2 # -*- coding: utf-8 -*-
3 # This is unit with tests for LDAP access checks
10 sys.path.append("bin/python")
12 samba.ensure_external_module("subunit", "subunit/python")
13 samba.ensure_external_module("testtools", "testtools")
15 import samba.getopt as options
18 SCOPE_BASE, SCOPE_SUBTREE, LdbError, ERR_NO_SUCH_OBJECT,
19 ERR_UNWILLING_TO_PERFORM, ERR_INSUFFICIENT_ACCESS_RIGHTS)
20 from ldb import ERR_CONSTRAINT_VIOLATION
21 from ldb import ERR_OPERATIONS_ERROR
22 from ldb import Message, MessageElement, Dn
23 from ldb import FLAG_MOD_REPLACE, FLAG_MOD_DELETE
24 from samba.ndr import ndr_pack, ndr_unpack
25 from samba.dcerpc import security
27 from samba.auth import system_session
28 from samba import gensec
29 from samba.samdb import SamDB
30 from samba.credentials import Credentials
32 from subunit.run import SubunitTestRunner
35 parser = optparse.OptionParser("ldap [options] <host>")
36 sambaopts = options.SambaOptions(parser)
37 parser.add_option_group(sambaopts)
38 parser.add_option_group(options.VersionOptions(parser))
40 # use command line creds if available
41 credopts = options.CredentialsOptions(parser)
42 parser.add_option_group(credopts)
43 opts, args = parser.parse_args()
51 lp = sambaopts.get_loadparm()
52 creds = credopts.get_credentials(lp)
53 creds.set_gensec_features(creds.get_gensec_features() | gensec.FEATURE_SEAL)
59 class AclTests(samba.tests.TestCase):
61 def delete_force(self, ldb, dn):
64 except LdbError, (num, _):
65 self.assertEquals(num, ERR_NO_SUCH_OBJECT)
67 def find_basedn(self, ldb):
68 res = ldb.search(base="", expression="", scope=SCOPE_BASE,
69 attrs=["defaultNamingContext"])
70 self.assertEquals(len(res), 1)
71 return res[0]["defaultNamingContext"][0]
73 def find_domain_sid(self, ldb):
74 res = ldb.search(base=self.base_dn, expression="(objectClass=*)", scope=SCOPE_BASE)
75 return ndr_unpack(security.dom_sid,res[0]["objectSid"][0])
78 super(AclTests, self).setUp()
80 self.base_dn = self.find_basedn(self.ldb_admin)
81 self.domain_sid = self.find_domain_sid(self.ldb_admin)
82 self.user_pass = "samba123@"
83 res = self.ldb_admin.search(base="", expression="", scope=SCOPE_BASE,
84 attrs=["configurationNamingContext"])
85 self.configuration_dn = res[0]["configurationNamingContext"][0]
86 print "baseDN: %s" % self.base_dn
88 def get_user_dn(self, name):
89 return "CN=%s,CN=Users,%s" % (name, self.base_dn)
91 def modify_desc(self, object_dn, desc):
92 """ Modify security descriptor using either SDDL string
93 or security.descriptor object
95 assert(isinstance(desc, str) or isinstance(desc, security.descriptor))
97 dn: """ + object_dn + """
99 replace: nTSecurityDescriptor
101 if isinstance(desc, str):
102 mod += "nTSecurityDescriptor: %s" % desc
103 elif isinstance(desc, security.descriptor):
104 mod += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
105 self.ldb_admin.modify_ldif(mod)
107 def add_group_member(self, _ldb, group_dn, member_dn):
108 """ Modify user to ge member of a group
109 e.g. User to be 'Doamin Admin' group member
112 dn: """ + group_dn + """
115 member: """ + member_dn
116 _ldb.modify_ldif(ldif)
118 def create_ou(self, _ldb, ou_dn, desc=None):
120 dn: """ + ou_dn + """
121 ou: """ + ou_dn.split(",")[0][3:] + """
122 objectClass: organizationalUnit
126 assert(isinstance(desc, str) or isinstance(desc, security.descriptor))
127 if isinstance(desc, str):
128 ldif += "nTSecurityDescriptor: %s" % desc
129 elif isinstance(desc, security.descriptor):
130 ldif += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
133 def create_active_user(self, _ldb, user_dn):
135 dn: """ + user_dn + """
136 sAMAccountName: """ + user_dn.split(",")[0][3:] + """
138 unicodePwd:: """ + base64.b64encode("\"samba123@\"".encode('utf-16-le')) + """
143 def create_test_user(self, _ldb, user_dn, desc=None):
145 dn: """ + user_dn + """
146 sAMAccountName: """ + user_dn.split(",")[0][3:] + """
148 userPassword: """ + self.user_pass + """
152 assert(isinstance(desc, str) or isinstance(desc, security.descriptor))
153 if isinstance(desc, str):
154 ldif += "nTSecurityDescriptor: %s" % desc
155 elif isinstance(desc, security.descriptor):
156 ldif += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
159 def create_group(self, _ldb, group_dn, desc=None):
161 dn: """ + group_dn + """
163 sAMAccountName: """ + group_dn.split(",")[0][3:] + """
168 assert(isinstance(desc, str) or isinstance(desc, security.descriptor))
169 if isinstance(desc, str):
170 ldif += "nTSecurityDescriptor: %s" % desc
171 elif isinstance(desc, security.descriptor):
172 ldif += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
175 def create_security_group(self, _ldb, group_dn, desc=None):
177 dn: """ + group_dn + """
179 sAMAccountName: """ + group_dn.split(",")[0][3:] + """
180 groupType: -2147483646
184 assert(isinstance(desc, str) or isinstance(desc, security.descriptor))
185 if isinstance(desc, str):
186 ldif += "nTSecurityDescriptor: %s" % desc
187 elif isinstance(desc, security.descriptor):
188 ldif += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
191 def read_desc(self, object_dn):
192 res = self.ldb_admin.search(object_dn, SCOPE_BASE, None, ["nTSecurityDescriptor"])
193 desc = res[0]["nTSecurityDescriptor"][0]
194 return ndr_unpack(security.descriptor, desc)
196 def get_ldb_connection(self, target_username, target_password):
197 creds_tmp = Credentials()
198 creds_tmp.set_username(target_username)
199 creds_tmp.set_password(target_password)
200 creds_tmp.set_domain(creds.get_domain())
201 creds_tmp.set_realm(creds.get_realm())
202 creds_tmp.set_workstation(creds.get_workstation())
203 creds_tmp.set_gensec_features(creds_tmp.get_gensec_features()
204 | gensec.FEATURE_SEAL)
205 ldb_target = SamDB(url=host, credentials=creds_tmp, lp=lp)
208 def get_object_sid(self, object_dn):
209 res = self.ldb_admin.search(object_dn)
210 return ndr_unpack(security.dom_sid, res[0]["objectSid"][0])
212 def dacl_add_ace(self, object_dn, ace):
213 desc = self.read_desc(object_dn)
214 desc_sddl = desc.as_sddl(self.domain_sid)
217 if desc_sddl.find("(") >= 0:
218 desc_sddl = desc_sddl[:desc_sddl.index("(")] + ace + desc_sddl[desc_sddl.index("("):]
220 desc_sddl = desc_sddl + ace
221 self.modify_desc(object_dn, desc_sddl)
223 def get_desc_sddl(self, object_dn):
224 """ Return object nTSecutiryDescriptor in SDDL format
226 desc = self.read_desc(object_dn)
227 return desc.as_sddl(self.domain_sid)
229 # Test if we have any additional groups for users than default ones
230 def assert_user_no_group_member(self, username):
231 res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s)" % self.get_user_dn(username))
233 self.assertEqual(res[0]["memberOf"][0], "")
239 def create_enable_user(self, username):
240 self.create_active_user(self.ldb_admin, self.get_user_dn(username))
241 self.ldb_admin.enable_account("(sAMAccountName=" + username + ")")
243 def set_dsheuristics(self, dsheuristics):
245 m.dn = Dn(self.ldb_admin, "CN=Directory Service, CN=Windows NT, CN=Services, "
246 + self.configuration_dn)
247 if dsheuristics is not None:
248 m["dSHeuristics"] = MessageElement(dsheuristics, FLAG_MOD_REPLACE,
251 m["dSHeuristics"] = MessageElement([], FLAG_MOD_DELETE, "dsHeuristics")
252 self.ldb_admin.modify(m)
254 def set_minPwdAge(self, value):
256 m.dn = Dn(self.ldb_admin, self.base_dn)
257 m["minPwdAge"] = MessageElement(value, FLAG_MOD_REPLACE, "minPwdAge")
258 self.ldb_admin.modify(m)
260 #tests on ldap add operations
261 class AclAddTests(AclTests):
264 super(AclAddTests, self).setUp()
265 # Domain admin that will be creator of OU parent-child structure
266 self.usr_admin_owner = "acl_add_user1"
267 # Second domain admin that will not be creator of OU parent-child structure
