source4/dsdb/tests/python/ldap.py

   1 #!/usr/bin/env python
   2 # -*- coding: utf-8 -*-
   3 # This is a port of the original in testprogs/ejs/ldap.js
   4
   5 import optparse
   6 import sys
   7 import time
   8 import base64
   9 import os
  10
  11 sys.path.append("bin/python")
  12 import samba
  13 samba.ensure_external_module("subunit", "subunit/python")
  14 samba.ensure_external_module("testtools", "testtools")
  15
  16 import samba.getopt as options
  17
  18 from samba.auth import system_session
  19 from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError
  20 from ldb import ERR_NO_SUCH_OBJECT, ERR_ATTRIBUTE_OR_VALUE_EXISTS
  21 from ldb import ERR_ENTRY_ALREADY_EXISTS, ERR_UNWILLING_TO_PERFORM
  22 from ldb import ERR_NOT_ALLOWED_ON_NON_LEAF, ERR_OTHER, ERR_INVALID_DN_SYNTAX
  23 from ldb import ERR_NO_SUCH_ATTRIBUTE
  24 from ldb import ERR_OBJECT_CLASS_VIOLATION, ERR_NOT_ALLOWED_ON_RDN
  25 from ldb import ERR_NAMING_VIOLATION, ERR_CONSTRAINT_VIOLATION
  26 from ldb import ERR_UNDEFINED_ATTRIBUTE_TYPE
  27 from ldb import Message, MessageElement, Dn
  28 from ldb import FLAG_MOD_ADD, FLAG_MOD_REPLACE, FLAG_MOD_DELETE
  29 from samba import Ldb
  30 from samba.dsdb import (UF_NORMAL_ACCOUNT, UF_WORKSTATION_TRUST_ACCOUNT,
  31     UF_PASSWD_NOTREQD, UF_ACCOUNTDISABLE, ATYPE_NORMAL_ACCOUNT,
  32     ATYPE_WORKSTATION_TRUST)
  33
  34 from subunit.run import SubunitTestRunner
  35 import unittest
  36
  37 from samba.ndr import ndr_pack, ndr_unpack
  38 from samba.dcerpc import security
  39
  40 parser = optparse.OptionParser("ldap [options] <host>")
  41 sambaopts = options.SambaOptions(parser)
  42 parser.add_option_group(sambaopts)
  43 parser.add_option_group(options.VersionOptions(parser))
  44 # use command line creds if available
  45 credopts = options.CredentialsOptions(parser)
  46 parser.add_option_group(credopts)
  47 opts, args = parser.parse_args()
  48
  49 if len(args) < 1:
  50     parser.print_usage()
  51     sys.exit(1)
  52
  53 host = args[0]
  54
  55 lp = sambaopts.get_loadparm()
  56 creds = credopts.get_credentials(lp)
  57
  58 class BasicTests(unittest.TestCase):
  59
  60     def delete_force(self, ldb, dn):
  61         try:
  62             ldb.delete(dn)
  63         except LdbError, (num, _):
  64             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
  65
  66     def find_basedn(self, ldb):
  67         res = ldb.search(base="", expression="", scope=SCOPE_BASE,
  68                          attrs=["defaultNamingContext"])
  69         self.assertEquals(len(res), 1)
  70         return res[0]["defaultNamingContext"][0]
  71
  72     def find_configurationdn(self, ldb):
  73         res = ldb.search(base="", expression="", scope=SCOPE_BASE, attrs=["configurationNamingContext"])
  74         self.assertEquals(len(res), 1)
  75         return res[0]["configurationNamingContext"][0]
  76
  77     def find_schemadn(self, ldb):
  78         res = ldb.search(base="", expression="", scope=SCOPE_BASE, attrs=["schemaNamingContext"])
  79         self.assertEquals(len(res), 1)
  80         return res[0]["schemaNamingContext"][0]
  81
  82     def find_domain_sid(self):
  83         res = self.ldb.search(base=self.base_dn, expression="(objectClass=*)", scope=SCOPE_BASE)
  84         return ndr_unpack( security.dom_sid,res[0]["objectSid"][0])
  85
  86     def setUp(self):
  87         super(BasicTests, self).setUp()
  88         self.ldb = ldb
  89         self.gc_ldb = gc_ldb
  90         self.base_dn = self.find_basedn(ldb)
  91         self.configuration_dn = self.find_configurationdn(ldb)
  92         self.schema_dn = self.find_schemadn(ldb)
  93         self.domain_sid = self.find_domain_sid()
  94
  95         print "baseDN: %s\n" % self.base_dn
  96
  97         self.delete_force(self.ldb, "cn=posixuser,cn=users," + self.base_dn)
  98         self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
  99         self.delete_force(self.ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
 100         self.delete_force(self.ldb, "cn=ldaptestuser3,cn=users," + self.base_dn)
 101         self.delete_force(self.ldb, "cn=ldaptestuser4,cn=ldaptestcontainer," + self.base_dn)
 102         self.delete_force(self.ldb, "cn=ldaptestuser4,cn=ldaptestcontainer2," + self.base_dn)
 103         self.delete_force(self.ldb, "cn=ldaptestuser5,cn=users," + self.base_dn)
 104         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 105         self.delete_force(self.ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 106         self.delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
 107         self.delete_force(self.ldb, "cn=ldaptest2computer,cn=computers," + self.base_dn)
 108         self.delete_force(self.ldb, "cn=ldaptestcomputer3,cn=computers," + self.base_dn)
 109         self.delete_force(self.ldb, "cn=ldaptestutf8user èùéìòà,cn=users," + self.base_dn)
 110         self.delete_force(self.ldb, "cn=ldaptestutf8user2  èùéìòà,cn=users," + self.base_dn)
 111         self.delete_force(self.ldb, "cn=entry1,cn=ldaptestcontainer," + self.base_dn)
 112         self.delete_force(self.ldb, "cn=entry2,cn=ldaptestcontainer," + self.base_dn)
 113         self.delete_force(self.ldb, "cn=ldaptestcontainer," + self.base_dn)
 114         self.delete_force(self.ldb, "cn=ldaptestcontainer2," + self.base_dn)
 115         self.delete_force(self.ldb, "cn=parentguidtest,cn=users," + self.base_dn)
 116         self.delete_force(self.ldb, "cn=parentguidtest,cn=testotherusers," + self.base_dn)
 117         self.delete_force(self.ldb, "cn=testotherusers," + self.base_dn)
 118         self.delete_force(self.ldb, "cn=ldaptestobject," + self.base_dn)
 119         self.delete_force(self.ldb, "description=xyz,cn=users," + self.base_dn)
 120         self.delete_force(self.ldb, "ou=testou,cn=users," + self.base_dn)
 121
 122     def test_objectclasses(self):
 123         """Test objectClass behaviour"""
 124         print "Test objectClass behaviour"""
 125
 126         # Invalid objectclass specified
 127         try:
 128             self.ldb.add({
 129                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 130                 "objectClass": "X" })
 131             self.fail()
 132         except LdbError, (num, _):
 133             self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
 134
 135         # We cannot instanciate from an abstract objectclass
 136         try:
 137             self.ldb.add({
 138                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 139                 "objectClass": "connectionPoint" })
 140             self.fail()
 141         except LdbError, (num, _):
 142             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 143
 144         self.ldb.add({
 145              "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 146              "objectClass": "person" })
 147
 148         # We can remove derivation classes of the structural objectclass
 149         # but they're going to be readded afterwards
 150         m = Message()
 151         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 152         m["objectClass"] = MessageElement("top", FLAG_MOD_DELETE,
 153           "objectClass")
 154         ldb.modify(m)
 155
 156         res = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 157                          scope=SCOPE_BASE, attrs=["objectClass"])
 158         self.assertTrue(len(res) == 1)
 159         self.assertTrue("top" in res[0]["objectClass"])
 160
 161         # The top-most structural class cannot be deleted since there are
 162         # attributes of it in use
 163         m = Message()
 164         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 165         m["objectClass"] = MessageElement("person", FLAG_MOD_DELETE,
 166           "objectClass")
 167         try:
 168             ldb.modify(m)
 169             self.fail()
 170         except LdbError, (num, _):
 171             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 172
 173         # We cannot delete classes which weren't specified
 174         m = Message()
 175         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 176         m["objectClass"] = MessageElement("computer", FLAG_MOD_DELETE,
 177           "objectClass")
 178         try:
 179             ldb.modify(m)
 180             self.fail()
 181         except LdbError, (num, _):
 182             self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
 183
 184         # An invalid class cannot be added
 185         m = Message()
 186         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 187         m["objectClass"] = MessageElement("X", FLAG_MOD_ADD,
 188           "objectClass")
 189         try:
 190             ldb.modify(m)
 191             self.fail()
 192         except LdbError, (num, _):
 193             self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
 194
 195         # The top-most structural class cannot be changed by adding another
 196         # structural one
 197         m = Message()
 198         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 199         m["objectClass"] = MessageElement("user", FLAG_MOD_ADD,
 200           "objectClass")
 201         try:
 202             ldb.modify(m)
 203             self.fail()
 204         except LdbError, (num, _):
 205             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 206
 207         # An already specified objectclass cannot be added another time
 208         m = Message()
 209         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 210         m["objectClass"] = MessageElement("person", FLAG_MOD_ADD,
 211           "objectClass")
 212         try:
 213             ldb.modify(m)
 214             self.fail()
 215         except LdbError, (num, _):
 216             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 217
 218         # Auxiliary classes can always be added
 219         m = Message()
 220         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 221         m["objectClass"] = MessageElement("bootableDevice", FLAG_MOD_ADD,
 222           "objectClass")
 223         ldb.modify(m)
 224
 225         # It's only possible to replace with the same objectclass combination.
 226         # So the replace action on "objectClass" attributes is really useless.
 227         m = Message()
 228         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 229         m["objectClass"] = MessageElement(["top", "person", "bootableDevice"],
 230           FLAG_MOD_REPLACE, "objectClass")
 231         ldb.modify(m)
 232
 233         m = Message()
 234         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 235         m["objectClass"] = MessageElement(["person", "bootableDevice"],
 236           FLAG_MOD_REPLACE, "objectClass")
 237         ldb.modify(m)
 238
 239         m = Message()
 240         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 241         m["objectClass"] = MessageElement(["top", "person", "bootableDevice",
 242           "connectionPoint"], FLAG_MOD_REPLACE, "objectClass")
 243         try:
 244             ldb.modify(m)
 245             self.fail()
 246         except LdbError, (num, _):
 247             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 248
 249         m = Message()
 250         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 251         m["objectClass"] = MessageElement(["top", "computer"], FLAG_MOD_REPLACE,
 252           "objectClass")
 253         try:
 254             ldb.modify(m)
 255             self.fail()
 256         except LdbError, (num, _):
 257             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 258
 259         # Classes can be removed unless attributes of them are used.
 260         m = Message()
 261         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 262         m["objectClass"] = MessageElement("bootableDevice", FLAG_MOD_DELETE,
 263           "objectClass")
 264         ldb.modify(m)
 265
 266         res = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 267                          scope=SCOPE_BASE, attrs=["objectClass"])
 268         self.assertTrue(len(res) == 1)
 269         self.assertFalse("bootableDevice" in res[0]["objectClass"])
 270
 271         m = Message()
 272         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 273         m["objectClass"] = MessageElement("bootableDevice", FLAG_MOD_ADD,
 274           "objectClass")
 275         ldb.modify(m)
 276
 277         # Add an attribute specific to the "bootableDevice" class
 278         m = Message()
 279         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 280         m["bootParameter"] = MessageElement("test", FLAG_MOD_ADD,
 281           "bootParameter")
 282         ldb.modify(m)
 283
 284         # Classes can be removed unless attributes of them are used. Now there
 285         # exist such attributes on the entry.
 286         m = Message()
 287         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 288         m["objectClass"] = MessageElement("bootableDevice", FLAG_MOD_DELETE,
 289           "objectClass")
 290         try:
 291             ldb.modify(m)
 292             self.fail()
 293         except LdbError, (num, _):
 294             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 295
 296         # Remove the previously specified attribute
 297         m = Message()
 298         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 299         m["bootParameter"] = MessageElement("test", FLAG_MOD_DELETE,
 300           "bootParameter")
 301         ldb.modify(m)
 302
 303         # Classes can be removed unless attributes of them are used.
 304         m = Message()
 305         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 306         m["objectClass"] = MessageElement("bootableDevice", FLAG_MOD_DELETE,
 307           "objectClass")
 308         ldb.modify(m)
 309
 310         self.delete_force(self.ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
 311
 312     def test_system_only(self):
 313         """Test systemOnly objects"""
 314         print "Test systemOnly objects"""
 315
 316         try:
 317             self.ldb.add({
 318                 "dn": "cn=ldaptestobject," + self.base_dn,
 319                 "objectclass": "configuration"})
 320             self.fail()
 321         except LdbError, (num, _):
 322             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 323
 324         self.delete_force(self.ldb, "cn=ldaptestobject," + self.base_dn)
 325
 326     def test_invalid_parent(self):
 327         """Test adding an object with invalid parent"""
 328         print "Test adding an object with invalid parent"""
 329
 330         try:
 331             self.ldb.add({
 332                 "dn": "cn=ldaptestgroup,cn=thisdoesnotexist123,"
 333                    + self.base_dn,
 334                 "objectclass": "group"})
 335             self.fail()
 336         except LdbError, (num, _):
 337             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
 338
 339         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=thisdoesnotexist123,"
 340           + self.base_dn)
 341
 342         try:
 343             self.ldb.add({
 344                 "dn": "ou=testou,cn=users," + self.base_dn,
 345                 "objectclass": "organizationalUnit"})
 346             self.fail()
 347         except LdbError, (num, _):
 348             self.assertEquals(num, ERR_NAMING_VIOLATION)
 349
 350         self.delete_force(self.ldb, "ou=testou,cn=users," + self.base_dn)
 351
 352     def test_invalid_attribute(self):
 353         """Test invalid attributes on schema/objectclasses"""
 354         print "Test invalid attributes on schema/objectclasses"""
 355
 356         # attributes not in schema test
 357
 358         # add operation
 359
 360         try:
 361             self.ldb.add({
 362                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 363                 "objectclass": "group",
 364                 "thisdoesnotexist": "x"})
 365             self.fail()
 366         except LdbError, (num, _):
 367             self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
 368
 369         self.ldb.add({
 370              "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 371              "objectclass": "group"})
 372
 373         # modify operation
 374
 375         m = Message()
 376         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 377         m["thisdoesnotexist"] = MessageElement("x", FLAG_MOD_REPLACE,
 378           "thisdoesnotexist")
 379         try:
 380             ldb.modify(m)
 381             self.fail()
 382         except LdbError, (num, _):
 383             self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
 384
 385         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 386
 387         # attributes not in objectclasses and mandatory attributes missing test
 388         # Use here a non-SAM entry since it doesn't have special triggers
 389         # associated which have an impact on the error results.
