2 # -*- coding: utf-8 -*-
3 # This is a port of the original in testprogs/ejs/ldap.js
13 sys.path.append("bin/python")
14 sys.path.append("../lib/subunit/python")
16 import samba.getopt as options
18 from samba.auth import system_session
19 from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError
20 from ldb import ERR_NO_SUCH_OBJECT, ERR_ATTRIBUTE_OR_VALUE_EXISTS
21 from ldb import ERR_ENTRY_ALREADY_EXISTS, ERR_UNWILLING_TO_PERFORM
22 from ldb import ERR_NOT_ALLOWED_ON_NON_LEAF, ERR_OTHER, ERR_INVALID_DN_SYNTAX
23 from ldb import ERR_NO_SUCH_ATTRIBUTE, ERR_INSUFFICIENT_ACCESS_RIGHTS
24 from ldb import ERR_OBJECT_CLASS_VIOLATION, ERR_NOT_ALLOWED_ON_RDN
25 from ldb import ERR_NAMING_VIOLATION, ERR_CONSTRAINT_VIOLATION
26 from ldb import Message, MessageElement, Dn
27 from ldb import FLAG_MOD_ADD, FLAG_MOD_REPLACE, FLAG_MOD_DELETE
28 from samba import Ldb, param, dom_sid_to_rid
29 from samba import UF_NORMAL_ACCOUNT, UF_TEMP_DUPLICATE_ACCOUNT
30 from samba import UF_SERVER_TRUST_ACCOUNT, UF_WORKSTATION_TRUST_ACCOUNT
31 from samba import UF_INTERDOMAIN_TRUST_ACCOUNT
32 from samba import UF_PASSWD_NOTREQD, UF_ACCOUNTDISABLE
33 from samba import GTYPE_SECURITY_BUILTIN_LOCAL_GROUP
34 from samba import GTYPE_SECURITY_GLOBAL_GROUP, GTYPE_SECURITY_DOMAIN_LOCAL_GROUP
35 from samba import GTYPE_SECURITY_UNIVERSAL_GROUP
36 from samba import GTYPE_DISTRIBUTION_GLOBAL_GROUP
37 from samba import GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP
38 from samba import GTYPE_DISTRIBUTION_UNIVERSAL_GROUP
39 from samba import ATYPE_NORMAL_ACCOUNT, ATYPE_WORKSTATION_TRUST
40 from samba import ATYPE_SECURITY_GLOBAL_GROUP, ATYPE_SECURITY_LOCAL_GROUP
41 from samba import ATYPE_SECURITY_UNIVERSAL_GROUP
42 from samba import ATYPE_DISTRIBUTION_GLOBAL_GROUP
43 from samba import ATYPE_DISTRIBUTION_LOCAL_GROUP
44 from samba import ATYPE_DISTRIBUTION_UNIVERSAL_GROUP
46 from subunit import SubunitTestRunner
49 from samba.ndr import ndr_pack, ndr_unpack
50 from samba.dcerpc import security
52 parser = optparse.OptionParser("ldap [options] <host>")
53 sambaopts = options.SambaOptions(parser)
54 parser.add_option_group(sambaopts)
55 parser.add_option_group(options.VersionOptions(parser))
56 # use command line creds if available
57 credopts = options.CredentialsOptions(parser)
58 parser.add_option_group(credopts)
59 opts, args = parser.parse_args()
67 lp = sambaopts.get_loadparm()
68 creds = credopts.get_credentials(lp)
70 class BasicTests(unittest.TestCase):
71 def delete_force(self, ldb, dn):
74 except LdbError, (num, _):
75 self.assertEquals(num, ERR_NO_SUCH_OBJECT)
77 def find_basedn(self, ldb):
78 res = ldb.search(base="", expression="", scope=SCOPE_BASE,
79 attrs=["defaultNamingContext"])
80 self.assertEquals(len(res), 1)
81 return res[0]["defaultNamingContext"][0]
83 def find_configurationdn(self, ldb):
84 res = ldb.search(base="", expression="", scope=SCOPE_BASE, attrs=["configurationNamingContext"])
85 self.assertEquals(len(res), 1)
86 return res[0]["configurationNamingContext"][0]
88 def find_schemadn(self, ldb):
89 res = ldb.search(base="", expression="", scope=SCOPE_BASE, attrs=["schemaNamingContext"])
90 self.assertEquals(len(res), 1)
91 return res[0]["schemaNamingContext"][0]
93 def find_domain_sid(self):
94 res = self.ldb.search(base=self.base_dn, expression="(objectClass=*)", scope=SCOPE_BASE)
95 return ndr_unpack( security.dom_sid,res[0]["objectSid"][0])
100 self.base_dn = self.find_basedn(ldb)
101 self.configuration_dn = self.find_configurationdn(ldb)
102 self.schema_dn = self.find_schemadn(ldb)
103 self.domain_sid = self.find_domain_sid()
105 print "baseDN: %s\n" % self.base_dn
107 self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
108 self.delete_force(self.ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
109 self.delete_force(self.ldb, "cn=ldaptestuser3,cn=users," + self.base_dn)
