwdHistory, self.dc1_guid, 1),
 372             (DRSUAPI_ATTID_pwdLastSet, self.dc1_guid, 1),
 373             (DRSUAPI_ATTID_primaryGroupID, self.dc1_guid, 1),
 374             (DRSUAPI_ATTID_objectSid, self.dc1_guid, 1),
 375             (DRSUAPI_ATTID_accountExpires, self.dc1_guid, 1),
 376             (DRSUAPI_ATTID_lmPwdHistory, self.dc1_guid, 1),
 377             (DRSUAPI_ATTID_sAMAccountName, self.dc1_guid, 1),
 378             (DRSUAPI_ATTID_sAMAccountType, self.dc1_guid, 1),
 379             (DRSUAPI_ATTID_userPrincipalName, self.dc1_guid, 1),
 380             (DRSUAPI_ATTID_objectCategory, self.dc1_guid, 1)]
 381
 382         # check user info on DC2 - should be valid user
 383         user_cur = self._check_obj(sam_ldb=self.ldb_dc2, drs=self.drs_dc2,
 384                                    obj_orig=user_moved_orig,
 385                                    is_deleted=False,
 386                                    expected_metadata=moved_metadata_dc2)
 387
 388         # delete user on DC1
 389         self.ldb_dc1.delete('<GUID=%s>' % self._GUID_string(user_orig["objectGUID"][0]))
 390         deleted_metadata = [
 391             (DRSUAPI_ATTID_objectClass, self.dc1_guid, 1),
 392             (DRSUAPI_ATTID_cn, self.dc1_guid, 2),
 393             (DRSUAPI_ATTID_instanceType, self.dc1_guid, 1),
 394             (DRSUAPI_ATTID_whenCreated, self.dc1_guid, 1),
 395             (DRSUAPI_ATTID_isDeleted, self.dc1_guid, 1),
 396             (DRSUAPI_ATTID_ntSecurityDescriptor, self.dc1_guid, 1),
 397             (DRSUAPI_ATTID_name, self.dc1_guid, 3),
 398             (DRSUAPI_ATTID_userAccountControl, self.dc1_guid, None),
 399             (DRSUAPI_ATTID_codePage, self.dc1_guid, 2),
 400             (DRSUAPI_ATTID_countryCode, self.dc1_guid, 2),
 401             (DRSUAPI_ATTID_dBCSPwd, self.dc1_guid, 1),
 402             (DRSUAPI_ATTID_logonHours, self.dc1_guid, 1),
 403             (DRSUAPI_ATTID_unicodePwd, self.dc1_guid, 1),
 404             (DRSUAPI_ATTID_ntPwdHistory, self.dc1_guid, 1),
 405             (DRSUAPI_ATTID_pwdLastSet, self.dc1_guid, 2),
 406             (DRSUAPI_ATTID_primaryGroupID, self.dc1_guid, 2),
 407             (DRSUAPI_ATTID_objectSid, self.dc1_guid, 1),
 408             (DRSUAPI_ATTID_accountExpires, self.dc1_guid, 2),
 409             (DRSUAPI_ATTID_lmPwdHistory, self.dc1_guid, 1),
 410             (DRSUAPI_ATTID_sAMAccountName, self.dc1_guid, 1),
 411             (DRSUAPI_ATTID_sAMAccountType, self.dc1_guid, 2),
 412             (DRSUAPI_ATTID_userPrincipalName, self.dc1_guid, 2),
 413             (DRSUAPI_ATTID_lastKnownParent, self.dc1_guid, 1),
 414             (DRSUAPI_ATTID_objectCategory, self.dc1_guid, 2),
 415             (DRSUAPI_ATTID_isRecycled, self.dc1_guid, 1)]
 416
 417         user_cur = self._check_obj(sam_ldb=self.ldb_dc1, obj_orig=user_moved_orig, is_deleted=True, expected_metadata=deleted_metadata)
 418
 419         # Modify description on DC2.  This triggers a replication, but
 420         # not of 'name' and so a bug in Samba regarding the DN.
 421         msg = ldb.Message()
 422         msg.dn = new_dn
 423         msg["description"] = ldb.MessageElement("User Description", ldb.FLAG_MOD_REPLACE, "description")
 424         self.ldb_dc2.modify(msg)
 425
 426         modified_metadata = [
 427             (DRSUAPI_ATTID_objectClass, self.dc1_guid, 1),
 428             (DRSUAPI_ATTID_cn, self.dc2_guid, 1),
 429             (DRSUAPI_ATTID_description, self.dc2_guid, 1),
 430             (DRSUAPI_ATTID_instanceType, self.dc1_guid, 1),
 431             (DRSUAPI_ATTID_whenCreated, self.dc1_guid, 1),
 432             (DRSUAPI_ATTID_ntSecurityDescriptor, self.dc1_guid, 1),
 433             (DRSUAPI_ATTID_name, self.dc1_guid, 2),
 434             (DRSUAPI_ATTID_userAccountControl, self.dc1_guid, None),
 435             (DRSUAPI_ATTID_codePage, self.dc1_guid, 1),
 436             (DRSUAPI_ATTID_countryCode, self.dc1_guid, 1),
 437             (DRSUAPI_ATTID_dBCSPwd, self.dc1_guid, 1),
 438             (DRSUAPI_ATTID_logonHours, self.dc1_guid, 1),
 439             (DRSUAPI_ATTID_unicodePwd, self.dc1_guid, 1),
 440             (DRSUAPI_ATTID_ntPwdHistory, self.dc1_guid, 1),
 441             (DRSUAPI_ATTID_pwdLastSet, self.dc1_guid, 1),
 442             (DRSUAPI_ATTID_primaryGroupID, self.dc1_guid, 1),
 443             (DRSUAPI_ATTID_objectSid, self.dc1_guid, 1),
 444             (DRSUAPI_ATTID_accountExpires, self.dc1_guid, 1),
 445             (DRSUAPI_ATTID_lmPwdHistory, self.dc1_guid, 1),
 446             (DRSUAPI_ATTID_sAMAccountName, self.dc1_guid, 1),
 447             (DRSUAPI_ATTID_sAMAccountType, self.dc1_guid, 1),
 448             (DRSUAPI_ATTID_userPrincipalName, self.dc1_guid, 1),
 449             (DRSUAPI_ATTID_objectCategory, self.dc1_guid, 1)]
 450
 451         user_cur = self._check_obj(sam_ldb=self.ldb_dc2, drs=self.drs_dc2,
 452                                    obj_orig=user_moved_orig,
 453                                    is_deleted=False,
 454                                    expected_metadata=modified_metadata)
 455
 456         # trigger replication from DC1 to DC2, for cleanup
 457         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
 458
 459         deleted_modified_metadata_dc2 = [
 460             (DRSUAPI_ATTID_objectClass, self.dc1_guid, 1),
 461             (DRSUAPI_ATTID_cn, self.dc2_guid, 2),
 462             (DRSUAPI_ATTID_description, self.dc2_guid, 2),
 463             (DRSUAPI_ATTID_instanceType, self.dc1_guid, 1),
 464             (DRSUAPI_ATTID_whenCreated, self.dc1_guid, 1),
 465             (DRSUAPI_ATTID_isDeleted, self.dc1_guid, 1),
 466             (DRSUAPI_ATTID_ntSecurityDescriptor, self.dc1_guid, 1),
 467             (DRSUAPI_ATTID_name, self.dc1_guid, 3),
 468             (DRSUAPI_ATTID_userAccountControl, self.dc1_guid, None),
 469             (DRSUAPI_ATTID_codePage, self.dc1_guid, 2),
 470             (DRSUAPI_ATTID_countryCode, self.dc1_guid, 2),
 471             (DRSUAPI_ATTID_dBCSPwd, self.dc1_guid, 1),
 472             (DRSUAPI_ATTID_logonHours, self.dc1_guid, 1),
 473             (DRSUAPI_ATTID_unicodePwd, self.dc1_guid, 1),
 474             (DRSUAPI_ATTID_ntPwdHistory, self.dc1_guid, 1),
 475             (DRSUAPI_ATTID_pwdLastSet, self.dc1_guid, 2),
 476             (DRSUAPI_ATTID_primaryGroupID, self.dc1_guid, 2),
 477             (DRSUAPI_ATTID_objectSid, self.dc1_guid, 1),
 478             (DRSUAPI_ATTID_accountExpires, self.dc1_guid, 2),
 479             (DRSUAPI_ATTID_lmPwdHistory, self.dc1_guid, 1),
 480             (DRSUAPI_ATTID_sAMAccountName, self.dc1_guid, 1),
 481             (DRSUAPI_ATTID_sAMAccountType, self.dc1_guid, 2),
 482             (DRSUAPI_ATTID_userPrincipalName, self.dc1_guid, 2),
 483             (DRSUAPI_ATTID_lastKnownParent, self.dc1_guid, 1),
 484             (DRSUAPI_ATTID_objectCategory, self.dc1_guid, 2),
 485             (DRSUAPI_ATTID_isRecycled, self.dc1_guid, 1)]
 486
 487         # check user info on DC2 - should be deleted user
 488         user_cur = self._check_obj(sam_ldb=self.ldb_dc2, drs=self.drs_dc2,
 489                                    obj_orig=user_moved_orig,
 490                                    is_deleted=True,
 491                                    expected_metadata=deleted_modified_metadata_dc2)
 492         self.assertFalse("description" in user_cur)
 493
 494         # trigger replication from DC2 to DC1, for cleanup
 495         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True)
 496
 497         deleted_modified_metadata_dc1 = [
 498             (DRSUAPI_ATTID_objectClass, self.dc1_guid, 1),
 499             (DRSUAPI_ATTID_cn, self.dc1_guid, 2),
 500             (DRSUAPI_ATTID_description, self.dc2_guid, 2),
 501             (DRSUAPI_ATTID_instanceType, self.dc1_guid, 1),
 502             (DRSUAPI_ATTID_whenCreated, self.dc1_guid, 1),
 503             (DRSUAPI_ATTID_isDeleted, self.dc1_guid, 1),
 504             (DRSUAPI_ATTID_ntSecurityDescriptor, self.dc1_guid, 1),
 505             (DRSUAPI_ATTID_name, self.dc1_guid, 3),
 506             (DRSUAPI_ATTID_userAccountControl, self.dc1_guid, None),
 507             (DRSUAPI_ATTID_codePage, self.dc1_guid, 2),
 508             (DRSUAPI_ATTID_countryCode, self.dc1_guid, 2),
 509             (DRSUAPI_ATTID_dBCSPwd, self.dc1_guid, 1),
 510             (DRSUAPI_ATTID_logonHours, self.dc1_guid, 1),
 511             (DRSUAPI_ATTID_unicodePwd, self.dc1_guid, 1),
 512             (DRSUAPI_ATTID_ntPwdHistory, self.dc1_guid, 1),
 513             (DRSUAPI_ATTID_pwdLastSet, self.dc1_guid, 2),
 514             (DRSUAPI_ATTID_primaryGroupID, self.dc1_guid, 2),
 515             (DRSUAPI_ATTID_objectSid, self.dc1_guid, 1),
 516             (DRSUAPI_ATTID_accountExpires, self.dc1_guid, 2),
 517             (DRSUAPI_ATTID_lmPwdHistory, self.dc1_guid, 1),
 518             (DRSUAPI_ATTID_sAMAccountName, self.dc1_guid, 1),
 519             (DRSUAPI_ATTID_sAMAccountType, self.dc1_guid, 2),
 520             (DRSUAPI_ATTID_userPrincipalName, self.dc1_guid, 2),
 521             (DRSUAPI_ATTID_lastKnownParent, self.dc1_guid, 1),
 522             (DRSUAPI_ATTID_objectCategory, self.dc1_guid, 2),
 523             (DRSUAPI_ATTID_isRecycled, self.dc1_guid, 1)]
 524
 525         # check user info on DC1 - should be deleted user
 526         user_cur = self._check_obj(sam_ldb=self.ldb_dc1, drs=self.drs_dc1,
 527                                    obj_orig=user_moved_orig,
 528                                    is_deleted=True,
 529                                    expected_metadata=deleted_modified_metadata_dc1)
 530         self.assertFalse("description" in user_cur)
 531
 532     def test_ReplicateMoveObject2(self):
 533         """Verifies how a moved container with a user inside is not
 534            replicated between two DCs as no replication is triggered
 535            This test should verify that:
 536             - the OU is not replicated
 537             - the user is not replicated
 538
 539            """
 540         # work-out unique username to test with
 541         username = self._make_username()
 542
 543         # create user on DC1
 544         self.ldb_dc1.newuser(username=username,
 545                              userou="ou=%s,ou=%s"
 546                              % (self.ou1_dn.get_component_value(0),
 547                                 self.top_ou.get_component_value(0)),
 548                              password=None, setpassword=False)
 549         ldb_res = self.ldb_dc1.search(base=self.ou1_dn,
 550                                       scope=SCOPE_SUBTREE,
 551                                       expression="(samAccountName=%s)" % username,
 552                                       attrs=["*", "parentGUID"])
 553         self.assertEquals(len(ldb_res), 1)
 554         user_orig = ldb_res[0]
 555         user_dn   = ldb_res[0]["dn"]
 556
 557         # check user info on DC1
 558         print("Testing for %s with GUID %s" % (username, self._GUID_string(user_orig["objectGUID"][0])))
 559         initial_metadata = [
 560             (DRSUAPI_ATTID_objectClass, self.dc1_guid, 1),
 561             (DRSUAPI_ATTID_cn, self.dc1_guid, 1),
 562             (DRSUAPI_ATTID_instanceType, self.dc1_guid, 1),
 563             (DRSUAPI_ATTID_whenCreated, self.dc1_guid, 1),
 564             (DRSUAPI_ATTID_ntSecurityDescriptor, self.dc1_guid, 1),
 565             (DRSUAPI_ATTID_name, self.dc1_guid, 1),
 566             (DRSUAPI_ATTID_userAccountControl, self.dc1_guid, None),
 567             (DRSUAPI_ATTID_codePage, self.dc1_guid, 1),
 568             (DRSUAPI_ATTID_countryCode, self.dc1_guid, 1),
 569             (DRSUAPI_ATTID_dBCSPwd, self.dc1_guid, 1),
 570             (DRSUAPI_ATTID_logonHours, self.dc1_guid, 1),
 571             (DRSUAPI_ATTID_unicodePwd, self.dc1_guid, 1),
 572             (DRSUAPI_ATTID_ntPwdHistory, self.dc1_guid, 1),
 573             (DRSUAPI_ATTID_pwdLastSet, self.dc1_guid, 1),
 574             (DRSUAPI_ATTID_primaryGroupID, self.dc1_guid, 1),
 575             (DRSUAPI_ATTID_objectSid, self.dc1_guid, 1),
 576             (DRSUAPI_ATTID_accountExpires, self.dc1_guid, 1),
 577             (DRSUAPI_ATTID_lmPwdHistory, self.dc1_guid, 1),
 578             (DRSUAPI_ATTID_sAMAccountName, self.dc1_guid, 1),
 579             (DRSUAPI_ATTID_sAMAccountType, self.dc1_guid, 1),
 580             (DRSUAPI_ATTID_userPrincipalName, self.dc1_guid, 1),
 581             (DRSUAPI_ATTID_objectCategory, self.dc1_guid, 1)]
 582
 583         self._check_obj(sam_ldb=self.ldb_dc1, drs=self.drs_dc1,
 584                         obj_orig=user_orig, is_deleted=False,
 585                         expected_metadata=initial_metadata)
 586
 587         new_dn = ldb.Dn(self.ldb_dc1, "CN=%s" % username)
 588         new_dn.add_base(self.ou2_dn)
 589         self.ldb_dc1.rename(user_dn, new_dn)
 590         ldb_res = self.ldb_dc1.search(base=self.ou2_dn,
 591                                       scope=SCOPE_SUBTREE,
 592                                       expression="(samAccountName=%s)" % username,
 593                                       attrs=["*", "parentGUID"])
 594         self.assertEquals(len(ldb_res), 1)
 595         user_moved_orig = ldb_res[0]
 596
 597         moved_metadata = [
 598             (DRSUAPI_ATTID_objectClass, self.dc1_guid, 1),
 599             (DRSUAPI_ATTID_cn, self.dc1_guid, 1),
 600             (DRSUAPI_ATTID_instanceType, self.dc1_guid, 1),
 601             (DRSUAPI_ATTID_whenCreated, self.dc1_guid, 1),
 602             (DRSUAPI_ATTID_ntSecurityDescriptor, self.dc1_guid, 1),
 603             (DRSUAPI_ATTID_name, self.dc1_guid, 2),
 604             (DRSUAPI_ATTID_userAccountControl, self.dc1_guid, None),
 605             (DRSUAPI_ATTID_codePage, self.dc1_guid, 1),
 606             (DRSUAPI_ATTID_countryCode, self.dc1_guid, 1),
 607             (DRSUAPI_ATTID_dBCSPwd, self.dc1_guid, 1),
 608             (DRSUAPI_ATTID_logonHours, self.dc1_guid, 1),
 609             (DRSUAPI_ATTID_unicodePwd, self.dc1_guid, 1),
 610             (DRSUAPI_ATTID_ntPwdHistory, self.dc1_guid, 1),
 611             (DRSUAPI_ATTID_pwdLastSet, self.dc1_guid, 1),
 612             (DRSUAPI_ATTID_primaryGroupID, self.dc1_guid, 1),
 613             (DRSUAPI_ATTID_objectSid, self.dc1_guid, 1),
 614             (DRSUAPI_ATTID_accountExpires, self.dc1_guid, 1),
 615             (DRSUAPI_ATTID_lmPwdHistory, self.dc1_guid, 1),
 616             (DRSUAPI_ATTID_sAMAccountName, self.dc1_guid, 1),
 617             (DRSUAPI_ATTID_sAMAccountType, self.dc1_guid, 1),
 618             (DRSUAPI_ATTID_userPrincipalName, self.dc1_guid, 1),
 619             (DRSUAPI_ATTID_objectCategory, self.dc1_guid, 1)]
 620
 621         # check user info on DC1 after rename - should be valid user
 622         user_cur = self._check_obj(sam_ldb=self.ldb_dc1, drs=self.drs_dc1,
 623                                    obj_orig=user_moved_orig,
 624                                    is_deleted=False,
 625                                    expected_metadata=moved_metadata)
 626
 627         # check user info on DC2 - should not be there, we have not done replication
 628         ldb_res = self.ldb_dc2.search(base=self.ou2_dn,
 629                                       scope=SCOPE_SUBTREE,
 630                                       expression="(samAccountName=%s)" % username,
 631                                       attrs=["*", "parentGUID"])