 390
 391         # add operations
 392
 393         # mandatory attribute missing
 394         try:
 395             self.ldb.add({
 396                 "dn": "cn=ldaptestobject," + self.base_dn,
 397                 "objectclass": "ipProtocol"})
 398             self.fail()
 399         except LdbError, (num, _):
 400             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 401
 402         # inadequate but schema-valid attribute specified
 403         try:
 404             self.ldb.add({
 405                 "dn": "cn=ldaptestobject," + self.base_dn,
 406                 "objectclass": "ipProtocol",
 407                 "ipProtocolNumber": "1",
 408                 "uid" : "0"})
 409             self.fail()
 410         except LdbError, (num, _):
 411             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 412
 413         self.ldb.add({
 414             "dn": "cn=ldaptestobject," + self.base_dn,
 415             "objectclass": "ipProtocol",
 416             "ipProtocolNumber": "1"})
 417
 418         # modify operations
 419
 420         # inadequate but schema-valid attribute add trial
 421         m = Message()
 422         m.dn = Dn(ldb, "cn=ldaptestobject," + self.base_dn)
 423         m["uid"] = MessageElement("0", FLAG_MOD_ADD, "uid")
 424         try:
 425             ldb.modify(m)
 426             self.fail()
 427         except LdbError, (num, _):
 428             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 429
 430         # mandatory attribute delete trial
 431         m = Message()
 432         m.dn = Dn(ldb, "cn=ldaptestobject," + self.base_dn)
 433         m["ipProtocolNumber"] = MessageElement([], FLAG_MOD_DELETE,
 434           "ipProtocolNumber")
 435         try:
 436             ldb.modify(m)
 437             self.fail()
 438         except LdbError, (num, _):
 439             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 440
 441         # mandatory attribute delete trial
 442         m = Message()
 443         m.dn = Dn(ldb, "cn=ldaptestobject," + self.base_dn)
 444         m["ipProtocolNumber"] = MessageElement([], FLAG_MOD_REPLACE,
 445           "ipProtocolNumber")
 446         try:
 447             ldb.modify(m)
 448             self.fail()
 449         except LdbError, (num, _):
 450             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 451
 452         self.delete_force(self.ldb, "cn=ldaptestobject," + self.base_dn)
 453
 454     def test_single_valued_attributes(self):
 455         """Test single-valued attributes"""
 456         print "Test single-valued attributes"""
 457
 458         try:
 459             self.ldb.add({
 460                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 461                 "objectclass": "group",
 462                 "sAMAccountName": ["nam1", "nam2"]})
 463             self.fail()
 464         except LdbError, (num, _):
 465             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 466
 467         self.ldb.add({
 468              "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 469              "objectclass": "group"})
 470
 471         m = Message()
 472         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 473         m["sAMAccountName"] = MessageElement(["nam1","nam2"], FLAG_MOD_REPLACE,
 474           "sAMAccountName")
 475         try:
 476             ldb.modify(m)
 477             self.fail()
 478         except LdbError, (num, _):
 479             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 480
 481         m = Message()
 482         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 483         m["sAMAccountName"] = MessageElement("testgroupXX", FLAG_MOD_REPLACE,
 484           "sAMAccountName")
 485         ldb.modify(m)
 486
 487         m = Message()
 488         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 489         m["sAMAccountName"] = MessageElement("testgroupXX2", FLAG_MOD_ADD,
 490           "sAMAccountName")
 491         try:
 492             ldb.modify(m)
 493             self.fail()
 494         except LdbError, (num, _):
 495             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 496
 497         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 498
 499     def test_multi_valued_attributes(self):
 500         """Test multi-valued attributes"""
 501         print "Test multi-valued attributes"""
 502
 503 # TODO: In this test I added some special tests where I got very unusual
 504 # results back from a real AD. s4 doesn't match them and I've no idea how to
 505 # implement those error cases (maybe there exists a special trigger for
 506 # "description" attributes which handle them)
 507
 508         self.ldb.add({
 509             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 510             "description": "desc2",
 511             "objectclass": "group",
 512             "description": "desc1"})
 513
 514         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 515
 516         self.ldb.add({
 517             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 518             "objectclass": "group",
 519             "description": ["desc1", "desc2"]})
 520
 521 #        m = Message()
 522 #        m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 523 #        m["description"] = MessageElement(["desc1","desc2"], FLAG_MOD_REPLACE,
 524 #          "description")
 525 #        try:
 526 #            ldb.modify(m)
 527 #            self.fail()
 528 #        except LdbError, (num, _):
 529 #            self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 530
 531         m = Message()
 532         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 533         m["description"] = MessageElement("desc1", FLAG_MOD_REPLACE,
 534           "description")
 535         ldb.modify(m)
 536
 537 #        m = Message()
 538 #        m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 539 #        m["description"] = MessageElement("desc3", FLAG_MOD_ADD,
 540 #          "description")
 541 #        try:
 542 #            ldb.modify(m)
 543 #            self.fail()
 544 #        except LdbError, (num, _):
 545 #            self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 546
 547         m = Message()
 548         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 549         m["description"] = MessageElement(["desc1","desc2"], FLAG_MOD_DELETE,
 550           "description")
 551         try:
 552             ldb.modify(m)
 553             self.fail()
 554         except LdbError, (num, _):
 555             self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
 556
 557         m = Message()
 558         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 559         m["description"] = MessageElement("desc1", FLAG_MOD_DELETE,
 560           "description")
 561         ldb.modify(m)
 562
 563 #        m = Message()
 564 #        m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 565 #        m["description"] = MessageElement(["desc1","desc2"], FLAG_MOD_REPLACE,
 566 #          "description")
 567 #        try:
 568 #            ldb.modify(m)
 569 #            self.fail()
 570 #        except LdbError, (num, _):
 571 #            self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 572
 573 #        m = Message()
 574 #        m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 575 #        m["description"] = MessageElement(["desc3", "desc4"], FLAG_MOD_ADD,
 576 #          "description")
 577 #        try:
 578 #            ldb.modify(m)
 579 #            self.fail()
 580 #        except LdbError, (num, _):
 581 #            self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 582
 583         m = Message()
 584         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 585         m["description"] = MessageElement("desc3", FLAG_MOD_ADD,
 586           "description")
 587         ldb.modify(m)
 588
 589         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 590
 591     def test_empty_messages(self):
 592         """Test empty messages"""
 593         print "Test empty messages"""
 594
 595         m = Message()
 596         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 597
 598         try:
 599             ldb.add(m)
 600             self.fail()
 601         except LdbError, (num, _):
 602             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 603
 604         try:
 605             ldb.modify(m)
 606             self.fail()
 607         except LdbError, (num, _):
 608             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 609
 610         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 611
 612     def test_empty_attributes(self):
 613         """Test empty attributes"""
 614         print "Test empty attributes"""
 615
 616         m = Message()
 617         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 618         m["objectClass"] = MessageElement("group", FLAG_MOD_ADD, "objectClass")
 619         m["description"] = MessageElement([], FLAG_MOD_ADD, "description")
 620
 621         try:
 622             ldb.add(m)
 623             self.fail()
 624         except LdbError, (num, _):
 625             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 626
 627         self.ldb.add({
 628             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 629             "objectclass": "group"})
 630
 631         m = Message()
 632         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 633         m["description"] = MessageElement([], FLAG_MOD_ADD, "description")
 634
 635         try:
 636             ldb.modify(m)
 637             self.fail()
 638         except LdbError, (num, _):
 639             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 640
 641         m = Message()
 642         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 643         m["description"] = MessageElement([], FLAG_MOD_REPLACE, "description")
 644         ldb.modify(m)
 645
 646         m = Message()
 647         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 648         m["description"] = MessageElement([], FLAG_MOD_DELETE, "description")
 649         try:
 650             ldb.modify(m)
 651             self.fail()
 652         except LdbError, (num, _):
 653             self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
 654
 655         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 656
 657     def test_instanceType(self):
 658         """Tests the 'instanceType' attribute"""
 659         print "Tests the 'instanceType' attribute"""
 660
 661         # The instance type is single-valued
 662         try:
 663             self.ldb.add({
 664                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 665                 "objectclass": "group",
 666                 "instanceType": ["0", "1"]})
 667             self.fail()
 668         except LdbError, (num, _):
 669             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 670
 671         # The head NC flag cannot be set without the write flag
 672         try:
 673             self.ldb.add({
 674                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 675                 "objectclass": "group",
 676                 "instanceType": "1" })
 677             self.fail()
 678         except LdbError, (num, _):
 679             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 680
 681         # We cannot manipulate NCs without the head NC flag
 682         try:
 683             self.ldb.add({
 684                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 685                 "objectclass": "group",
 686                 "instanceType": "32" })
 687             self.fail()
 688         except LdbError, (num, _):
 689             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 690
 691         self.ldb.add({
 692              "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 693              "objectclass": "group"})
 694
 695         m = Message()
 696         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 697         m["instanceType"] = MessageElement("0", FLAG_MOD_REPLACE,
 698           "instanceType")
 699         try:
 700             ldb.modify(m)
 701             self.fail()
 702         except LdbError, (num, _):
 703             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 704
 705         m = Message()
 706         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 707         m["instanceType"] = MessageElement([], FLAG_MOD_REPLACE,
 708           "instanceType")
 709         try:
 710             ldb.modify(m)
 711             self.fail()
 712         except LdbError, (num, _):
 713             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 714
 715         m = Message()
 716         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 717         m["instanceType"] = MessageElement([], FLAG_MOD_DELETE, "instanceType")
 718         try:
 719             ldb.modify(m)
 720             self.fail()
 721         except LdbError, (num, _):
 722             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 723
 724         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 725
 726     def test_distinguished_name(self):
 727         """Tests the 'distinguishedName' attribute"""
 728         print "Tests the 'distinguishedName' attribute"""
 729
 730         # a wrong "distinguishedName" attribute is obviously tolerated
 731         self.ldb.add({
 732               "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 733               "objectclass": "group",
 734               "distinguishedName": "cn=ldaptest,cn=users," + self.base_dn})
 735
 736         # proof if the DN has been set correctly
 737         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 738                          scope=SCOPE_BASE, attrs=["distinguishedName"])
 739         self.assertTrue(len(res) == 1)
 740         self.assertTrue("distinguishedName" in res[0])
 741         self.assertTrue(Dn(ldb, res[0]["distinguishedName"][0])
 742            == Dn(ldb, "cn=ldaptestgroup, cn=users," + self.base_dn))
 743
 744         m = Message()
 745         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 746         m["distinguishedName"] = MessageElement(
 747           "cn=ldaptestuser,cn=users," + self.base_dn, FLAG_MOD_ADD,
 748           "distinguishedName")
 749
 750         try:
 751             ldb.modify(m)
 752             self.fail()
 753         except LdbError, (num, _):
 754             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 755
 756         m = Message()
 757         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 758         m["distinguishedName"] = MessageElement(
 759           "cn=ldaptestuser,cn=users," + self.base_dn, FLAG_MOD_REPLACE,
 760           "distinguishedName")
 761
 762         try:
 763             ldb.modify(m)
 764             self.fail()
 765         except LdbError, (num, _):
 766             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 767
 768         m = Message()
 769         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 770         m["distinguishedName"] = MessageElement(
 771           "cn=ldaptestuser,cn=users," + self.base_dn, FLAG_MOD_DELETE,
 772           "distinguishedName")
 773
 774         try:
 775             ldb.modify(m)
 776             self.fail()
 777         except LdbError, (num, _):
 778             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 779
 780         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 781
 782     def test_rdn_name(self):
 783         """Tests the RDN"""
 784         print "Tests the RDN"""
 785
 786         try:
 787             self.ldb.add({
 788                  "dn": "description=xyz,cn=users," + self.base_dn,
 789                  "objectclass": "group"})
 790             self.fail()
 791         except LdbError, (num, _):
 792             self.assertEquals(num, ERR_NAMING_VIOLATION)
 793
 794         self.delete_force(self.ldb, "description=xyz,cn=users," + self.base_dn)
 795
 796         # a wrong "name" attribute is obviously tolerated
 797         self.ldb.add({
 798              "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 799              "objectclass": "group",
 800              "name": "ldaptestgroupx"})
 801
 802         # proof if the name has been set correctly
 803         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 804                          scope=SCOPE_BASE, attrs=["name"])
 805         self.assertTrue(len(res) == 1)
 806         self.assertTrue("name" in res[0])
 807         self.assertTrue(res[0]["name"][0] == "ldaptestgroup")
 808
 809         m = Message()
 810         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 811         m["name"] = MessageElement("cn=ldaptestuser", FLAG_MOD_REPLACE,
 812           "name")
 813         try:
 814             ldb.modify(m)
 815             self.fail()
 816         except LdbError, (num, _):
 817             self.assertEquals(num, ERR_NOT_ALLOWED_ON_RDN)
 818
 819         m = Message()
 820         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 821         m["cn"] = MessageElement("ldaptestuser",
 822           FLAG_MOD_REPLACE, "cn")
 823         try:
 824             ldb.modify(m)
 825             self.fail()
 826         except LdbError, (num, _):
 827             self.assertEquals(num, ERR_NOT_ALLOWED_ON_RDN)
 828
 829         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 830
 831
 832         # this test needs to be disabled until we really understand
 833         # what the rDN length constraints are
 834     def DISABLED_test_largeRDN(self):
 835         """Testing large rDN (limit 64 characters)"""
 836         rdn = "CN=a012345678901234567890123456789012345678901234567890123456789012";
 837         self.delete_force(self.ldb, "%s,%s" % (rdn, self.base_dn))
 838         ldif = """
 839 dn: %s,%s""" % (rdn,self.base_dn) + """
 840 objectClass: container
 841 """
 842         self.ldb.add_ldif(ldif)
 843         self.delete_force(self.ldb, "%s,%s" % (rdn, self.base_dn))
 844
 845         rdn = "CN=a0123456789012345678901234567890123456789012345678901234567890120";
 846         self.delete_force(self.ldb, "%s,%s" % (rdn, self.base_dn))
 847         try:
 848             ldif = """
 849 dn: %s,%s""" % (rdn,self.base_dn) + """
 850 objectClass: container
 851 """
 852             self.ldb.add_ldif(ldif)
 853             self.fail()
 854         except LdbError, (num, _):
 855             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 856         self.delete_force(self.ldb, "%s,%s" % (rdn, self.base_dn))
 857
 858     def test_rename(self):
 859         """Tests the rename operation"""
 860         print "Tests the rename operations"""
 861
 862         try:
 863             # cannot rename to be a child of itself
 864             ldb.rename(self.base_dn, "dc=test," + self.base_dn)
 865             self.fail()
 866         except LdbError, (num, _):
 867             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 868
 869         try:
 870             # inexistent object
 871             ldb.rename("cn=ldaptestuser2,cn=users," + self.base_dn, "cn=ldaptestuser2,cn=users," + self.base_dn)
 872             self.fail()
 873         except LdbError, (num, _):
 874             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
 875
 876         self.ldb.add({
 877              "dn": "cn=ldaptestuser2,cn=users," + self.base_dn,
 878              "objectclass": ["user", "person"] })
 879
 880         ldb.rename("cn=ldaptestuser2,cn=users," + self.base_dn, "cn=ldaptestuser2,cn=users," + self.base_dn)
 881         ldb.rename("cn=ldaptestuser2,cn=users," + self.base_dn, "cn=ldaptestuser3,cn=users," + self.base_dn)
 882         ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "cn=ldaptestUSER3,cn=users," + self.base_dn)
 883
 884         try:
 885             # containment problem: a user entry cannot contain user entries
 886             ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "cn=ldaptestuser4,cn=ldaptestuser3,cn=users," + self.base_dn)
 887             self.fail()
 888         except LdbError, (num, _):
 889             self.assertEquals(num, ERR_NAMING_VIOLATION)
 890
 891         try:
 892             # invalid parent
 893             ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "cn=ldaptestuser3,cn=people,cn=users," + self.base_dn)
 894             self.fail()
 895         except LdbError, (num, _):
 896             self.assertEquals(num, ERR_OTHER)
 897
 898         try:
 899             # invalid target DN syntax
 900             ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, ",cn=users," + self.base_dn)
 901             self.fail()
 902         except LdbError, (num, _):
 903             self.assertEquals(num, ERR_INVALID_DN_SYNTAX)
 904
 905         try:
 906             # invalid RDN name
 907             ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "ou=ldaptestuser3,cn=users," + self.base_dn)
 908             self.fail()
 909         except LdbError, (num, _):
 910             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 911
 912         self.delete_force(self.ldb, "cn=ldaptestuser3,cn=users," + self.base_dn)
 913
 914         # Performs some "systemFlags" testing
 915
 916         # Move failing since no "SYSTEM_FLAG_CONFIG_ALLOW_MOVE"
 917         try:
 918             ldb.rename("CN=DisplaySpecifiers," + self.configuration_dn, "CN=DisplaySpecifiers,CN=Services," + self.configuration_dn)
 919             self.fail()
 920         except LdbError, (num, _):
 921             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 922
 923         # Limited move failing since no "SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE"
 924         try:
 925             ldb.rename("CN=Directory Service,CN=Windows NT,CN=Services," + self.configuration_dn, "CN=Directory Service,CN=RRAS,CN=Services," + self.configuration_dn)
 926             self.fail()
 927         except LdbError, (num, _):
 928             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 929
 930         # Rename failing since no "SYSTEM_FLAG_CONFIG_ALLOW_RENAME"
 931         try:
 932             ldb.rename("CN=DisplaySpecifiers," + self.configuration_dn, "CN=DisplaySpecifiers2," + self.configuration_dn)
 933             self.fail()
 934         except LdbError, (num, _):
 935             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 936
 937         # It's not really possible to test moves on the schema partition since
 938         # there don't exist subcontainers on it.