268 self.usr_admin_not_owner = "acl_add_user2"
270 self.regular_user = "acl_add_user3"
271 self.create_enable_user(self.usr_admin_owner)
272 self.create_enable_user(self.usr_admin_not_owner)
273 self.create_enable_user(self.regular_user)
275 # add admins to the Domain Admins group
276 self.add_group_member(self.ldb_admin, "CN=Domain Admins,CN=Users," + self.base_dn, \
277 self.get_user_dn(self.usr_admin_owner))
278 self.add_group_member(self.ldb_admin, "CN=Domain Admins,CN=Users," + self.base_dn, \
279 self.get_user_dn(self.usr_admin_not_owner))
281 self.ldb_owner = self.get_ldb_connection(self.usr_admin_owner, self.user_pass)
282 self.ldb_notowner = self.get_ldb_connection(self.usr_admin_not_owner, self.user_pass)
283 self.ldb_user = self.get_ldb_connection(self.regular_user, self.user_pass)
286 super(AclAddTests, self).tearDown()
287 self.delete_force(self.ldb_admin, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
288 self.delete_force(self.ldb_admin, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
289 self.delete_force(self.ldb_admin, "OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
290 self.delete_force(self.ldb_admin, "OU=test_add_ou1," + self.base_dn)
291 self.delete_force(self.ldb_admin, self.get_user_dn(self.usr_admin_owner))
292 self.delete_force(self.ldb_admin, self.get_user_dn(self.usr_admin_not_owner))
293 self.delete_force(self.ldb_admin, self.get_user_dn(self.regular_user))
295 # Make sure top OU is deleted (and so everything under it)
296 def assert_top_ou_deleted(self):
297 res = self.ldb_admin.search(self.base_dn,
298 expression="(distinguishedName=%s,%s)" % (
299 "OU=test_add_ou1", self.base_dn))
300 self.assertEqual(res, [])
302 def test_add_u1(self):
303 """Testing OU with the rights of Doman Admin not creator of the OU """
304 self.assert_top_ou_deleted()
305 # Change descriptor for top level OU
306 self.create_ou(self.ldb_owner, "OU=test_add_ou1," + self.base_dn)
307 self.create_ou(self.ldb_owner, "OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
308 user_sid = self.get_object_sid(self.get_user_dn(self.usr_admin_not_owner))
309 mod = "(D;CI;WPCC;;;%s)" % str(user_sid)
310 self.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
311 # Test user and group creation with another domain admin's credentials
312 self.create_test_user(self.ldb_notowner, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
313 self.create_group(self.ldb_notowner, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
314 # Make sure we HAVE created the two objects -- user and group
315 # !!! We should not be able to do that, but however beacuse of ACE ordering our inherited Deny ACE
316 # !!! comes after explicit (A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA) that comes from somewhere
317 res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s,%s)" % ("CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn))
318 self.assertTrue(len(res) > 0)
319 res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s,%s)" % ("CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn))
320 self.assertTrue(len(res) > 0)
322 def test_add_u2(self):
323 """Testing OU with the regular user that has no rights granted over the OU """
324 self.assert_top_ou_deleted()
325 # Create a parent-child OU structure with domain admin credentials
326 self.create_ou(self.ldb_owner, "OU=test_add_ou1," + self.base_dn)
327 self.create_ou(self.ldb_owner, "OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
328 # Test user and group creation with regular user credentials
330 self.create_test_user(self.ldb_user, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
331 self.create_group(self.ldb_user, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
332 except LdbError, (num, _):
333 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
336 # Make sure we HAVEN'T created any of two objects -- user or group
337 res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s,%s)" % ("CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn))
338 self.assertEqual(res, [])
339 res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s,%s)" % ("CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn))
340 self.assertEqual(res, [])
342 def test_add_u3(self):
343 """Testing OU with the rights of regular user granted the right 'Create User child objects' """
344 self.assert_top_ou_deleted()
345 # Change descriptor for top level OU
346 self.create_ou(self.ldb_owner, "OU=test_add_ou1," + self.base_dn)
347 user_sid = self.get_object_sid(self.get_user_dn(self.regular_user))
348 mod = "(OA;CI;CC;bf967aba-0de6-11d0-a285-00aa003049e2;;%s)" % str(user_sid)
349 self.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
350 self.create_ou(self.ldb_owner, "OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
351 # Test user and group creation with granted user only to one of the objects
352 self.create_test_user(self.ldb_user, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
354 self.create_group(self.ldb_user, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
355 except LdbError, (num, _):
356 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
359 # Make sure we HAVE created the one of two objects -- user
360 res = self.ldb_admin.search(self.base_dn,
361 expression="(distinguishedName=%s,%s)" %
362 ("CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1",
364 self.assertNotEqual(len(res), 0)
365 res = self.ldb_admin.search(self.base_dn,
366 expression="(distinguishedName=%s,%s)" %
367 ("CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1",
369 self.assertEqual(res, [])
371 def test_add_u4(self):
372 """ 4 Testing OU with the rights of Doman Admin creator of the OU"""
373 self.assert_top_ou_deleted()
374 self.create_ou(self.ldb_owner, "OU=test_add_ou1," + self.base_dn)
375 self.create_ou(self.ldb_owner, "OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
376 self.create_test_user(self.ldb_owner, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
377 self.create_group(self.ldb_owner, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
378 # Make sure we have successfully created the two objects -- user and group
379 res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s,%s)" % ("CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn))
380 self.assertTrue(len(res) > 0)
381 res = self.ldb_admin.search(self.base_dn,
382 expression="(distinguishedName=%s,%s)" % ("CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn))
383 self.assertTrue(len(res) > 0)
385 #tests on ldap modify operations
386 class AclModifyTests(AclTests):
389 super(AclModifyTests, self).setUp()
390 self.user_with_wp = "acl_mod_user1"
391 self.user_with_sm = "acl_mod_user2"
392 self.user_with_group_sm = "acl_mod_user3"
393 self.create_enable_user(self.user_with_wp)
394 self.create_enable_user(self.user_with_sm)
395 self.create_enable_user(self.user_with_group_sm)
396 self.ldb_user = self.get_ldb_connection(self.user_with_wp, self.user_pass)
397 self.ldb_user2 = self.get_ldb_connection(self.user_with_sm, self.user_pass)
398 self.ldb_user3 = self.get_ldb_connection(self.user_with_group_sm, self.user_pass)
399 self.user_sid = self.get_object_sid( self.get_user_dn(self.user_with_wp))
400 self.create_group(self.ldb_admin, "CN=test_modify_group2,CN=Users," + self.base_dn)
401 self.create_group(self.ldb_admin, "CN=test_modify_group3,CN=Users," + self.base_dn)
402 self.create_test_user(self.ldb_admin, self.get_user_dn("test_modify_user2"))
405 super(AclModifyTests, self).tearDown()
406 self.delete_force(self.ldb_admin, self.get_user_dn("test_modify_user1"))
407 self.delete_force(self.ldb_admin, "CN=test_modify_group1,CN=Users," + self.base_dn)