 632         self.assertEquals(len(ldb_res), 0)
 633
 634         # delete user on DC1
 635         self.ldb_dc1.delete('<GUID=%s>' % self._GUID_string(user_orig["objectGUID"][0]))
 636
 637         deleted_metadata_dc1 = [
 638             (DRSUAPI_ATTID_objectClass, self.dc1_guid, 1),
 639             (DRSUAPI_ATTID_cn, self.dc1_guid, 2),
 640             (DRSUAPI_ATTID_instanceType, self.dc1_guid, 1),
 641             (DRSUAPI_ATTID_whenCreated, self.dc1_guid, 1),
 642             (DRSUAPI_ATTID_isDeleted, self.dc1_guid, 1),
 643             (DRSUAPI_ATTID_ntSecurityDescriptor, self.dc1_guid, 1),
 644             (DRSUAPI_ATTID_name, self.dc1_guid, 3),
 645             (DRSUAPI_ATTID_userAccountControl, self.dc1_guid, None),
 646             (DRSUAPI_ATTID_codePage, self.dc1_guid, 2),
 647             (DRSUAPI_ATTID_countryCode, self.dc1_guid, 2),
 648             (DRSUAPI_ATTID_dBCSPwd, self.dc1_guid, 1),
 649             (DRSUAPI_ATTID_logonHours, self.dc1_guid, 1),
 650             (DRSUAPI_ATTID_unicodePwd, self.dc1_guid, 1),
 651             (DRSUAPI_ATTID_ntPwdHistory, self.dc1_guid, 1),
 652             (DRSUAPI_ATTID_pwdLastSet, self.dc1_guid, 2),
 653             (DRSUAPI_ATTID_primaryGroupID, self.dc1_guid, 2),
 654             (DRSUAPI_ATTID_objectSid, self.dc1_guid, 1),
 655             (DRSUAPI_ATTID_accountExpires, self.dc1_guid, 2),
 656             (DRSUAPI_ATTID_lmPwdHistory, self.dc1_guid, 1),
 657             (DRSUAPI_ATTID_sAMAccountName, self.dc1_guid, 1),
 658             (DRSUAPI_ATTID_sAMAccountType, self.dc1_guid, 2),
 659             (DRSUAPI_ATTID_userPrincipalName, self.dc1_guid, 2),
 660             (DRSUAPI_ATTID_lastKnownParent, self.dc1_guid, 1),
 661             (DRSUAPI_ATTID_objectCategory, self.dc1_guid, 2),
 662             (DRSUAPI_ATTID_isRecycled, self.dc1_guid, 1)]
 663
 664         # check user info on DC1 - should be deleted user
 665         user_cur = self._check_obj(sam_ldb=self.ldb_dc1, drs=self.drs_dc1,
 666                                    obj_orig=user_moved_orig,
 667                                    is_deleted=True,
 668                                    expected_metadata=deleted_metadata_dc1)
 669         # trigger replication from DC1 to DC2, for cleanup
 670         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
 671
 672         deleted_metadata_dc2 = [
 673             (DRSUAPI_ATTID_objectClass, self.dc1_guid, 1),
 674             (DRSUAPI_ATTID_cn, self.dc2_guid, 1),
 675             (DRSUAPI_ATTID_instanceType, self.dc1_guid, 1),
 676             (DRSUAPI_ATTID_whenCreated, self.dc1_guid, 1),
 677             (DRSUAPI_ATTID_isDeleted, self.dc1_guid, 1),
 678             (DRSUAPI_ATTID_ntSecurityDescriptor, self.dc1_guid, 1),
 679             (DRSUAPI_ATTID_name, self.dc1_guid, 3),
 680             (DRSUAPI_ATTID_userAccountControl, self.dc1_guid, None),
 681             (DRSUAPI_ATTID_codePage, self.dc1_guid, 2),
 682             (DRSUAPI_ATTID_countryCode, self.dc1_guid, 2),
 683             (DRSUAPI_ATTID_dBCSPwd, self.dc1_guid, 1),
 684             (DRSUAPI_ATTID_logonHours, self.dc1_guid, 1),
 685             (DRSUAPI_ATTID_unicodePwd, self.dc1_guid, 1),
 686             (DRSUAPI_ATTID_ntPwdHistory, self.dc1_guid, 1),
 687             (DRSUAPI_ATTID_pwdLastSet, self.dc1_guid, 2),
 688             (DRSUAPI_ATTID_primaryGroupID, self.dc1_guid, 2),
 689             (DRSUAPI_ATTID_objectSid, self.dc1_guid, 1),
 690             (DRSUAPI_ATTID_accountExpires, self.dc1_guid, 2),
 691             (DRSUAPI_ATTID_lmPwdHistory, self.dc1_guid, 1),
 692             (DRSUAPI_ATTID_sAMAccountName, self.dc1_guid, 1),
 693             (DRSUAPI_ATTID_sAMAccountType, self.dc1_guid, 2),
 694             (DRSUAPI_ATTID_userPrincipalName, self.dc1_guid, 2),
 695             (DRSUAPI_ATTID_lastKnownParent, self.dc1_guid, 1),
 696             (DRSUAPI_ATTID_objectCategory, self.dc1_guid, 2),
 697             (DRSUAPI_ATTID_isRecycled, self.dc1_guid, 1)]
 698
 699         # check user info on DC2 - should be deleted user
 700         user_cur = self._check_obj(sam_ldb=self.ldb_dc2, drs=self.drs_dc2,
 701                                    obj_orig=user_moved_orig,
 702                                    is_deleted=True,
 703                                    expected_metadata=deleted_metadata_dc2)
 704
 705         # trigger replication from DC2 to DC1, for cleanup
 706         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True)
 707
 708         # check user info on DC1 - should be deleted user
 709         user_cur = self._check_obj(sam_ldb=self.ldb_dc1, drs=self.drs_dc1,
 710                                    obj_orig=user_moved_orig,
 711                                    is_deleted=True,
 712                                    expected_metadata=deleted_metadata_dc1)
 713
 714     def test_ReplicateMoveObject3(self):
 715         """Verifies how a moved container with a user inside is replicated between two DCs.
 716            This test should verify that:
 717             - the OU is created on DC1
 718             - the OU is renamed on DC1
 719             - We verify that after replication,
 720               that the user has the correct DN (under OU2).
 721
 722            """
 723         # work-out unique username to test with
 724         username = self._make_username()
 725
 726         # create user on DC1
 727         self.ldb_dc1.newuser(username=username,
 728                              userou="ou=%s,ou=%s"
 729                              % (self.ou1_dn.get_component_value(0),
 730                                 self.top_ou.get_component_value(0)),
 731                              password=None, setpassword=False)
 732         ldb_res = self.ldb_dc1.search(base=self.ou1_dn,
 733                                       scope=SCOPE_SUBTREE,
 734                                       expression="(samAccountName=%s)" % username,
 735                                       attrs=["*", "parentGUID"])
 736         self.assertEquals(len(ldb_res), 1)
 737         user_orig = ldb_res[0]
 738         user_dn   = ldb_res[0]["dn"]
 739
 740         # check user info on DC1
 741         print("Testing for %s with GUID %s" % (username, self._GUID_string(user_orig["objectGUID"][0])))
 742         initial_metadata = [
 743             (DRSUAPI_ATTID_objectClass, self.dc1_guid, 1),
 744             (DRSUAPI_ATTID_cn, self.dc1_guid, 1),
 745             (DRSUAPI_ATTID_instanceType, self.dc1_guid, 1),
 746             (DRSUAPI_ATTID_whenCreated, self.dc1_guid, 1),
 747             (DRSUAPI_ATTID_ntSecurityDescriptor, self.dc1_guid, 1),
 748             (DRSUAPI_ATTID_name, self.dc1_guid, 1),
 749             (DRSUAPI_ATTID_userAccountControl, self.dc1_guid, None),
 750             (DRSUAPI_ATTID_codePage, self.dc1_guid, 1),
 751             (DRSUAPI_ATTID_countryCode, self.dc1_guid, 1),
 752             (DRSUAPI_ATTID_dBCSPwd, self.dc1_guid, 1),
 753             (DRSUAPI_ATTID_logonHours, self.dc1_guid, 1),
 754             (DRSUAPI_ATTID_unicodePwd, self.dc1_guid, 1),
 755             (DRSUAPI_ATTID_ntPwdHistory, self.dc1_guid, 1),
 756             (DRSUAPI_ATTID_pwdLastSet, self.dc1_guid, 1),
 757             (DRSUAPI_ATTID_primaryGroupID, self.dc1_guid, 1),
 758             (DRSUAPI_ATTID_objectSid, self.dc1_guid, 1),
 759             (DRSUAPI_ATTID_accountExpires, self.dc1_guid, 1),
 760             (DRSUAPI_ATTID_lmPwdHistory, self.dc1_guid, 1),
 761             (DRSUAPI_ATTID_sAMAccountName, self.dc1_guid, 1),
 762             (DRSUAPI_ATTID_sAMAccountType, self.dc1_guid, 1),
 763             (DRSUAPI_ATTID_userPrincipalName, self.dc1_guid, 1),
 764             (DRSUAPI_ATTID_objectCategory, self.dc1_guid, 1)]
 765
 766         self._check_obj(sam_ldb=self.ldb_dc1, drs=self.drs_dc1,
 767                         obj_orig=user_orig, is_deleted=False,
 768                         expected_metadata=initial_metadata)
 769
 770         new_dn = ldb.Dn(self.ldb_dc1, "CN=%s" % username)
 771         new_dn.add_base(self.ou2_dn)
 772         self.ldb_dc1.rename(user_dn, new_dn)
 773         ldb_res = self.ldb_dc1.search(base=self.ou2_dn,
 774                                       scope=SCOPE_SUBTREE,
 775                                       expression="(samAccountName=%s)" % username,
 776                                       attrs=["*", "parentGUID"])
 777         self.assertEquals(len(ldb_res), 1)
 778
 779         user_moved_orig = ldb_res[0]
 780         user_moved_dn   = ldb_res[0]["dn"]
 781
 782         # trigger replication from DC1 to DC2
 783         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
 784         moved_metadata = [
 785             (DRSUAPI_ATTID_objectClass, self.dc1_guid, 1),
 786             (DRSUAPI_ATTID_cn, self.dc1_guid, 1),
 787             (DRSUAPI_ATTID_instanceType, self.dc1_guid, 1),
 788             (DRSUAPI_ATTID_whenCreated, self.dc1_guid, 1),
 789             (DRSUAPI_ATTID_ntSecurityDescriptor, self.dc1_guid, 1),
 790             (DRSUAPI_ATTID_name, self.dc1_guid, 2),
 791             (DRSUAPI_ATTID_userAccountControl, self.dc1_guid, None),
 792             (DRSUAPI_ATTID_codePage, self.dc1_guid, 1),
 793             (DRSUAPI_ATTID_countryCode, self.dc1_guid, 1),
 794             (DRSUAPI_ATTID_dBCSPwd, self.dc1_guid, 1),
 795             (DRSUAPI_ATTID_logonHours, self.dc1_guid, 1),
 796             (DRSUAPI_ATTID_unicodePwd, self.dc1_guid, 1),
 797             (DRSUAPI_ATTID_ntPwdHistory, self.dc1_guid, 1),
 798             (DRSUAPI_ATTID_pwdLastSet, self.dc1_guid, 1),
 799             (DRSUAPI_ATTID_primaryGroupID, self.dc1_guid, 1),
 800             (DRSUAPI_ATTID_objectSid, self.dc1_guid, 1),
 801             (DRSUAPI_ATTID_accountExpires, self.dc1_guid, 1),
 802             (DRSUAPI_ATTID_lmPwdHistory, self.dc1_guid, 1),
 803             (DRSUAPI_ATTID_sAMAccountName, self.dc1_guid, 1),
 804             (DRSUAPI_ATTID_sAMAccountType, self.dc1_guid, 1),
 805             (DRSUAPI_ATTID_userPrincipalName, self.dc1_guid, 1),
 806             (DRSUAPI_ATTID_objectCategory, self.dc1_guid, 1)]
 807
 808         # check user info on DC1 after rename - should be valid user
 809         user_cur = self._check_obj(sam_ldb=self.ldb_dc1, drs=self.drs_dc1,
 810                                    obj_orig=user_moved_orig,
 811                                    is_deleted=False,
 812                                    expected_metadata=moved_metadata)
 813
 814         # delete user on DC1
 815         self.ldb_dc1.delete('<GUID=%s>' % self._GUID_string(user_orig["objectGUID"][0]))
 816         deleted_metadata_dc1 = [
 817             (DRSUAPI_ATTID_objectClass, self.dc1_guid, 1),
 818             (DRSUAPI_ATTID_cn, self.dc1_guid, 2),
 819             (DRSUAPI_ATTID_instanceType, self.dc1_guid, 1),
 820             (DRSUAPI_ATTID_whenCreated, self.dc1_guid, 1),
 821             (DRSUAPI_ATTID_isDeleted, self.dc1_guid, 1),
 822             (DRSUAPI_ATTID_ntSecurityDescriptor, self.dc1_guid, 1),
 823             (DRSUAPI_ATTID_name, self.dc1_guid, 3),
 824             (DRSUAPI_ATTID_userAccountControl, self.dc1_guid, None),
 825             (DRSUAPI_ATTID_codePage, self.dc1_guid, 2),
 826             (DRSUAPI_ATTID_countryCode, self.dc1_guid, 2),
 827             (DRSUAPI_ATTID_dBCSPwd, self.dc1_guid, 1),
 828             (DRSUAPI_ATTID_logonHours, self.dc1_guid, 1),
 829             (DRSUAPI_ATTID_unicodePwd, self.dc1_guid, 1),
 830             (DRSUAPI_ATTID_ntPwdHistory, self.dc1_guid, 1),
 831             (DRSUAPI_ATTID_pwdLastSet, self.dc1_guid, 2),
 832             (DRSUAPI_ATTID_primaryGroupID, self.dc1_guid, 2),
 833             (DRSUAPI_ATTID_objectSid, self.dc1_guid, 1),
 834             (DRSUAPI_ATTID_accountExpires, self.dc1_guid, 2),
 835             (DRSUAPI_ATTID_lmPwdHistory, self.dc1_guid, 1),
 836             (DRSUAPI_ATTID_sAMAccountName, self.dc1_guid, 1),
 837             (DRSUAPI_ATTID_sAMAccountType, self.dc1_guid, 2),
 838             (DRSUAPI_ATTID_userPrincipalName, self.dc1_guid, 2),
 839             (DRSUAPI_ATTID_lastKnownParent, self.dc1_guid, 1),
 840             (DRSUAPI_ATTID_objectCategory, self.dc1_guid, 2),
 841             (DRSUAPI_ATTID_isRecycled, self.dc1_guid, 1)]
 842
 843         # check user info on DC1 - should be deleted user
 844         user_cur = self._check_obj(sam_ldb=self.ldb_dc1, drs=self.drs_dc1,
 845                                    obj_orig=user_moved_orig,
 846                                    is_deleted=True,
 847                                    expected_metadata=deleted_metadata_dc1)
 848
 849         # trigger replication from DC2 to DC1
 850         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True)
 851
 852         # check user info on DC1 - should be deleted user
 853         user_cur = self._check_obj(sam_ldb=self.ldb_dc1, drs=self.drs_dc1,
 854                                    obj_orig=user_moved_orig,
 855                                    is_deleted=True,
 856                                    expected_metadata=deleted_metadata_dc1)
 857
 858         # trigger replication from DC1 to DC2, for cleanup
 859         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
 860
 861         deleted_metadata_dc2 = [
 862             (DRSUAPI_ATTID_objectClass, self.dc1_guid, 1),
 863             (DRSUAPI_ATTID_cn, self.dc2_guid, 2),
 864             (DRSUAPI_ATTID_instanceType, self.dc1_guid, 1),
 865             (DRSUAPI_ATTID_whenCreated, self.dc1_guid, 1),
 866             (DRSUAPI_ATTID_isDeleted, self.dc1_guid, 1),
 867             (DRSUAPI_ATTID_ntSecurityDescriptor, self.dc1_guid, 1),
 868             (DRSUAPI_ATTID_name, self.dc1_guid, 3),
 869             (DRSUAPI_ATTID_userAccountControl, self.dc1_guid, None),
 870             (DRSUAPI_ATTID_codePage, self.dc1_guid, 2),
 871             (DRSUAPI_ATTID_countryCode, self.dc1_guid, 2),
 872             (DRSUAPI_ATTID_dBCSPwd, self.dc1_guid, 1),
 873             (DRSUAPI_ATTID_logonHours, self.dc1_guid, 1),
 874             (DRSUAPI_ATTID_unicodePwd, self.dc1_guid, 1),
 875             (DRSUAPI_ATTID_ntPwdHistory, self.dc1_guid, 1),
 876             (DRSUAPI_ATTID_pwdLastSet, self.dc1_guid, 2),
 877             (DRSUAPI_ATTID_primaryGroupID, self.dc1_guid, 2),
 878             (DRSUAPI_ATTID_objectSid, self.dc1_guid, 1),
 879             (DRSUAPI_ATTID_accountExpires, self.dc1_guid, 2),
 880             (DRSUAPI_ATTID_lmPwdHistory, self.dc1_guid, 1),
 881             (DRSUAPI_ATTID_sAMAccountName, self.dc1_guid, 1),
 882             (DRSUAPI_ATTID_sAMAccountType, self.dc1_guid, 2),
 883             (DRSUAPI_ATTID_userPrincipalName, self.dc1_guid, 2),
 884             (DRSUAPI_ATTID_lastKnownParent, self.dc1_guid, 1),
 885             (DRSUAPI_ATTID_objectCategory, self.dc1_guid, 2),
 886             (DRSUAPI_ATTID_isRecycled, self.dc1_guid, 1)]
 887
 888         # check user info on DC2 - should be deleted user
 889         user_cur = self._check_obj(sam_ldb=self.ldb_dc2, drs=self.drs_dc2,
 890                                    obj_orig=user_moved_orig,
 891                                    is_deleted=True,
 892                                    expected_metadata=deleted_metadata_dc2)
 893
 894     def test_ReplicateMoveObject3b(self):
 895         """Verifies how a moved container with a user inside is replicated between two DCs.