 939
 940         # Rename failing since "SYSTEM_FLAG_SCHEMA_BASE_OBJECT"
 941         try:
 942             ldb.rename("CN=Top," + self.schema_dn, "CN=Top2," + self.schema_dn)
 943             self.fail()
 944         except LdbError, (num, _):
 945             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 946
 947         # Move failing since "SYSTEM_FLAG_DOMAIN_DISALLOW_MOVE"
 948         try:
 949             ldb.rename("CN=Users," + self.base_dn, "CN=Users,CN=Computers," + self.base_dn)
 950             self.fail()
 951         except LdbError, (num, _):
 952             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 953
 954         # Rename failing since "SYSTEM_FLAG_DOMAIN_DISALLOW_RENAME"
 955         try:
 956             ldb.rename("CN=Users," + self.base_dn, "CN=Users2," + self.base_dn)
 957             self.fail()
 958         except LdbError, (num, _):
 959             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 960
 961         # Performs some other constraints testing
 962
 963         try:
 964             ldb.rename("CN=Policies,CN=System," + self.base_dn, "CN=Users2," + self.base_dn)
 965             self.fail()
 966         except LdbError, (num, _):
 967             self.assertEquals(num, ERR_OTHER)
 968
 969     def test_rename_twice(self):
 970         """Tests the rename operation twice - this corresponds to a past bug"""
 971         print "Tests the rename twice operation"""
 972
 973         self.ldb.add({
 974              "dn": "cn=ldaptestuser5,cn=users," + self.base_dn,
 975              "objectclass": ["user", "person"] })
 976
 977         ldb.rename("cn=ldaptestuser5,cn=users," + self.base_dn, "cn=ldaptestUSER5,cn=users," + self.base_dn)
 978         self.delete_force(self.ldb, "cn=ldaptestuser5,cn=users," + self.base_dn)
 979         self.ldb.add({
 980              "dn": "cn=ldaptestuser5,cn=users," + self.base_dn,
 981              "objectclass": ["user", "person"] })
 982         ldb.rename("cn=ldaptestuser5,cn=Users," + self.base_dn, "cn=ldaptestUSER5,cn=users," + self.base_dn)
 983         res = ldb.search(expression="cn=ldaptestuser5")
 984         print "Found %u records" % len(res)
 985         self.assertEquals(len(res), 1, "Wrong number of hits for cn=ldaptestuser5")
 986         res = ldb.search(expression="(&(cn=ldaptestuser5)(objectclass=user))")
 987         print "Found %u records" % len(res)
 988         self.assertEquals(len(res), 1, "Wrong number of hits for (&(cn=ldaptestuser5)(objectclass=user))")
 989         self.delete_force(self.ldb, "cn=ldaptestuser5,cn=users," + self.base_dn)
 990
 991     def test_parentGUID(self):
 992         """Test parentGUID behaviour"""
 993         print "Testing parentGUID behaviour\n"
 994
 995         # TODO: This seems to fail on Windows Server. Hidden attribute?
 996
 997         self.ldb.add({
 998             "dn": "cn=parentguidtest,cn=users," + self.base_dn,
 999             "objectclass":"user",
1000             "samaccountname":"parentguidtest"});
1001         res1 = ldb.search(base="cn=parentguidtest,cn=users," + self.base_dn, scope=SCOPE_BASE,
1002                           attrs=["parentGUID", "samaccountname"]);
1003         res2 = ldb.search(base="cn=users," + self.base_dn,scope=SCOPE_BASE,
1004                           attrs=["objectGUID"]);
1005         res3 = ldb.search(base=self.base_dn, scope=SCOPE_BASE,
1006                           attrs=["parentGUID"]);
1007
1008         """Check if the parentGUID is valid """
1009         self.assertEquals(res1[0]["parentGUID"], res2[0]["objectGUID"]);
1010
1011         """Check if it returns nothing when there is no parent object"""
1012         has_parentGUID = False
1013         for key in res3[0].keys():
1014             if key == "parentGUID":
1015                 has_parentGUID = True
1016                 break
1017         self.assertFalse(has_parentGUID);
1018
1019         """Ensures that if you look for another object attribute after the constructed
1020             parentGUID, it will return correctly"""
1021         has_another_attribute = False
1022         for key in res1[0].keys():
1023             if key == "sAMAccountName":
1024                 has_another_attribute = True
1025                 break
1026         self.assertTrue(has_another_attribute)
1027         self.assertTrue(len(res1[0]["samaccountname"]) == 1)
1028         self.assertEquals(res1[0]["samaccountname"][0], "parentguidtest");
1029
1030         print "Testing parentGUID behaviour on rename\n"
1031
1032         self.ldb.add({
1033             "dn": "cn=testotherusers," + self.base_dn,
1034             "objectclass":"container"});
1035         res1 = ldb.search(base="cn=testotherusers," + self.base_dn,scope=SCOPE_BASE,
1036                           attrs=["objectGUID"]);
1037         ldb.rename("cn=parentguidtest,cn=users," + self.base_dn,
1038                    "cn=parentguidtest,cn=testotherusers," + self.base_dn);
1039         res2 = ldb.search(base="cn=parentguidtest,cn=testotherusers," + self.base_dn,
1040                           scope=SCOPE_BASE,
1041                           attrs=["parentGUID"]);
1042         self.assertEquals(res1[0]["objectGUID"], res2[0]["parentGUID"]);
1043
1044         self.delete_force(self.ldb, "cn=parentguidtest,cn=testotherusers," + self.base_dn)
1045         self.delete_force(self.ldb, "cn=testotherusers," + self.base_dn)
1046
1047     def test_groupType_int32(self):
1048         """Test groupType (int32) behaviour (should appear to be casted to a 32 bit signed integer before comparsion)"""
1049         print "Testing groupType (int32) behaviour\n"
1050
1051         res1 = ldb.search(base=self.base_dn, scope=SCOPE_SUBTREE,
1052                           attrs=["groupType"], expression="groupType=2147483653");
1053
1054         res2 = ldb.search(base=self.base_dn, scope=SCOPE_SUBTREE,
1055                           attrs=["groupType"], expression="groupType=-2147483643");
1056
1057         self.assertEquals(len(res1), len(res2))
1058
1059         self.assertTrue(res1.count > 0)
1060
1061         self.assertEquals(res1[0]["groupType"][0], "-2147483643")
1062
1063     def test_linked_attributes(self):
1064         """This tests the linked attribute behaviour"""
1065         print "Testing linked attribute behaviour\n"
1066
1067         ldb.add({
1068             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
1069             "objectclass": "group"})
1070
1071         # This should not work since "memberOf" is linked to "member"
1072         try:
1073             ldb.add({
1074                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1075                 "objectclass": ["user", "person"],
1076                 "memberOf": "cn=ldaptestgroup,cn=users," + self.base_dn})
1077         except LdbError, (num, _):
1078             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1079
1080         ldb.add({
1081             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1082             "objectclass": ["user", "person"]})
1083
1084         m = Message()
1085         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1086         m["memberOf"] = MessageElement("cn=ldaptestgroup,cn=users," + self.base_dn,
1087           FLAG_MOD_ADD, "memberOf")
1088         try:
1089             ldb.modify(m)
1090             self.fail()
1091         except LdbError, (num, _):
1092             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1093
1094         m = Message()
1095         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1096         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
1097           FLAG_MOD_ADD, "member")
1098         ldb.modify(m)
1099
1100         m = Message()
1101         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1102         m["memberOf"] = MessageElement("cn=ldaptestgroup,cn=users," + self.base_dn,
1103           FLAG_MOD_REPLACE, "memberOf")
1104         try:
1105             ldb.modify(m)
1106             self.fail()
1107         except LdbError, (num, _):
1108             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1109
1110         m = Message()
1111         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1112         m["memberOf"] = MessageElement("cn=ldaptestgroup,cn=users," + self.base_dn,
1113           FLAG_MOD_DELETE, "memberOf")
1114         try:
1115             ldb.modify(m)
1116             self.fail()
1117         except LdbError, (num, _):
1118             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1119
1120         m = Message()
1121         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1122         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
1123           FLAG_MOD_DELETE, "member")
1124         ldb.modify(m)
1125
1126         # This should yield no results since the member attribute for
1127         # "ldaptestuser" should have been deleted
1128         res1 = ldb.search("cn=ldaptestgroup, cn=users," + self.base_dn,
1129                           scope=SCOPE_BASE,
1130                           expression="(member=cn=ldaptestuser,cn=users," + self.base_dn + ")",
1131                           attrs=[])
1132         self.assertTrue(len(res1) == 0)
1133
1134         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1135
1136         ldb.add({
1137             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
1138             "objectclass": "group",
1139             "member": "cn=ldaptestuser,cn=users," + self.base_dn})
1140
1141         self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1142
1143         # Make sure that the "member" attribute for "ldaptestuser" has been
1144         # removed
1145         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1146                           scope=SCOPE_BASE, attrs=["member"])
1147         self.assertTrue(len(res) == 1)
1148         self.assertFalse("member" in res[0])
1149
1150         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1151
1152     def test_groups(self):
1153         """This tests the group behaviour (setting, changing) of a user account"""
1154         print "Testing group behaviour\n"
1155
1156         ldb.add({
1157             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
1158             "objectclass": "group"})
1159
1160         ldb.add({
1161             "dn": "cn=ldaptestgroup2,cn=users," + self.base_dn,
1162             "objectclass": "group"})
1163
1164         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1165                           scope=SCOPE_BASE, attrs=["objectSID"])
1166         self.assertTrue(len(res1) == 1)
1167         group_rid_1 = security.dom_sid(ldb.schema_format_value("objectSID",
1168           res1[0]["objectSID"][0])).split()[1]
1169
1170         res1 = ldb.search("cn=ldaptestgroup2,cn=users," + self.base_dn,
1171                           scope=SCOPE_BASE, attrs=["objectSID"])
1172         self.assertTrue(len(res1) == 1)
1173         group_rid_2 = security.dom_sid(ldb.schema_format_value("objectSID",
1174           res1[0]["objectSID"][0])).split()[1]
1175
1176         # Try to create a user with an invalid primary group
1177         try:
1178             ldb.add({
1179                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1180                 "objectclass": ["user", "person"],
1181                 "primaryGroupID": "0"})
1182             self.fail()
1183         except LdbError, (num, _):
1184             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1185         self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1186
1187         # Try to Create a user with a valid primary group
1188 # TODO Some more investigation needed here
1189 #        try:
1190 #            ldb.add({
1191 #                "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1192 #                "objectclass": ["user", "person"],
1193 #                "primaryGroupID": str(group_rid_1)})
1194 #            self.fail()
1195 #        except LdbError, (num, _):
1196 #            self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1197 #        self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1198
1199         # Test to see how we should behave when the user account doesn't
1200         # exist
1201         m = Message()
1202         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1203         m["primaryGroupID"] = MessageElement("0", FLAG_MOD_REPLACE,
1204           "primaryGroupID")
1205         try:
1206             ldb.modify(m)
1207             self.fail()
1208         except LdbError, (num, _):
1209             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
1210
1211         # Test to see how we should behave when the account isn't a user
1212         m = Message()
1213         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1214         m["primaryGroupID"] = MessageElement("0", FLAG_MOD_REPLACE,
1215           "primaryGroupID")
1216         try:
1217             ldb.modify(m)
1218             self.fail()
1219         except LdbError, (num, _):
1220             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
1221
1222         ldb.add({
1223             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1224             "objectclass": ["user", "person"]})
1225
1226         # We should be able to reset our actual primary group
1227         m = Message()
1228         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1229         m["primaryGroupID"] = MessageElement("513", FLAG_MOD_REPLACE,
1230           "primaryGroupID")
1231         ldb.modify(m)
1232
1233         # Try to add invalid primary group
1234         m = Message()
1235         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1236         m["primaryGroupID"] = MessageElement("0", FLAG_MOD_REPLACE,
1237           "primaryGroupID")
1238         try:
1239             ldb.modify(m)
1240             self.fail()
1241         except LdbError, (num, _):
1242             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1243
1244         # Try to make group 1 primary - should be denied since it is not yet
1245         # secondary
1246         m = Message()
1247         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1248         m["primaryGroupID"] = MessageElement(str(group_rid_1),
1249           FLAG_MOD_REPLACE, "primaryGroupID")
1250         try:
1251             ldb.modify(m)
1252             self.fail()
1253         except LdbError, (num, _):
1254             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1255
1256         # Make group 1 secondary
1257         m = Message()
1258         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1259         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
1260                                      FLAG_MOD_REPLACE, "member")
1261         ldb.modify(m)
1262
1263         # Make group 1 primary
1264         m = Message()
1265         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1266         m["primaryGroupID"] = MessageElement(str(group_rid_1),
1267           FLAG_MOD_REPLACE, "primaryGroupID")
1268         ldb.modify(m)
1269
1270         # Try to delete group 1 - should be denied
1271         try:
1272             ldb.delete("cn=ldaptestgroup,cn=users," + self.base_dn)
1273             self.fail()
1274         except LdbError, (num, _):
1275             self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
1276
1277         # Try to add group 1 also as secondary - should be denied
1278         m = Message()
1279         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1280         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
1281                                      FLAG_MOD_ADD, "member")
1282         try:
1283             ldb.modify(m)
1284             self.fail()
1285         except LdbError, (num, _):
1286             self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
1287
1288         # Try to add invalid member to group 1 - should be denied
1289         m = Message()
1290         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1291         m["member"] = MessageElement(