110 self.delete_force(self.ldb, "cn=ldaptestuser4,cn=ldaptestcontainer," + self.base_dn)
111 self.delete_force(self.ldb, "cn=ldaptestuser4,cn=ldaptestcontainer2," + self.base_dn)
112 self.delete_force(self.ldb, "cn=ldaptestuser5,cn=users," + self.base_dn)
113 self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
114 self.delete_force(self.ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
115 self.delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
116 self.delete_force(self.ldb, "cn=ldaptest2computer,cn=computers," + self.base_dn)
117 self.delete_force(self.ldb, "cn=ldaptestcomputer3,cn=computers," + self.base_dn)
118 self.delete_force(self.ldb, "cn=ldaptestutf8user èùéìòà,cn=users," + self.base_dn)
119 self.delete_force(self.ldb, "cn=ldaptestutf8user2 èùéìòà,cn=users," + self.base_dn)
120 self.delete_force(self.ldb, "cn=ldaptestcontainer," + self.base_dn)
121 self.delete_force(self.ldb, "cn=ldaptestcontainer2," + self.base_dn)
122 self.delete_force(self.ldb, "cn=parentguidtest,cn=users," + self.base_dn)
123 self.delete_force(self.ldb, "cn=parentguidtest,cn=testotherusers," + self.base_dn)
124 self.delete_force(self.ldb, "cn=testotherusers," + self.base_dn)
125 self.delete_force(self.ldb, "cn=ldaptestobject," + self.base_dn)
126 self.delete_force(self.ldb, "description=xyz,cn=users," + self.base_dn)
127 self.delete_force(self.ldb, "ou=testou,cn=users," + self.base_dn)
129 def test_system_only(self):
130 """Test systemOnly objects"""
131 print "Test systemOnly objects"""
135 "dn": "cn=ldaptestobject," + self.base_dn,
136 "objectclass": "configuration"})
138 except LdbError, (num, _):
139 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
141 self.delete_force(self.ldb, "cn=ldaptestobject," + self.base_dn)
143 def test_invalid_parent(self):
144 """Test adding an object with invalid parent"""
145 print "Test adding an object with invalid parent"""
149 "dn": "cn=ldaptestgroup,cn=thisdoesnotexist123,"
151 "objectclass": "group"})
153 except LdbError, (num, _):
154 self.assertEquals(num, ERR_NO_SUCH_OBJECT)
156 self.delete_force(self.ldb, "cn=ldaptestgroup,cn=thisdoesnotexist123,"
161 "dn": "ou=testou,cn=users," + self.base_dn,
162 "objectclass": "organizationalUnit"})
164 except LdbError, (num, _):
165 self.assertEquals(num, ERR_NAMING_VIOLATION)
167 self.delete_force(self.ldb, "ou=testou,cn=users," + self.base_dn)
169 def test_invalid_attribute(self):
170 """Test adding invalid attributes (not in schema)"""
171 print "Test adding invalid attributes (not in schema)"""
175 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
176 "objectclass": "group",
177 "thisdoesnotexist": "x"})
179 except LdbError, (num, _):
180 self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
183 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
184 "objectclass": "group"})
187 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
188 m["thisdoesnotexist"] = MessageElement("x", FLAG_MOD_REPLACE,
193 except LdbError, (num, _):
194 self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
196 self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
198 def test_single_valued_attributes(self):
199 """Test single-valued attributes"""
200 print "Test single-valued attributes"""
204 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
205 "objectclass": "group",
206 "sAMAccountName": ["nam1", "nam2"]})
208 except LdbError, (num, _):
209 self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
212 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
213 "objectclass": "group"})
216 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
217 m["sAMAccountName"] = MessageElement(["nam1","nam2"], FLAG_MOD_REPLACE,
222 except LdbError, (num, _):
223 self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
226 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
227 m["sAMAccountName"] = MessageElement("testgroupXX", FLAG_MOD_REPLACE,