 896            This test should verify that:
 897             - the OU is created on DC1
 898             - the OU is renamed on DC1
 899             - We verify that after replication,
 900               that the user has the correct DN (under OU2).
 901
 902            """
 903         # work-out unique username to test with
 904         username = self._make_username()
 905
 906         # create user on DC1
 907         self.ldb_dc1.newuser(username=username,
 908                              userou="ou=%s,ou=%s"
 909                              % (self.ou1_dn.get_component_value(0),
 910                                 self.top_ou.get_component_value(0)),
 911                              password=None, setpassword=False)
 912         ldb_res = self.ldb_dc1.search(base=self.ou1_dn,
 913                                       scope=SCOPE_SUBTREE,
 914                                       expression="(samAccountName=%s)" % username,
 915                                       attrs=["*", "parentGUID"])
 916         self.assertEquals(len(ldb_res), 1)
 917         user_orig = ldb_res[0]
 918         user_dn   = ldb_res[0]["dn"]
 919
 920         # check user info on DC1
 921         print("Testing for %s with GUID %s" % (username, self._GUID_string(user_orig["objectGUID"][0])))
 922         initial_metadata = [
 923             (DRSUAPI_ATTID_objectClass, self.dc1_guid, 1),
 924             (DRSUAPI_ATTID_cn, self.dc1_guid, 1),
 925             (DRSUAPI_ATTID_instanceType, self.dc1_guid, 1),
 926             (DRSUAPI_ATTID_whenCreated, self.dc1_guid, 1),
 927             (DRSUAPI_ATTID_ntSecurityDescriptor, self.dc1_guid, 1),
 928             (DRSUAPI_ATTID_name, self.dc1_guid, 1),
 929             (DRSUAPI_ATTID_userAccountControl, self.dc1_guid, None),
 930             (DRSUAPI_ATTID_codePage, self.dc1_guid, 1),
 931             (DRSUAPI_ATTID_countryCode, self.dc1_guid, 1),
 932             (DRSUAPI_ATTID_dBCSPwd, self.dc1_guid, 1),
 933             (DRSUAPI_ATTID_logonHours, self.dc1_guid, 1),
 934             (DRSUAPI_ATTID_unicodePwd, self.dc1_guid, 1),
 935             (DRSUAPI_ATTID_ntPwdHistory, self.dc1_guid, 1),
 936             (DRSUAPI_ATTID_pwdLastSet, self.dc1_guid, 1),
 937             (DRSUAPI_ATTID_primaryGroupID, self.dc1_guid, 1),
 938             (DRSUAPI_ATTID_objectSid, self.dc1_guid, 1),
 939             (DRSUAPI_ATTID_accountExpires, self.dc1_guid, 1),
 940             (DRSUAPI_ATTID_lmPwdHistory, self.dc1_guid, 1),
 941             (DRSUAPI_ATTID_sAMAccountName, self.dc1_guid, 1),
 942             (DRSUAPI_ATTID_sAMAccountType, self.dc1_guid, 1),
 943             (DRSUAPI_ATTID_userPrincipalName, self.dc1_guid, 1),
 944             (DRSUAPI_ATTID_objectCategory, self.dc1_guid, 1)]
 945
 946         self._check_obj(sam_ldb=self.ldb_dc1, drs=self.drs_dc1,
 947                         obj_orig=user_orig, is_deleted=False,
 948                         expected_metadata=initial_metadata)
 949
 950         new_dn = ldb.Dn(self.ldb_dc1, "CN=%s" % username)
 951         new_dn.add_base(self.ou2_dn)
 952         self.ldb_dc1.rename(user_dn, new_dn)
 953         ldb_res = self.ldb_dc1.search(base=self.ou2_dn,
 954                                       scope=SCOPE_SUBTREE,
 955                                       expression="(samAccountName=%s)" % username,
 956                                       attrs=["*", "parentGUID"])
 957         self.assertEquals(len(ldb_res), 1)
 958
 959         user_moved_orig = ldb_res[0]
 960         user_moved_dn   = ldb_res[0]["dn"]
 961
 962         # trigger replication from DC2 (Which has never seen the object) to DC1
 963         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True)
 964         moved_metadata = [
 965             (DRSUAPI_ATTID_objectClass, self.dc1_guid, 1),
 966             (DRSUAPI_ATTID_cn, self.dc1_guid, 1),
 967             (DRSUAPI_ATTID_instanceType, self.dc1_guid, 1),
 968             (DRSUAPI_ATTID_whenCreated, self.dc1_guid, 1),
 969             (DRSUAPI_ATTID_ntSecurityDescriptor, self.dc1_guid, 1),
 970             (DRSUAPI_ATTID_name, self.dc1_guid, 2),
 971             (DRSUAPI_ATTID_userAccountControl, self.dc1_guid, None),
 972             (DRSUAPI_ATTID_codePage, self.dc1_guid, 1),
 973             (DRSUAPI_ATTID_countryCode, self.dc1_guid, 1),
 974             (DRSUAPI_ATTID_dBCSPwd, self.dc1_guid, 1),
 975             (DRSUAPI_ATTID_logonHours, self.dc1_guid, 1),
 976             (DRSUAPI_ATTID_unicodePwd, self.dc1_guid, 1),
 977             (DRSUAPI_ATTID_ntPwdHistory, self.dc1_guid, 1),
 978             (DRSUAPI_ATTID_pwdLastSet, self.dc1_guid, 1),
 979             (DRSUAPI_ATTID_primaryGroupID, self.dc1_guid, 1),
 980             (DRSUAPI_ATTID_objectSid, self.dc1_guid, 1),
 981             (DRSUAPI_ATTID_accountExpires, self.dc1_guid, 1),
 982             (DRSUAPI_ATTID_lmPwdHistory, self.dc1_guid, 1),
 983             (DRSUAPI_ATTID_sAMAccountName, self.dc1_guid, 1),
 984             (DRSUAPI_ATTID_sAMAccountType, self.dc1_guid, 1),
 985             (DRSUAPI_ATTID_userPrincipalName, self.dc1_guid, 1),
 986             (DRSUAPI_ATTID_objectCategory, self.dc1_guid, 1)]
 987
 988         # check user info on DC1 after rename - should be valid user
 989         user_cur = self._check_obj(sam_ldb=self.ldb_dc1, drs=self.drs_dc1,
 990                                    obj_orig=user_moved_orig,
 991                                    is_deleted=False,
 992                                    expected_metadata=moved_metadata)
 993
 994         # delete user on DC1
 995         self.ldb_dc1.delete('<GUID=%s>' % self._GUID_string(user_orig["objectGUID"][0]))
 996         deleted_metadata_dc1 = [
 997             (DRSUAPI_ATTID_objectClass, self.dc1_guid, 1),
 998             (DRSUAPI_ATTID_cn, self.dc1_guid, 2),
 999             (DRSUAPI_ATTID_instanceType, self.dc1_guid, 1),
1000             (DRSUAPI_ATTID_whenCreated, self.dc1_guid, 1),
1001             (DRSUAPI_ATTID_isDeleted, self.dc1_guid, 1),
1002             (DRSUAPI_ATTID_ntSecurityDescriptor, self.dc1_guid, 1),
1003             (DRSUAPI_ATTID_name, self.dc1_guid, 3),
1004             (DRSUAPI_ATTID_userAccountControl, self.dc1_guid, None),
1005             (DRSUAPI_ATTID_codePage, self.dc1_guid, 2),
1006             (DRSUAPI_ATTID_countryCode, self.dc1_guid, 2),
1007             (DRSUAPI_ATTID_dBCSPwd, self.dc1_guid, 1),
1008             (DRSUAPI_ATTID_logonHours, self.dc1_guid, 1),
1009             (DRSUAPI_ATTID_unicodePwd, self.dc1_guid, 1),
1010             (DRSUAPI_ATTID_ntPwdHistory, self.dc1_guid, 1),
1011             (DRSUAPI_ATTID_pwdLastSet, self.dc1_guid, 2),
1012             (DRSUAPI_ATTID_primaryGroupID, self.dc1_guid, 2),
1013             (DRSUAPI_ATTID_objectSid, self.dc1_guid, 1),
1014             (DRSUAPI_ATTID_accountExpires, self.dc1_guid, 2),
1015             (DRSUAPI_ATTID_lmPwdHistory, self.dc1_guid, 1),
1016             (DRSUAPI_ATTID_sAMAccountName, self.dc1_guid, 1),
1017             (DRSUAPI_ATTID_sAMAccountType, self.dc1_guid, 2),
1018             (DRSUAPI_ATTID_userPrincipalName, self.dc1_guid, 2),
1019             (DRSUAPI_ATTID_lastKnownParent, self.dc1_guid, 1),
1020             (DRSUAPI_ATTID_objectCategory, self.dc1_guid, 2),
1021             (DRSUAPI_ATTID_isRecycled, self.dc1_guid, 1)]
1022
1023         # check user info on DC1 - should be deleted user
1024         user_cur = self._check_obj(sam_ldb=self.ldb_dc1, drs=self.drs_dc1,
1025                                    obj_orig=user_moved_orig,
1026                                    is_deleted=True,
1027                                    expected_metadata=deleted_metadata_dc1)
1028
1029         # trigger replication from DC2 to DC1
1030         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True)
1031
1032         # check user info on DC1 - should be deleted user
1033         user_cur = self._check_obj(sam_ldb=self.ldb_dc1, drs=self.drs_dc1,
1034                                    obj_orig=user_moved_orig,
1035                                    is_deleted=True,
1036                                    expected_metadata=deleted_metadata_dc1)
1037
1038         # trigger replication from DC1 to DC2, for cleanup
1039         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
1040
1041         deleted_metadata_dc2 = [
1042             (DRSUAPI_ATTID_objectClass, self.dc1_guid, 1),
1043             (DRSUAPI_ATTID_cn, self.dc2_guid, 1),
1044             (DRSUAPI_ATTID_instanceType, self.dc1_guid, 1),
1045             (DRSUAPI_ATTID_whenCreated, self.dc1_guid, 1),
1046             (DRSUAPI_ATTID_isDeleted, self.dc1_guid, 1),
1047             (DRSUAPI_ATTID_ntSecurityDescriptor, self.dc1_guid, 1),
1048             (DRSUAPI_ATTID_name, self.dc1_guid, 3),
1049             (DRSUAPI_ATTID_userAccountControl, self.dc1_guid, None),
1050             (DRSUAPI_ATTID_codePage, self.dc1_guid, 2),
1051             (DRSUAPI_ATTID_countryCode, self.dc1_guid, 2),
1052             (DRSUAPI_ATTID_dBCSPwd, self.dc1_guid, 1),
1053             (DRSUAPI_ATTID_logonHours, self.dc1_guid, 1),
1054             (DRSUAPI_ATTID_unicodePwd, self.dc1_guid, 1),
1055             (DRSUAPI_ATTID_ntPwdHistory, self.dc1_guid, 1),
1056             (DRSUAPI_ATTID_pwdLastSet, self.dc1_guid, 2),
1057             (DRSUAPI_ATTID_primaryGroupID, self.dc1_guid, 2),
1058             (DRSUAPI_ATTID_objectSid, self.dc1_guid, 1),
1059             (DRSUAPI_ATTID_accountExpires, self.dc1_guid, 2),
1060             (DRSUAPI_ATTID_lmPwdHistory, self.dc1_guid, 1),
1061             (DRSUAPI_ATTID_sAMAccountName, self.dc1_guid, 1),
1062             (DRSUAPI_ATTID_sAMAccountType, self.dc1_guid, 2),
1063             (DRSUAPI_ATTID_userPrincipalName, self.dc1_guid, 2),
1064             (DRSUAPI_ATTID_lastKnownParent, self.dc1_guid, 1),
1065             (DRSUAPI_ATTID_objectCategory, self.dc1_guid, 2),
1066             (DRSUAPI_ATTID_isRecycled, self.dc1_guid, 1)]
1067
1068         # check user info on DC2 - should be deleted user
1069         user_cur = self._check_obj(sam_ldb=self.ldb_dc2, drs=self.drs_dc2,
1070                                    obj_orig=user_moved_orig,
1071                                    is_deleted=True,
1072                                    expected_metadata=deleted_metadata_dc2)
1073
1074     def test_ReplicateMoveObject4(self):
1075         """Verifies how a moved container with a user inside is replicated between two DCs.