1292           "cn=ldaptestuser3,cn=users," + self.base_dn,
1293           FLAG_MOD_ADD, "member")
1294         try:
1295             ldb.modify(m)
1296             self.fail()
1297         except LdbError, (num, _):
1298             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
1299
1300         # Make group 2 secondary
1301         m = Message()
1302         m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
1303         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
1304                                      FLAG_MOD_ADD, "member")
1305         ldb.modify(m)
1306
1307         # Swap the groups
1308         m = Message()
1309         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1310         m["primaryGroupID"] = MessageElement(str(group_rid_2),
1311           FLAG_MOD_REPLACE, "primaryGroupID")
1312         ldb.modify(m)
1313
1314         # Old primary group should contain a "member" attribute for the user,
1315         # the new shouldn't contain anymore one
1316         res1 = ldb.search("cn=ldaptestgroup, cn=users," + self.base_dn,
1317                           scope=SCOPE_BASE, attrs=["member"])
1318         self.assertTrue(len(res1) == 1)
1319         self.assertTrue(len(res1[0]["member"]) == 1)
1320         self.assertEquals(res1[0]["member"][0].lower(),
1321           ("cn=ldaptestuser,cn=users," + self.base_dn).lower())
1322
1323         res1 = ldb.search("cn=ldaptestgroup2, cn=users," + self.base_dn,
1324                           scope=SCOPE_BASE, attrs=["member"])
1325         self.assertTrue(len(res1) == 1)
1326         self.assertFalse("member" in res1[0])
1327
1328         # Also this should be denied
1329         try:
1330             ldb.add({
1331               "dn": "cn=ldaptestuser1,cn=users," + self.base_dn,
1332               "objectclass": ["user", "person"],
1333               "primaryGroupID": "0"})
1334             self.fail()
1335         except LdbError, (num, _):
1336             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1337
1338         self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1339         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1340         self.delete_force(self.ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
1341
1342     def test_sam_attributes(self):
1343         """Test the behaviour of special attributes of SAM objects"""
1344         print "Testing the behaviour of special attributes of SAM objects\n"""
1345
1346         ldb.add({
1347             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1348             "objectclass": ["user", "person"]})
1349         ldb.add({
1350             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
1351             "objectclass": "group"})
1352
1353         m = Message()
1354         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1355         m["groupType"] = MessageElement("0", FLAG_MOD_ADD,
1356           "groupType")
1357         try:
1358             ldb.modify(m)
1359             self.fail()
1360         except LdbError, (num, _):
1361             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
1362
1363         m = Message()
1364         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1365         m["groupType"] = MessageElement([], FLAG_MOD_DELETE,
1366           "groupType")
1367         try:
1368             ldb.modify(m)
1369             self.fail()
1370         except LdbError, (num, _):
1371             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1372
1373         m = Message()
1374         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1375         m["primaryGroupID"] = MessageElement("0", FLAG_MOD_ADD,
1376           "primaryGroupID")
1377         try:
1378             ldb.modify(m)
1379             self.fail()
1380         except LdbError, (num, _):
1381             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
1382
1383         m = Message()
1384         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1385         m["primaryGroupID"] = MessageElement([], FLAG_MOD_DELETE,
1386           "primaryGroupID")
1387         try:
1388             ldb.modify(m)
1389             self.fail()
1390         except LdbError, (num, _):
1391             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1392
1393         m = Message()
1394         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1395         m["userAccountControl"] = MessageElement("0", FLAG_MOD_ADD,
1396           "userAccountControl")
1397         try:
1398             ldb.modify(m)
1399             self.fail()
1400         except LdbError, (num, _):
1401             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
1402
1403         m = Message()
1404         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1405         m["userAccountControl"] = MessageElement([], FLAG_MOD_DELETE,
1406           "userAccountControl")
1407         try:
1408             ldb.modify(m)
1409             self.fail()
1410         except LdbError, (num, _):
1411             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1412
1413         m = Message()
1414         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1415         m["sAMAccountType"] = MessageElement("0", FLAG_MOD_ADD,
1416           "sAMAccountType")
1417         try:
1418             ldb.modify(m)
1419             self.fail()
1420         except LdbError, (num, _):
1421             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1422
1423         m = Message()
1424         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1425         m["sAMAccountType"] = MessageElement([], FLAG_MOD_REPLACE,
1426           "sAMAccountType")
1427         try:
1428             ldb.modify(m)
1429             self.fail()
1430         except LdbError, (num, _):
1431             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1432
1433         m = Message()
1434         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1435         m["sAMAccountType"] = MessageElement([], FLAG_MOD_DELETE,
1436           "sAMAccountType")
1437         try:
1438             ldb.modify(m)
1439             self.fail()
1440         except LdbError, (num, _):
1441             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1442
1443         self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1444         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1445
1446     def test_primary_group_token_constructed(self):
1447         """Test the primary group token behaviour (hidden-generated-readonly attribute on groups) and some other constructed attributes"""
1448         print "Testing primary group token behaviour and other constructed attributes\n"
1449
1450         try:
1451             ldb.add({
1452                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
1453                 "objectclass": "group",
1454                 "primaryGroupToken": "100"})
1455             self.fail()
1456         except LdbError, (num, _):
1457             self.assertEquals(num, ERR_UNDEFINED_ATTRIBUTE_TYPE)
1458         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1459
1460         ldb.add({
1461             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1462             "objectclass": ["user", "person"]})
1463
1464         ldb.add({
1465             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
1466             "objectclass": "group"})
1467
1468         # Testing for one invalid, and one valid operational attribute, but also the things they are built from
1469         res1 = ldb.search(self.base_dn,
1470                           scope=SCOPE_BASE, attrs=["primaryGroupToken", "canonicalName", "objectClass", "objectSid"])
1471         self.assertTrue(len(res1) == 1)
1472         self.assertFalse("primaryGroupToken" in res1[0])
1473         self.assertTrue("canonicalName" in res1[0])
1474         self.assertTrue("objectClass" in res1[0])
1475         self.assertTrue("objectSid" in res1[0])
1476
1477         res1 = ldb.search(self.base_dn,
1478                           scope=SCOPE_BASE, attrs=["primaryGroupToken", "canonicalName"])
1479         self.assertTrue(len(res1) == 1)
1480         self.assertFalse("primaryGroupToken" in res1[0])
1481         self.assertFalse("objectSid" in res1[0])
1482         self.assertFalse("objectClass" in res1[0])
1483         self.assertTrue("canonicalName" in res1[0])
1484
1485         res1 = ldb.search("cn=users,"+self.base_dn,
1486                           scope=SCOPE_BASE, attrs=["primaryGroupToken"])
1487         self.assertTrue(len(res1) == 1)
1488         self.assertFalse("primaryGroupToken" in res1[0])
1489
1490         res1 = ldb.search("cn=ldaptestuser, cn=users," + self.base_dn,
1491                           scope=SCOPE_BASE, attrs=["primaryGroupToken"])
1492         self.assertTrue(len(res1) == 1)
1493         self.assertFalse("primaryGroupToken" in res1[0])
1494
1495         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1496                           scope=SCOPE_BASE)
1497         self.assertTrue(len(res1) == 1)
1498         self.assertFalse("primaryGroupToken" in res1[0])
1499
1500         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1501                           scope=SCOPE_BASE, attrs=["primaryGroupToken", "objectSID"])
1502         self.assertTrue(len(res1) == 1)
1503         primary_group_token = int(res1[0]["primaryGroupToken"][0])
1504
1505         rid = security.dom_sid(ldb.schema_format_value("objectSID", res1[0]["objectSID"][0])).split()[1]
1506         self.assertEquals(primary_group_token, rid)
1507
1508         m = Message()
1509         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1510         m["primaryGroupToken"] = "100"
1511         try:
1512             ldb.modify(m)
1513             self.fail()
1514         except LdbError, (num, _):
1515             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
1516
1517         self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1518         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1519
1520     def test_tokenGroups(self):
1521         """Test the tokenGroups behaviour (hidden-generated-readonly attribute on SAM objects)"""
1522         print "Testing tokenGroups behaviour\n"
1523
1524         # The domain object shouldn't contain any "tokenGroups" entry
1525         res = ldb.search(self.base_dn, scope=SCOPE_BASE, attrs=["tokenGroups"])
1526         self.assertTrue(len(res) == 1)
1527         self.assertFalse("tokenGroups" in res[0])
1528
1529         # The domain administrator should contain "tokenGroups" entries
1530         # (the exact number depends on the domain/forest function level and the
1531         # DC software versions)
1532         res = ldb.search("cn=Administrator,cn=Users," + self.base_dn,
1533                          scope=SCOPE_BASE, attrs=["tokenGroups"])
1534         self.assertTrue(len(res) == 1)
1535         self.assertTrue("tokenGroups" in res[0])
1536
1537         ldb.add({
1538             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1539             "objectclass": ["user", "person"]})
1540
1541         # This testuser should contain at least two "tokenGroups" entries
1542         # (exactly two on an unmodified "Domain Users" and "Users" group)
1543         res = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1544                          scope=SCOPE_BASE, attrs=["tokenGroups"])
1545         self.assertTrue(len(res) == 1)
1546         self.assertTrue(len(res[0]["tokenGroups"]) >= 2)
1547
1548         # one entry which we need to find should point to domains "Domain Users"
1549         # group and another entry should point to the builtin "Users"group
1550         domain_users_group_found = False
1551         users_group_found = False
1552         for sid in res[0]["tokenGroups"]:
1553             rid = security.dom_sid(ldb.schema_format_value("objectSID", sid)).split()[1]
1554             if rid == 513:
1555                 domain_users_group_found = True
1556             if rid == 545:
1557                 users_group_found = True
1558
1559         self.assertTrue(domain_users_group_found)
1560         self.assertTrue(users_group_found)
1561
1562         self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1563
1564     def test_wkguid(self):
1565         """Test Well known GUID behaviours (including DN+Binary)"""
1566         print "Test Well known GUID behaviours (including DN+Binary)"""
1567
1568         res = self.ldb.search(base=("<WKGUID=ab1d30f3768811d1aded00c04fd8d5cd,%s>" % self.base_dn), scope=SCOPE_BASE, attrs=[])
1569         self.assertEquals(len(res), 1)
1570
1571         res2 = self.ldb.search(scope=SCOPE_BASE, attrs=["wellKnownObjects"], expression=("wellKnownObjects=B:32:ab1d30f3768811d1aded00c04fd8d5cd:%s" % res[0].dn))
1572         self.assertEquals(len(res2), 1)
1573
1574         # Prove that the matching rule is over the whole DN+Binary
1575         res2 = self.ldb.search(scope=SCOPE_BASE, attrs=["wellKnownObjects"], expression=("wellKnownObjects=B:32:ab1d30f3768811d1aded00c04fd8d5cd"))
1576         self.assertEquals(len(res2), 0)
1577         # Prove that the matching rule is over the whole DN+Binary
1578         res2 = self.ldb.search(scope=SCOPE_BASE, attrs=["wellKnownObjects"], expression=("wellKnownObjects=%s") % res[0].dn)
1579         self.assertEquals(len(res2), 0)
1580
1581     def test_subschemasubentry(self):
1582         """Test subSchemaSubEntry appears when requested, but not when not requested"""
1583         print "Test subSchemaSubEntry"""
1584
1585         res = self.ldb.search(base=self.base_dn, scope=SCOPE_BASE, attrs=["subSchemaSubEntry"])
1586         self.assertEquals(len(res), 1)
1587         self.assertEquals(res[0]["subSchemaSubEntry"][0], "CN=Aggregate,"+self.schema_dn)
1588
1589         res = self.ldb.search(base=self.base_dn, scope=SCOPE_BASE, attrs=["*"])
1590         self.assertEquals(len(res), 1)
1591         self.assertTrue("subScheamSubEntry" not in res[0])
1592
1593     def test_delete(self):
1594         """Tests the delete operation"""
1595         print "Tests the delete operations"""
1596
1597         ldb.add({
1598             "dn": "cn=ldaptestcontainer," + self.base_dn,
1599             "objectclass": "container"})
1600         ldb.add({
1601             "dn": "cn=entry1,cn=ldaptestcontainer," + self.base_dn,
1602             "objectclass": "container"})
1603         ldb.add({
1604             "dn": "cn=entry2,cn=ldaptestcontainer," + self.base_dn,
1605             "objectclass": "container"})
1606
1607         try:
1608             ldb.delete("cn=ldaptestcontainer," + self.base_dn)
1609             self.fail()
1610         except LdbError, (num, _):
1611             self.assertEquals(num, ERR_NOT_ALLOWED_ON_NON_LEAF)
1612
1613         ldb.delete("cn=ldaptestcontainer," + self.base_dn, ["tree_delete:0"])
1614
1615         try:
1616             res = ldb.search("cn=ldaptestcontainer," + self.base_dn,
1617                              scope=SCOPE_BASE, attrs=[])
1618             self.fail()
1619         except LdbError, (num, _):
1620             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
1621         try:
1622             res = ldb.search("cn=entry1,cn=ldaptestcontainer," + self.base_dn,
1623                              scope=SCOPE_BASE, attrs=[])
1624             self.fail()
1625         except LdbError, (num, _):
1626             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
1627         try:
1628             res = ldb.search("cn=entry2,cn=ldaptestcontainer," + self.base_dn,
1629                              scope=SCOPE_BASE, attrs=[])
1630             self.fail()
1631         except LdbError, (num, _):
1632             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
1633
1634         self.delete_force(self.ldb, "cn=entry1,cn=ldaptestcontainer," + self.base_dn)
1635         self.delete_force(self.ldb, "cn=entry2,cn=ldaptestcontainer," + self.base_dn)
1636         self.delete_force(self.ldb, "cn=ldaptestcontainer," + self.base_dn)
1637
1638         # Performs some protected object delete testing