408 self.delete_force(self.ldb_admin, "CN=test_modify_group2,CN=Users," + self.base_dn)
409 self.delete_force(self.ldb_admin, "CN=test_modify_group3,CN=Users," + self.base_dn)
410 self.delete_force(self.ldb_admin, "OU=test_modify_ou1," + self.base_dn)
411 self.delete_force(self.ldb_admin, self.get_user_dn(self.user_with_wp))
412 self.delete_force(self.ldb_admin, self.get_user_dn(self.user_with_sm))
413 self.delete_force(self.ldb_admin, self.get_user_dn(self.user_with_group_sm))
414 self.delete_force(self.ldb_admin, self.get_user_dn("test_modify_user2"))
416 def test_modify_u1(self):
417 """5 Modify one attribute if you have DS_WRITE_PROPERTY for it"""
418 mod = "(OA;;WP;bf967953-0de6-11d0-a285-00aa003049e2;;%s)" % str(self.user_sid)
419 # First test object -- User
420 print "Testing modify on User object"
421 self.create_test_user(self.ldb_admin, self.get_user_dn("test_modify_user1"))
422 self.dacl_add_ace(self.get_user_dn("test_modify_user1"), mod)
424 dn: """ + self.get_user_dn("test_modify_user1") + """
427 displayName: test_changed"""
428 self.ldb_user.modify_ldif(ldif)
429 res = self.ldb_admin.search(self.base_dn,
430 expression="(distinguishedName=%s)" % self.get_user_dn("test_modify_user1"))
431 self.assertEqual(res[0]["displayName"][0], "test_changed")
432 # Second test object -- Group
433 print "Testing modify on Group object"
434 self.create_group(self.ldb_admin, "CN=test_modify_group1,CN=Users," + self.base_dn)
435 self.dacl_add_ace("CN=test_modify_group1,CN=Users," + self.base_dn, mod)
437 dn: CN=test_modify_group1,CN=Users,""" + self.base_dn + """
440 displayName: test_changed"""
441 self.ldb_user.modify_ldif(ldif)
442 res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s)" % str("CN=test_modify_group1,CN=Users," + self.base_dn))
443 self.assertEqual(res[0]["displayName"][0], "test_changed")
444 # Third test object -- Organizational Unit
445 print "Testing modify on OU object"
446 #self.delete_force(self.ldb_admin, "OU=test_modify_ou1," + self.base_dn)
447 self.create_ou(self.ldb_admin, "OU=test_modify_ou1," + self.base_dn)
448 self.dacl_add_ace("OU=test_modify_ou1," + self.base_dn, mod)
450 dn: OU=test_modify_ou1,""" + self.base_dn + """
453 displayName: test_changed"""
454 self.ldb_user.modify_ldif(ldif)
455 res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s)" % str("OU=test_modify_ou1," + self.base_dn))
456 self.assertEqual(res[0]["displayName"][0], "test_changed")
458 def test_modify_u2(self):
459 """6 Modify two attributes as you have DS_WRITE_PROPERTY granted only for one of them"""
460 mod = "(OA;;WP;bf967953-0de6-11d0-a285-00aa003049e2;;%s)" % str(self.user_sid)
461 # First test object -- User
462 print "Testing modify on User object"
463 #self.delete_force(self.ldb_admin, self.get_user_dn("test_modify_user1"))
464 self.create_test_user(self.ldb_admin, self.get_user_dn("test_modify_user1"))
465 self.dacl_add_ace(self.get_user_dn("test_modify_user1"), mod)
466 # Modify on attribute you have rights for
468 dn: """ + self.get_user_dn("test_modify_user1") + """
471 displayName: test_changed"""
472 self.ldb_user.modify_ldif(ldif)
473 res = self.ldb_admin.search(self.base_dn,
474 expression="(distinguishedName=%s)" %
475 self.get_user_dn("test_modify_user1"))
476 self.assertEqual(res[0]["displayName"][0], "test_changed")
477 # Modify on attribute you do not have rights for granted
479 dn: """ + self.get_user_dn("test_modify_user1") + """
482 url: www.samba.org"""
484 self.ldb_user.modify_ldif(ldif)
485 except LdbError, (num, _):
486 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
488 # This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
490 # Second test object -- Group
491 print "Testing modify on Group object"
492 self.create_group(self.ldb_admin, "CN=test_modify_group1,CN=Users," + self.base_dn)
493 self.dacl_add_ace("CN=test_modify_group1,CN=Users," + self.base_dn, mod)
495 dn: CN=test_modify_group1,CN=Users,""" + self.base_dn + """
498 displayName: test_changed"""
499 self.ldb_user.modify_ldif(ldif)
500 res = self.ldb_admin.search(self.base_dn,
501 expression="(distinguishedName=%s)" %
502 str("CN=test_modify_group1,CN=Users," + self.base_dn))
503 self.assertEqual(res[0]["displayName"][0], "test_changed")
504 # Modify on attribute you do not have rights for granted
506 dn: CN=test_modify_group1,CN=Users,""" + self.base_dn + """
509 url: www.samba.org"""
511 self.ldb_user.modify_ldif(ldif)
512 except LdbError, (num, _):
513 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
515 # This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
517 # Second test object -- Organizational Unit
518 print "Testing modify on OU object"
519 self.create_ou(self.ldb_admin, "OU=test_modify_ou1," + self.base_dn)
520 self.dacl_add_ace("OU=test_modify_ou1," + self.base_dn, mod)
522 dn: OU=test_modify_ou1,""" + self.base_dn + """
525 displayName: test_changed"""
526 self.ldb_user.modify_ldif(ldif)
527 res = self.ldb_admin.search(self.base_dn,
528 expression="(distinguishedName=%s)" % str("OU=test_modify_ou1,"
530 self.assertEqual(res[0]["displayName"][0], "test_changed")
531 # Modify on attribute you do not have rights for granted
533 dn: OU=test_modify_ou1,""" + self.base_dn + """
536 url: www.samba.org"""
538 self.ldb_user.modify_ldif(ldif)
539 except LdbError, (num, _):
540 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
542 # This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
545 def test_modify_u3(self):
546 """7 Modify one attribute as you have no what so ever rights granted"""
547 # First test object -- User
548 print "Testing modify on User object"
549 self.create_test_user(self.ldb_admin, self.get_user_dn("test_modify_user1"))
550 # Modify on attribute you do not have rights for granted
552 dn: """ + self.get_user_dn("test_modify_user1") + """
555 url: www.samba.org"""
557 self.ldb_user.modify_ldif(ldif)
558 except LdbError, (num, _):
559 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
561 # This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
564 # Second test object -- Group
565 print "Testing modify on Group object"
566 self.create_group(self.ldb_admin, "CN=test_modify_group1,CN=Users," + self.base_dn)
567 # Modify on attribute you do not have rights for granted
569 dn: CN=test_modify_group1,CN=Users,""" + self.base_dn + """
572 url: www.samba.org"""
574 self.ldb_user.modify_ldif(ldif)
575 except LdbError, (num, _):
576 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
578 # This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
581 # Second test object -- Organizational Unit
582 print "Testing modify on OU object"
583 #self.delete_force(self.ldb_admin, "OU=test_modify_ou1," + self.base_dn)
584 self.create_ou(self.ldb_admin, "OU=test_modify_ou1," + self.base_dn)
585 # Modify on attribute you do not have rights for granted
587 dn: OU=test_modify_ou1,""" + self.base_dn + """
590 url: www.samba.org"""
592 self.ldb_user.modify_ldif(ldif)
593 except LdbError, (num, _):
594 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
596 # This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
600 def test_modify_u4(self):
601 """11 Grant WP to PRINCIPAL_SELF and test modify"""
603 dn: """ + self.get_user_dn(self.user_with_wp) + """
605 add: adminDescription
606 adminDescription: blah blah blah"""
608 self.ldb_user.modify_ldif(ldif)
609 except LdbError, (num, _):
610 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
612 # This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
615 mod = "(OA;;WP;bf967919-0de6-11d0-a285-00aa003049e2;;PS)"
616 self.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
617 # Modify on attribute you have rights for
618 self.ldb_user.modify_ldif(ldif)