1076            This test should verify that:
1077             - the OU is replicated properly
1078             - the user is modified on DC2
1079             - the OU is renamed on DC1
1080             - We verify that after replication DC1 -> DC2,
1081               that the user has the correct DN (under OU2), and the description
1082
1083            """
1084         # work-out unique username to test with
1085         username = self._make_username()
1086
1087         # create user on DC1
1088         self.ldb_dc1.newuser(username=username,
1089                              userou="ou=%s,ou=%s"
1090                              % (self.ou1_dn.get_component_value(0),
1091                                 self.top_ou.get_component_value(0)),
1092                              password=None, setpassword=False)
1093         ldb_res = self.ldb_dc1.search(base=self.ou1_dn,
1094                                       scope=SCOPE_SUBTREE,
1095                                       expression="(samAccountName=%s)" % username,
1096                                       attrs=["*", "parentGUID"])
1097         self.assertEquals(len(ldb_res), 1)
1098         user_orig = ldb_res[0]
1099         user_dn   = ldb_res[0]["dn"]
1100
1101         # check user info on DC1
1102         print("Testing for %s with GUID %s" % (username, self._GUID_string(user_orig["objectGUID"][0])))
1103         initial_metadata = [
1104             (DRSUAPI_ATTID_objectClass, self.dc1_guid, 1),
1105             (DRSUAPI_ATTID_cn, self.dc1_guid, 1),
1106             (DRSUAPI_ATTID_instanceType, self.dc1_guid, 1),
1107             (DRSUAPI_ATTID_whenCreated, self.dc1_guid, 1),
1108             (DRSUAPI_ATTID_ntSecurityDescriptor, self.dc1_guid, 1),
1109             (DRSUAPI_ATTID_name, self.dc1_guid, 1),
1110             (DRSUAPI_ATTID_userAccountControl, self.dc1_guid, None),
1111             (DRSUAPI_ATTID_codePage, self.dc1_guid, 1),
1112             (DRSUAPI_ATTID_countryCode, self.dc1_guid, 1),
1113             (DRSUAPI_ATTID_dBCSPwd, self.dc1_guid, 1),
1114             (DRSUAPI_ATTID_logonHours, self.dc1_guid, 1),
1115             (DRSUAPI_ATTID_unicodePwd, self.dc1_guid, 1),
1116             (DRSUAPI_ATTID_ntPwdHistory, self.dc1_guid, 1),
1117             (DRSUAPI_ATTID_pwdLastSet, self.dc1_guid, 1),
1118             (DRSUAPI_ATTID_primaryGroupID, self.dc1_guid, 1),
1119             (DRSUAPI_ATTID_objectSid, self.dc1_guid, 1),
1120             (DRSUAPI_ATTID_accountExpires, self.dc1_guid, 1),
1121             (DRSUAPI_ATTID_lmPwdHistory, self.dc1_guid, 1),
1122             (DRSUAPI_ATTID_sAMAccountName, self.dc1_guid, 1),
1123             (DRSUAPI_ATTID_sAMAccountType, self.dc1_guid, 1),
1124             (DRSUAPI_ATTID_userPrincipalName, self.dc1_guid, 1),
1125             (DRSUAPI_ATTID_objectCategory, self.dc1_guid, 1)]
1126
1127         self._check_obj(sam_ldb=self.ldb_dc1, drs=self.drs_dc1,
1128                         obj_orig=user_orig, is_deleted=False,
1129                         expected_metadata=initial_metadata)
1130
1131         # trigger replication from DC1 to DC2
1132         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
1133
1134         initial_metadata_dc2 = [
1135             (DRSUAPI_ATTID_objectClass, self.dc1_guid, 1),
1136             (DRSUAPI_ATTID_cn, self.dc2_guid, 1),
1137             (DRSUAPI_ATTID_instanceType, self.dc1_guid, 1),
1138             (DRSUAPI_ATTID_whenCreated, self.dc1_guid, 1),
1139             (DRSUAPI_ATTID_ntSecurityDescriptor, self.dc1_guid, 1),
1140             (DRSUAPI_ATTID_name, self.dc1_guid, 1),
1141             (DRSUAPI_ATTID_userAccountControl, self.dc1_guid, None),
1142             (DRSUAPI_ATTID_codePage, self.dc1_guid, 1),
1143             (DRSUAPI_ATTID_countryCode, self.dc1_guid, 1),
1144             (DRSUAPI_ATTID_dBCSPwd, self.dc1_guid, 1),
1145             (DRSUAPI_ATTID_logonHours, self.dc1_guid, 1),
1146             (DRSUAPI_ATTID_unicodePwd, self.dc1_guid, 1),
1147             (DRSUAPI_ATTID_ntPwdHistory, self.dc1_guid, 1),
1148             (DRSUAPI_ATTID_pwdLastSet, self.dc1_guid, 1),
1149             (DRSUAPI_ATTID_primaryGroupID, self.dc1_guid, 1),
1150             (DRSUAPI_ATTID_objectSid, self.dc1_guid, 1),
1151             (DRSUAPI_ATTID_accountExpires, self.dc1_guid, 1),
1152             (DRSUAPI_ATTID_lmPwdHistory, self.dc1_guid, 1),
1153             (DRSUAPI_ATTID_sAMAccountName, self.dc1_guid, 1),
1154             (DRSUAPI_ATTID_sAMAccountType, self.dc1_guid, 1),
1155             (DRSUAPI_ATTID_userPrincipalName, self.dc1_guid, 1),
1156             (DRSUAPI_ATTID_objectCategory, self.dc1_guid, 1)]
1157
1158         # check user info on DC2 - should still be valid user
1159         user_cur = self._check_obj(sam_ldb=self.ldb_dc2, drs=self.drs_dc2,
1160                                    obj_orig=user_orig, is_deleted=False,
1161                                    expected_metadata=initial_metadata_dc2)
1162
1163         new_dn = ldb.Dn(self.ldb_dc1, "CN=%s" % username)
1164         new_dn.add_base(self.ou2_dn)
1165         self.ldb_dc1.rename(user_dn, new_dn)
1166         ldb_res = self.ldb_dc1.search(base=self.ou2_dn,
1167                                       scope=SCOPE_SUBTREE,
1168                                       expression="(samAccountName=%s)" % username,
1169                                       attrs=["*", "parentGUID"])
1170         self.assertEquals(len(ldb_res), 1)
1171
1172         user_moved_orig = ldb_res[0]
1173         user_moved_dn   = ldb_res[0]["dn"]
1174
1175         moved_metadata = [
1176             (DRSUAPI_ATTID_objectClass, self.dc1_guid, 1),
1177             (DRSUAPI_ATTID_cn, self.dc1_guid, 1),
1178             (DRSUAPI_ATTID_instanceType, self.dc1_guid, 1),
1179             (DRSUAPI_ATTID_whenCreated, self.dc1_guid, 1),
1180             (DRSUAPI_ATTID_ntSecurityDescriptor, self.dc1_guid, 1),
1181             (DRSUAPI_ATTID_name, self.dc1_guid, 2),
1182             (DRSUAPI_ATTID_userAccountControl, self.dc1_guid, None),
1183             (DRSUAPI_ATTID_codePage, self.dc1_guid, 1),
1184             (DRSUAPI_ATTID_countryCode, self.dc1_guid, 1),
1185             (DRSUAPI_ATTID_dBCSPwd, self.dc1_guid, 1),
1186             (DRSUAPI_ATTID_logonHours, self.dc1_guid, 1),
1187             (DRSUAPI_ATTID_unicodePwd, self.dc1_guid, 1),
1188             (DRSUAPI_ATTID_ntPwdHistory, self.dc1_guid, 1),
1189             (DRSUAPI_ATTID_pwdLastSet, self.dc1_guid, 1),
1190             (DRSUAPI_ATTID_primaryGroupID, self.dc1_guid, 1),
1191             (DRSUAPI_ATTID_objectSid, self.dc1_guid, 1),
1192             (DRSUAPI_ATTID_accountExpires, self.dc1_guid, 1),
1193             (DRSUAPI_ATTID_lmPwdHistory, self.dc1_guid, 1),
1194             (DRSUAPI_ATTID_sAMAccountName, self.dc1_guid, 1),
1195             (DRSUAPI_ATTID_sAMAccountType, self.dc1_guid, 1),
1196             (DRSUAPI_ATTID_userPrincipalName, self.dc1_guid, 1),
1197             (DRSUAPI_ATTID_objectCategory, self.dc1_guid, 1)]
1198
1199         # check user info on DC1 after rename - should be valid user
1200         user_cur = self._check_obj(sam_ldb=self.ldb_dc1, drs=self.drs_dc1,
1201                                    obj_orig=user_moved_orig,
1202                                    is_deleted=False,
1203                                    expected_metadata=moved_metadata)
1204
1205         # Modify description on DC2.  This triggers a replication, but
1206         # not of 'name' and so a bug in Samba regarding the DN.
1207         msg = ldb.Message()
1208         msg.dn = user_dn
1209         msg["description"] = ldb.MessageElement("User Description", ldb.FLAG_MOD_REPLACE, "description")
1210         self.ldb_dc2.modify(msg)
1211
1212         modified_metadata = [
1213             (DRSUAPI_ATTID_objectClass, self.dc1_guid, 1),
1214             (DRSUAPI_ATTID_cn, self.dc2_guid, 1),
1215             (DRSUAPI_ATTID_description, self.dc2_guid, 1),
1216             (DRSUAPI_ATTID_instanceType, self.dc1_guid, 1),
1217             (DRSUAPI_ATTID_whenCreated, self.dc1_guid, 1),
1218             (DRSUAPI_ATTID_ntSecurityDescriptor, self.dc1_guid, 1),
1219             (DRSUAPI_ATTID_name, self.dc1_guid, 1),
1220             (DRSUAPI_ATTID_userAccountControl, self.dc1_guid, None),
1221             (DRSUAPI_ATTID_codePage, self.dc1_guid, 1),
1222             (DRSUAPI_ATTID_countryCode, self.dc1_guid, 1),
1223             (DRSUAPI_ATTID_dBCSPwd, self.dc1_guid, 1),
1224             (DRSUAPI_ATTID_logonHours, self.dc1_guid, 1),
1225             (DRSUAPI_ATTID_unicodePwd, self.dc1_guid, 1),
1226             (DRSUAPI_ATTID_ntPwdHistory, self.dc1_guid, 1),
1227             (DRSUAPI_ATTID_pwdLastSet, self.dc1_guid, 1),
1228             (DRSUAPI_ATTID_primaryGroupID, self.dc1_guid, 1),
1229             (DRSUAPI_ATTID_objectSid, self.dc1_guid, 1),
1230             (DRSUAPI_ATTID_accountExpires, self.dc1_guid, 1),
1231             (DRSUAPI_ATTID_lmPwdHistory, self.dc1_guid, 1),
1232             (DRSUAPI_ATTID_sAMAccountName, self.dc1_guid, 1),
1233             (DRSUAPI_ATTID_sAMAccountType, self.dc1_guid, 1),
1234             (DRSUAPI_ATTID_userPrincipalName, self.dc1_guid, 1),
1235             (DRSUAPI_ATTID_objectCategory, self.dc1_guid, 1)]
1236
1237         user_cur = self._check_obj(sam_ldb=self.ldb_dc2, drs=self.drs_dc2,
1238                                    obj_orig=user_orig,
1239                                    is_deleted=False,
1240                                    expected_metadata=modified_metadata)
1241
1242         # trigger replication from DC1 to DC2
1243         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
1244
1245         modified_renamed_metadata = [
1246             (DRSUAPI_ATTID_objectClass, self.dc1_guid, 1),
1247             (DRSUAPI_ATTID_cn, self.dc2_guid, 2),
1248             (DRSUAPI_ATTID_description, self.dc2_guid, 1),
1249             (DRSUAPI_ATTID_instanceType, self.dc1_guid, 1),
1250             (DRSUAPI_ATTID_whenCreated, self.dc1_guid, 1),
1251             (DRSUAPI_ATTID_ntSecurityDescriptor, self.dc1_guid, 1),
1252             (DRSUAPI_ATTID_name, self.dc1_guid, 2),
1253             (DRSUAPI_ATTID_userAccountControl, self.dc1_guid, None),
1254             (DRSUAPI_ATTID_codePage, self.dc1_guid, 1),
1255             (DRSUAPI_ATTID_countryCode, self.dc1_guid, 1),
1256             (DRSUAPI_ATTID_dBCSPwd, self.dc1_guid, 1),
1257             (DRSUAPI_ATTID_logonHours, self.dc1_guid, 1),
1258             (DRSUAPI_ATTID_unicodePwd, self.dc1_guid, 1),
1259             (DRSUAPI_ATTID_ntPwdHistory, self.dc1_guid, 1),
1260             (DRSUAPI_ATTID_pwdLastSet, self.dc1_guid, 1),
1261             (DRSUAPI_ATTID_primaryGroupID, self.dc1_guid, 1),
1262             (DRSUAPI_ATTID_objectSid, self.dc1_guid, 1),
1263             (DRSUAPI_ATTID_accountExpires, self.dc1_guid, 1),
1264             (DRSUAPI_ATTID_lmPwdHistory, self.dc1_guid, 1),
1265             (DRSUAPI_ATTID_sAMAccountName, self.dc1_guid, 1),
1266             (DRSUAPI_ATTID_sAMAccountType, self.dc1_guid, 1),
1267             (DRSUAPI_ATTID_userPrincipalName, self.dc1_guid, 1),
1268             (DRSUAPI_ATTID_objectCategory, self.dc1_guid, 1)]
1269
1270         # check user info on DC2 - should still be valid user
1271         user_cur = self._check_obj(sam_ldb=self.ldb_dc2, drs=self.drs_dc2,
1272                                    obj_orig=user_moved_orig,
1273                                    is_deleted=False,
1274                                    expected_metadata=modified_renamed_metadata)
1275
1276         self.assertTrue("description" in user_cur)
1277
1278         # delete user on DC1
1279         self.ldb_dc1.delete('<GUID=%s>' % self._GUID_string(user_orig["objectGUID"][0]))
1280         deleted_metadata_dc1 = [
1281             (DRSUAPI_ATTID_objectClass, self.dc1_guid, 1),
1282             (DRSUAPI_ATTID_cn, self.dc1_guid, 2),
1283             (DRSUAPI_ATTID_instanceType, self.dc1_guid, 1),
1284             (DRSUAPI_ATTID_whenCreated, self.dc1_guid, 1),
1285             (DRSUAPI_ATTID_isDeleted, self.dc1_guid, 1),
1286             (DRSUAPI_ATTID_ntSecurityDescriptor, self.dc1_guid, 1),
1287             (DRSUAPI_ATTID_name, self.dc1_guid, 3),
1288             (DRSUAPI_ATTID_userAccountControl, self.dc1_guid, None),
1289             (DRSUAPI_ATTID_codePage, self.dc1_guid, 2),
1290             (DRSUAPI_ATTID_countryCode, self.dc1_guid, 2),
1291             (DRSUAPI_ATTID_dBCSPwd, self.dc1_guid, 1),
1292             (DRSUAPI_ATTID_logonHours, self.dc1_guid, 1),
1293             (DRSUAPI_ATTID_unicodePwd, self.dc1_guid, 1),
1294             (DRSUAPI_ATTID_ntPwdHistory, self.dc1_guid, 1),
1295             (DRSUAPI_ATTID_pwdLastSet, self.dc1_guid, 2),
1296             (DRSUAPI_ATTID_primaryGroupID, self.dc1_guid, 2),
1297             (DRSUAPI_ATTID_objectSid, self.dc1_guid, 1),
1298             (DRSUAPI_ATTID_accountExpires, self.dc1_guid, 2),
1299             (DRSUAPI_ATTID_lmPwdHistory, self.dc1_guid, 1),
1300             (DRSUAPI_ATTID_sAMAccountName, self.dc1_guid, 1),
1301             (DRSUAPI_ATTID_sAMAccountType, self.dc1_guid, 2),
1302             (DRSUAPI_ATTID_userPrincipalName, self.dc1_guid, 2),
1303             (DRSUAPI_ATTID_lastKnownParent, self.dc1_guid, 1),
1304             (DRSUAPI_ATTID_objectCategory, self.dc1_guid, 2),
1305             (DRSUAPI_ATTID_isRecycled, self.dc1_guid, 1)]
1306
1307         # check user info on DC1 - should be deleted user
1308         user_cur = self._check_obj(sam_ldb=self.ldb_dc1, drs=self.drs_dc1,
1309                                    obj_orig=user_moved_orig,
1310                                    is_deleted=True,
1311                                    expected_metadata=deleted_metadata_dc1)
1312
1313         # trigger replication from DC2 to DC1
1314         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True)
1315         # check user info on DC2 - should still be valid user
1316         user_cur = self._check_obj(sam_ldb=self.ldb_dc2, drs=self.drs_dc2,
1317                                    obj_orig=user_moved_orig,
1318                                    is_deleted=False,
1319                                    expected_metadata=modified_renamed_metadata)
1320
1321         self.assertTrue("description" in user_cur)
1322
1323         deleted_metadata_dc1 = [
1324             (DRSUAPI_ATTID_objectClass, self.dc1_guid, 1),
1325             (DRSUAPI_ATTID_cn, self.dc1_guid, 2),
1326             (DRSUAPI_ATTID_description, self.dc1_guid, 2),
1327             (DRSUAPI_ATTID_instanceType, self.dc1_guid, 1),
1328             (DRSUAPI_ATTID_whenCreated, self.dc1_guid, 1),
1329             (DRSUAPI_ATTID_isDeleted, self.dc1_guid, 1),
1330             (DRSUAPI_ATTID_ntSecurityDescriptor, self.dc1_guid, 1),