1639
1640         res = ldb.search(base="", expression="", scope=SCOPE_BASE,
1641                          attrs=["dsServiceName", "dNSHostName"])
1642         self.assertEquals(len(res), 1)
1643
1644         try:
1645             ldb.delete(res[0]["dsServiceName"][0])
1646             self.fail()
1647         except LdbError, (num, _):
1648             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1649
1650         res = ldb.search(self.base_dn, scope=SCOPE_SUBTREE,
1651                          attrs=["rIDSetReferences"],
1652                          expression="(&(objectClass=computer)(dNSHostName=" + res[0]["dNSHostName"][0] + "))")
1653         self.assertEquals(len(res), 1)
1654
1655         try:
1656             ldb.delete(res[0]["rIDSetReferences"][0])
1657             self.fail()
1658         except LdbError, (num, _):
1659             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1660
1661         try:
1662             ldb.delete("cn=Enterprise Schema,cn=Partitions," + self.configuration_dn)
1663             self.fail()
1664         except LdbError, (num, _):
1665             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1666
1667         try:
1668             ldb.delete("cn=Enterprise Configuration,cn=Partitions," + self.configuration_dn)
1669             self.fail()
1670         except LdbError, (num, _):
1671             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1672
1673         # Performs some "systemFlags" testing
1674
1675         # Delete failing since "SYSTEM_FLAG_DISALLOW_DELETE"
1676         try:
1677             ldb.delete("CN=Users," + self.base_dn)
1678             self.fail()
1679         except LdbError, (num, _):
1680             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1681
1682     def test_all(self):
1683         """Basic tests"""
1684
1685         print "Testing user add"
1686
1687         ldb.add({
1688             "dn": "cn=ldaptestuser,cn=uSers," + self.base_dn,
1689             "objectclass": ["user", "person"],
1690             "cN": "LDAPtestUSER",
1691             "givenname": "ldap",
1692             "sn": "testy"})
1693
1694         ldb.add({
1695             "dn": "cn=ldaptestgroup,cn=uSers," + self.base_dn,
1696             "objectclass": "group",
1697             "member": "cn=ldaptestuser,cn=useRs," + self.base_dn})
1698
1699         ldb.add({
1700             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1701             "objectclass": "computer",
1702             "cN": "LDAPtestCOMPUTER"})
1703
1704         ldb.add({"dn": "cn=ldaptest2computer,cn=computers," + self.base_dn,
1705             "objectClass": "computer",
1706             "cn": "LDAPtest2COMPUTER",
1707             "userAccountControl": str(UF_WORKSTATION_TRUST_ACCOUNT),
1708             "displayname": "ldap testy"})
1709
1710         try:
1711             ldb.add({"dn": "cn=ldaptestcomputer3,cn=computers," + self.base_dn,
1712                      "objectClass": "computer",
1713                      "cn": "LDAPtest2COMPUTER"
1714                      })
1715             self.fail()
1716         except LdbError, (num, _):
1717             self.assertEquals(num, ERR_INVALID_DN_SYNTAX)
1718
1719         try:
1720             ldb.add({"dn": "cn=ldaptestcomputer3,cn=computers," + self.base_dn,
1721                      "objectClass": "computer",
1722                      "cn": "ldaptestcomputer3",
1723                      "sAMAccountType": str(ATYPE_NORMAL_ACCOUNT)
1724                 })
1725             self.fail()
1726         except LdbError, (num, _):
1727             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1728
1729         ldb.add({"dn": "cn=ldaptestcomputer3,cn=computers," + self.base_dn,
1730                  "objectClass": "computer",
1731                  "cn": "LDAPtestCOMPUTER3"
1732                  })
1733
1734         print "Testing ldb.search for (&(cn=ldaptestcomputer3)(objectClass=user))";
1735         res = ldb.search(self.base_dn, expression="(&(cn=ldaptestcomputer3)(objectClass=user))");
1736         self.assertEquals(len(res), 1, "Found only %d for (&(cn=ldaptestcomputer3)(objectClass=user))" % len(res))
1737
1738         self.assertEquals(str(res[0].dn), ("CN=ldaptestcomputer3,CN=Computers," + self.base_dn));
1739         self.assertEquals(res[0]["cn"][0], "ldaptestcomputer3");
1740         self.assertEquals(res[0]["name"][0], "ldaptestcomputer3");
1741         self.assertEquals(res[0]["objectClass"][0], "top");
1742         self.assertEquals(res[0]["objectClass"][1], "person");
1743         self.assertEquals(res[0]["objectClass"][2], "organizationalPerson");
1744         self.assertEquals(res[0]["objectClass"][3], "user");
1745         self.assertEquals(res[0]["objectClass"][4], "computer");
1746         self.assertTrue("objectGUID" in res[0])
1747         self.assertTrue("whenCreated" in res[0])
1748         self.assertEquals(res[0]["objectCategory"][0], ("CN=Computer,CN=Schema,CN=Configuration," + self.base_dn));
1749         self.assertEquals(int(res[0]["primaryGroupID"][0]), 513);
1750         self.assertEquals(int(res[0]["sAMAccountType"][0]), ATYPE_NORMAL_ACCOUNT);
1751         self.assertEquals(int(res[0]["userAccountControl"][0]), UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD | UF_ACCOUNTDISABLE);
1752
1753         self.delete_force(self.ldb, "cn=ldaptestcomputer3,cn=computers," + self.base_dn)
1754
1755         print "Testing attribute or value exists behaviour"
1756         try:
1757             ldb.modify_ldif("""
1758 dn: cn=ldaptest2computer,cn=computers,""" + self.base_dn + """
1759 changetype: modify
1760 replace: servicePrincipalName
1761 servicePrincipalName: host/ldaptest2computer
1762 servicePrincipalName: host/ldaptest2computer
1763 servicePrincipalName: cifs/ldaptest2computer
1764 """)
1765             self.fail()
1766         except LdbError, (num, msg):
1767             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
1768
1769         ldb.modify_ldif("""
1770 dn: cn=ldaptest2computer,cn=computers,""" + self.base_dn + """
1771 changetype: modify
1772 replace: servicePrincipalName
1773 servicePrincipalName: host/ldaptest2computer
1774 servicePrincipalName: cifs/ldaptest2computer
1775 """)
1776         try:
1777             ldb.modify_ldif("""
1778 dn: cn=ldaptest2computer,cn=computers,""" + self.base_dn + """
1779 changetype: modify
1780 add: servicePrincipalName
1781 servicePrincipalName: host/ldaptest2computer
1782 """)
1783             self.fail()
1784         except LdbError, (num, msg):
1785             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
1786
1787         print "Testing ranged results"
1788         ldb.modify_ldif("""
1789 dn: cn=ldaptest2computer,cn=computers,""" + self.base_dn + """
1790 changetype: modify
1791 replace: servicePrincipalName
1792 """)
1793
1794         ldb.modify_ldif("""
1795 dn: cn=ldaptest2computer,cn=computers,""" + self.base_dn + """
1796 changetype: modify
1797 add: servicePrincipalName
1798 servicePrincipalName: host/ldaptest2computer0
1799 servicePrincipalName: host/ldaptest2computer1
1800 servicePrincipalName: host/ldaptest2computer2
1801 servicePrincipalName: host/ldaptest2computer3
1802 servicePrincipalName: host/ldaptest2computer4
1803 servicePrincipalName: host/ldaptest2computer5
1804 servicePrincipalName: host/ldaptest2computer6
1805 servicePrincipalName: host/ldaptest2computer7
1806 servicePrincipalName: host/ldaptest2computer8
1807 servicePrincipalName: host/ldaptest2computer9
1808 servicePrincipalName: host/ldaptest2computer10
1809 servicePrincipalName: host/ldaptest2computer11
1810 servicePrincipalName: host/ldaptest2computer12
1811 servicePrincipalName: host/ldaptest2computer13
1812 servicePrincipalName: host/ldaptest2computer14
1813 servicePrincipalName: host/ldaptest2computer15
1814 servicePrincipalName: host/ldaptest2computer16
1815 servicePrincipalName: host/ldaptest2computer17
1816 servicePrincipalName: host/ldaptest2computer18
1817 servicePrincipalName: host/ldaptest2computer19
1818 servicePrincipalName: host/ldaptest2computer20
1819 servicePrincipalName: host/ldaptest2computer21
1820 servicePrincipalName: host/ldaptest2computer22
1821 servicePrincipalName: host/ldaptest2computer23
1822 servicePrincipalName: host/ldaptest2computer24
1823 servicePrincipalName: host/ldaptest2computer25
1824 servicePrincipalName: host/ldaptest2computer26
1825 servicePrincipalName: host/ldaptest2computer27
1826 servicePrincipalName: host/ldaptest2computer28
1827 servicePrincipalName: host/ldaptest2computer29
1828 """)
1829
1830         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE,
1831                          attrs=["servicePrincipalName;range=0-*"])
1832         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
1833         #print len(res[0]["servicePrincipalName;range=0-*"])
1834         self.assertEquals(len(res[0]["servicePrincipalName;range=0-*"]), 30)
1835
1836         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=0-19"])
1837         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
1838             # print res[0]["servicePrincipalName;range=0-19"].length
1839         self.assertEquals(len(res[0]["servicePrincipalName;range=0-19"]), 20)
1840
1841
1842         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=0-30"])
1843         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
1844         self.assertEquals(len(res[0]["servicePrincipalName;range=0-*"]), 30)
1845
1846         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=0-40"])
1847         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
1848         self.assertEquals(len(res[0]["servicePrincipalName;range=0-*"]), 30)
1849
1850         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=30-40"])
1851         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
1852         self.assertEquals(len(res[0]["servicePrincipalName;range=30-*"]), 0)
1853
1854
1855         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=10-40"])
1856         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
1857         self.assertEquals(len(res[0]["servicePrincipalName;range=10-*"]), 20)
1858         # pos_11 = res[0]["servicePrincipalName;range=10-*"][18]
1859
1860         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=11-40"])
1861         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
1862         self.assertEquals(len(res[0]["servicePrincipalName;range=11-*"]), 19)
1863             # print res[0]["servicePrincipalName;range=11-*"][18]
1864             # print pos_11
1865             # self.assertEquals((res[0]["servicePrincipalName;range=11-*"][18]), pos_11)
1866
1867         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=11-15"])
1868         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
1869         self.assertEquals(len(res[0]["servicePrincipalName;range=11-15"]), 5)
1870             # self.assertEquals(res[0]["servicePrincipalName;range=11-15"][4], pos_11)
1871
1872         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName"])
1873         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
1874             # print res[0]["servicePrincipalName"][18]
1875             # print pos_11
1876         self.assertEquals(len(res[0]["servicePrincipalName"]), 30)
1877             # self.assertEquals(res[0]["servicePrincipalName"][18], pos_11)
1878
1879         self.delete_force(self.ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
1880         ldb.add({
1881             "dn": "cn=ldaptestuser2,cn=useRs," + self.base_dn,
1882             "objectClass": ["person", "user"],
1883             "cn": "LDAPtestUSER2",
1884             "givenname": "testy",
1885             "sn": "ldap user2"})
1886
1887         print "Testing Ambigious Name Resolution"
1888         # Testing ldb.search for (&(anr=ldap testy)(objectClass=user))
1889         res = ldb.search(expression="(&(anr=ldap testy)(objectClass=user))")
1890         self.assertEquals(len(res), 3, "Found only %d of 3 for (&(anr=ldap testy)(objectClass=user))" % len(res))
1891
1892         # Testing ldb.search for (&(anr=testy ldap)(objectClass=user))
1893         res = ldb.search(expression="(&(anr=testy ldap)(objectClass=user))")
1894         self.assertEquals(len(res), 2, "Found only %d of 2 for (&(anr=testy ldap)(objectClass=user))" % len(res))
1895
1896         # Testing ldb.search for (&(anr=ldap)(objectClass=user))
1897         res = ldb.search(expression="(&(anr=ldap)(objectClass=user))")
1898         self.assertEquals(len(res), 4, "Found only %d of 4 for (&(anr=ldap)(objectClass=user))" % len(res))
1899
1900         # Testing ldb.search for (&(anr==ldap)(objectClass=user))
1901         res = ldb.search(expression="(&(anr==ldap)(objectClass=user))")
1902         self.assertEquals(len(res), 1, "Could not find (&(anr==ldap)(objectClass=user)). Found only %d for (&(anr=ldap)(objectClass=user))" % len(res))
1903
1904         self.assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + self.base_dn))
1905         self.assertEquals(res[0]["cn"][0], "ldaptestuser")
1906         self.assertEquals(str(res[0]["name"]), "ldaptestuser")
1907
1908         # Testing ldb.search for (&(anr=testy)(objectClass=user))
1909         res = ldb.search(expression="(&(anr=testy)(objectClass=user))")
1910         self.assertEquals(len(res), 2, "Found only %d for (&(anr=testy)(objectClass=user))" % len(res))
1911
1912         # Testing ldb.search for (&(anr=testy ldap)(objectClass=user))
1913         res = ldb.search(expression="(&(anr=testy ldap)(objectClass=user))")
1914         self.assertEquals(len(res), 2, "Found only %d for (&(anr=testy ldap)(objectClass=user))" % len(res))
1915
1916         # Testing ldb.search for (&(anr==testy ldap)(objectClass=user))
1917 # this test disabled for the moment, as anr with == tests are not understood
1918 #        res = ldb.search(expression="(&(anr==testy ldap)(objectClass=user))")
1919 #        self.assertEquals(len(res), 1, "Found only %d for (&(anr==testy ldap)(objectClass=user))" % len(res))
1920
1921 #        self.assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + self.base_dn))
1922 #        self.assertEquals(res[0]["cn"][0], "ldaptestuser")
1923 #        self.assertEquals(res[0]["name"][0], "ldaptestuser")
1924
1925         # Testing ldb.search for (&(anr==testy ldap)(objectClass=user))
1926 #        res = ldb.search(expression="(&(anr==testy ldap)(objectClass=user))")
1927 #        self.assertEquals(len(res), 1, "Could not find (&(anr==testy ldap)(objectClass=user))")
1928
1929 #        self.assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + self.base_dn))
1930 #        self.assertEquals(res[0]["cn"][0], "ldaptestuser")
1931 #        self.assertEquals(res[0]["name"][0], "ldaptestuser")
1932
1933         # Testing ldb.search for (&(anr=testy ldap user)(objectClass=user))
1934         res = ldb.search(expression="(&(anr=testy ldap user)(objectClass=user))")
1935         self.assertEquals(len(res), 1, "Could not find (&(anr=testy ldap user)(objectClass=user))")
1936
1937         self.assertEquals(str(res[0].dn), ("CN=ldaptestuser2,CN=Users," + self.base_dn))
1938         self.assertEquals(str(res[0]["cn"]), "ldaptestuser2")
1939         self.assertEquals(str(res[0]["name"]), "ldaptestuser2")
1940
1941         # Testing ldb.search for (&(anr==testy ldap user2)(objectClass=user))
1942 #        res = ldb.search(expression="(&(anr==testy ldap user2)(objectClass=user))")
1943 #        self.assertEquals(len(res), 1, "Could not find (&(anr==testy ldap user2)(objectClass=user))")
1944
1945         self.assertEquals(str(res[0].dn), ("CN=ldaptestuser2,CN=Users," + self.base_dn))
1946         self.assertEquals(str(res[0]["cn"]), "ldaptestuser2")
1947         self.assertEquals(str(res[0]["name"]), "ldaptestuser2")
1948
1949         # Testing ldb.search for (&(anr==ldap user2)(objectClass=user))
1950 #        res = ldb.search(expression="(&(anr==ldap user2)(objectClass=user))")
1951 #        self.assertEquals(len(res), 1, "Could not find (&(anr==ldap user2)(objectClass=user))")