619 res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s)" \
620 % self.get_user_dn(self.user_with_wp), attrs=["adminDescription"] )
621 self.assertEqual(res[0]["adminDescription"][0], "blah blah blah")
623 def test_modify_u5(self):
624 """12 test self membership"""
626 dn: CN=test_modify_group2,CN=Users,""" + self.base_dn + """
629 Member: """ + self.get_user_dn(self.user_with_sm)
630 #the user has no rights granted, this should fail
632 self.ldb_user2.modify_ldif(ldif)
633 except LdbError, (num, _):
634 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
636 # This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
639 #grant self-membership, should be able to add himself
640 user_sid = self.get_object_sid(self.get_user_dn(self.user_with_sm))
641 mod = "(OA;;SW;bf9679c0-0de6-11d0-a285-00aa003049e2;;%s)" % str(user_sid)
642 self.dacl_add_ace("CN=test_modify_group2,CN=Users," + self.base_dn, mod)
643 self.ldb_user2.modify_ldif(ldif)
644 res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
645 % ("CN=test_modify_group2,CN=Users," + self.base_dn), attrs=["Member"])
646 self.assertEqual(res[0]["Member"][0], self.get_user_dn(self.user_with_sm))
649 dn: CN=test_modify_group2,CN=Users,""" + self.base_dn + """
652 Member: CN=test_modify_user2,CN=Users,""" + self.base_dn
654 self.ldb_user2.modify_ldif(ldif)
655 except LdbError, (num, _):
656 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
660 def test_modify_u6(self):
661 """13 test self membership"""
663 dn: CN=test_modify_group2,CN=Users,""" + self.base_dn + """
666 Member: """ + self.get_user_dn(self.user_with_sm) + """
667 Member: CN=test_modify_user2,CN=Users,""" + self.base_dn
669 #grant self-membership, should be able to add himself but not others at the same time
670 user_sid = self.get_object_sid(self.get_user_dn(self.user_with_sm))
671 mod = "(OA;;SW;bf9679c0-0de6-11d0-a285-00aa003049e2;;%s)" % str(user_sid)
672 self.dacl_add_ace("CN=test_modify_group2,CN=Users," + self.base_dn, mod)
674 self.ldb_user2.modify_ldif(ldif)
675 except LdbError, (num, _):
676 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
680 def test_modify_u7(self):
681 """13 User with WP modifying Member"""
682 #a second user is given write property permission
683 user_sid = self.get_object_sid(self.get_user_dn(self.user_with_wp))
684 mod = "(A;;WP;;;%s)" % str(user_sid)
685 self.dacl_add_ace("CN=test_modify_group2,CN=Users," + self.base_dn, mod)
687 dn: CN=test_modify_group2,CN=Users,""" + self.base_dn + """
690 Member: """ + self.get_user_dn(self.user_with_wp)
691 self.ldb_user.modify_ldif(ldif)
692 res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
693 % ("CN=test_modify_group2,CN=Users," + self.base_dn), attrs=["Member"])
694 self.assertEqual(res[0]["Member"][0], self.get_user_dn(self.user_with_wp))
696 dn: CN=test_modify_group2,CN=Users,""" + self.base_dn + """
699 self.ldb_user.modify_ldif(ldif)
701 dn: CN=test_modify_group2,CN=Users,""" + self.base_dn + """
704 Member: CN=test_modify_user2,CN=Users,""" + self.base_dn
705 self.ldb_user.modify_ldif(ldif)
706 res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
707 % ("CN=test_modify_group2,CN=Users," + self.base_dn), attrs=["Member"])
708 self.assertEqual(res[0]["Member"][0], "CN=test_modify_user2,CN=Users," + self.base_dn)
710 #enable these when we have search implemented
711 class AclSearchTests(AclTests):
714 super(AclSearchTests, self).setUp()
715 self.u1 = "search_u1"
716 self.u2 = "search_u2"
717 self.u3 = "search_u3"
718 self.group1 = "group1"
719 self.anonymous = SamDB(url=host, session_info=system_session(),
721 res = self.ldb_admin.search("CN=Directory Service, CN=Windows NT, CN=Services, "
722 + self.configuration_dn, scope=SCOPE_BASE, attrs=["dSHeuristics"])
723 if "dSHeuristics" in res[0]:
724 self.dsheuristics = res[0]["dSHeuristics"][0]
726 self.dsheuristics = None
727 self.create_enable_user(self.u1)
728 self.create_enable_user(self.u2)
729 self.create_enable_user(self.u3)
730 self.create_security_group(self.ldb_admin, self.get_user_dn(self.group1))
731 self.add_group_member(self.ldb_admin, self.get_user_dn(self.group1), \
732 self.get_user_dn(self.u2))
733 self.ldb_user = self.get_ldb_connection(self.u1, self.user_pass)
734 self.ldb_user2 = self.get_ldb_connection(self.u2, self.user_pass)
735 self.ldb_user3 = self.get_ldb_connection(self.u3, self.user_pass)
736 self.full_list = [Dn(self.ldb_admin, "OU=ou2,OU=ou1," + self.base_dn),
737 Dn(self.ldb_admin, "OU=ou1," + self.base_dn),
738 Dn(self.ldb_admin, "OU=ou3,OU=ou2,OU=ou1," + self.base_dn),
739 Dn(self.ldb_admin, "OU=ou4,OU=ou2,OU=ou1," + self.base_dn),
740 Dn(self.ldb_admin, "OU=ou5,OU=ou3,OU=ou2,OU=ou1," + self.base_dn),
741 Dn(self.ldb_admin, "OU=ou6,OU=ou4,OU=ou2,OU=ou1," + self.base_dn)]
742 self.user_sid = self.get_object_sid(self.get_user_dn(self.u1))
743 self.group_sid = self.get_object_sid(self.get_user_dn(self.group1))
745 def create_clean_ou(self, object_dn):
746 """ Base repeating setup for unittests to follow """
747 res = self.ldb_admin.search(base=self.base_dn, scope=SCOPE_SUBTREE, \
748 expression="distinguishedName=%s" % object_dn)
749 # Make sure top testing OU has been deleted before starting the test
750 self.assertEqual(res, [])
751 self.create_ou(self.ldb_admin, object_dn)
752 desc_sddl = self.get_desc_sddl(object_dn)
753 # Make sure there are inheritable ACEs initially
754 self.assertTrue("CI" in desc_sddl or "OI" in desc_sddl)
755 # Find and remove all inherit ACEs
756 res = re.findall("\(.*?\)", desc_sddl)
757 res = [x for x in res if ("CI" in x) or ("OI" in x)]
759 desc_sddl = desc_sddl.replace(x, "")
760 # Add flag 'protected' in both DACL and SACL so no inherit ACEs
761 # can propagate from above
762 # remove SACL, we are not interested
763 desc_sddl = desc_sddl.replace(":AI", ":AIP")
764 self.modify_desc(object_dn, desc_sddl)
765 # Verify all inheritable ACEs are gone
766 desc_sddl = self.get_desc_sddl(object_dn)
767 self.assertFalse("CI" in desc_sddl)
768 self.assertFalse("OI" in desc_sddl)
771 super(AclSearchTests, self).tearDown()
772 self.set_dsheuristics(self.dsheuristics)
773 self.delete_force(self.ldb_admin, "OU=test_search_ou2,OU=test_search_ou1," + self.base_dn)
774 self.delete_force(self.ldb_admin, "OU=test_search_ou1," + self.base_dn)
775 self.delete_force(self.ldb_admin, "OU=ou6,OU=ou4,OU=ou2,OU=ou1," + self.base_dn)
776 self.delete_force(self.ldb_admin, "OU=ou5,OU=ou3,OU=ou2,OU=ou1," + self.base_dn)
777 self.delete_force(self.ldb_admin, "OU=ou4,OU=ou2,OU=ou1," + self.base_dn)
778 self.delete_force(self.ldb_admin, "OU=ou3,OU=ou2,OU=ou1," + self.base_dn)
779 self.delete_force(self.ldb_admin, "OU=ou2,OU=ou1," + self.base_dn)
780 self.delete_force(self.ldb_admin, "OU=ou1," + self.base_dn)
781 self.delete_force(self.ldb_admin, self.get_user_dn("search_u1"))
782 self.delete_force(self.ldb_admin, self.get_user_dn("search_u2"))
783 self.delete_force(self.ldb_admin, self.get_user_dn("search_u3"))
784 self.delete_force(self.ldb_admin, self.get_user_dn("group1"))
786 def test_search_anonymous1(self):
787 """Verify access of rootDSE with the correct request"""
788 res = self.anonymous.search("", expression="(objectClass=*)", scope=SCOPE_BASE)
789 self.assertEquals(len(res), 1)
790 #verify some of the attributes
791 #dont care about values
792 self.assertTrue("ldapServiceName" in res[0])
793 self.assertTrue("namingContexts" in res[0])
794 self.assertTrue("isSynchronized" in res[0])
795 self.assertTrue("dsServiceName" in res[0])
796 self.assertTrue("supportedSASLMechanisms" in res[0])
797 self.assertTrue("isGlobalCatalogReady" in res[0])
798 self.assertTrue("domainControllerFunctionality" in res[0])
799 self.assertTrue("serverName" in res[0])