1331             (DRSUAPI_ATTID_name, self.dc1_guid, 3),
1332             (DRSUAPI_ATTID_userAccountControl, self.dc1_guid, None),
1333             (DRSUAPI_ATTID_codePage, self.dc1_guid, 2),
1334             (DRSUAPI_ATTID_countryCode, self.dc1_guid, 2),
1335             (DRSUAPI_ATTID_dBCSPwd, self.dc1_guid, 1),
1336             (DRSUAPI_ATTID_logonHours, self.dc1_guid, 1),
1337             (DRSUAPI_ATTID_unicodePwd, self.dc1_guid, 1),
1338             (DRSUAPI_ATTID_ntPwdHistory, self.dc1_guid, 1),
1339             (DRSUAPI_ATTID_pwdLastSet, self.dc1_guid, 2),
1340             (DRSUAPI_ATTID_primaryGroupID, self.dc1_guid, 2),
1341             (DRSUAPI_ATTID_objectSid, self.dc1_guid, 1),
1342             (DRSUAPI_ATTID_accountExpires, self.dc1_guid, 2),
1343             (DRSUAPI_ATTID_lmPwdHistory, self.dc1_guid, 1),
1344             (DRSUAPI_ATTID_sAMAccountName, self.dc1_guid, 1),
1345             (DRSUAPI_ATTID_sAMAccountType, self.dc1_guid, 2),
1346             (DRSUAPI_ATTID_userPrincipalName, self.dc1_guid, 2),
1347             (DRSUAPI_ATTID_lastKnownParent, self.dc1_guid, 1),
1348             (DRSUAPI_ATTID_objectCategory, self.dc1_guid, 2),
1349             (DRSUAPI_ATTID_isRecycled, self.dc1_guid, 1)]
1350
1351         # check user info on DC1 - should be deleted user
1352         user_cur = self._check_obj(sam_ldb=self.ldb_dc1, drs=self.drs_dc1,
1353                                    obj_orig=user_moved_orig,
1354                                    is_deleted=True,
1355                                    expected_metadata=deleted_metadata_dc1)
1356
1357         self.assertFalse("description" in user_cur)
1358
1359         # trigger replication from DC1 to DC2, for cleanup
1360         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
1361
1362         deleted_metadata_dc2 = [
1363             (DRSUAPI_ATTID_objectClass, self.dc1_guid, 1),
1364             (DRSUAPI_ATTID_cn, self.dc2_guid, 3),
1365             (DRSUAPI_ATTID_description, self.dc1_guid, 2),
1366             (DRSUAPI_ATTID_instanceType, self.dc1_guid, 1),
1367             (DRSUAPI_ATTID_whenCreated, self.dc1_guid, 1),
1368             (DRSUAPI_ATTID_isDeleted, self.dc1_guid, 1),
1369             (DRSUAPI_ATTID_ntSecurityDescriptor, self.dc1_guid, 1),
1370             (DRSUAPI_ATTID_name, self.dc1_guid, 3),
1371             (DRSUAPI_ATTID_userAccountControl, self.dc1_guid, None),
1372             (DRSUAPI_ATTID_codePage, self.dc1_guid, 2),
1373             (DRSUAPI_ATTID_countryCode, self.dc1_guid, 2),
1374             (DRSUAPI_ATTID_dBCSPwd, self.dc1_guid, 1),
1375             (DRSUAPI_ATTID_logonHours, self.dc1_guid, 1),
1376             (DRSUAPI_ATTID_unicodePwd, self.dc1_guid, 1),
1377             (DRSUAPI_ATTID_ntPwdHistory, self.dc1_guid, 1),
1378             (DRSUAPI_ATTID_pwdLastSet, self.dc1_guid, 2),
1379             (DRSUAPI_ATTID_primaryGroupID, self.dc1_guid, 2),
1380             (DRSUAPI_ATTID_objectSid, self.dc1_guid, 1),
1381             (DRSUAPI_ATTID_accountExpires, self.dc1_guid, 2),
1382             (DRSUAPI_ATTID_lmPwdHistory, self.dc1_guid, 1),
1383             (DRSUAPI_ATTID_sAMAccountName, self.dc1_guid, 1),
1384             (DRSUAPI_ATTID_sAMAccountType, self.dc1_guid, 2),
1385             (DRSUAPI_ATTID_userPrincipalName, self.dc1_guid, 2),
1386             (DRSUAPI_ATTID_lastKnownParent, self.dc1_guid, 1),
1387             (DRSUAPI_ATTID_objectCategory, self.dc1_guid, 2),
1388             (DRSUAPI_ATTID_isRecycled, self.dc1_guid, 1)]
1389
1390         # check user info on DC2 - should be deleted user
1391         user_cur = self._check_obj(sam_ldb=self.ldb_dc2, drs=self.drs_dc2,
1392                                    obj_orig=user_moved_orig,
1393                                    is_deleted=True,
1394                                    expected_metadata=deleted_metadata_dc2)
1395
1396         self.assertFalse("description" in user_cur)
1397
1398     def test_ReplicateMoveObject5(self):
1399         """Verifies how a moved container with a user inside is replicated between two DCs.
1400            This test should verify that:
1401             - the OU is replicated properly
1402             - the user is modified on DC2
1403             - the OU is renamed on DC1
1404             - We verify that after replication DC2 -> DC1,
1405               that the user has the correct DN (under OU2), and the description
1406
1407            """
1408         # work-out unique username to test with
1409         username = self._make_username()
1410
1411         # create user on DC1
1412         self.ldb_dc1.newuser(username=username,
1413                              userou="ou=%s,ou=%s"
1414                              % (self.ou1_dn.get_component_value(0),
1415                                 self.top_ou.get_component_value(0)),
1416                              password=None, setpassword=False)
1417         ldb_res = self.ldb_dc1.search(base=self.ou1_dn,
1418                                       scope=SCOPE_SUBTREE,
1419                                       expression="(samAccountName=%s)" % username,
1420                                       attrs=["*", "parentGUID"])
1421         self.assertEquals(len(ldb_res), 1)
1422         user_orig = ldb_res[0]
1423         user_dn   = ldb_res[0]["dn"]
1424
1425         # trigger replication from DC1 to DC2
1426         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
1427         # check user info on DC2 - should still be valid user
1428         user_cur = self._check_obj(sam_ldb=self.ldb_dc1, obj_orig=user_orig, is_deleted=False)
1429
1430         # check user info on DC1
1431         print("Testing for %s with GUID %s" % (username, self._GUID_string(user_orig["objectGUID"][0])))
1432         self._check_obj(sam_ldb=self.ldb_dc1, obj_orig=user_orig, is_deleted=False)
1433
1434         new_dn = ldb.Dn(self.ldb_dc1, "CN=%s" % username)
1435         new_dn.add_base(self.ou2_dn)
1436         self.ldb_dc1.rename(user_dn, new_dn)
1437         ldb_res = self.ldb_dc1.search(base=self.ou2_dn,
1438                                       scope=SCOPE_SUBTREE,
1439                                       expression="(samAccountName=%s)" % username,
1440                                       attrs=["*", "parentGUID"])
1441         self.assertEquals(len(ldb_res), 1)
1442
1443         user_moved_orig = ldb_res[0]
1444         user_moved_dn   = ldb_res[0]["dn"]
1445
1446         # Modify description on DC2.  This triggers a replication, but
1447         # not of 'name' and so a bug in Samba regarding the DN.
1448         msg = ldb.Message()
1449         msg.dn = user_dn
1450         msg["description"] = ldb.MessageElement("User Description", ldb.FLAG_MOD_REPLACE, "description")
1451         self.ldb_dc2.modify(msg)
1452
1453         # trigger replication from DC2 to DC1
1454         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True)
1455         # check user info on DC1 - should still be valid user
1456         user_cur = self._check_obj(sam_ldb=self.ldb_dc1, obj_orig=user_moved_orig, is_deleted=False)
1457         self.assertTrue("description" in user_cur)
1458
1459         # trigger replication from DC1 to DC2
1460         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
1461         user_cur = self._check_obj(sam_ldb=self.ldb_dc2, obj_orig=user_moved_orig, is_deleted=False)
1462         self.assertTrue("description" in user_cur)
1463
1464         # delete user on DC2
1465         self.ldb_dc2.delete('<GUID=%s>' % self._GUID_string(user_orig["objectGUID"][0]))
1466         # trigger replication from DC2 to DC1 for cleanup
1467         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True)
1468
1469         # check user info on DC1 - should be deleted user
1470         user_cur = self._check_obj(sam_ldb=self.ldb_dc1, obj_orig=user_moved_orig, is_deleted=True)
1471         self.assertFalse("description" in user_cur)
1472
1473     def test_ReplicateMoveObject6(self):
1474         """Verifies how a moved container is replicated between two DCs.
1475            This test should verify that:
1476             - the OU1 is replicated properly
1477             - the OU1 is modified on DC2
1478             - the OU1 is renamed on DC1
1479             - We verify that after replication DC1 -> DC2,
1480               that the OU1 has the correct DN (under OU2), and the description
1481
1482            """
1483         ldb_res = self.ldb_dc1.search(base=self.ou1_dn,
1484                                       scope=SCOPE_BASE,
1485                                       attrs=["*", "parentGUID"])
1486         self.assertEquals(len(ldb_res), 1)
1487         ou_orig = ldb_res[0]
1488         ou_dn   = ldb_res[0]["dn"]
1489
1490         # check user info on DC1
1491         print("Testing for %s with GUID %s" % (self.ou1_dn, self._GUID_string(ou_orig["objectGUID"][0])))
1492         self._check_obj(sam_ldb=self.ldb_dc1, obj_orig=ou_orig, is_deleted=False)
1493
1494         # trigger replication from DC1 to DC2
1495         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
1496         # check user info on DC2 - should still be valid user
1497         ou_cur = self._check_obj(sam_ldb=self.ldb_dc1, obj_orig=ou_orig, is_deleted=False)
1498
1499         new_dn = ldb.Dn(self.ldb_dc1, "OU=%s" % self.ou1_dn.get_component_value(0))
1500         new_dn.add_base(self.ou2_dn)
1501         self.ldb_dc1.rename(ou_dn, new_dn)
1502         ldb_res = self.ldb_dc1.search(base=new_dn,
1503                                       scope=SCOPE_BASE,
1504                                       attrs=["*", "parentGUID"])
1505         self.assertEquals(len(ldb_res), 1)
1506
1507         ou_moved_orig = ldb_res[0]
1508         ou_moved_dn   = ldb_res[0]["dn"]
1509
1510         # Modify description on DC2.  This triggers a replication, but
1511         # not of 'name' and so a bug in Samba regarding the DN.
1512         msg = ldb.Message()
1513         msg.dn = ou_dn
1514         msg["description"] = ldb.MessageElement("OU Description", ldb.FLAG_MOD_REPLACE, "description")
1515         self.ldb_dc2.modify(msg)
1516
1517         # trigger replication from DC1 to DC2
1518         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
1519         # check user info on DC2 - should still be valid user
1520         ou_cur = self._check_obj(sam_ldb=self.ldb_dc2, obj_orig=ou_moved_orig, is_deleted=False)
1521         self.assertTrue("description" in ou_cur)
1522
1523         # delete OU on DC1
1524         self.ldb_dc1.delete('<GUID=%s>' % self._GUID_string(ou_orig["objectGUID"][0]))
1525         # trigger replication from DC2 to DC1
1526         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True)
1527         # check user info on DC2 - should be deleted user
1528         ou_cur = self._check_obj(sam_ldb=self.ldb_dc1, obj_orig=ou_moved_orig, is_deleted=True)
1529         self.assertFalse("description" in ou_cur)
1530
1531         # trigger replication from DC1 to DC2, for cleanup
1532         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
1533
1534         # check user info on DC2 - should be deleted user
1535         ou_cur = self._check_obj(sam_ldb=self.ldb_dc2, obj_orig=ou_moved_orig, is_deleted=True)
1536         self.assertFalse("description" in ou_cur)
1537
1538     def test_ReplicateMoveObject7(self):
1539         """Verifies how a moved container is replicated between two DCs.
1540            This test should verify that:
1541             - the OU1 is replicated properly
1542             - the OU1 is modified on DC2
1543             - the OU1 is renamed on DC1 to be under OU2
1544             - We verify that after replication DC2 -> DC1,
1545               that the OU1 has the correct DN (under OU2), and the description
1546
1547            """
1548         ldb_res = self.ldb_dc1.search(base=self.ou1_dn,
1549                                       scope=SCOPE_BASE,
1550                                       attrs=["*", "parentGUID"])
1551         self.assertEquals(len(ldb_res), 1)
1552         ou_orig = ldb_res[0]
1553         ou_dn   = ldb_res[0]["dn"]
1554
1555         # check user info on DC1
1556         print("Testing for %s with GUID %s" % (self.ou1_dn, self._GUID_string(ou_orig["objectGUID"][0])))
1557         self._check_obj(sam_ldb=self.ldb_dc1, obj_orig=ou_orig, is_deleted=False)
1558
1559         # trigger replication from DC1 to DC2
1560         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
1561         # check user info on DC2 - should still be valid user
1562         ou_cur = self._check_obj(sam_ldb=self.ldb_dc1, obj_orig=ou_orig, is_deleted=False)
1563
1564         new_dn = ldb.Dn(self.ldb_dc1, "OU=%s" % self.ou1_dn.get_component_value(0))
1565         new_dn.add_base(self.ou2_dn)
1566         self.ldb_dc1.rename(ou_dn, new_dn)
1567         ldb_res = self.ldb_dc1.search(base=new_dn,
1568                                       scope=SCOPE_BASE,
1569                                       attrs=["*", "parentGUID"])
1570         self.assertEquals(len(ldb_res), 1)
1571
1572         ou_moved_orig = ldb_res[0]
1573         ou_moved_dn   = ldb_res[0]["dn"]
1574
1575         # Modify description on DC2.  This triggers a replication, but
1576         # not of 'name' and so a bug in Samba regarding the DN.
1577         msg = ldb.Message()
1578         msg.dn = ou_dn
1579         msg["description"] = ldb.MessageElement("OU Description", ldb.FLAG_MOD_REPLACE, "description")
1580         self.ldb_dc2.modify(msg)
1581
1582         # trigger replication from DC2 to DC1
1583         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True)
1584         # check user info on DC1 - should still be valid user
1585         ou_cur = self._check_obj(sam_ldb=self.ldb_dc1, obj_orig=ou_moved_orig, is_deleted=False)
1586         self.assertTrue("description" in ou_cur)
1587
1588         # delete OU on DC1
1589         self.ldb_dc1.delete('<GUID=%s>' % self._GUID_string(ou_orig["objectGUID"][0]))
1590         # trigger replication from DC2 to DC1
1591         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True)
1592         # check user info on DC2 - should be deleted user
1593         ou_cur = self._check_obj(sam_ldb=self.ldb_dc1, obj_orig=ou_moved_orig, is_deleted=True)
1594         self.assertFalse("description" in ou_cur)
1595
1596         # trigger replication from DC1 to DC2, for cleanup
1597         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
1598
1599         # check user info on DC2 - should be deleted user
1600         ou_cur = self._check_obj(sam_ldb=self.ldb_dc2, obj_orig=ou_moved_orig, is_deleted=True)
1601         self.assertFalse("description" in ou_cur)
1602
1603     def test_ReplicateMoveObject8(self):
1604         """Verifies how a moved container is replicated between two DCs.