1952
1953         self.assertEquals(str(res[0].dn), ("CN=ldaptestuser2,CN=Users," + self.base_dn))
1954         self.assertEquals(str(res[0]["cn"]), "ldaptestuser2")
1955         self.assertEquals(str(res[0]["name"]), "ldaptestuser2")
1956
1957         # Testing ldb.search for (&(anr==not ldap user2)(objectClass=user))
1958 #        res = ldb.search(expression="(&(anr==not ldap user2)(objectClass=user))")
1959 #        self.assertEquals(len(res), 0, "Must not find (&(anr==not ldap user2)(objectClass=user))")
1960
1961         # Testing ldb.search for (&(anr=not ldap user2)(objectClass=user))
1962         res = ldb.search(expression="(&(anr=not ldap user2)(objectClass=user))")
1963         self.assertEquals(len(res), 0, "Must not find (&(anr=not ldap user2)(objectClass=user))")
1964
1965         # Testing ldb.search for (&(anr="testy ldap")(objectClass=user)) (ie, with quotes)
1966 #        res = ldb.search(expression="(&(anr==\"testy ldap\")(objectClass=user))")
1967 #        self.assertEquals(len(res), 0, "Found (&(anr==\"testy ldap\")(objectClass=user))")
1968
1969         print "Testing Renames"
1970
1971         attrs = ["objectGUID", "objectSid"]
1972         print "Testing ldb.search for (&(cn=ldaptestUSer2)(objectClass=user))"
1973         res_user = ldb.search(self.base_dn, expression="(&(cn=ldaptestUSer2)(objectClass=user))", scope=SCOPE_SUBTREE, attrs=attrs)
1974         self.assertEquals(len(res_user), 1, "Could not find (&(cn=ldaptestUSer2)(objectClass=user))")
1975
1976         # Check rename works with extended/alternate DN forms
1977         ldb.rename("<SID=" + ldb.schema_format_value("objectSID", res_user[0]["objectSID"][0]) + ">" , "cn=ldaptestUSER3,cn=users," + self.base_dn)
1978
1979         print "Testing ldb.search for (&(cn=ldaptestuser3)(objectClass=user))"
1980         res = ldb.search(expression="(&(cn=ldaptestuser3)(objectClass=user))")
1981         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestuser3)(objectClass=user))")
1982
1983         self.assertEquals(str(res[0].dn), ("CN=ldaptestUSER3,CN=Users," + self.base_dn))
1984         self.assertEquals(str(res[0]["cn"]), "ldaptestUSER3")
1985         self.assertEquals(str(res[0]["name"]), "ldaptestUSER3")
1986
1987          #"Testing ldb.search for (&(&(cn=ldaptestuser3)(userAccountControl=*))(objectClass=user))"
1988         res = ldb.search(expression="(&(&(cn=ldaptestuser3)(userAccountControl=*))(objectClass=user))")
1989         self.assertEquals(len(res), 1, "(&(&(cn=ldaptestuser3)(userAccountControl=*))(objectClass=user))")
1990
1991         self.assertEquals(str(res[0].dn), ("CN=ldaptestUSER3,CN=Users," + self.base_dn))
1992         self.assertEquals(str(res[0]["cn"]), "ldaptestUSER3")
1993         self.assertEquals(str(res[0]["name"]), "ldaptestUSER3")
1994
1995          #"Testing ldb.search for (&(&(cn=ldaptestuser3)(userAccountControl=546))(objectClass=user))"
1996         res = ldb.search(expression="(&(&(cn=ldaptestuser3)(userAccountControl=546))(objectClass=user))")
1997         self.assertEquals(len(res), 1, "(&(&(cn=ldaptestuser3)(userAccountControl=546))(objectClass=user))")
1998
1999         self.assertEquals(str(res[0].dn), ("CN=ldaptestUSER3,CN=Users," + self.base_dn))
2000         self.assertEquals(str(res[0]["cn"]), "ldaptestUSER3")
2001         self.assertEquals(str(res[0]["name"]), "ldaptestUSER3")
2002
2003          #"Testing ldb.search for (&(&(cn=ldaptestuser3)(userAccountControl=547))(objectClass=user))"
2004         res = ldb.search(expression="(&(&(cn=ldaptestuser3)(userAccountControl=547))(objectClass=user))")
2005         self.assertEquals(len(res), 0, "(&(&(cn=ldaptestuser3)(userAccountControl=547))(objectClass=user))")
2006
2007         # This is a Samba special, and does not exist in real AD
2008         #    print "Testing ldb.search for (dn=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")"
2009         #    res = ldb.search("(dn=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")")
2010         #    if (res.error != 0 || len(res) != 1) {
2011         #        print "Could not find (dn=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")"
2012         #        self.assertEquals(len(res), 1)
2013         #    }
2014         #    self.assertEquals(res[0].dn, ("CN=ldaptestUSER3,CN=Users," + self.base_dn))
2015         #    self.assertEquals(res[0].cn, "ldaptestUSER3")
2016         #    self.assertEquals(res[0].name, "ldaptestUSER3")
2017
2018         print "Testing ldb.search for (distinguishedName=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")"
2019         res = ldb.search(expression="(distinguishedName=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")")
2020         self.assertEquals(len(res), 1, "Could not find (dn=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")")
2021         self.assertEquals(str(res[0].dn), ("CN=ldaptestUSER3,CN=Users," + self.base_dn))
2022         self.assertEquals(str(res[0]["cn"]), "ldaptestUSER3")
2023         self.assertEquals(str(res[0]["name"]), "ldaptestUSER3")
2024
2025         # ensure we cannot add it again
2026         try:
2027             ldb.add({"dn": "cn=ldaptestuser3,cn=userS," + self.base_dn,
2028                       "objectClass": ["person", "user"],
2029                       "cn": "LDAPtestUSER3"})
2030             self.fail()
2031         except LdbError, (num, _):
2032             self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
2033
2034         # rename back
2035         ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "cn=ldaptestuser2,cn=users," + self.base_dn)
2036
2037         # ensure we cannot rename it twice
2038         try:
2039             ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn,
2040                        "cn=ldaptestuser2,cn=users," + self.base_dn)
2041             self.fail()
2042         except LdbError, (num, _):
2043             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
2044
2045         # ensure can now use that name
2046         ldb.add({"dn": "cn=ldaptestuser3,cn=users," + self.base_dn,
2047                       "objectClass": ["person", "user"],
2048                       "cn": "LDAPtestUSER3"})
2049
2050         # ensure we now cannot rename
2051         try:
2052             ldb.rename("cn=ldaptestuser2,cn=users," + self.base_dn, "cn=ldaptestuser3,cn=users," + self.base_dn)
2053             self.fail()
2054         except LdbError, (num, _):
2055             self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
2056         try:
2057             ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "cn=ldaptestuser3,cn=configuration," + self.base_dn)
2058             self.fail()
2059         except LdbError, (num, _):
2060             self.assertTrue(num in (71, 64))
2061
2062         ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "cn=ldaptestuser5,cn=users," + self.base_dn)
2063
2064         ldb.delete("cn=ldaptestuser5,cn=users," + self.base_dn)
2065
2066         self.delete_force(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
2067
2068         ldb.rename("cn=ldaptestgroup,cn=users," + self.base_dn, "cn=ldaptestgroup2,cn=users," + self.base_dn)
2069
2070         print "Testing subtree renames"
2071
2072         ldb.add({"dn": "cn=ldaptestcontainer," + self.base_dn,
2073                  "objectClass": "container"})
2074
2075         ldb.add({"dn": "CN=ldaptestuser4,CN=ldaptestcontainer," + self.base_dn,
2076                  "objectClass": ["person", "user"],
2077                  "cn": "LDAPtestUSER4"})
2078
2079         ldb.modify_ldif("""
2080 dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
2081 changetype: modify
2082 add: member
2083 member: cn=ldaptestuser4,cn=ldaptestcontainer,""" + self.base_dn + """
2084 member: cn=ldaptestcomputer,cn=computers,""" + self.base_dn + """
2085 member: cn=ldaptestuser2,cn=users,""" + self.base_dn + """
2086 """)
2087
2088         print "Testing ldb.rename of cn=ldaptestcontainer," + self.base_dn + " to cn=ldaptestcontainer2," + self.base_dn
2089         ldb.rename("CN=ldaptestcontainer," + self.base_dn, "CN=ldaptestcontainer2," + self.base_dn)
2090
2091         print "Testing ldb.search for (&(cn=ldaptestuser4)(objectClass=user))"
2092         res = ldb.search(expression="(&(cn=ldaptestuser4)(objectClass=user))")
2093         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestuser4)(objectClass=user))")
2094
2095         print "Testing subtree ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in (just renamed from) cn=ldaptestcontainer," + self.base_dn
2096         try:
2097             res = ldb.search("cn=ldaptestcontainer," + self.base_dn,
2098                     expression="(&(cn=ldaptestuser4)(objectClass=user))",
2099                     scope=SCOPE_SUBTREE)
2100             self.fail(res)
2101         except LdbError, (num, _):
2102             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
2103
2104         print "Testing one-level ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in (just renamed from) cn=ldaptestcontainer," + self.base_dn
2105         try:
2106             res = ldb.search("cn=ldaptestcontainer," + self.base_dn,
2107                     expression="(&(cn=ldaptestuser4)(objectClass=user))", scope=SCOPE_ONELEVEL)
2108             self.fail()
2109         except LdbError, (num, _):
2110             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
2111
2112         print "Testing ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in renamed container"
2113         res = ldb.search("cn=ldaptestcontainer2," + self.base_dn, expression="(&(cn=ldaptestuser4)(objectClass=user))", scope=SCOPE_SUBTREE)
2114         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestuser4)(objectClass=user)) under cn=ldaptestcontainer2," + self.base_dn)
2115
2116         self.assertEquals(str(res[0].dn), ("CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn))
2117         self.assertEquals(res[0]["memberOf"][0].upper(), ("CN=ldaptestgroup2,CN=Users," + self.base_dn).upper())
2118
2119         time.sleep(4)
2120
2121         print "Testing ldb.search for (&(member=CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn + ")(objectclass=group)) to check subtree renames and linked attributes"
2122         res = ldb.search(self.base_dn, expression="(&(member=CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn + ")(objectclass=group))", scope=SCOPE_SUBTREE)
2123         self.assertEquals(len(res), 1, "Could not find (&(member=CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn + ")(objectclass=group)), perhaps linked attributes are not consistant with subtree renames?")
2124
2125         print "Testing ldb.rename (into itself) of cn=ldaptestcontainer2," + self.base_dn + " to cn=ldaptestcontainer,cn=ldaptestcontainer2," + self.base_dn
2126         try:
2127             ldb.rename("cn=ldaptestcontainer2," + self.base_dn, "cn=ldaptestcontainer,cn=ldaptestcontainer2," + self.base_dn)
2128             self.fail()
2129         except LdbError, (num, _):
2130             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
2131
2132         print "Testing ldb.rename (into non-existent container) of cn=ldaptestcontainer2," + self.base_dn + " to cn=ldaptestcontainer,cn=ldaptestcontainer3," + self.base_dn
2133         try:
2134             ldb.rename("cn=ldaptestcontainer2," + self.base_dn, "cn=ldaptestcontainer,cn=ldaptestcontainer3," + self.base_dn)
2135             self.fail()
2136         except LdbError, (num, _):
2137             self.assertTrue(num in (ERR_UNWILLING_TO_PERFORM, ERR_OTHER))
2138
2139         print "Testing delete (should fail, not a leaf node) of renamed cn=ldaptestcontainer2," + self.base_dn
2140         try:
2141             ldb.delete("cn=ldaptestcontainer2," + self.base_dn)
2142             self.fail()
2143         except LdbError, (num, _):
2144             self.assertEquals(num, ERR_NOT_ALLOWED_ON_NON_LEAF)
2145
2146         print "Testing base ldb.search for CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn
2147         res = ldb.search(expression="(objectclass=*)", base=("CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn), scope=SCOPE_BASE)
2148         self.assertEquals(len(res), 1)
2149         res = ldb.search(expression="(cn=ldaptestuser40)", base=("CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn), scope=SCOPE_BASE)
2150         self.assertEquals(len(res), 0)
2151
2152         print "Testing one-level ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in cn=ldaptestcontainer2," + self.base_dn
2153         res = ldb.search(expression="(&(cn=ldaptestuser4)(objectClass=user))", base=("cn=ldaptestcontainer2," + self.base_dn), scope=SCOPE_ONELEVEL)
2154         # FIXME: self.assertEquals(len(res), 0)
2155
2156         print "Testing one-level ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in cn=ldaptestcontainer2," + self.base_dn
2157         res = ldb.search(expression="(&(cn=ldaptestuser4)(objectClass=user))", base=("cn=ldaptestcontainer2," + self.base_dn), scope=SCOPE_SUBTREE)
2158         # FIXME: self.assertEquals(len(res), 0)
2159
2160         print "Testing delete of subtree renamed "+("CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn)
2161         ldb.delete(("CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn))
2162         print "Testing delete of renamed cn=ldaptestcontainer2," + self.base_dn
2163         ldb.delete("cn=ldaptestcontainer2," + self.base_dn)
2164
2165         ldb.add({"dn": "cn=ldaptestutf8user èùéìòà,cn=users," + self.base_dn, "objectClass": "user"})
2166
2167         ldb.add({"dn": "cn=ldaptestutf8user2  èùéìòà,cn=users," + self.base_dn, "objectClass": "user"})
2168
2169         print "Testing ldb.search for (&(cn=ldaptestuser)(objectClass=user))"
2170         res = ldb.search(expression="(&(cn=ldaptestuser)(objectClass=user))")
2171         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestuser)(objectClass=user))")
2172
2173         self.assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + self.base_dn))
2174         self.assertEquals(str(res[0]["cn"]), "ldaptestuser")
2175         self.assertEquals(str(res[0]["name"]), "ldaptestuser")
2176         self.assertEquals(set(res[0]["objectClass"]), set(["top", "person", "organizationalPerson", "user"]))
2177         self.assertTrue("objectGUID" in res[0])
2178         self.assertTrue("whenCreated" in res[0])
2179         self.assertEquals(str(res[0]["objectCategory"]), ("CN=Person,CN=Schema,CN=Configuration," + self.base_dn))
2180         self.assertEquals(int(res[0]["sAMAccountType"][0]), ATYPE_NORMAL_ACCOUNT)
2181         self.assertEquals(int(res[0]["userAccountControl"][0]), UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD | UF_ACCOUNTDISABLE)
2182         self.assertEquals(res[0]["memberOf"][0].upper(), ("CN=ldaptestgroup2,CN=Users," + self.base_dn).upper())
2183         self.assertEquals(len(res[0]["memberOf"]), 1)
2184
2185         print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=cn=person,cn=schema,cn=configuration," + self.base_dn + "))"
2186         res2 = ldb.search(expression="(&(cn=ldaptestuser)(objectCategory=cn=person,cn=schema,cn=configuration," + self.base_dn + "))")
2187         self.assertEquals(len(res2), 1, "Could not find (&(cn=ldaptestuser)(objectCategory=cn=person,cn=schema,cn=configuration," + self.base_dn + "))")
2188
2189         self.assertEquals(res[0].dn, res2[0].dn)
2190
2191         print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=PerSon))"
2192         res3 = ldb.search(expression="(&(cn=ldaptestuser)(objectCategory=PerSon))")
2193         self.assertEquals(len(res3), 1, "Could not find (&(cn=ldaptestuser)(objectCategory=PerSon)): matched %d" % len(res3))
2194
2195         self.assertEquals(res[0].dn, res3[0].dn)
2196
2197         if gc_ldb is not None:
2198             print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=PerSon)) in Global Catalog"
2199             res3gc = gc_ldb.search(expression="(&(cn=ldaptestuser)(objectCategory=PerSon))")
2200             self.assertEquals(len(res3gc), 1)
2201