801 def test_search_anonymous2(self):
802 """Make sure we cannot access anything else"""
804 res = self.anonymous.search("", expression="(objectClass=*)", scope=SCOPE_SUBTREE)
805 except LdbError, (num, _):
806 self.assertEquals(num, ERR_OPERATIONS_ERROR)
810 res = self.anonymous.search(self.base_dn, expression="(objectClass=*)", scope=SCOPE_SUBTREE)
811 except LdbError, (num, _):
812 self.assertEquals(num, ERR_OPERATIONS_ERROR)
816 res = self.anonymous.search("CN=Configuration," + self.base_dn, expression="(objectClass=*)",
818 except LdbError, (num, _):
819 self.assertEquals(num, ERR_OPERATIONS_ERROR)
823 def test_search_anonymous3(self):
824 """Set dsHeuristics and repeat"""
825 self.set_dsheuristics("0000002")
826 self.create_ou(self.ldb_admin, "OU=test_search_ou1," + self.base_dn)
827 mod = "(A;CI;LC;;;AN)"
828 self.dacl_add_ace("OU=test_search_ou1," + self.base_dn, mod)
829 self.create_ou(self.ldb_admin, "OU=test_search_ou2,OU=test_search_ou1," + self.base_dn)
830 res = self.anonymous.search("OU=test_search_ou2,OU=test_search_ou1," + self.base_dn,
831 expression="(objectClass=*)", scope=SCOPE_SUBTREE)
832 self.assertEquals(len(res), 1)
833 self.assertTrue("dn" in res[0])
834 self.assertTrue(res[0]["dn"] == Dn(self.ldb_admin,
835 "OU=test_search_ou2,OU=test_search_ou1," + self.base_dn))
836 res = self.anonymous.search("CN=Configuration," + self.base_dn, expression="(objectClass=*)",
838 self.assertEquals(len(res), 1)
839 self.assertTrue("dn" in res[0])
840 self.assertTrue(res[0]["dn"] == Dn(self.ldb_admin, self.configuration_dn))
842 def test_search1(self):
843 """Make sure users can see ous if given LC to user and group"""
844 self.create_clean_ou("OU=ou1," + self.base_dn)
845 mod = "(A;;LC;;;%s)(A;;LC;;;%s)" % (str(self.user_sid), str(self.group_sid))
846 self.dacl_add_ace("OU=ou1," + self.base_dn, mod)
847 self.create_ou(self.ldb_admin, "OU=ou2,OU=ou1," + self.base_dn,
848 "D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)" + mod)
849 self.create_ou(self.ldb_admin, "OU=ou3,OU=ou2,OU=ou1," + self.base_dn,
850 "D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)" + mod)
851 self.create_ou(self.ldb_admin, "OU=ou4,OU=ou2,OU=ou1," + self.base_dn,
852 "D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)" + mod)
853 self.create_ou(self.ldb_admin, "OU=ou5,OU=ou3,OU=ou2,OU=ou1," + self.base_dn,
854 "D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)" + mod)
855 self.create_ou(self.ldb_admin, "OU=ou6,OU=ou4,OU=ou2,OU=ou1," + self.base_dn,
856 "D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)" + mod)
858 #regular users must see only ou1 and ou2
859 res = self.ldb_user3.search("OU=ou1," + self.base_dn, expression="(objectClass=*)",
861 self.assertEquals(len(res), 2)
862 ok_list = [Dn(self.ldb_admin, "OU=ou2,OU=ou1," + self.base_dn),
863 Dn(self.ldb_admin, "OU=ou1," + self.base_dn)]
865 res_list = [ x["dn"] for x in res if x["dn"] in ok_list ]
866 self.assertEquals(sorted(res_list), sorted(ok_list))
868 #these users should see all ous
869 res = self.ldb_user.search("OU=ou1," + self.base_dn, expression="(objectClass=*)",
871 self.assertEquals(len(res), 6)
872 res_list = [ x["dn"] for x in res if x["dn"] in self.full_list ]
873 self.assertEquals(sorted(res_list), sorted(self.full_list))
875 res = self.ldb_user2.search("OU=ou1," + self.base_dn, expression="(objectClass=*)",
877 self.assertEquals(len(res), 6)
878 res_list = [ x["dn"] for x in res if x["dn"] in self.full_list ]
879 self.assertEquals(sorted(res_list), sorted(self.full_list))
881 def test_search2(self):
882 """Make sure users can't see ous if access is explicitly denied"""
883 self.create_clean_ou("OU=ou1," + self.base_dn)
884 self.create_ou(self.ldb_admin, "OU=ou2,OU=ou1," + self.base_dn)
885 self.create_ou(self.ldb_admin, "OU=ou3,OU=ou2,OU=ou1," + self.base_dn)
886 self.create_ou(self.ldb_admin, "OU=ou4,OU=ou2,OU=ou1," + self.base_dn)
887 self.create_ou(self.ldb_admin, "OU=ou5,OU=ou3,OU=ou2,OU=ou1," + self.base_dn)
888 self.create_ou(self.ldb_admin, "OU=ou6,OU=ou4,OU=ou2,OU=ou1," + self.base_dn)
889 mod = "(D;;LC;;;%s)(D;;LC;;;%s)" % (str(self.user_sid), str(self.group_sid))
890 self.dacl_add_ace("OU=ou2,OU=ou1," + self.base_dn, mod)
891 res = self.ldb_user3.search("OU=ou1," + self.base_dn, expression="(objectClass=*)",
893 #this user should see all ous
894 res_list = [ x["dn"] for x in res if x["dn"] in self.full_list ]
895 self.assertEquals(sorted(res_list), sorted(self.full_list))
897 #these users should see ou1, 2, 5 and 6 but not 3 and 4
898 res = self.ldb_user.search("OU=ou1," + self.base_dn, expression="(objectClass=*)",
900 ok_list = [Dn(self.ldb_admin, "OU=ou2,OU=ou1," + self.base_dn),
901 Dn(self.ldb_admin, "OU=ou1," + self.base_dn),
902 Dn(self.ldb_admin, "OU=ou5,OU=ou3,OU=ou2,OU=ou1," + self.base_dn),
903 Dn(self.ldb_admin, "OU=ou6,OU=ou4,OU=ou2,OU=ou1," + self.base_dn)]
904 res_list = [ x["dn"] for x in res if x["dn"] in ok_list ]
905 self.assertEquals(sorted(res_list), sorted(ok_list))
907 res = self.ldb_user2.search("OU=ou1," + self.base_dn, expression="(objectClass=*)",
909 self.assertEquals(len(res), 4)
910 res_list = [ x["dn"] for x in res if x["dn"] in ok_list ]
911 self.assertEquals(sorted(res_list), sorted(ok_list))
913 def test_search3(self):
914 """Make sure users can't see ous if access is explicitly denied - 2"""
915 self.create_clean_ou("OU=ou1," + self.base_dn)
916 mod = "(A;CI;LC;;;%s)(A;CI;LC;;;%s)" % (str(self.user_sid), str(self.group_sid))
917 self.dacl_add_ace("OU=ou1," + self.base_dn, mod)
918 self.create_ou(self.ldb_admin, "OU=ou2,OU=ou1," + self.base_dn,
919 "D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)")
920 self.create_ou(self.ldb_admin, "OU=ou3,OU=ou2,OU=ou1," + self.base_dn,
921 "D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)")
922 self.create_ou(self.ldb_admin, "OU=ou4,OU=ou2,OU=ou1," + self.base_dn,
923 "D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)")
924 self.create_ou(self.ldb_admin, "OU=ou5,OU=ou3,OU=ou2,OU=ou1," + self.base_dn,
925 "D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)")
926 self.create_ou(self.ldb_admin, "OU=ou6,OU=ou4,OU=ou2,OU=ou1," + self.base_dn,
927 "D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)")
929 mod = "(D;;LC;;;%s)(D;;LC;;;%s)" % (str(self.user_sid), str(self.group_sid))
930 self.dacl_add_ace("OU=ou2,OU=ou1," + self.base_dn, mod)
932 ok_list = [Dn(self.ldb_admin, "OU=ou2,OU=ou1," + self.base_dn),
933 Dn(self.ldb_admin, "OU=ou1," + self.base_dn)]
935 res = self.ldb_user3.search("OU=ou1," + self.base_dn, expression="(objectClass=*)",
937 res_list = [ x["dn"] for x in res if x["dn"] in ok_list ]
938 self.assertEquals(sorted(res_list), sorted(ok_list))
940 ok_list = [Dn(self.ldb_admin, "OU=ou2,OU=ou1," + self.base_dn),
941 Dn(self.ldb_admin, "OU=ou1," + self.base_dn),
942 Dn(self.ldb_admin, "OU=ou5,OU=ou3,OU=ou2,OU=ou1," + self.base_dn),
943 Dn(self.ldb_admin, "OU=ou6,OU=ou4,OU=ou2,OU=ou1," + self.base_dn)]
945 #should not see ou3 and ou4, but should see ou5 and ou6
946 res = self.ldb_user.search("OU=ou1," + self.base_dn, expression="(objectClass=*)",
948 self.assertEquals(len(res), 4)
949 res_list = [ x["dn"] for x in res if x["dn"] in ok_list ]
950 self.assertEquals(sorted(res_list), sorted(ok_list))
952 res = self.ldb_user2.search("OU=ou1," + self.base_dn, expression="(objectClass=*)",
954 self.assertEquals(len(res), 4)
955 res_list = [ x["dn"] for x in res if x["dn"] in ok_list ]
956 self.assertEquals(sorted(res_list), sorted(ok_list))
958 def test_search4(self):
959 """There is no difference in visibility if the user is also creator"""
960 self.create_clean_ou("OU=ou1," + self.base_dn)
961 mod = "(A;CI;CC;;;%s)" % (str(self.user_sid))