1605            This test should verify that:
1606             - the OU1 is replicated properly
1607             - the OU1 is modified on DC2
1608             - the OU1 is renamed on DC1 to OU1-renamed
1609             - We verify that after replication DC1 -> DC2,
1610               that the OU1 has the correct DN (OU1-renamed), and the description
1611
1612            """
1613         ldb_res = self.ldb_dc1.search(base=self.ou1_dn,
1614                                       scope=SCOPE_BASE,
1615                                       attrs=["*", "parentGUID"])
1616         self.assertEquals(len(ldb_res), 1)
1617         ou_orig = ldb_res[0]
1618         ou_dn   = ldb_res[0]["dn"]
1619
1620         # check user info on DC1
1621         print("Testing for %s with GUID %s" % (self.ou1_dn, self._GUID_string(ou_orig["objectGUID"][0])))
1622         self._check_obj(sam_ldb=self.ldb_dc1, obj_orig=ou_orig, is_deleted=False)
1623
1624         # trigger replication from DC1 to DC2
1625         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
1626         # check user info on DC2 - should still be valid user
1627         ou_cur = self._check_obj(sam_ldb=self.ldb_dc1, obj_orig=ou_orig, is_deleted=False)
1628
1629         new_dn = ldb.Dn(self.ldb_dc1, "OU=%s-renamed" % self.ou1_dn.get_component_value(0))
1630         new_dn.add_base(self.ou1_dn.parent())
1631         self.ldb_dc1.rename(ou_dn, new_dn)
1632         ldb_res = self.ldb_dc1.search(base=new_dn,
1633                                       scope=SCOPE_BASE,
1634                                       attrs=["*", "parentGUID"])
1635         self.assertEquals(len(ldb_res), 1)
1636
1637         ou_moved_orig = ldb_res[0]
1638         ou_moved_dn   = ldb_res[0]["dn"]
1639
1640         # Modify description on DC2.  This triggers a replication, but
1641         # not of 'name' and so a bug in Samba regarding the DN.
1642         msg = ldb.Message()
1643         msg.dn = ou_dn
1644         msg["description"] = ldb.MessageElement("OU Description", ldb.FLAG_MOD_REPLACE, "description")
1645         self.ldb_dc2.modify(msg)
1646
1647         # trigger replication from DC1 to DC2
1648         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
1649         # check user info on DC2 - should still be valid user
1650         ou_cur = self._check_obj(sam_ldb=self.ldb_dc2, obj_orig=ou_moved_orig, is_deleted=False)
1651         self.assertTrue("description" in ou_cur)
1652
1653         # delete OU on DC1
1654         self.ldb_dc1.delete('<GUID=%s>' % self._GUID_string(ou_orig["objectGUID"][0]))
1655         # trigger replication from DC2 to DC1
1656         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True)
1657         # check user info on DC2 - should be deleted user
1658         ou_cur = self._check_obj(sam_ldb=self.ldb_dc1, obj_orig=ou_moved_orig, is_deleted=True)
1659         self.assertFalse("description" in ou_cur)
1660
1661         # trigger replication from DC1 to DC2, for cleanup
1662         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
1663
1664         # check user info on DC2 - should be deleted user
1665         ou_cur = self._check_obj(sam_ldb=self.ldb_dc2, obj_orig=ou_moved_orig, is_deleted=True)
1666         self.assertFalse("description" in ou_cur)
1667
1668     def test_ReplicateMoveObject9(self):
1669         """Verifies how a moved container is replicated between two DCs.
1670            This test should verify that:
1671             - the OU1 is replicated properly
1672             - the OU1 is modified on DC2
1673             - the OU1 is renamed on DC1 to be under OU2
1674             - the OU1 is renamed on DC1 to OU1-renamed
1675             - We verify that after replication DC1 -> DC2,
1676               that the OU1 has the correct DN (OU1-renamed), and the description
1677
1678            """
1679         ldb_res = self.ldb_dc1.search(base=self.ou1_dn,
1680                                       scope=SCOPE_BASE,
1681                                       attrs=["*", "parentGUID"])
1682         self.assertEquals(len(ldb_res), 1)
1683         ou_orig = ldb_res[0]
1684         ou_dn   = ldb_res[0]["dn"]
1685
1686         # check user info on DC1
1687         print("Testing for %s with GUID %s" % (self.ou1_dn, self._GUID_string(ou_orig["objectGUID"][0])))
1688         self._check_obj(sam_ldb=self.ldb_dc1, obj_orig=ou_orig, is_deleted=False)
1689
1690         # trigger replication from DC1 to DC2
1691         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
1692         # check user info on DC2 - should still be valid user
1693         ou_cur = self._check_obj(sam_ldb=self.ldb_dc1, obj_orig=ou_orig, is_deleted=False)
1694
1695         new_dn = ldb.Dn(self.ldb_dc1, "OU=%s-renamed" % self.ou1_dn.get_component_value(0))
1696         new_dn.add_base(self.ou1_dn.parent())
1697         self.ldb_dc1.rename(ou_dn, new_dn)
1698         ldb_res = self.ldb_dc1.search(base=new_dn,
1699                                       scope=SCOPE_BASE,
1700                                       attrs=["*", "parentGUID"])
1701         self.assertEquals(len(ldb_res), 1)
1702
1703         ou_moved_orig = ldb_res[0]
1704         ou_moved_dn   = ldb_res[0]["dn"]
1705
1706         # Modify description on DC2.  This triggers a replication, but
1707         # not of 'name' and so a bug in Samba regarding the DN.
1708         msg = ldb.Message()
1709         msg.dn = ou_dn
1710         msg["description"] = ldb.MessageElement("OU Description", ldb.FLAG_MOD_REPLACE, "description")
1711         self.ldb_dc2.modify(msg)
1712
1713         # trigger replication from DC2 to DC1
1714         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True)
1715         # check user info on DC1 - should still be valid user
1716         ou_cur = self._check_obj(sam_ldb=self.ldb_dc1, obj_orig=ou_moved_orig, is_deleted=False)
1717         self.assertTrue("description" in ou_cur)
1718
1719         # delete OU on DC1
1720         self.ldb_dc1.delete('<GUID=%s>' % self._GUID_string(ou_orig["objectGUID"][0]))
1721         # trigger replication from DC2 to DC1
1722         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True)
1723         # check user info on DC2 - should be deleted user
1724         ou_cur = self._check_obj(sam_ldb=self.ldb_dc1, obj_orig=ou_moved_orig, is_deleted=True)
1725         self.assertFalse("description" in ou_cur)
1726
1727         # trigger replication from DC1 to DC2, for cleanup
1728         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
1729
1730         # check user info on DC2 - should be deleted user
1731         ou_cur = self._check_obj(sam_ldb=self.ldb_dc2, obj_orig=ou_moved_orig, is_deleted=True)
1732         self.assertFalse("description" in ou_cur)
1733
1734     def test_ReplicateMoveObject10(self):
1735         """Verifies how a moved container is replicated between two DCs.
1736            This test should verify that:
1737             - the OU1 is replicated properly
1738             - the OU1 is modified on DC2
1739             - the OU1 is deleted on DC1
1740             - We verify that after replication DC1 -> DC2,
1741               that the OU1 is deleted, and the description has gone away
1742
1743            """
1744         ldb_res = self.ldb_dc1.search(base=self.ou1_dn,
1745                                       scope=SCOPE_BASE,
1746                                       attrs=["*", "parentGUID"])
1747         self.assertEquals(len(ldb_res), 1)
1748         ou_orig = ldb_res[0]
1749         ou_dn   = ldb_res[0]["dn"]
1750
1751         # check user info on DC1
1752         print("Testing for %s with GUID %s" % (self.ou1_dn, self._GUID_string(ou_orig["objectGUID"][0])))
1753         self._check_obj(sam_ldb=self.ldb_dc1, obj_orig=ou_orig, is_deleted=False)
1754
1755         # trigger replication from DC1 to DC2
1756         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
1757         # check user info on DC2 - should still be valid user
1758         ou_cur = self._check_obj(sam_ldb=self.ldb_dc1, obj_orig=ou_orig, is_deleted=False)
1759
1760         # Modify description on DC2.  This triggers a replication, but
1761         # not of 'name' and so a bug in Samba regarding the DN.
1762         msg = ldb.Message()
1763         msg.dn = ou_dn
1764         msg["description"] = ldb.MessageElement("OU Description", ldb.FLAG_MOD_REPLACE, "description")
1765         self.ldb_dc2.modify(msg)
1766
1767         # delete OU on DC1
1768         self.ldb_dc1.delete('<GUID=%s>' % self._GUID_string(ou_orig["objectGUID"][0]))
1769         # trigger replication from DC1 to DC2
1770         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
1771         # check user info on DC2 - should be deleted OU
1772         ou_cur = self._check_obj(sam_ldb=self.ldb_dc2, obj_orig=ou_orig, is_deleted=True)
1773         self.assertFalse("description" in ou_cur)
1774
1775         # trigger replication from DC1 to DC2, for cleanup
1776         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True)
1777
1778         # check user info on DC2 - should be deleted OU
1779         ou_cur = self._check_obj(sam_ldb=self.ldb_dc1, obj_orig=ou_orig, is_deleted=True)
1780         self.assertFalse("description" in ou_cur)
1781
1782     def test_ReplicateMoveObject11(self):
1783         """Verifies how a moved container is replicated between two DCs.
1784            This test should verify that:
1785             - the OU1 is replicated properly
1786             - the OU1 is modified on DC2
1787             - the OU1 is deleted on DC1
1788             - We verify that after replication DC2 -> DC1,
1789               that the OU1 is deleted, and the description has gone away
1790
1791            """
1792         ldb_res = self.ldb_dc1.search(base=self.ou1_dn,
1793                                       scope=SCOPE_BASE,
1794                                       attrs=["*", "parentGUID"])
1795         self.assertEquals(len(ldb_res), 1)
1796         ou_orig = ldb_res[0]
1797         ou_dn   = ldb_res[0]["dn"]
1798
1799         # check user info on DC1
1800         print("Testing for %s with GUID %s" % (self.ou1_dn, self._GUID_string(ou_orig["objectGUID"][0])))
1801         self._check_obj(sam_ldb=self.ldb_dc1, obj_orig=ou_orig, is_deleted=False)
1802
1803         # trigger replication from DC1 to DC2
1804         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
1805         # check user info on DC2 - should still be valid user
1806         ou_cur = self._check_obj(sam_ldb=self.ldb_dc1, obj_orig=ou_orig, is_deleted=False)
1807
1808         # Modify description on DC2.  This triggers a replication, but
1809         # not of 'name' and so a bug in Samba regarding the DN.
1810         msg = ldb.Message()
1811         msg.dn = ou_dn
1812         msg["description"] = ldb.MessageElement("OU Description", ldb.FLAG_MOD_REPLACE, "description")
1813         self.ldb_dc2.modify(msg)
1814
1815         # delete OU on DC1
1816         self.ldb_dc1.delete('<GUID=%s>' % self._GUID_string(ou_orig["objectGUID"][0]))
1817         # trigger replication from DC2 to DC1
1818         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True)
1819         # check user info on DC2 - should be deleted OU
1820         ou_cur = self._check_obj(sam_ldb=self.ldb_dc1, obj_orig=ou_orig, is_deleted=True)
1821         self.assertFalse("description" in ou_cur)
1822
1823         # trigger replication from DC1 to DC2, for cleanup
1824         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
1825
1826         # check user info on DC2 - should be deleted OU
1827         ou_cur = self._check_obj(sam_ldb=self.ldb_dc2, obj_orig=ou_orig, is_deleted=True)
1828         self.assertFalse("description" in ou_cur)
1829
1830
1831 class DrsMoveBetweenTreeOfObjectTestCase(drs_base.DrsBaseTestCase):
1832
1833     def setUp(self):
1834         super(DrsMoveBetweenTreeOfObjectTestCase, self).setUp()
1835         # disable automatic replication temporary
1836         self._disable_all_repl(self.dnsname_dc1)
1837         self._disable_all_repl(self.dnsname_dc2)
1838
1839         self.top_ou = samba.tests.create_test_ou(self.ldb_dc1,
1840                                                  "replica_move")
1841
1842         # make sure DCs are synchronized before the test
1843         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
1844         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True)
1845
1846         self.ou1_dn = ldb.Dn(self.ldb_dc1, "OU=DrsOU1")
1847         self.ou1_dn.add_base(self.top_ou)
1848         self.ou1 = {}
1849         self.ou1["dn"] = self.ou1_dn
1850         self.ou1["objectclass"] = "organizationalUnit"
1851         self.ou1["ou"] = self.ou1_dn.get_component_value(0)
1852
1853         self.ou2_dn = ldb.Dn(self.ldb_dc1, "OU=DrsOU2,OU=DrsOU1")
1854         self.ou2_dn.add_base(self.top_ou)
1855         self.ou2 = {}
1856         self.ou2["dn"] = self.ou2_dn
1857         self.ou2["objectclass"] = "organizationalUnit"
1858         self.ou2["ou"] = self.ou2_dn.get_component_value(0)
1859
1860         self.ou2b_dn = ldb.Dn(self.ldb_dc1, "OU=DrsOU2B,OU=DrsOU1")
1861         self.ou2b_dn.add_base(self.top_ou)
1862         self.ou2b = {}
1863         self.ou2b["dn"] = self.ou2b_dn
1864         self.ou2b["objectclass"] = "organizationalUnit"
1865         self.ou2b["ou"] = self.ou2b_dn.get_component_value(0)
1866
1867         self.ou2c_dn = ldb.Dn(self.ldb_dc1, "OU=DrsOU2C,OU=DrsOU1")
1868         self.ou2c_dn.add_base(self.top_ou)
1869
1870         self.ou3_dn = ldb.Dn(self.ldb_dc1, "OU=DrsOU3,OU=DrsOU2,OU=DrsOU1")
1871         self.ou3_dn.add_base(self.top_ou)
1872         self.ou3 = {}
1873         self.ou3["dn"] = self.ou3_dn
1874         self.ou3["objectclass"] = "organizationalUnit"
1875         self.ou3["ou"] = self.ou3_dn.get_component_value(0)
1876
1877         self.ou4_dn = ldb.Dn(self.ldb_dc1, "OU=DrsOU4,OU=DrsOU3,OU=DrsOU2,OU=DrsOU1")
1878         self.ou4_dn.add_base(self.top_ou)
1879         self.ou4 = {}
1880         self.ou4["dn"] = self.ou4_dn
1881         self.ou4["objectclass"] = "organizationalUnit"
1882         self.ou4["ou"] = self.ou4_dn.get_component_value(0)
1883
1884         self.ou5_dn = ldb.Dn(self.ldb_dc1, "OU=DrsOU5,OU=DrsOU4,OU=DrsOU3,OU=DrsOU2,OU=DrsOU1")
1885         self.ou5_dn.add_base(self.top_ou)
1886         self.ou5 = {}
1887         self.ou5["dn"] = self.ou5_dn
1888         self.ou5["objectclass"] = "organizationalUnit"
1889         self.ou5["ou"] = self.ou5_dn.get_component_value(0)
1890
1891         self.ou6_dn = ldb.Dn(self.ldb_dc1, "OU=DrsOU6,OU=DrsOU5,OU=DrsOU4,OU=DrsOU3,OU=DrsOU2,OU=DrsOU1")
1892         self.ou6_dn.add_base(self.top_ou)
1893         self.ou6 = {}
1894         self.ou6["dn"] = self.ou6_dn
1895         self.ou6["objectclass"] = "organizationalUnit"
1896         self.ou6["ou"] = self.ou6_dn.get_component_value(0)
1897
1898     def tearDown(self):
1899         self.ldb_dc1.delete(self.top_ou, ["tree_delete:1"])
1900         self._enable_all_repl(self.dnsname_dc1)
1901         self._enable_all_repl(self.dnsname_dc2)
1902         super(DrsMoveBetweenTreeOfObjectTestCase, self).tearDown()
1903
1904     def _make_username(self):
1905         return "DrsTreeU_" + time.strftime("%s", time.gmtime())
1906
1907     # now also used to check the group
1908     def _check_obj(self, sam_ldb, obj_orig, is_deleted):
1909         # search the user by guid as it may be deleted
1910         guid_str = self._GUID_string(obj_orig["objectGUID"][0])
1911         res = sam_ldb.search(base='<GUID=%s>' % guid_str,
1912                              controls=["show_deleted:1"],
1913                              attrs=["*", "parentGUID"])
1914         self.assertEquals(len(res), 1)
1915         user_cur = res[0]
1916         cn_orig = obj_orig["cn"][0]
1917         cn_cur  = user_cur["cn"][0]
1918         name_orig = obj_orig["name"][0]
1919         name_cur  = user_cur["name"][0]
1920         dn_orig = obj_orig["dn"]
1921         dn_cur  = user_cur["dn"]
1922         # now check properties of the user
1923         if is_deleted:
1924             self.assertTrue("isDeleted" in user_cur)
1925             self.assertEquals(cn_cur.split('\n')[0], cn_orig)
1926             self.assertEquals(name_cur.split('\n')[0], name_orig)
1927             self.assertEquals(dn_cur.get_rdn_value().split('\n')[0],
1928                               dn_orig.get_rdn_value())
1929             self.assertEqual(name_cur, cn_cur)
1930         else:
1931             self.assertFalse("isDeleted" in user_cur)
1932             self.assertEquals(cn_cur, cn_orig)
1933             self.assertEquals(name_cur, name_orig)
1934             self.assertEquals(dn_cur, dn_orig)
1935             self.assertEqual(name_cur, cn_cur)
1936         self.assertEqual(name_cur, user_cur.dn.get_rdn_value())
1937
1938         return user_cur
1939
1940     def test_ReplicateMoveInTree1(self):
1941         """Verifies how an object is replicated between two DCs.