232 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
233 m["sAMAccountName"] = MessageElement("testgroupXX2", FLAG_MOD_ADD,
238 except LdbError, (num, _):
239 self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
241 self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
243 def test_multi_valued_attributes(self):
244 """Test multi-valued attributes"""
245 print "Test multi-valued attributes"""
247 # TODO: In this test I added some special tests where I got very unusual
248 # results back from a real AD. s4 doesn't match them and I've no idea how to
249 # implement those error cases (maybe there exists a special trigger for
250 # "description" attributes which handle them)
253 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
254 "description": "desc2",
255 "objectclass": "group",
256 "description": "desc1"})
258 self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
261 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
262 "objectclass": "group",
263 "description": ["desc1", "desc2"]})
266 # m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
267 # m["description"] = MessageElement(["desc1","desc2"], FLAG_MOD_REPLACE,
272 # except LdbError, (num, _):
273 # self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
276 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
277 m["description"] = MessageElement("desc1", FLAG_MOD_REPLACE,
282 # m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
283 # m["description"] = MessageElement("desc3", FLAG_MOD_ADD,
288 # except LdbError, (num, _):
289 # self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
292 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
293 m["description"] = MessageElement(["desc1","desc2"], FLAG_MOD_DELETE,
298 except LdbError, (num, _):
299 self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
302 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
303 m["description"] = MessageElement("desc1", FLAG_MOD_DELETE,
308 # m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
309 # m["description"] = MessageElement(["desc1","desc2"], FLAG_MOD_REPLACE,
314 # except LdbError, (num, _):
315 # self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
318 # m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
319 # m["description"] = MessageElement(["desc3", "desc4"], FLAG_MOD_ADD,
324 # except LdbError, (num, _):
325 # self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
328 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
329 m["description"] = MessageElement("desc3", FLAG_MOD_ADD,
333 self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
335 def test_empty_messages(self):
336 """Test empty messages"""
337 print "Test empty messages"""
340 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
345 except LdbError, (num, _):
346 self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
351 except LdbError, (num, _):
352 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
354 self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
356 def test_empty_attributes(self):
357 """Test empty attributes"""
358 print "Test empty attributes"""
361 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
362 m["objectClass"] = MessageElement("group", FLAG_MOD_ADD, "objectClass")
363 m["description"] = MessageElement([], FLAG_MOD_ADD, "description")
368 except LdbError, (num, _):
369 self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
372 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
373 "objectclass": "group"})
376 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
377 m["description"] = MessageElement([], FLAG_MOD_ADD, "description")
382 except LdbError, (num, _):
383 self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
386 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
387 m["description"] = MessageElement([], FLAG_MOD_REPLACE, "description")
391 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