2202             self.assertEquals(res[0].dn, res3gc[0].dn)
2203
2204         print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=PerSon)) in with 'phantom root' control"
2205
2206         if gc_ldb is not None:
2207             res3control = gc_ldb.search(self.base_dn, expression="(&(cn=ldaptestuser)(objectCategory=PerSon))", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["search_options:1:2"])
2208             self.assertEquals(len(res3control), 1, "Could not find (&(cn=ldaptestuser)(objectCategory=PerSon)) in Global Catalog")
2209
2210             self.assertEquals(res[0].dn, res3control[0].dn)
2211
2212         ldb.delete(res[0].dn)
2213
2214         print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectClass=user))"
2215         res = ldb.search(expression="(&(cn=ldaptestcomputer)(objectClass=user))")
2216         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestuser)(objectClass=user))")
2217
2218         self.assertEquals(str(res[0].dn), ("CN=ldaptestcomputer,CN=Computers," + self.base_dn))
2219         self.assertEquals(str(res[0]["cn"]), "ldaptestcomputer")
2220         self.assertEquals(str(res[0]["name"]), "ldaptestcomputer")
2221         self.assertEquals(set(res[0]["objectClass"]), set(["top", "person", "organizationalPerson", "user", "computer"]))
2222         self.assertTrue("objectGUID" in res[0])
2223         self.assertTrue("whenCreated" in res[0])
2224         self.assertEquals(str(res[0]["objectCategory"]), ("CN=Computer,CN=Schema,CN=Configuration," + self.base_dn))
2225         self.assertEquals(int(res[0]["primaryGroupID"][0]), 513)
2226         self.assertEquals(int(res[0]["sAMAccountType"][0]), ATYPE_NORMAL_ACCOUNT)
2227         self.assertEquals(int(res[0]["userAccountControl"][0]), UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD | UF_ACCOUNTDISABLE)
2228         self.assertEquals(res[0]["memberOf"][0].upper(), ("CN=ldaptestgroup2,CN=Users," + self.base_dn).upper())
2229         self.assertEquals(len(res[0]["memberOf"]), 1)
2230
2231         print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + "))"
2232         res2 = ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + "))")
2233         self.assertEquals(len(res2), 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + "))")
2234
2235         self.assertEquals(res[0].dn, res2[0].dn)
2236
2237         if gc_ldb is not None:
2238             print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + ")) in Global Catlog"
2239             res2gc = gc_ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + "))")
2240             self.assertEquals(len(res2gc), 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + ")) in Global Catlog")
2241
2242             self.assertEquals(res[0].dn, res2gc[0].dn)
2243
2244         print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=compuTER))"
2245         res3 = ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=compuTER))")
2246         self.assertEquals(len(res3), 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=compuTER))")
2247
2248         self.assertEquals(res[0].dn, res3[0].dn)
2249
2250         if gc_ldb is not None:
2251             print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=compuTER)) in Global Catalog"
2252             res3gc = gc_ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=compuTER))")
2253             self.assertEquals(len(res3gc), 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=compuTER)) in Global Catalog")
2254
2255             self.assertEquals(res[0].dn, res3gc[0].dn)
2256
2257         print "Testing ldb.search for (&(cn=ldaptestcomp*r)(objectCategory=compuTER))"
2258         res4 = ldb.search(expression="(&(cn=ldaptestcomp*r)(objectCategory=compuTER))")
2259         self.assertEquals(len(res4), 1, "Could not find (&(cn=ldaptestcomp*r)(objectCategory=compuTER))")
2260
2261         self.assertEquals(res[0].dn, res4[0].dn)
2262
2263         print "Testing ldb.search for (&(cn=ldaptestcomput*)(objectCategory=compuTER))"
2264         res5 = ldb.search(expression="(&(cn=ldaptestcomput*)(objectCategory=compuTER))")
2265         self.assertEquals(len(res5), 1, "Could not find (&(cn=ldaptestcomput*)(objectCategory=compuTER))")
2266
2267         self.assertEquals(res[0].dn, res5[0].dn)
2268
2269         print "Testing ldb.search for (&(cn=*daptestcomputer)(objectCategory=compuTER))"
2270         res6 = ldb.search(expression="(&(cn=*daptestcomputer)(objectCategory=compuTER))")
2271         self.assertEquals(len(res6), 1, "Could not find (&(cn=*daptestcomputer)(objectCategory=compuTER))")
2272
2273         self.assertEquals(res[0].dn, res6[0].dn)
2274
2275         ldb.delete("<GUID=" + ldb.schema_format_value("objectGUID", res[0]["objectGUID"][0]) + ">")
2276
2277         print "Testing ldb.search for (&(cn=ldaptest2computer)(objectClass=user))"
2278         res = ldb.search(expression="(&(cn=ldaptest2computer)(objectClass=user))")
2279         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptest2computer)(objectClass=user))")
2280
2281         self.assertEquals(str(res[0].dn), "CN=ldaptest2computer,CN=Computers," + self.base_dn)
2282         self.assertEquals(str(res[0]["cn"]), "ldaptest2computer")
2283         self.assertEquals(str(res[0]["name"]), "ldaptest2computer")
2284         self.assertEquals(list(res[0]["objectClass"]), ["top", "person", "organizationalPerson", "user", "computer"])
2285         self.assertTrue("objectGUID" in res[0])
2286         self.assertTrue("whenCreated" in res[0])
2287         self.assertEquals(res[0]["objectCategory"][0], "CN=Computer,CN=Schema,CN=Configuration," + self.base_dn)
2288         self.assertEquals(int(res[0]["sAMAccountType"][0]), ATYPE_WORKSTATION_TRUST)
2289         self.assertEquals(int(res[0]["userAccountControl"][0]), UF_WORKSTATION_TRUST_ACCOUNT)
2290
2291         ldb.delete("<SID=" + ldb.schema_format_value("objectSID", res[0]["objectSID"][0]) + ">")
2292
2293         attrs = ["cn", "name", "objectClass", "objectGUID", "objectSID", "whenCreated", "nTSecurityDescriptor", "memberOf", "allowedAttributes", "allowedAttributesEffective"]
2294         print "Testing ldb.search for (&(cn=ldaptestUSer2)(objectClass=user))"
2295         res_user = ldb.search(self.base_dn, expression="(&(cn=ldaptestUSer2)(objectClass=user))", scope=SCOPE_SUBTREE, attrs=attrs)
2296         self.assertEquals(len(res_user), 1, "Could not find (&(cn=ldaptestUSer2)(objectClass=user))")
2297
2298         self.assertEquals(str(res_user[0].dn), ("CN=ldaptestuser2,CN=Users," + self.base_dn))
2299         self.assertEquals(str(res_user[0]["cn"]), "ldaptestuser2")
2300         self.assertEquals(str(res_user[0]["name"]), "ldaptestuser2")
2301         self.assertEquals(list(res_user[0]["objectClass"]), ["top", "person", "organizationalPerson", "user"])
2302         self.assertTrue("objectSid" in res_user[0])
2303         self.assertTrue("objectGUID" in res_user[0])
2304         self.assertTrue("whenCreated" in res_user[0])
2305         self.assertTrue("nTSecurityDescriptor" in res_user[0])
2306         self.assertTrue("allowedAttributes" in res_user[0])
2307         self.assertTrue("allowedAttributesEffective" in res_user[0])
2308         self.assertEquals(res_user[0]["memberOf"][0].upper(), ("CN=ldaptestgroup2,CN=Users," + self.base_dn).upper())
2309
2310         ldaptestuser2_sid = res_user[0]["objectSid"][0]
2311         ldaptestuser2_guid = res_user[0]["objectGUID"][0]
2312
2313         attrs = ["cn", "name", "objectClass", "objectGUID", "objectSID", "whenCreated", "nTSecurityDescriptor", "member", "allowedAttributes", "allowedAttributesEffective"]
2314         print "Testing ldb.search for (&(cn=ldaptestgroup2)(objectClass=group))"
2315         res = ldb.search(self.base_dn, expression="(&(cn=ldaptestgroup2)(objectClass=group))", scope=SCOPE_SUBTREE, attrs=attrs)
2316         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group))")
2317
2318         self.assertEquals(str(res[0].dn), ("CN=ldaptestgroup2,CN=Users," + self.base_dn))
2319         self.assertEquals(str(res[0]["cn"]), "ldaptestgroup2")
2320         self.assertEquals(str(res[0]["name"]), "ldaptestgroup2")
2321         self.assertEquals(list(res[0]["objectClass"]), ["top", "group"])
2322         self.assertTrue("objectGUID" in res[0])
2323         self.assertTrue("objectSid" in res[0])
2324         self.assertTrue("whenCreated" in res[0])
2325         self.assertTrue("nTSecurityDescriptor" in res[0])
2326         self.assertTrue("allowedAttributes" in res[0])
2327         self.assertTrue("allowedAttributesEffective" in res[0])
2328         memberUP = []
2329         for m in res[0]["member"]:
2330             memberUP.append(m.upper())
2331         self.assertTrue(("CN=ldaptestuser2,CN=Users," + self.base_dn).upper() in memberUP)
2332
2333         res = ldb.search(self.base_dn, expression="(&(cn=ldaptestgroup2)(objectClass=group))", scope=SCOPE_SUBTREE, attrs=attrs, controls=["extended_dn:1:1"])
2334         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group))")
2335
2336         print res[0]["member"]
2337         memberUP = []
2338         for m in res[0]["member"]:
2339             memberUP.append(m.upper())
2340         print ("<GUID=" + ldb.schema_format_value("objectGUID", ldaptestuser2_guid) + ">;<SID=" + ldb.schema_format_value("objectSid", ldaptestuser2_sid) + ">;CN=ldaptestuser2,CN=Users," + self.base_dn).upper()
2341
2342         self.assertTrue(("<GUID=" + ldb.schema_format_value("objectGUID", ldaptestuser2_guid) + ">;<SID=" + ldb.schema_format_value("objectSid", ldaptestuser2_sid) + ">;CN=ldaptestuser2,CN=Users," + self.base_dn).upper() in memberUP)
2343
2344         print "Quicktest for linked attributes"
2345         ldb.modify_ldif("""
2346 dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
2347 changetype: modify
2348 replace: member
2349 member: CN=ldaptestuser2,CN=Users,""" + self.base_dn + """
2350 member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + self.base_dn + """
2351 """)
2352
2353         ldb.modify_ldif("""
2354 dn: <GUID=""" + ldb.schema_format_value("objectGUID", res[0]["objectGUID"][0]) + """>
2355 changetype: modify
2356 replace: member
2357 member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + self.base_dn + """
2358 """)
2359
2360         ldb.modify_ldif("""
2361 dn: <SID=""" + ldb.schema_format_value("objectSid", res[0]["objectSid"][0]) + """>
2362 changetype: modify
2363 delete: member
2364 """)
2365
2366         ldb.modify_ldif("""
2367 dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
2368 changetype: modify
2369 add: member
2370 member: <GUID=""" + ldb.schema_format_value("objectGUID", res[0]["objectGUID"][0]) + """>
2371 member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + self.base_dn + """
2372 """)
2373
2374         ldb.modify_ldif("""
2375 dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
2376 changetype: modify
2377 replace: member
2378 """)
2379
2380         ldb.modify_ldif("""
2381 dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
2382 changetype: modify
2383 add: member
2384 member: <SID=""" + ldb.schema_format_value("objectSid", res_user[0]["objectSid"][0]) + """>
2385 member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + self.base_dn + """
2386 """)
2387
2388         ldb.modify_ldif("""
2389 dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
2390 changetype: modify
2391 delete: member
2392 member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + self.base_dn + """
2393 """)
2394
2395         res = ldb.search(self.base_dn, expression="(&(cn=ldaptestgroup2)(objectClass=group))", scope=SCOPE_SUBTREE, attrs=attrs)
2396         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group))")
2397
2398         self.assertEquals(str(res[0].dn), ("CN=ldaptestgroup2,CN=Users," + self.base_dn))
2399         self.assertEquals(res[0]["member"][0], ("CN=ldaptestuser2,CN=Users," + self.base_dn))
2400         self.assertEquals(len(res[0]["member"]), 1)
2401
2402         ldb.delete(("CN=ldaptestuser2,CN=Users," + self.base_dn))
2403
2404         time.sleep(4)
2405
2406         attrs = ["cn", "name", "objectClass", "objectGUID", "whenCreated", "nTSecurityDescriptor", "member"]
2407         print "Testing ldb.search for (&(cn=ldaptestgroup2)(objectClass=group)) to check linked delete"
2408         res = ldb.search(self.base_dn, expression="(&(cn=ldaptestgroup2)(objectClass=group))", scope=SCOPE_SUBTREE, attrs=attrs)
2409         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group)) to check linked delete")
2410
2411         self.assertEquals(str(res[0].dn), ("CN=ldaptestgroup2,CN=Users," + self.base_dn))
2412         self.assertTrue("member" not in res[0])
2413
2414         print "Testing ldb.search for (&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))"
2415 # TODO UTF8 users don't seem to work fully anymore
2416 #        res = ldb.search(expression="(&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))")
2417         res = ldb.search(expression="(&(cn=ldaptestutf8user èùéìòà)(objectclass=user))")
2418         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))")
2419
2420         self.assertEquals(str(res[0].dn), ("CN=ldaptestutf8user èùéìòà,CN=Users," + self.base_dn))
2421         self.assertEquals(str(res[0]["cn"]), "ldaptestutf8user èùéìòà")
2422         self.assertEquals(str(res[0]["name"]), "ldaptestutf8user èùéìòà")
2423         self.assertEquals(list(res[0]["objectClass"]), ["top", "person", "organizationalPerson", "user"])
2424         self.assertTrue("objectGUID" in res[0])
2425         self.assertTrue("whenCreated" in res[0])
2426
2427         ldb.delete(res[0].dn)
2428
2429         print "Testing ldb.search for (&(cn=ldaptestutf8user2*)(objectClass=user))"
2430         res = ldb.search(expression="(&(cn=ldaptestutf8user2*)(objectClass=user))")
2431         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestutf8user2*)(objectClass=user))")
2432
2433         ldb.delete(res[0].dn)
2434
2435         ldb.delete(("CN=ldaptestgroup2,CN=Users," + self.base_dn))
2436
2437         print "Testing ldb.search for (&(cn=ldaptestutf8user2 ÈÙÉÌÒÀ)(objectClass=user))"
2438 # TODO UTF8 users don't seem to work fully anymore
2439 #        res = ldb.search(expression="(&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))")
2440 #        self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))")
2441
2442         print "Testing that we can't get at the configuration DN from the main search base"
2443         res = ldb.search(self.base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
2444         self.assertEquals(len(res), 0)
2445
2446         print "Testing that we can get at the configuration DN from the main search base on the LDAP port with the 'phantom root' search_options control"
2447         res = ldb.search(self.base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["search_options:1:2"])
2448         self.assertTrue(len(res) > 0)
2449
2450         if gc_ldb is not None:
2451             print "Testing that we can get at the configuration DN from the main search base on the GC port with the search_options control == 0"
2452
2453             res = gc_ldb.search(self.base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["search_options:1:0"])
2454             self.assertTrue(len(res) > 0)
2455
2456             print "Testing that we do find configuration elements in the global catlog"
2457             res = gc_ldb.search(self.base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
2458             self.assertTrue(len(res) > 0)
2459
2460             print "Testing that we do find configuration elements and user elements at the same time"
2461             res = gc_ldb.search(self.base_dn, expression="(|(objectClass=crossRef)(objectClass=person))", scope=SCOPE_SUBTREE, attrs=["cn"])
2462             self.assertTrue(len(res) > 0)
2463
2464             print "Testing that we do find configuration elements in the global catlog, with the configuration basedn"
2465             res = gc_ldb.search(self.configuration_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