1942            This test should verify that:
1943             - a complex OU tree can be replicated correctly
1944             - the user is in the correct spot (renamed into) within the tree
1945               on both DCs
1946            """
1947         # work-out unique username to test with
1948         username = self._make_username()
1949
1950         self.ldb_dc1.add(self.ou1)
1951
1952         # create user on DC1
1953         self.ldb_dc1.newuser(username=username,
1954                              userou="ou=%s,ou=%s"
1955                              % (self.ou1_dn.get_component_value(0),
1956                                 self.top_ou.get_component_value(0)),
1957                              password=None, setpassword=False)
1958         ldb_res = self.ldb_dc1.search(base=self.ou1_dn,
1959                                       scope=SCOPE_SUBTREE,
1960                                       expression="(samAccountName=%s)" % username)
1961         self.assertEquals(len(ldb_res), 1)
1962         user_orig = ldb_res[0]
1963         user_dn   = ldb_res[0]["dn"]
1964
1965         # check user info on DC1
1966         print("Testing for %s with GUID %s" % (username, self._GUID_string(user_orig["objectGUID"][0])))
1967         self._check_obj(sam_ldb=self.ldb_dc1, obj_orig=user_orig, is_deleted=False)
1968
1969         self.ldb_dc1.add(self.ou2)
1970         self.ldb_dc1.add(self.ou3)
1971         self.ldb_dc1.add(self.ou4)
1972         self.ldb_dc1.add(self.ou5)
1973
1974         new_dn = ldb.Dn(self.ldb_dc1, "CN=%s" % username)
1975         new_dn.add_base(self.ou5_dn)
1976         self.ldb_dc1.rename(user_dn, new_dn)
1977         ldb_res = self.ldb_dc1.search(base=self.ou2_dn,
1978                                       scope=SCOPE_SUBTREE,
1979                                       expression="(samAccountName=%s)" % username)
1980         self.assertEquals(len(ldb_res), 1)
1981
1982         user_moved_orig = ldb_res[0]
1983         user_moved_dn   = ldb_res[0]["dn"]
1984
1985         # trigger replication from DC1 to DC2
1986         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
1987         # check user info on DC2 - should be valid user
1988         user_cur = self._check_obj(sam_ldb=self.ldb_dc2, obj_orig=user_moved_orig, is_deleted=False)
1989
1990         # delete user on DC1
1991         self.ldb_dc1.delete('<GUID=%s>' % self._GUID_string(user_orig["objectGUID"][0]))
1992
1993         # trigger replication from DC1 to DC2, for cleanup
1994         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
1995
1996     def test_ReplicateMoveInTree2(self):
1997         """Verifies how an object is replicated between two DCs.
1998            This test should verify that:
1999             - a complex OU tree can be replicated correctly
2000             - the user is in the correct spot (renamed into) within the tree
2001               on both DCs
2002             - that a rename back works correctly, and is replicated
2003            """
2004         # work-out unique username to test with
2005         username = self._make_username()
2006
2007         self.ldb_dc1.add(self.ou1)
2008
2009         # create user on DC1
2010         self.ldb_dc1.newuser(username=username,
2011                              userou="ou=%s,ou=%s"
2012                              % (self.ou1_dn.get_component_value(0),
2013                                 self.top_ou.get_component_value(0)),
2014                              password=None, setpassword=False)
2015         ldb_res = self.ldb_dc1.search(base=self.ou1_dn,
2016                                       scope=SCOPE_SUBTREE,
2017                                       expression="(samAccountName=%s)" % username)
2018         self.assertEquals(len(ldb_res), 1)
2019         user_orig = ldb_res[0]
2020         user_dn   = ldb_res[0]["dn"]
2021
2022         # check user info on DC1
2023         print("Testing for %s with GUID %s" % (username, self._GUID_string(user_orig["objectGUID"][0])))
2024         self._check_obj(sam_ldb=self.ldb_dc1, obj_orig=user_orig, is_deleted=False)
2025
2026         self.ldb_dc1.add(self.ou2)
2027         self.ldb_dc1.add(self.ou2b)
2028         self.ldb_dc1.add(self.ou3)
2029
2030         new_dn = ldb.Dn(self.ldb_dc1, "CN=%s" % username)
2031         new_dn.add_base(self.ou3_dn)
2032         self.ldb_dc1.rename(user_dn, new_dn)
2033
2034         new_dn3 = ldb.Dn(self.ldb_dc1, "OU=%s" % self.ou3_dn.get_component_value(0))
2035         new_dn3.add_base(self.ou2b_dn)
2036         self.ldb_dc1.rename(self.ou3_dn, new_dn3)
2037
2038         ldb_res = self.ldb_dc1.search(base=new_dn3,
2039                                       scope=SCOPE_SUBTREE,
2040                                       expression="(samAccountName=%s)" % username)
2041         self.assertEquals(len(ldb_res), 1)
2042
2043         user_moved_orig = ldb_res[0]
2044         user_moved_dn   = ldb_res[0]["dn"]
2045
2046         # trigger replication from DC1 to DC2
2047         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
2048         # check user info on DC2 - should be valid user
2049         user_cur = self._check_obj(sam_ldb=self.ldb_dc2, obj_orig=user_moved_orig, is_deleted=False)
2050
2051         # Rename on DC1
2052         new_dn = ldb.Dn(self.ldb_dc1, "CN=%s" % username)
2053         new_dn.add_base(self.ou1_dn)
2054         self.ldb_dc1.rename(user_moved_dn, new_dn)
2055
2056         # Modify description on DC2
2057         msg = ldb.Message()
2058         msg.dn = user_moved_dn
2059         msg["description"] = ldb.MessageElement("User Description", ldb.FLAG_MOD_REPLACE, "description")
2060         self.ldb_dc2.modify(msg)
2061
2062         ldb_res = self.ldb_dc1.search(base=self.ou1_dn,
2063                                       scope=SCOPE_SUBTREE,
2064                                       expression="(samAccountName=%s)" % username)
2065         self.assertEquals(len(ldb_res), 1)
2066
2067         user_moved_orig = ldb_res[0]
2068         user_moved_dn   = ldb_res[0]["dn"]
2069
2070         # trigger replication from DC1 to DC2
2071         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
2072         # check user info on DC2 - should be valid user
2073         user_cur = self._check_obj(sam_ldb=self.ldb_dc2, obj_orig=user_moved_orig, is_deleted=False)
2074         self.assertTrue("description" in user_cur)
2075
2076         # delete user on DC1
2077         self.ldb_dc1.delete('<GUID=%s>' % self._GUID_string(user_orig["objectGUID"][0]))
2078
2079         # trigger replication from DC2 to DC1
2080         self._net_drs_replicate(DC=self.dnsname_dc1, fromDC=self.dnsname_dc2, forced=True)
2081         # check user info on DC1 - should be deleted user
2082         user_cur = self._check_obj(sam_ldb=self.ldb_dc1, obj_orig=user_moved_orig, is_deleted=True)
2083         self.assertFalse("description" in user_cur)
2084
2085         # trigger replication from DC1 to DC2, for cleanup
2086         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
2087         # check user info on DC2 - should be deleted user
2088         user_cur = self._check_obj(sam_ldb=self.ldb_dc2, obj_orig=user_moved_orig, is_deleted=True)
2089         self.assertFalse("description" in user_cur)
2090
2091     def test_ReplicateMoveInTree3(self):
2092         """Verifies how an object is replicated between two DCs.
2093            This test should verify that:
2094             - a complex OU tree can be replicated correctly
2095             - the user is in the correct spot (renamed into) within the tree
2096               on both DCs
2097             - that a rename back works correctly, and is replicated
2098            """
2099         # work-out unique username to test with
2100         username = self._make_username()
2101
2102         self.ldb_dc1.add(self.ou1)
2103
2104         # create user on DC1
2105         self.ldb_dc1.newuser(username=username,
2106                              userou="ou=%s,ou=%s"
2107                              % (self.ou1_dn.get_component_value(0),
2108                                 self.top_ou.get_component_value(0)),
2109                              password=None, setpassword=False)
2110         ldb_res = self.ldb_dc1.search(base=self.ou1_dn,
2111                                       scope=SCOPE_SUBTREE,
2112                                       expression="(samAccountName=%s)" % username)
2113         self.assertEquals(len(ldb_res), 1)
2114         user_orig = ldb_res[0]
2115         user_dn   = ldb_res[0]["dn"]
2116
2117         # check user info on DC1
2118         print("Testing for %s with GUID %s" % (username, self._GUID_string(user_orig["objectGUID"][0])))
2119         self._check_obj(sam_ldb=self.ldb_dc1, obj_orig=user_orig, is_deleted=False)
2120
2121         self.ldb_dc1.add(self.ou2)
2122         self.ldb_dc1.add(self.ou2b)
2123         self.ldb_dc1.add(self.ou3)
2124
2125         new_dn = ldb.Dn(self.ldb_dc1, "CN=%s" % username)
2126         new_dn.add_base(self.ou3_dn)
2127         self.ldb_dc1.rename(user_dn, new_dn)
2128
2129         new_dn3 = ldb.Dn(self.ldb_dc1, "OU=%s" % self.ou3_dn.get_component_value(0))
2130         new_dn3.add_base(self.ou2b_dn)
2131         self.ldb_dc1.rename(self.ou3_dn, new_dn3)
2132
2133         ldb_res = self.ldb_dc1.search(base=new_dn3,
2134                                       scope=SCOPE_SUBTREE,
2135                                       expression="(samAccountName=%s)" % username)
2136         self.assertEquals(len(ldb_res), 1)
2137
2138         user_moved_orig = ldb_res[0]
2139         user_moved_dn   = ldb_res[0]["dn"]
2140
2141         # trigger replication from DC1 to DC2
2142         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
2143         # check user info on DC2 - should be valid user
2144         user_cur = self._check_obj(sam_ldb=self.ldb_dc2, obj_orig=user_moved_orig, is_deleted=False)
2145
2146         new_dn = ldb.Dn(self.ldb_dc1, "CN=%s" % username)
2147         new_dn.add_base(self.ou2_dn)
2148         self.ldb_dc1.rename(user_moved_dn, new_dn)
2149
2150         self.ldb_dc1.rename(self.ou2_dn, self.ou2c_dn)
2151         self.ldb_dc1.rename(self.ou2b_dn, self.ou2_dn)
2152         self.ldb_dc1.rename(self.ou2c_dn, self.ou2b_dn)
2153
2154         ldb_res = self.ldb_dc1.search(base=self.ou1_dn,
2155                                       scope=SCOPE_SUBTREE,
2156                                       expression="(samAccountName=%s)" % username,
2157                                       attrs=["*", "parentGUID"])
2158         self.assertEquals(len(ldb_res), 1)
2159
2160         user_moved_orig = ldb_res[0]
2161         user_moved_dn   = ldb_res[0]["dn"]
2162
2163         # trigger replication from DC1 to DC2
2164         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
2165         # check user info on DC2 - should be valid user
2166         user_cur = self._check_obj(sam_ldb=self.ldb_dc2, obj_orig=user_moved_orig, is_deleted=False)
2167
2168         self.assertEquals(user_cur["parentGUID"], user_moved_orig["parentGUID"])
2169
2170         # delete user on DC1
2171         self.ldb_dc1.delete('<GUID=%s>' % self._GUID_string(user_orig["objectGUID"][0]))
2172
2173         # trigger replication from DC1 to DC2, for cleanup
2174         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
2175
2176     def test_ReplicateMoveInTree3b(self):
2177         """Verifies how an object is replicated between two DCs.
2178            This test should verify that:
2179             - a complex OU tree can be replicated correctly
2180             - the user is in the correct spot (renamed into) within the tree
2181               on both DCs
2182             - that a rename back works correctly, and is replicated
2183             - that a complex rename suffle, combined with unrelated changes to the object,
2184               is replicated correctly.  The aim here is the send the objects out-of-order
2185               when sorted by usnChanged.
2186             - confirm that the OU tree and (in particular the user DN) is identical between
2187               the DCs once this has been replicated.
2188         """
2189         # work-out unique username to test with
2190         username = self._make_username()
2191
2192         self.ldb_dc1.add(self.ou1)
2193
2194         # create user on DC1
2195         self.ldb_dc1.newuser(username=username,
2196                              userou="ou=%s,ou=%s"
2197                              % (self.ou1_dn.get_component_value(0),
2198                                 self.top_ou.get_component_value(0)),
2199                              password=None, setpassword=False)
2200         ldb_res = self.ldb_dc1.search(base=self.ou1_dn,
2201                                       scope=SCOPE_SUBTREE,
2202                                       expression="(samAccountName=%s)" % username)
2203         self.assertEquals(len(ldb_res), 1)
2204         user_orig = ldb_res[0]
2205         user_dn   = ldb_res[0]["dn"]
2206
2207         # check user info on DC1
2208         print("Testing for %s with GUID %s" % (username, self._GUID_string(user_orig["objectGUID"][0])))
2209         self._check_obj(sam_ldb=self.ldb_dc1, obj_orig=user_orig, is_deleted=False)
2210
2211         self.ldb_dc1.add(self.ou2)
2212         self.ldb_dc1.add(self.ou2b)
2213         self.ldb_dc1.add(self.ou3)
2214
2215         new_dn = ldb.Dn(self.ldb_dc1, "CN=%s" % username)
2216         new_dn.add_base(self.ou2_dn)
2217         self.ldb_dc1.rename(user_dn, new_dn)
2218
2219         ldb_res = self.ldb_dc1.search(base=self.ou2_dn,
2220                                       scope=SCOPE_SUBTREE,
2221                                       expression="(samAccountName=%s)" % username)
2222         self.assertEquals(len(ldb_res), 1)
2223
2224         user_moved_orig = ldb_res[0]
2225         user_moved_dn   = ldb_res[0]["dn"]
2226
2227         # trigger replication from DC1 to DC2
2228         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
2229         # check user info on DC2 - should be valid user
2230         user_cur = self._check_obj(sam_ldb=self.ldb_dc2, obj_orig=user_moved_orig, is_deleted=False)
2231
2232         msg = ldb.Message()
2233         msg.dn = new_dn
2234         msg["description"] = ldb.MessageElement("User Description", ldb.FLAG_MOD_REPLACE, "description")
2235         self.ldb_dc1.modify(msg)
2236
2237         # The sleep(1) calls here ensure that the name objects get a
2238         # new 1-sec based timestamp, and so we select how the conflict
2239         # resolution resolves.