962 self.dacl_add_ace("OU=ou1," + self.base_dn, mod)
963 self.create_ou(self.ldb_user, "OU=ou2,OU=ou1," + self.base_dn,
964 "D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)")
965 self.create_ou(self.ldb_user, "OU=ou3,OU=ou2,OU=ou1," + self.base_dn,
966 "D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)")
967 self.create_ou(self.ldb_user, "OU=ou4,OU=ou2,OU=ou1," + self.base_dn,
968 "D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)")
969 self.create_ou(self.ldb_user, "OU=ou5,OU=ou3,OU=ou2,OU=ou1," + self.base_dn,
970 "D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)")
971 self.create_ou(self.ldb_user, "OU=ou6,OU=ou4,OU=ou2,OU=ou1," + self.base_dn,
972 "D:(A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA)")
974 ok_list = [Dn(self.ldb_admin, "OU=ou2,OU=ou1," + self.base_dn),
975 Dn(self.ldb_admin, "OU=ou1," + self.base_dn)]
976 res = self.ldb_user3.search("OU=ou1," + self.base_dn, expression="(objectClass=*)",
978 self.assertEquals(len(res), 2)
979 res_list = [ x["dn"] for x in res if x["dn"] in ok_list ]
980 self.assertEquals(sorted(res_list), sorted(ok_list))
982 res = self.ldb_user.search("OU=ou1," + self.base_dn, expression="(objectClass=*)",
984 self.assertEquals(len(res), 2)
985 res_list = [ x["dn"] for x in res if x["dn"] in ok_list ]
986 self.assertEquals(sorted(res_list), sorted(ok_list))
988 #tests on ldap delete operations
989 class AclDeleteTests(AclTests):
992 super(AclDeleteTests, self).setUp()
993 self.regular_user = "acl_delete_user1"
994 # Create regular user
995 self.create_enable_user(self.regular_user)
996 self.ldb_user = self.get_ldb_connection(self.regular_user, self.user_pass)
999 super(AclDeleteTests, self).tearDown()
1000 self.delete_force(self.ldb_admin, self.get_user_dn("test_delete_user1"))
1001 self.delete_force(self.ldb_admin, self.get_user_dn(self.regular_user))
1003 def test_delete_u1(self):
1004 """User is prohibited by default to delete another User object"""
1005 # Create user that we try to delete
1006 self.create_test_user(self.ldb_admin, self.get_user_dn("test_delete_user1"))
1007 # Here delete User object should ALWAYS through exception
1009 self.ldb_user.delete(self.get_user_dn("test_delete_user1"))
1010 except LdbError, (num, _):
1011 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
1015 def test_delete_u2(self):
1016 """User's group has RIGHT_DELETE to another User object"""
1017 user_dn = self.get_user_dn("test_delete_user1")
1018 # Create user that we try to delete
1019 self.create_test_user(self.ldb_admin, user_dn)
1020 mod = "(A;;SD;;;AU)"
1021 self.dacl_add_ace(user_dn, mod)
1022 # Try to delete User object
1023 self.ldb_user.delete(user_dn)
1024 res = self.ldb_admin.search(self.base_dn,
1025 expression="(distinguishedName=%s)" % user_dn)
1026 self.assertEqual(res, [])
1028 def test_delete_u3(self):
1029 """User indentified by SID has RIGHT_DELETE to another User object"""
1030 user_dn = self.get_user_dn("test_delete_user1")
1031 # Create user that we try to delete
1032 self.create_test_user(self.ldb_admin, user_dn)
1033 mod = "(A;;SD;;;%s)" % self.get_object_sid(self.get_user_dn(self.regular_user))
1034 self.dacl_add_ace(user_dn, mod)
1035 # Try to delete User object
1036 self.ldb_user.delete(user_dn)
1037 res = self.ldb_admin.search(self.base_dn,
1038 expression="(distinguishedName=%s)" % user_dn)
1039 self.assertEqual(res, [])
1041 #tests on ldap rename operations
1042 class AclRenameTests(AclTests):
1045 super(AclRenameTests, self).setUp()
1046 self.regular_user = "acl_rename_user1"
1048 # Create regular user
1049 self.create_enable_user(self.regular_user)
1050 self.ldb_user = self.get_ldb_connection(self.regular_user, self.user_pass)
1053 super(AclRenameTests, self).tearDown()
1055 self.delete_force(self.ldb_admin, "CN=test_rename_user1,OU=test_rename_ou3,OU=test_rename_ou2," + self.base_dn)
1056 self.delete_force(self.ldb_admin, "CN=test_rename_user2,OU=test_rename_ou3,OU=test_rename_ou2," + self.base_dn)
1057 self.delete_force(self.ldb_admin, "CN=test_rename_user5,OU=test_rename_ou3,OU=test_rename_ou2," + self.base_dn)
1058 self.delete_force(self.ldb_admin, "OU=test_rename_ou3,OU=test_rename_ou2," + self.base_dn)
1060 self.delete_force(self.ldb_admin, "CN=test_rename_user1,OU=test_rename_ou2," + self.base_dn)
1061 self.delete_force(self.ldb_admin, "CN=test_rename_user2,OU=test_rename_ou2," + self.base_dn)
1062 self.delete_force(self.ldb_admin, "CN=test_rename_user5,OU=test_rename_ou2," + self.base_dn)
1063 self.delete_force(self.ldb_admin, "OU=test_rename_ou2," + self.base_dn)
1065 self.delete_force(self.ldb_admin, "CN=test_rename_user1,OU=test_rename_ou1," + self.base_dn)
1066 self.delete_force(self.ldb_admin, "CN=test_rename_user2,OU=test_rename_ou1," + self.base_dn)
1067 self.delete_force(self.ldb_admin, "CN=test_rename_user5,OU=test_rename_ou1," + self.base_dn)
1068 self.delete_force(self.ldb_admin, "OU=test_rename_ou3,OU=test_rename_ou1," + self.base_dn)
1069 self.delete_force(self.ldb_admin, "OU=test_rename_ou1," + self.base_dn)
1070 self.delete_force(self.ldb_admin, self.get_user_dn(self.regular_user))
1072 def test_rename_u1(self):
1073 """Regular user fails to rename 'User object' within single OU"""
1074 # Create OU structure
1075 self.create_ou(self.ldb_admin, "OU=test_rename_ou1," + self.base_dn)
1076 self.create_test_user(self.ldb_admin, "CN=test_rename_user1,OU=test_rename_ou1," + self.base_dn)
1078 self.ldb_user.rename("CN=test_rename_user1,OU=test_rename_ou1," + self.base_dn, \
1079 "CN=test_rename_user5,OU=test_rename_ou1," + self.base_dn)
1080 except LdbError, (num, _):
1081 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
1085 def test_rename_u2(self):
1086 """Grant WRITE_PROPERTY to AU so regular user can rename 'User object' within single OU"""
1087 ou_dn = "OU=test_rename_ou1," + self.base_dn
1088 user_dn = "CN=test_rename_user1," + ou_dn
1089 rename_user_dn = "CN=test_rename_user5," + ou_dn
1090 # Create OU structure
1091 self.create_ou(self.ldb_admin, ou_dn)
1092 self.create_test_user(self.ldb_admin, user_dn)
1093 mod = "(A;;WP;;;AU)"
1094 self.dacl_add_ace(user_dn, mod)
1095 # Rename 'User object' having WP to AU
1096 self.ldb_user.rename(user_dn, rename_user_dn)
1097 res = self.ldb_admin.search(self.base_dn,
1098 expression="(distinguishedName=%s)" % user_dn)
1099 self.assertEqual(res, [])
1100 res = self.ldb_admin.search(self.base_dn,
1101 expression="(distinguishedName=%s)" % rename_user_dn)
1102 self.assertNotEqual(res, [])
1104 def test_rename_u3(self):
1105 """Test rename with rights granted to 'User object' SID"""
1106 ou_dn = "OU=test_rename_ou1," + self.base_dn
1107 user_dn = "CN=test_rename_user1," + ou_dn
1108 rename_user_dn = "CN=test_rename_user5," + ou_dn
1109 # Create OU structure
1110 self.create_ou(self.ldb_admin, ou_dn)
1111 self.create_test_user(self.ldb_admin, user_dn)
1112 sid = self.get_object_sid(self.get_user_dn(self.regular_user))
1113 mod = "(A;;WP;;;%s)" % str(sid)
1114 self.dacl_add_ace(user_dn, mod)
1115 # Rename 'User object' having WP to AU
1116 self.ldb_user.rename(user_dn, rename_user_dn)
1117 res = self.ldb_admin.search(self.base_dn,
1118 expression="(distinguishedName=%s)" % user_dn)
1119 self.assertEqual(res, [])
1120 res = self.ldb_admin.search(self.base_dn,
1121 expression="(distinguishedName=%s)" % rename_user_dn)
1122 self.assertNotEqual(res, [])
1124 def test_rename_u4(self):
1125 """Rename 'User object' cross OU with WP, SD and CC right granted on reg. user to AU"""
1126 ou1_dn = "OU=test_rename_ou1," + self.base_dn
1127 ou2_dn = "OU=test_rename_ou2," + self.base_dn
1128 user_dn = "CN=test_rename_user2," + ou1_dn
1129 rename_user_dn = "CN=test_rename_user5," + ou2_dn
1130 # Create OU structure