2466             self.assertTrue(len(res) > 0)
2467
2468         print "Testing that we can get at the configuration DN on the main LDAP port"
2469         res = ldb.search(self.configuration_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
2470         self.assertTrue(len(res) > 0)
2471
2472         print "Testing objectCategory canonacolisation"
2473         res = ldb.search(self.configuration_dn, expression="objectCategory=ntDsDSA", scope=SCOPE_SUBTREE, attrs=["cn"])
2474         self.assertTrue(len(res) > 0, "Didn't find any records with objectCategory=ntDsDSA")
2475         self.assertTrue(len(res) != 0)
2476
2477         res = ldb.search(self.configuration_dn, expression="objectCategory=CN=ntDs-DSA," + self.schema_dn, scope=SCOPE_SUBTREE, attrs=["cn"])
2478         self.assertTrue(len(res) > 0, "Didn't find any records with objectCategory=CN=ntDs-DSA," + self.schema_dn)
2479         self.assertTrue(len(res) != 0)
2480
2481         print "Testing objectClass attribute order on "+ self.base_dn
2482         res = ldb.search(expression="objectClass=domain", base=self.base_dn,
2483                          scope=SCOPE_BASE, attrs=["objectClass"])
2484         self.assertEquals(len(res), 1)
2485
2486         self.assertEquals(list(res[0]["objectClass"]), ["top", "domain", "domainDNS"])
2487
2488     #  check enumeration
2489
2490         print "Testing ldb.search for objectCategory=person"
2491         res = ldb.search(self.base_dn, expression="objectCategory=person", scope=SCOPE_SUBTREE, attrs=["cn"])
2492         self.assertTrue(len(res) > 0)
2493
2494         print "Testing ldb.search for objectCategory=person with domain scope control"
2495         res = ldb.search(self.base_dn, expression="objectCategory=person", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["domain_scope:1"])
2496         self.assertTrue(len(res) > 0)
2497
2498         print "Testing ldb.search for objectCategory=user"
2499         res = ldb.search(self.base_dn, expression="objectCategory=user", scope=SCOPE_SUBTREE, attrs=["cn"])
2500         self.assertTrue(len(res) > 0)
2501
2502         print "Testing ldb.search for objectCategory=user with domain scope control"
2503         res = ldb.search(self.base_dn, expression="objectCategory=user", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["domain_scope:1"])
2504         self.assertTrue(len(res) > 0)
2505
2506         print "Testing ldb.search for objectCategory=group"
2507         res = ldb.search(self.base_dn, expression="objectCategory=group", scope=SCOPE_SUBTREE, attrs=["cn"])
2508         self.assertTrue(len(res) > 0)
2509
2510         print "Testing ldb.search for objectCategory=group with domain scope control"
2511         res = ldb.search(self.base_dn, expression="objectCategory=group", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["domain_scope:1"])
2512         self.assertTrue(len(res) > 0)
2513
2514         print "Testing creating a user with the posixAccount objectClass"
2515         self.ldb.add_ldif("""dn: cn=posixuser,CN=Users,%s
2516 objectClass: top
2517 objectClass: person
2518 objectClass: posixAccount
2519 objectClass: user
2520 objectClass: organizationalPerson
2521 cn: posixuser
2522 uid: posixuser
2523 sn: posixuser
2524 uidNumber: 10126
2525 gidNumber: 10126
2526 homeDirectory: /home/posixuser
2527 loginShell: /bin/bash
2528 gecos: Posix User;;;
2529 description: A POSIX user"""% (self.base_dn))
2530
2531         print "Testing removing the posixAccount objectClass from an existing user"
2532         self.ldb.modify_ldif("""dn: cn=posixuser,CN=Users,%s
2533 changetype: modify
2534 delete: objectClass
2535 objectClass: posixAccount"""% (self.base_dn))
2536
2537         print "Testing adding the posixAccount objectClass to an existing user"
2538         self.ldb.modify_ldif("""dn: cn=posixuser,CN=Users,%s
2539 changetype: modify
2540 add: objectClass
2541 objectClass: posixAccount"""% (self.base_dn))
2542
2543         self.delete_force(self.ldb, "cn=posixuser,cn=users," + self.base_dn)
2544         self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
2545         self.delete_force(self.ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
2546         self.delete_force(self.ldb, "cn=ldaptestuser3,cn=users," + self.base_dn)
2547         self.delete_force(self.ldb, "cn=ldaptestuser4,cn=ldaptestcontainer," + self.base_dn)
2548         self.delete_force(self.ldb, "cn=ldaptestuser4,cn=ldaptestcontainer2," + self.base_dn)
2549         self.delete_force(self.ldb, "cn=ldaptestuser5,cn=users," + self.base_dn)
2550         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2551         self.delete_force(self.ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
2552         self.delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2553         self.delete_force(self.ldb, "cn=ldaptest2computer,cn=computers," + self.base_dn)
2554         self.delete_force(self.ldb, "cn=ldaptestcomputer3,cn=computers," + self.base_dn)
2555         self.delete_force(self.ldb, "cn=ldaptestutf8user èùéìòà,cn=users," + self.base_dn)
2556         self.delete_force(self.ldb, "cn=ldaptestutf8user2  èùéìòà,cn=users," + self.base_dn)
2557         self.delete_force(self.ldb, "cn=ldaptestcontainer," + self.base_dn)
2558         self.delete_force(self.ldb, "cn=ldaptestcontainer2," + self.base_dn)
2559
2560     def test_security_descriptor_add(self):
2561         """ Testing ldb.add_ldif() for nTSecurityDescriptor """
2562         user_name = "testdescriptoruser1"
2563         user_dn = "CN=%s,CN=Users,%s" % (user_name, self.base_dn)
2564         #
2565         # Test add_ldif() with SDDL security descriptor input
2566         #
2567         self.delete_force(self.ldb, user_dn)
2568         try:
2569             sddl = "O:DUG:DUD:PAI(A;;RPWP;;;AU)S:PAI"
2570             self.ldb.add_ldif("""
2571 dn: """ + user_dn + """
2572 objectclass: user
2573 sAMAccountName: """ + user_name + """
2574 nTSecurityDescriptor: """ + sddl)
2575             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2576             desc = res[0]["nTSecurityDescriptor"][0]
2577             desc = ndr_unpack( security.descriptor, desc )
2578             desc_sddl = desc.as_sddl( self.domain_sid )
2579             self.assertEqual(desc_sddl, sddl)
2580         finally:
2581             self.delete_force(self.ldb, user_dn)
2582         #
2583         # Test add_ldif() with BASE64 security descriptor
2584         #
2585         try:
2586             sddl = "O:DUG:DUD:PAI(A;;RPWP;;;AU)S:PAI"
2587             desc = security.descriptor.from_sddl(sddl, self.domain_sid)
2588             desc_binary = ndr_pack(desc)
2589             desc_base64 = base64.b64encode(desc_binary)
2590             self.ldb.add_ldif("""
2591 dn: """ + user_dn + """
2592 objectclass: user
2593 sAMAccountName: """ + user_name + """
2594 nTSecurityDescriptor:: """ + desc_base64)
2595             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2596             desc = res[0]["nTSecurityDescriptor"][0]
2597             desc = ndr_unpack(security.descriptor, desc)
2598             desc_sddl = desc.as_sddl(self.domain_sid)
2599             self.assertEqual(desc_sddl, sddl)
2600         finally:
2601             self.delete_force(self.ldb, user_dn)
2602
2603     def test_security_descriptor_add_neg(self):
2604         """Test add_ldif() with BASE64 security descriptor input using WRONG domain SID
2605             Negative test
2606         """
2607         user_name = "testdescriptoruser1"
2608         user_dn = "CN=%s,CN=Users,%s" % (user_name, self.base_dn)
2609         self.delete_force(self.ldb, user_dn)
2610         try:
2611             sddl = "O:DUG:DUD:PAI(A;;RPWP;;;AU)S:PAI"
2612             desc = security.descriptor.from_sddl(sddl, security.dom_sid('S-1-5-21'))
2613             desc_base64 = base64.b64encode( ndr_pack(desc) )
2614             self.ldb.add_ldif("""
2615 dn: """ + user_dn + """
2616 objectclass: user
2617 sAMAccountName: """ + user_name + """
2618 nTSecurityDescriptor:: """ + desc_base64)
2619             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2620             self.assertTrue("nTSecurityDescriptor" in res[0])
2621         finally:
2622             self.delete_force(self.ldb, user_dn)
2623
2624     def test_security_descriptor_modify(self):
2625         """ Testing ldb.modify_ldif() for nTSecurityDescriptor """
2626         user_name = "testdescriptoruser2"
2627         user_dn = "CN=%s,CN=Users,%s" % (user_name, self.base_dn)
2628         #
2629         # Delete user object and test modify_ldif() with SDDL security descriptor input
2630         # Add ACE to the original descriptor test
2631         #
2632         try:
2633             self.delete_force(self.ldb, user_dn)
2634             self.ldb.add_ldif("""
2635 dn: """ + user_dn + """
2636 objectclass: user
2637 sAMAccountName: """ + user_name)
2638             # Modify descriptor
2639             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2640             desc = res[0]["nTSecurityDescriptor"][0]
2641             desc = ndr_unpack(security.descriptor, desc)
2642             desc_sddl = desc.as_sddl(self.domain_sid)
2643             sddl = desc_sddl[:desc_sddl.find("(")] + "(A;;RPWP;;;AU)" + desc_sddl[desc_sddl.find("("):]
2644             mod = """
2645 dn: """ + user_dn + """
2646 changetype: modify
2647 replace: nTSecurityDescriptor
2648 nTSecurityDescriptor: """ + sddl
2649             self.ldb.modify_ldif(mod)
2650             # Read modified descriptor
2651             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2652             desc = res[0]["nTSecurityDescriptor"][0]
2653             desc = ndr_unpack(security.descriptor, desc)
2654             desc_sddl = desc.as_sddl(self.domain_sid)
2655             self.assertEqual(desc_sddl, sddl)
2656         finally:
2657             self.delete_force(self.ldb, user_dn)
2658         #
2659         # Test modify_ldif() with SDDL security descriptor input
2660         # New desctiptor test
2661         #
2662         try:
2663             self.ldb.add_ldif("""
2664 dn: """ + user_dn + """
2665 objectclass: user
2666 sAMAccountName: """ + user_name)
2667             # Modify descriptor
2668             sddl = "O:DUG:DUD:PAI(A;;RPWP;;;AU)S:PAI"
2669             mod = """
2670 dn: """ + user_dn + """
2671 changetype: modify
2672 replace: nTSecurityDescriptor
2673 nTSecurityDescriptor: """ + sddl
2674             self.ldb.modify_ldif(mod)
2675             # Read modified descriptor
2676             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2677             desc = res[0]["nTSecurityDescriptor"][0]
2678             desc = ndr_unpack(security.descriptor, desc)
2679             desc_sddl = desc.as_sddl(self.domain_sid)
2680             self.assertEqual(desc_sddl, sddl)
2681         finally:
2682             self.delete_force(self.ldb, user_dn)
2683         #
2684         # Test modify_ldif() with BASE64 security descriptor input
2685         # Add ACE to the original descriptor test
2686         #
2687         try:
2688             self.ldb.add_ldif("""
2689 dn: """ + user_dn + """
2690 objectclass: user
2691 sAMAccountName: """ + user_name)
2692             # Modify descriptor
2693             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2694             desc = res[0]["nTSecurityDescriptor"][0]
2695             desc = ndr_unpack(security.descriptor, desc)
2696             desc_sddl = desc.as_sddl(self.domain_sid)
2697             sddl = desc_sddl[:desc_sddl.find("(")] + "(A;;RPWP;;;AU)" + desc_sddl[desc_sddl.find("("):]
2698             desc = security.descriptor.from_sddl(sddl, self.domain_sid)
2699             desc_base64 = base64.b64encode(ndr_pack(desc))
2700             mod = """
2701 dn: """ + user_dn + """
2702 changetype: modify
2703 replace: nTSecurityDescriptor
2704 nTSecurityDescriptor:: """ + desc_base64
2705             self.ldb.modify_ldif(mod)
2706             # Read modified descriptor
2707             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2708             desc = res[0]["nTSecurityDescriptor"][0]
2709             desc = ndr_unpack(security.descriptor, desc)
2710             desc_sddl = desc.as_sddl(self.domain_sid)
2711             self.assertEqual(desc_sddl, sddl)
2712         finally:
2713             self.delete_force(self.ldb, user_dn)
2714         #
2715         # Test modify_ldif() with BASE64 security descriptor input
2716         # New descriptor test
2717         #
2718         try:
2719             self.delete_force(self.ldb, user_dn)
2720             self.ldb.add_ldif("""
2721 dn: """ + user_dn + """
2722 objectclass: user
2723 sAMAccountName: """ + user_name)
2724             # Modify descriptor
2725             sddl = "O:DUG:DUD:PAI(A;;RPWP;;;AU)S:PAI"
2726             desc = security.descriptor.from_sddl(sddl, self.domain_sid)
2727             desc_base64 = base64.b64encode(ndr_pack(desc))
2728             mod = """
2729 dn: """ + user_dn + """
2730 changetype: modify
2731 replace: nTSecurityDescriptor
2732 nTSecurityDescriptor:: """ + desc_base64
2733             self.ldb.modify_ldif(mod)
2734             # Read modified descriptor
2735             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2736             desc = res[0]["nTSecurityDescriptor"][0]
2737             desc = ndr_unpack(security.descriptor, desc)
2738             desc_sddl = desc.as_sddl(self.domain_sid)
2739             self.assertEqual(desc_sddl, sddl)
2740         finally:
2741             self.delete_force(self.ldb, user_dn)
2742
2743
2744 class BaseDnTests(unittest.TestCase):
2745
2746     def setUp(self):
2747         super(BaseDnTests, self).setUp()
2748         self.ldb = ldb
2749
2750     def test_rootdse_attrs(self):
2751         """Testing for all rootDSE attributes"""
2752         res = self.ldb.search(scope=SCOPE_BASE, attrs=[])
2753         self.assertEquals(len(res), 1)
2754
2755     def test_highestcommittedusn(self):
2756         """Testing for highestCommittedUSN"""
2757         res = self.ldb.search("", scope=SCOPE_BASE, attrs=["highestCommittedUSN"])
2758         self.assertEquals(len(res), 1)
2759         self.assertTrue(int(res[0]["highestCommittedUSN"][0]) != 0)
2760
2761     def test_netlogon(self):
2762         """Testing for netlogon via LDAP"""
2763         res = self.ldb.search("", scope=SCOPE_BASE, attrs=["netlogon"])
2764         self.assertEquals(len(res), 0)
2765
2766     def test_netlogon_highestcommitted_usn(self):
2767         """Testing for netlogon and highestCommittedUSN via LDAP"""
2768         res = self.ldb.search("", scope=SCOPE_BASE,
2769                 attrs=["netlogon", "highestCommittedUSN"])
2770         self.assertEquals(len(res), 0)
2771
2772     def test_namingContexts(self):
2773         """Testing for namingContexts in rootDSE"""
2774         res = self.ldb.search("", scope=SCOPE_BASE,
2775                 attrs=["namingContexts", "defaultNamingContext", "schemaNamingContext", "configurationNamingContext"])
2776         self.assertEquals(len(res), 1)
2777
2778         ncs = set([])
2779         for nc in res[0]["namingContexts"]:
2780             self.assertTrue(nc not in ncs)
2781             ncs.add(nc)
2782
2783         self.assertTrue(res[0]["defaultNamingContext"][0] in ncs)
2784         self.assertTrue(res[0]["configurationNamingContext"][0] in ncs)
2785         self.assertTrue(res[0]["schemaNamingContext"][0] in ncs)
2786
2787
2788 if not "://" in host:
2789     if os.path.isfile(host):
2790         host = "tdb://%s" % host
2791     else:
2792         host = "ldap://%s" % host
2793
2794 ldb = Ldb(host, credentials=creds, session_info=system_session(), lp=lp)
2795 if not "tdb://" in host:
2796     gc_ldb = Ldb("%s:3268" % host, credentials=creds,
2797                  session_info=system_session(), lp=lp)
2798 else:
2799     gc_ldb = None
2800
2801 runner = SubunitTestRunner()
2802 rc = 0
2803 if not runner.run(unittest.makeSuite(BaseDnTests)).wasSuccessful():
2804     rc = 1
2805 if not runner.run(unittest.makeSuite(BasicTests)).wasSuccessful():
2806     rc = 1
2807 sys.exit(rc)