392 m["description"] = MessageElement([], FLAG_MOD_DELETE, "description")
396 except LdbError, (num, _):
397 self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
399 self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
401 def test_distinguished_name(self):
402 """Tests the 'distinguishedName' attribute"""
403 print "Tests the 'distinguishedName' attribute"""
406 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
407 "objectclass": "group"})
410 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
411 m["distinguishedName"] = MessageElement(
412 "cn=ldaptestuser,cn=users," + self.base_dn, FLAG_MOD_ADD,
418 except LdbError, (num, _):
419 self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
422 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
423 m["distinguishedName"] = MessageElement(
424 "cn=ldaptestuser,cn=users," + self.base_dn, FLAG_MOD_REPLACE,
430 except LdbError, (num, _):
431 self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
434 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
435 m["distinguishedName"] = MessageElement(
436 "cn=ldaptestuser,cn=users," + self.base_dn, FLAG_MOD_DELETE,
442 except LdbError, (num, _):
443 self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
445 self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
447 def test_rdn_name(self):
449 print "Tests the RDN"""
453 "dn": "description=xyz,cn=users," + self.base_dn,
454 "objectclass": "group"})
456 except LdbError, (num, _):
457 self.assertEquals(num, ERR_NAMING_VIOLATION)
459 self.delete_force(self.ldb, "description=xyz,cn=users," + self.base_dn)
462 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
463 "objectclass": "group"})
466 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
467 m["name"] = MessageElement("cn=ldaptestuser", FLAG_MOD_REPLACE,
473 except LdbError, (num, _):
474 self.assertEquals(num, ERR_NOT_ALLOWED_ON_RDN)
477 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
478 m["cn"] = MessageElement("ldaptestuser",
479 FLAG_MOD_REPLACE, "cn")
484 except LdbError, (num, _):
485 self.assertEquals(num, ERR_NOT_ALLOWED_ON_RDN)
487 self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
490 # this test needs to be disabled until we really understand
491 # what the rDN length constraints are
492 def DISABLED_test_largeRDN(self):
493 """Testing large rDN (limit 64 characters)"""
494 rdn = "CN=a012345678901234567890123456789012345678901234567890123456789012";
495 self.delete_force(self.ldb, "%s,%s" % (rdn, self.base_dn))
497 dn: %s,%s""" % (rdn,self.base_dn) + """
498 objectClass: container
500 self.ldb.add_ldif(ldif)
501 self.delete_force(self.ldb, "%s,%s" % (rdn, self.base_dn))
503 rdn = "CN=a0123456789012345678901234567890123456789012345678901234567890120";
504 self.delete_force(self.ldb, "%s,%s" % (rdn, self.base_dn))
507 dn: %s,%s""" % (rdn,self.base_dn) + """
508 objectClass: container
510 self.ldb.add_ldif(ldif)
512 except LdbError, (num, _):
513 self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
514 self.delete_force(self.ldb, "%s,%s" % (rdn, self.base_dn))
516 def test_rename(self):
517 """Tests the rename operation"""
518 print "Tests the rename operations"""
521 "dn": "cn=ldaptestuser2,cn=users," + self.base_dn,
522 "objectclass": ["user", "person"] })
524 ldb.rename("cn=ldaptestuser2,cn=users," + self.base_dn, "cn=ldaptestuser2,cn=users," + self.base_dn)
525 ldb.rename("cn=ldaptestuser2,cn=users," + self.base_dn, "cn=ldaptestuser3,cn=users," + self.base_dn)
526 ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "cn=ldaptestUSER3,cn=users," + self.base_dn)
528 ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, ",cn=users," + self.base_dn)
530 except LdbError, (num, _):
531 self.assertEquals(num, ERR_INVALID_DN_SYNTAX)
533 self.delete_force(self.ldb, "cn=ldaptestuser3,cn=users," + self.base_dn)
535 def test_rename_twice(self):
536 """Tests the rename operation twice - this corresponds to a past bug"""