1131 self.create_ou(self.ldb_admin, ou1_dn)
1132 self.create_ou(self.ldb_admin, ou2_dn)
1133 self.create_test_user(self.ldb_admin, user_dn)
1134 mod = "(A;;WPSD;;;AU)"
1135 self.dacl_add_ace(user_dn, mod)
1136 mod = "(A;;CC;;;AU)"
1137 self.dacl_add_ace(ou2_dn, mod)
1138 # Rename 'User object' having SD and CC to AU
1139 self.ldb_user.rename(user_dn, rename_user_dn)
1140 res = self.ldb_admin.search(self.base_dn,
1141 expression="(distinguishedName=%s)" % user_dn)
1142 self.assertEqual(res, [])
1143 res = self.ldb_admin.search(self.base_dn,
1144 expression="(distinguishedName=%s)" % rename_user_dn)
1145 self.assertNotEqual(res, [])
1147 def test_rename_u5(self):
1148 """Test rename with rights granted to 'User object' SID"""
1149 ou1_dn = "OU=test_rename_ou1," + self.base_dn
1150 ou2_dn = "OU=test_rename_ou2," + self.base_dn
1151 user_dn = "CN=test_rename_user2," + ou1_dn
1152 rename_user_dn = "CN=test_rename_user5," + ou2_dn
1153 # Create OU structure
1154 self.create_ou(self.ldb_admin, ou1_dn)
1155 self.create_ou(self.ldb_admin, ou2_dn)
1156 self.create_test_user(self.ldb_admin, user_dn)
1157 sid = self.get_object_sid(self.get_user_dn(self.regular_user))
1158 mod = "(A;;WPSD;;;%s)" % str(sid)
1159 self.dacl_add_ace(user_dn, mod)
1160 mod = "(A;;CC;;;%s)" % str(sid)
1161 self.dacl_add_ace(ou2_dn, mod)
1162 # Rename 'User object' having SD and CC to AU
1163 self.ldb_user.rename(user_dn, rename_user_dn)
1164 res = self.ldb_admin.search(self.base_dn,
1165 expression="(distinguishedName=%s)" % user_dn)
1166 self.assertEqual(res, [])
1167 res = self.ldb_admin.search(self.base_dn,
1168 expression="(distinguishedName=%s)" % rename_user_dn)
1169 self.assertNotEqual(res, [])
1171 def test_rename_u6(self):
1172 """Rename 'User object' cross OU with WP, DC and CC right granted on OU & user to AU"""
1173 ou1_dn = "OU=test_rename_ou1," + self.base_dn
1174 ou2_dn = "OU=test_rename_ou2," + self.base_dn
1175 user_dn = "CN=test_rename_user2," + ou1_dn
1176 rename_user_dn = "CN=test_rename_user2," + ou2_dn
1177 # Create OU structure
1178 self.create_ou(self.ldb_admin, ou1_dn)
1179 self.create_ou(self.ldb_admin, ou2_dn)
1180 #mod = "(A;CI;DCWP;;;AU)"
1181 mod = "(A;;DC;;;AU)"
1182 self.dacl_add_ace(ou1_dn, mod)
1183 mod = "(A;;CC;;;AU)"
1184 self.dacl_add_ace(ou2_dn, mod)
1185 self.create_test_user(self.ldb_admin, user_dn)
1186 mod = "(A;;WP;;;AU)"
1187 self.dacl_add_ace(user_dn, mod)
1188 # Rename 'User object' having SD and CC to AU
1189 self.ldb_user.rename(user_dn, rename_user_dn)
1190 res = self.ldb_admin.search(self.base_dn,
1191 expression="(distinguishedName=%s)" % user_dn)
1192 self.assertEqual(res, [])
1193 res = self.ldb_admin.search(self.base_dn,
1194 expression="(distinguishedName=%s)" % rename_user_dn)
1195 self.assertNotEqual(res, [])
1197 def test_rename_u7(self):
1198 """Rename 'User object' cross OU (second level) with WP, DC and CC right granted on OU to AU"""
1199 ou1_dn = "OU=test_rename_ou1," + self.base_dn
1200 ou2_dn = "OU=test_rename_ou2," + self.base_dn
1201 ou3_dn = "OU=test_rename_ou3," + ou2_dn
1202 user_dn = "CN=test_rename_user2," + ou1_dn
1203 rename_user_dn = "CN=test_rename_user5," + ou3_dn
1204 # Create OU structure
1205 self.create_ou(self.ldb_admin, ou1_dn)
1206 self.create_ou(self.ldb_admin, ou2_dn)
1207 self.create_ou(self.ldb_admin, ou3_dn)
1208 mod = "(A;CI;WPDC;;;AU)"
1209 self.dacl_add_ace(ou1_dn, mod)
1210 mod = "(A;;CC;;;AU)"
1211 self.dacl_add_ace(ou3_dn, mod)
1212 self.create_test_user(self.ldb_admin, user_dn)
1213 # Rename 'User object' having SD and CC to AU
1214 self.ldb_user.rename(user_dn, rename_user_dn)
1215 res = self.ldb_admin.search(self.base_dn,
1216 expression="(distinguishedName=%s)" % user_dn)
1217 self.assertEqual(res, [])
1218 res = self.ldb_admin.search(self.base_dn,
1219 expression="(distinguishedName=%s)" % rename_user_dn)
1220 self.assertNotEqual(res, [])
1222 def test_rename_u8(self):
1223 """Test rename on an object with and without modify access on the RDN attribute"""
1224 ou1_dn = "OU=test_rename_ou1," + self.base_dn
1225 ou2_dn = "OU=test_rename_ou2," + ou1_dn
1226 ou3_dn = "OU=test_rename_ou3," + ou1_dn
1227 # Create OU structure
1228 self.create_ou(self.ldb_admin, ou1_dn)
1229 self.create_ou(self.ldb_admin, ou2_dn)
1230 sid = self.get_object_sid(self.get_user_dn(self.regular_user))
1231 mod = "(OA;;WP;bf967a0e-0de6-11d0-a285-00aa003049e2;;%s)" % str(sid)
1232 self.dacl_add_ace(ou2_dn, mod)
1233 mod = "(OD;;WP;bf9679f0-0de6-11d0-a285-00aa003049e2;;%s)" % str(sid)
1234 self.dacl_add_ace(ou2_dn, mod)
1236 self.ldb_user.rename(ou2_dn, ou3_dn)
1237 except LdbError, (num, _):
1238 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
1240 # This rename operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
1242 sid = self.get_object_sid(self.get_user_dn(self.regular_user))
1243 mod = "(A;;WP;bf9679f0-0de6-11d0-a285-00aa003049e2;;%s)" % str(sid)
1244 self.dacl_add_ace(ou2_dn, mod)
1245 self.ldb_user.rename(ou2_dn, ou3_dn)
1246 res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s)" % ou2_dn)
1247 self.assertEqual(res, [])
1248 res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s)" % ou3_dn)
1249 self.assertNotEqual(res, [])
1251 #tests on Control Access Rights
1252 class AclCARTests(AclTests):
1255 super(AclCARTests, self).setUp()
1256 self.user_with_wp = "acl_car_user1"
1257 self.user_with_pc = "acl_car_user2"
1258 self.create_enable_user(self.user_with_wp)
1259 self.create_enable_user(self.user_with_pc)
1260 self.ldb_user = self.get_ldb_connection(self.user_with_wp, self.user_pass)
1261 self.ldb_user2 = self.get_ldb_connection(self.user_with_pc, self.user_pass)
1263 res = self.ldb_admin.search("CN=Directory Service, CN=Windows NT, CN=Services, "
1264 + self.configuration_dn, scope=SCOPE_BASE, attrs=["dSHeuristics"])
1265 if "dSHeuristics" in res[0]:
1266 self.dsheuristics = res[0]["dSHeuristics"][0]
1268 self.dsheuristics = None
1270 res = self.ldb_admin.search(self.base_dn, scope=SCOPE_BASE, attrs=["minPwdAge"])
1271 self.minPwdAge = res[0]["minPwdAge"][0]
1273 # Set the "dSHeuristics" to have the tests run against Windows Server
1274 self.set_dsheuristics("000000001")
1275 # Set minPwdAge to 0
1276 self.set_minPwdAge("0")
1279 super(AclCARTests, self).tearDown()
1280 #restore original values
1281 self.set_dsheuristics(self.dsheuristics)
1282 self.set_minPwdAge(self.minPwdAge)
1283 self.delete_force(self.ldb_admin, self.get_user_dn(self.user_with_wp))
1284 self.delete_force(self.ldb_admin, self.get_user_dn(self.user_with_pc))
1286 def test_change_password1(self):
1287 """Try a password change operation without any CARs given"""
1288 #users have change password by default - remove for negative testing
1289 desc = self.read_desc(self.get_user_dn(self.user_with_wp))
1290 sddl = desc.as_sddl(self.domain_sid)
1291 sddl = sddl.replace("(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD)", "")
1292 sddl = sddl.replace("(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;PS)", "")
1293 self.modify_desc(self.get_user_dn(self.user_with_wp), sddl)
1295 self.ldb_user.modify_ldif("""
1296 dn: """ + self.get_user_dn(self.user_with_wp) + """
1299 unicodePwd:: """ + base64.b64encode("\"samba123@\"".encode('utf-16-le')) + """
1301 unicodePwd:: """ + base64.b64encode("\"thatsAcomplPASS2\"".encode('utf-16-le')) + """
1303 except LdbError, (num, _):
1304 self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
1306 # for some reason we get constraint violation instead of insufficient access error
1309 def test_change_password2(self):
1310 """Make sure WP has no influence"""
1311 desc = self.read_desc(self.get_user_dn(self.user_with_wp))
1312 sddl = desc.as_sddl(self.domain_sid)