2240         self.ldb_dc1.rename(self.ou2_dn, self.ou2c_dn)
2241         time.sleep(1)
2242         self.ldb_dc1.rename(self.ou2b_dn, self.ou2_dn)
2243         time.sleep(1)
2244         self.ldb_dc1.rename(self.ou2c_dn, self.ou2b_dn)
2245
2246         new_dn = ldb.Dn(self.ldb_dc1, "CN=%s" % username)
2247         new_dn.add_base(self.ou2_dn)
2248         self.ldb_dc1.rename('<GUID=%s>' % self._GUID_string(user_orig["objectGUID"][0]), new_dn)
2249
2250         msg = ldb.Message()
2251         msg.dn = self.ou2_dn
2252         msg["description"] = ldb.MessageElement("OU2 Description", ldb.FLAG_MOD_REPLACE, "description")
2253         self.ldb_dc1.modify(msg)
2254
2255         msg = ldb.Message()
2256         msg.dn = self.ou2b_dn
2257         msg["description"] = ldb.MessageElement("OU2b Description", ldb.FLAG_MOD_REPLACE, "description")
2258         self.ldb_dc1.modify(msg)
2259
2260         ldb_res = self.ldb_dc1.search(base=self.ou2_dn,
2261                                       scope=SCOPE_SUBTREE,
2262                                       expression="(samAccountName=%s)" % username,
2263                                       attrs=["*", "parentGUID"])
2264         self.assertEquals(len(ldb_res), 1)
2265
2266         user_moved_orig = ldb_res[0]
2267         user_moved_dn   = ldb_res[0]["dn"]
2268
2269         # trigger replication from DC1 to DC2
2270         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
2271         # check user info on DC2 - should be valid user
2272         user_cur = self._check_obj(sam_ldb=self.ldb_dc2, obj_orig=user_moved_orig, is_deleted=False)
2273         self.assertEquals(user_cur["parentGUID"][0], user_moved_orig["parentGUID"][0])
2274
2275         # delete user on DC1
2276         self.ldb_dc1.delete('<GUID=%s>' % self._GUID_string(user_orig["objectGUID"][0]))
2277
2278         # trigger replication from DC1 to DC2, for cleanup
2279         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
2280
2281     def test_ReplicateMoveInTree4(self):
2282         """Verifies how an object is replicated between two DCs.
2283            This test should verify that:
2284             - an OU and user can be replicated correctly, even after a rename
2285             - The creation and rename of the OU has been combined with unrelated changes to the object,
2286               The aim here is the send the objects out-of-order when sorted by usnChanged.
2287             - That is, the OU will be sorted by usnChanged after the user that is within that OU.
2288             - That will cause the client to need to get the OU first, by use of the GET_ANC flag
2289         """
2290         # work-out unique username to test with
2291         username = self._make_username()
2292
2293         self.ldb_dc1.add(self.ou1)
2294
2295         # create user on DC1
2296         self.ldb_dc1.newuser(username=username,
2297                              userou="ou=%s,ou=%s"
2298                              % (self.ou1_dn.get_component_value(0),
2299                                 self.top_ou.get_component_value(0)),
2300                              password=None, setpassword=False)
2301         ldb_res = self.ldb_dc1.search(base=self.ou1_dn,
2302                                       scope=SCOPE_SUBTREE,
2303                                       expression="(samAccountName=%s)" % username)
2304         self.assertEquals(len(ldb_res), 1)
2305         user_orig = ldb_res[0]
2306         user_dn   = ldb_res[0]["dn"]
2307
2308         # check user info on DC1
2309         print("Testing for %s with GUID %s" % (username, self._GUID_string(user_orig["objectGUID"][0])))
2310         self._check_obj(sam_ldb=self.ldb_dc1, obj_orig=user_orig, is_deleted=False)
2311
2312         self.ldb_dc1.add(self.ou2)
2313
2314         new_dn = ldb.Dn(self.ldb_dc1, "CN=%s" % username)
2315         new_dn.add_base(self.ou2_dn)
2316         self.ldb_dc1.rename(user_dn, new_dn)
2317
2318         msg = ldb.Message()
2319         msg.dn = self.ou2_dn
2320         msg["description"] = ldb.MessageElement("OU2 Description", ldb.FLAG_MOD_REPLACE, "description")
2321         self.ldb_dc1.modify(msg)
2322
2323         ldb_res = self.ldb_dc1.search(base=self.ou2_dn,
2324                                       scope=SCOPE_SUBTREE,
2325                                       expression="(samAccountName=%s)" % username)
2326         self.assertEquals(len(ldb_res), 1)
2327
2328         user_moved_orig = ldb_res[0]
2329         user_moved_dn   = ldb_res[0]["dn"]
2330
2331         # trigger replication from DC1 to DC2
2332         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
2333         # check user info on DC2 - should be valid user
2334         user_cur = self._check_obj(sam_ldb=self.ldb_dc2, obj_orig=user_moved_orig, is_deleted=False)
2335
2336         # delete user on DC1
2337         self.ldb_dc1.delete('<GUID=%s>' % self._GUID_string(user_orig["objectGUID"][0]))
2338
2339         # trigger replication from DC1 to DC2, for cleanup
2340         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
2341
2342     def test_ReplicateAddInOU(self):
2343         """Verifies how an object is replicated between two DCs.
2344            This test should verify that:
2345             - an OU and user can be replicated correctly
2346             - The creation of the OU has been combined with unrelated changes to the object,
2347               The aim here is the send the objects out-of-order when sorted by usnChanged.
2348             - That is, the OU will be sorted by usnChanged after the user that is within that OU.
2349             - That will cause the client to need to get the OU first, by use of the GET_ANC flag
2350         """
2351         # work-out unique username to test with
2352         username = self._make_username()
2353
2354         self.ldb_dc1.add(self.ou1)
2355
2356         # create user on DC1
2357         self.ldb_dc1.newuser(username=username,
2358                              userou="ou=%s,ou=%s"
2359                              % (self.ou1_dn.get_component_value(0),
2360                                 self.top_ou.get_component_value(0)),
2361                              password=None, setpassword=False)
2362         ldb_res = self.ldb_dc1.search(base=self.ou1_dn,
2363                                       scope=SCOPE_SUBTREE,
2364                                       expression="(samAccountName=%s)" % username,
2365                                       attrs=["*", "parentGUID"])
2366         self.assertEquals(len(ldb_res), 1)
2367         user_orig = ldb_res[0]
2368         user_dn   = ldb_res[0]["dn"]
2369
2370         msg = ldb.Message()
2371         msg.dn = self.ou1_dn
2372         msg["description"] = ldb.MessageElement("OU1 Description", ldb.FLAG_MOD_REPLACE, "description")
2373         self.ldb_dc1.modify(msg)
2374
2375         # trigger replication from DC1 to DC2
2376         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
2377         # check user info on DC2 - should be valid user
2378         user_cur = self._check_obj(sam_ldb=self.ldb_dc2, obj_orig=user_orig, is_deleted=False)
2379
2380         self.assertEquals(user_cur["parentGUID"], user_orig["parentGUID"])
2381
2382         # delete user on DC1
2383         self.ldb_dc1.delete('<GUID=%s>' % self._GUID_string(user_orig["objectGUID"][0]))
2384
2385         # trigger replication from DC1 to DC2, for cleanup
2386         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
2387
2388     def test_ReplicateAddInMovedOU(self):
2389         """Verifies how an object is replicated between two DCs.
2390            This test should verify that:
2391             - an OU and user can be replicated correctly
2392             - The creation of the OU has been combined with unrelated changes to the object,
2393               The aim here is the send the objects out-of-order when sorted by usnChanged.
2394             - That is, the OU will be sorted by usnChanged after the user that is within that OU.
2395             - That will cause the client to need to get the OU first, by use of the GET_ANC flag
2396         """
2397         # work-out unique username to test with
2398         username = self._make_username()
2399
2400         self.ldb_dc1.add(self.ou1)
2401         self.ldb_dc1.add(self.ou2)
2402
2403         # create user on DC1
2404         self.ldb_dc1.newuser(username=username,
2405                              userou="ou=%s,ou=%s"
2406                              % (self.ou1_dn.get_component_value(0),
2407                                 self.top_ou.get_component_value(0)),
2408                              password=None, setpassword=False)
2409         ldb_res = self.ldb_dc1.search(base=self.ou1_dn,
2410                                       scope=SCOPE_SUBTREE,
2411                                       expression="(samAccountName=%s)" % username,
2412                                       attrs=["*", "parentGUID"])
2413         self.assertEquals(len(ldb_res), 1)
2414         user_orig = ldb_res[0]
2415         user_dn   = ldb_res[0]["dn"]
2416
2417         new_dn = ldb.Dn(self.ldb_dc1, "CN=%s" % username)
2418         new_dn.add_base(self.ou2_dn)
2419         self.ldb_dc1.rename(user_dn, new_dn)
2420
2421         self.ldb_dc1.rename(self.ou2_dn, self.ou2b_dn)
2422
2423         ldb_res = self.ldb_dc1.search(base=self.ou1_dn,
2424                                       scope=SCOPE_SUBTREE,
2425                                       expression="(samAccountName=%s)" % username,
2426                                       attrs=["*", "parentGUID"])
2427         self.assertEquals(len(ldb_res), 1)
2428         user_moved = ldb_res[0]
2429         user_moved_dn = ldb_res[0]["dn"]
2430
2431         # trigger replication from DC1 to DC2
2432         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
2433         # check user info on DC2 - should be valid user
2434         user_cur = self._check_obj(sam_ldb=self.ldb_dc2, obj_orig=user_moved, is_deleted=False)
2435
2436         self.assertEquals(user_cur["parentGUID"], user_moved["parentGUID"])
2437
2438         # delete user on DC1
2439         self.ldb_dc1.delete('<GUID=%s>' % self._GUID_string(user_orig["objectGUID"][0]))
2440
2441         # trigger replication from DC1 to DC2, for cleanup
2442         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
2443
2444     def test_ReplicateAddInConflictOU_time(self):
2445         """Verifies how an object is replicated between two DCs, when created in an ambigious location
2446            This test should verify that:
2447             - Without replication, two conflicting objects can be created
2448             - force the conflict resolution algorithm so we know which copy will win
2449               (by sleeping while creating the objects, therefore increasing that timestamp on 'name')
2450             - confirm that the user object, created on DC1, ends up in the right place on DC2
2451             - therefore confirm that the conflict algorithm worked correctly, and that parentGUID was used.
2452
2453         """
2454         # work-out unique username to test with
2455         username = self._make_username()
2456
2457         self.ldb_dc1.add(self.ou1)
2458
2459         # create user on DC1
2460         self.ldb_dc1.newuser(username=username,
2461                              userou="ou=%s,ou=%s"
2462                              % (self.ou1_dn.get_component_value(0),
2463                                 self.top_ou.get_component_value(0)),
2464                              password=None, setpassword=False)
2465         ldb_res = self.ldb_dc1.search(base=self.ou1_dn,
2466                                       scope=SCOPE_SUBTREE,
2467                                       expression="(samAccountName=%s)" % username,
2468                                       attrs=["*", "parentGUID"])
2469         self.assertEquals(len(ldb_res), 1)
2470         user_orig = ldb_res[0]
2471         user_dn   = ldb_res[0]["dn"]
2472
2473         # trigger replication from DC1 to DC2
2474         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
2475
2476         # Now create two, conflicting objects.  This gives the user
2477         # object something to be under on both DCs.
2478
2479         # We sleep between the two adds so that DC1 adds second, and
2480         # so wins the conflict resoution due to a later creation time
2481         # (modification timestamp on the name attribute).
2482         self.ldb_dc2.add(self.ou2)
2483         time.sleep(1)
2484         self.ldb_dc1.add(self.ou2)
2485
2486         new_dn = ldb.Dn(self.ldb_dc1, "CN=%s" % username)
2487         new_dn.add_base(self.ou2_dn)
2488         self.ldb_dc1.rename(user_dn, new_dn)
2489
2490         # Now that we have renamed the user (and so bumpted the
2491         # usnChanged), bump the value on the OUs.
2492         msg = ldb.Message()
2493         msg.dn = self.ou2_dn
2494         msg["description"] = ldb.MessageElement("OU2 Description", ldb.FLAG_MOD_REPLACE, "description")
2495         self.ldb_dc1.modify(msg)
2496
2497         msg = ldb.Message()
2498         msg.dn = self.ou2_dn
2499         msg["description"] = ldb.MessageElement("OU2 Description", ldb.FLAG_MOD_REPLACE, "description")
2500         self.ldb_dc2.modify(msg)
2501
2502         # trigger replication from DC1 to DC2
2503         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
2504         ldb_res = self.ldb_dc1.search(base=self.ou1_dn,
2505                                       scope=SCOPE_SUBTREE,
2506                                       expression="(samAccountName=%s)" % username,
2507                                       attrs=["*", "parentGUID"])
2508         self.assertEquals(len(ldb_res), 1)
2509         user_moved = ldb_res[0]
2510         user_moved_dn = ldb_res[0]["dn"]
2511
2512         # trigger replication from DC1 to DC2
2513         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
2514         # check user info on DC2 - should be under the OU2 from DC1
2515         user_cur = self._check_obj(sam_ldb=self.ldb_dc2, obj_orig=user_moved, is_deleted=False)
2516
2517         self.assertEquals(user_cur["parentGUID"], user_moved["parentGUID"])
2518
2519         # delete user on DC1
2520         self.ldb_dc1.delete('<GUID=%s>' % self._GUID_string(user_orig["objectGUID"][0]))
2521
2522         # trigger replication from DC1 to DC2, for cleanup
2523         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
2524
2525     def test_ReplicateAddInConflictOU2(self):
2526         """Verifies how an object is replicated between two DCs, when created in an ambigious location
2527            This test should verify that:
2528             - Without replication, two conflicting objects can be created
2529             - force the conflict resolution algorithm so we know which copy will win
2530               (by changing the description twice, therefore increasing that version count)
2531             - confirm that the user object, created on DC1, ends up in the right place on DC2
2532             - therefore confirm that the conflict algorithm worked correctly, and that parentGUID was used.
2533         """
2534         # work-out unique username to test with
2535         username = self._make_username()
2536
2537         self.ldb_dc1.add(self.ou1)
2538
2539         # create user on DC1
2540         self.ldb_dc1.newuser(username=username,
2541                              userou="ou=%s,ou=%s"
2542                              % (self.ou1_dn.get_component_value(0),
2543                                 self.top_ou.get_component_value(0)),
2544                              password=None, setpassword=False)
2545         ldb_res = self.ldb_dc1.search(base=self.ou1_dn,
2546                                       scope=SCOPE_SUBTREE,
2547                                       expression="(samAccountName=%s)" % username,
2548                                       attrs=["*", "parentGUID"])
2549         self.assertEquals(len(ldb_res), 1)
2550         user_orig = ldb_res[0]
2551         user_dn   = ldb_res[0]["dn"]
2552
2553         # trigger replication from DC1 to DC2
2554         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
2555
2556         # Now create two, conflicting objects.  This gives the user
2557         # object something to be under on both DCs.  We create it on
2558         # DC1 1sec later so that it will win the conflict resolution.
2559
2560         self.ldb_dc2.add(self.ou2)
2561         time.sleep(1)
2562         self.ldb_dc1.add(self.ou2)
2563
2564         new_dn = ldb.Dn(self.ldb_dc1, "CN=%s" % username)
2565         new_dn.add_base(self.ou2_dn)
2566         self.ldb_dc1.rename(user_dn, new_dn)
2567
2568         # Now that we have renamed the user (and so bumpted the
2569         # usnChanged), bump the value on the OUs.
2570         msg = ldb.Message()
2571         msg.dn = self.ou2_dn
2572         msg["description"] = ldb.MessageElement("OU2 Description", ldb.FLAG_MOD_REPLACE, "description")
2573         self.ldb_dc1.modify(msg)
2574
2575         msg = ldb.Message()
2576         msg.dn = self.ou2_dn
2577         msg["description"] = ldb.MessageElement("OU2 Description", ldb.FLAG_MOD_REPLACE, "description")
2578         self.ldb_dc2.modify(msg)
2579
2580         # trigger replication from DC1 to DC2
2581         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
2582         ldb_res = self.ldb_dc1.search(base=self.ou1_dn,
2583                                       scope=SCOPE_SUBTREE,
2584                                       expression="(samAccountName=%s)" % username,
2585                                       attrs=["*", "parentGUID"])
2586         self.assertEquals(len(ldb_res), 1)
2587         user_moved = ldb_res[0]
2588         user_moved_dn = ldb_res[0]["dn"]
2589
2590         # trigger replication from DC1 to DC2
2591         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)
2592         # check user info on DC2 - should be under the OU2 from DC1
2593         user_cur = self._check_obj(sam_ldb=self.ldb_dc2, obj_orig=user_moved, is_deleted=False)
2594
2595         self.assertEquals(user_cur["parentGUID"], user_moved["parentGUID"])
2596
2597         # delete user on DC1
2598         self.ldb_dc1.delete('<GUID=%s>' % self._GUID_string(user_orig["objectGUID"][0]))
2599
2600         # trigger replication from DC1 to DC2, for cleanup
2601         self._net_drs_replicate(DC=self.dnsname_dc2, fromDC=self.dnsname_dc1, forced=True)