537 print "Tests the rename twice operation"""
540 "dn": "cn=ldaptestuser5,cn=users," + self.base_dn,
541 "objectclass": ["user", "person"] })
543 ldb.rename("cn=ldaptestuser5,cn=users," + self.base_dn, "cn=ldaptestUSER5,cn=users," + self.base_dn)
544 self.delete_force(self.ldb, "cn=ldaptestuser5,cn=users," + self.base_dn)
546 "dn": "cn=ldaptestuser5,cn=users," + self.base_dn,
547 "objectclass": ["user", "person"] })
548 ldb.rename("cn=ldaptestuser5,cn=Users," + self.base_dn, "cn=ldaptestUSER5,cn=users," + self.base_dn)
549 res = ldb.search(expression="cn=ldaptestuser5")
550 print "Found %u records" % len(res)
551 self.assertEquals(len(res), 1, "Wrong number of hits for cn=ldaptestuser5")
552 res = ldb.search(expression="(&(cn=ldaptestuser5)(objectclass=user))")
553 print "Found %u records" % len(res)
554 self.assertEquals(len(res), 1, "Wrong number of hits for (&(cn=ldaptestuser5)(objectclass=user))")
555 self.delete_force(self.ldb, "cn=ldaptestuser5,cn=users," + self.base_dn)
557 def test_parentGUID(self):
558 """Test parentGUID behaviour"""
559 print "Testing parentGUID behaviour\n"
561 # TODO: This seems to fail on Windows Server. Hidden attribute?
564 "dn": "cn=parentguidtest,cn=users," + self.base_dn,
565 "objectclass":"user",
566 "samaccountname":"parentguidtest"});
567 res1 = ldb.search(base="cn=parentguidtest,cn=users," + self.base_dn, scope=SCOPE_BASE,
568 attrs=["parentGUID"]);
569 res2 = ldb.search(base="cn=users," + self.base_dn,scope=SCOPE_BASE,
570 attrs=["objectGUID"]);
571 self.assertEquals(res1[0]["parentGUID"], res2[0]["objectGUID"]);
573 print "Testing parentGUID behaviour on rename\n"
576 "dn": "cn=testotherusers," + self.base_dn,
577 "objectclass":"container"});
578 res1 = ldb.search(base="cn=testotherusers," + self.base_dn,scope=SCOPE_BASE,
579 attrs=["objectGUID"]);
580 ldb.rename("cn=parentguidtest,cn=users," + self.base_dn,
581 "cn=parentguidtest,cn=testotherusers," + self.base_dn);
582 res2 = ldb.search(base="cn=parentguidtest,cn=testotherusers," + self.base_dn,
584 attrs=["parentGUID"]);
585 self.assertEquals(res1[0]["objectGUID"], res2[0]["parentGUID"]);
587 self.delete_force(self.ldb, "cn=parentguidtest,cn=testotherusers," + self.base_dn)
588 self.delete_force(self.ldb, "cn=testotherusers," + self.base_dn)
590 def test_groupType_int32(self):
591 """Test groupType (int32) behaviour (should appear to be casted to a 32 bit signed integer before comparsion)"""
592 print "Testing groupType (int32) behaviour\n"
594 res1 = ldb.search(base=self.base_dn, scope=SCOPE_SUBTREE,
595 attrs=["groupType"], expression="groupType=2147483653");
597 res2 = ldb.search(base=self.base_dn, scope=SCOPE_SUBTREE,
598 attrs=["groupType"], expression="groupType=-2147483643");
600 self.assertEquals(len(res1), len(res2))
602 self.assertTrue(res1.count > 0)
604 self.assertEquals(res1[0]["groupType"][0], "-2147483643")
606 def test_groups(self):
607 """This tests the group behaviour (setting, changing) of a user account"""
608 print "Testing group behaviour\n"
611 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
612 "objectclass": "group"})
615 "dn": "cn=ldaptestgroup2,cn=users," + self.base_dn,
616 "objectclass": "group"})
618 res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
619 scope=SCOPE_BASE, attrs=["objectSID"])
620 self.assertTrue(len(res1) == 1)
621 group_rid_1 = dom_sid_to_rid(ldb.schema_format_value("objectSID",
622 res1[0]["objectSID"][0]))
624 res1 = ldb.search("cn=ldaptestgroup2,cn=users," + self.base_dn,
625 scope=SCOPE_BASE, attrs=["objectSID"])
626 self.assertTrue(len(res1) == 1)
627 group_rid_2 = dom_sid_to_rid(ldb.schema_format_value("objectSID",
628 res1[0]["objectSID"][0]))
630 # Try to create a user with an invalid primary group
633 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
634 "objectclass": ["user", "person"],
635 "primaryGroupID": "0"})