1313 sddl = sddl.replace("(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD)", "")
1314 sddl = sddl.replace("(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;PS)", "")
1315 self.modify_desc(self.get_user_dn(self.user_with_wp), sddl)
1316 mod = "(A;;WP;;;PS)"
1317 self.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
1318 desc = self.read_desc(self.get_user_dn(self.user_with_wp))
1319 sddl = desc.as_sddl(self.domain_sid)
1321 self.ldb_user.modify_ldif("""
1322 dn: """ + self.get_user_dn(self.user_with_wp) + """
1325 unicodePwd:: """ + base64.b64encode("\"samba123@\"".encode('utf-16-le')) + """
1327 unicodePwd:: """ + base64.b64encode("\"thatsAcomplPASS2\"".encode('utf-16-le')) + """
1329 except LdbError, (num, _):
1330 self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
1332 # for some reason we get constraint violation instead of insufficient access error
1335 def test_change_password3(self):
1336 """Make sure WP has no influence"""
1337 mod = "(D;;WP;;;PS)"
1338 self.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
1339 desc = self.read_desc(self.get_user_dn(self.user_with_wp))
1340 sddl = desc.as_sddl(self.domain_sid)
1341 self.ldb_user.modify_ldif("""
1342 dn: """ + self.get_user_dn(self.user_with_wp) + """
1345 unicodePwd:: """ + base64.b64encode("\"samba123@\"".encode('utf-16-le')) + """
1347 unicodePwd:: """ + base64.b64encode("\"thatsAcomplPASS2\"".encode('utf-16-le')) + """
1350 def test_change_password5(self):
1351 """Make sure rights have no influence on dBCSPwd"""
1352 desc = self.read_desc(self.get_user_dn(self.user_with_wp))
1353 sddl = desc.as_sddl(self.domain_sid)
1354 sddl = sddl.replace("(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD)", "")
1355 sddl = sddl.replace("(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;PS)", "")
1356 self.modify_desc(self.get_user_dn(self.user_with_wp), sddl)
1357 mod = "(D;;WP;;;PS)"
1358 self.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
1360 self.ldb_user.modify_ldif("""
1361 dn: """ + self.get_user_dn(self.user_with_wp) + """
1364 dBCSPwd: XXXXXXXXXXXXXXXX
1366 dBCSPwd: YYYYYYYYYYYYYYYY
1368 except LdbError, (num, _):
1369 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1373 def test_change_password6(self):
1374 """Test uneven delete/adds"""
1376 self.ldb_user.modify_ldif("""
1377 dn: """ + self.get_user_dn(self.user_with_wp) + """
1379 delete: userPassword
1380 userPassword: thatsAcomplPASS1
1381 delete: userPassword
1382 userPassword: thatsAcomplPASS1
1384 userPassword: thatsAcomplPASS2
1386 except LdbError, (num, _):
1387 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
1390 mod = "(OA;;CR;00299570-246d-11d0-a768-00aa006e0529;;PS)"
1391 self.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
1393 self.ldb_user.modify_ldif("""
1394 dn: """ + self.get_user_dn(self.user_with_wp) + """
1396 delete: userPassword
1397 userPassword: thatsAcomplPASS1
1398 delete: userPassword
1399 userPassword: thatsAcomplPASS1
1401 userPassword: thatsAcomplPASS2
1403 except LdbError, (num, _):
1404 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1408 def test_change_password7(self):
1409 """Try a password change operation without any CARs given"""
1410 #users have change password by default - remove for negative testing
1411 desc = self.read_desc(self.get_user_dn(self.user_with_wp))
1412 sddl = desc.as_sddl(self.domain_sid)
1413 self.modify_desc(self.get_user_dn(self.user_with_wp), sddl)
1414 #first change our own password
1415 self.ldb_user2.modify_ldif("""
1416 dn: """ + self.get_user_dn(self.user_with_pc) + """
1419 unicodePwd:: """ + base64.b64encode("\"samba123@\"".encode('utf-16-le')) + """
1421 unicodePwd:: """ + base64.b64encode("\"thatsAcomplPASS1\"".encode('utf-16-le')) + """
1423 #then someone else's
1424 self.ldb_user2.modify_ldif("""
1425 dn: """ + self.get_user_dn(self.user_with_wp) + """
1428 unicodePwd:: """ + base64.b64encode("\"samba123@\"".encode('utf-16-le')) + """
1430 unicodePwd:: """ + base64.b64encode("\"thatsAcomplPASS2\"".encode('utf-16-le')) + """
1433 def test_reset_password1(self):
1434 """Try a user password reset operation (unicodePwd) before and after granting CAR"""
1436 self.ldb_user.modify_ldif("""
1437 dn: """ + self.get_user_dn(self.user_with_wp) + """
1440 unicodePwd:: """ + base64.b64encode("\"thatsAcomplPASS1\"".encode('utf-16-le')) + """
1442 except LdbError, (num, _):
1443 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
1446 mod = "(OA;;CR;00299570-246d-11d0-a768-00aa006e0529;;PS)"
1447 self.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
1448 self.ldb_user.modify_ldif("""
1449 dn: """ + self.get_user_dn(self.user_with_wp) + """
1452 unicodePwd:: """ + base64.b64encode("\"thatsAcomplPASS1\"".encode('utf-16-le')) + """
1455 def test_reset_password2(self):
1456 """Try a user password reset operation (userPassword) before and after granting CAR"""
1458 self.ldb_user.modify_ldif("""
1459 dn: """ + self.get_user_dn(self.user_with_wp) + """
1461 replace: userPassword
1462 userPassword: thatsAcomplPASS1
1464 except LdbError, (num, _):
1465 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
1468 mod = "(OA;;CR;00299570-246d-11d0-a768-00aa006e0529;;PS)"
1469 self.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
1470 self.ldb_user.modify_ldif("""
1471 dn: """ + self.get_user_dn(self.user_with_wp) + """
1473 replace: userPassword
1474 userPassword: thatsAcomplPASS1
1477 def test_reset_password3(self):
1478 """Grant WP and see what happens (unicodePwd)"""
1479 mod = "(A;;WP;;;PS)"
1480 self.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
1482 self.ldb_user.modify_ldif("""
1483 dn: """ + self.get_user_dn(self.user_with_wp) + """
1486 unicodePwd:: """ + base64.b64encode("\"thatsAcomplPASS1\"".encode('utf-16-le')) + """
1488 except LdbError, (num, _):
1489 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
1493 def test_reset_password4(self):
1494 """Grant WP and see what happens (userPassword)"""
1495 mod = "(A;;WP;;;PS)"
1496 self.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
1498 self.ldb_user.modify_ldif("""
1499 dn: """ + self.get_user_dn(self.user_with_wp) + """
1501 replace: userPassword
1502 userPassword: thatsAcomplPASS1
1504 except LdbError, (num, _):
1505 self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
1509 def test_reset_password5(self):
1510 """Explicitly deny WP but grant CAR (unicodePwd)"""
1511 mod = "(D;;WP;;;PS)(OA;;CR;00299570-246d-11d0-a768-00aa006e0529;;PS)"
1512 self.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
1513 self.ldb_user.modify_ldif("""
1514 dn: """ + self.get_user_dn(self.user_with_wp) + """
1517 unicodePwd:: """ + base64.b64encode("\"thatsAcomplPASS1\"".encode('utf-16-le')) + """
1520 def test_reset_password6(self):
1521 """Explicitly deny WP but grant CAR (userPassword)"""
1522 mod = "(D;;WP;;;PS)(OA;;CR;00299570-246d-11d0-a768-00aa006e0529;;PS)"
1523 self.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
1524 self.ldb_user.modify_ldif("""
1525 dn: """ + self.get_user_dn(self.user_with_wp) + """
1527 replace: userPassword
1528 userPassword: thatsAcomplPASS1
1531 # Important unit running information
1533 if not "://" in host:
1534 host = "ldap://%s" % host
1535 ldb = SamDB(host, credentials=creds, session_info=system_session(), lp=lp)
1537 runner = SubunitTestRunner()
1539 if not runner.run(unittest.makeSuite(AclAddTests)).wasSuccessful():
1541 if not runner.run(unittest.makeSuite(AclModifyTests)).wasSuccessful():
1543 if not runner.run(unittest.makeSuite(AclDeleteTests)).wasSuccessful():
1545 if not runner.run(unittest.makeSuite(AclRenameTests)).wasSuccessful():
1547 if not runner.run(unittest.makeSuite(AclCARTests)).wasSuccessful():