637 except LdbError, (num, _):
638 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
639 self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
641 # Try to Create a user with a valid primary group
642 # TODO Some more investigation needed here
645 # "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
646 # "objectclass": ["user", "person"],
647 # "primaryGroupID": str(group_rid_1)})
649 # except LdbError, (num, _):
650 # self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
651 # self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
654 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
655 "objectclass": ["user", "person"]})
657 # Try to add invalid primary group
659 m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
660 m["primaryGroupID"] = MessageElement("0", FLAG_MOD_REPLACE,
665 except LdbError, (num, _):
666 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
668 # Try to make group 1 primary - should be denied since it is not yet
671 m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
672 m["primaryGroupID"] = MessageElement(str(group_rid_1),
673 FLAG_MOD_REPLACE, "primaryGroupID")
677 except LdbError, (num, _):
678 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
680 # Make group 1 secondary
682 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
683 m["member"] = "cn=ldaptestuser,cn=users," + self.base_dn
686 # Make group 1 primary
688 m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
689 m["primaryGroupID"] = MessageElement(str(group_rid_1),
690 FLAG_MOD_REPLACE, "primaryGroupID")
693 # Try to delete group 1 - should be denied
695 ldb.delete("cn=ldaptestgroup,cn=users," + self.base_dn)
697 except LdbError, (num, _):
698 self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
700 # Try to add group 1 also as secondary - should be denied
702 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
703 m["member"] = "cn=ldaptestuser,cn=users," + self.base_dn
707 except LdbError, (num, _):
708 self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
710 # Try to add invalid member to group 1 - should be denied
712 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
713 m["member"] = MessageElement(
714 "cn=ldaptestuser3,cn=users," + self.base_dn,
715 FLAG_MOD_ADD, "member")
719 except LdbError, (num, _):
720 self.assertEquals(num, ERR_NO_SUCH_OBJECT)
722 # Make group 2 secondary
724 m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
725 m["member"] = "cn=ldaptestuser,cn=users," + self.base_dn
730 m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
731 m["primaryGroupID"] = MessageElement(str(group_rid_2),
732 FLAG_MOD_REPLACE, "primaryGroupID")
735 # Old primary group should contain a "member" attribute for the user,
736 # the new shouldn't contain anymore one
737 res1 = ldb.search("cn=ldaptestgroup, cn=users," + self.base_dn,
738 scope=SCOPE_BASE, attrs=["member"])
739 self.assertTrue(len(res1) == 1)
740 self.assertTrue(len(res1[0]["member"]) == 1)
741 self.assertEquals(res1[0]["member"][0].lower(),
742 ("cn=ldaptestuser,cn=users," + self.base_dn).lower())
744 res1 = ldb.search("cn=ldaptestgroup2, cn=users," + self.base_dn,
745 scope=SCOPE_BASE, attrs=["member"])
746 self.assertTrue(len(res1) == 1)
747 self.assertFalse("member" in res1[0])
749 # Also this should be denied
752 "dn": "cn=ldaptestuser1,cn=users," + self.base_dn,
753 "objectclass": ["user", "person"],
754 "primaryGroupID": "0"})
756 except LdbError, (num, _):
757 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
759 self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
760 self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
761 self.delete_force(self.ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
763 def test_primary_group_token(self):
764 """Test the primary group token behaviour (hidden-generated-readonly attribute on groups)"""
765 print "Testing primary group token behaviour\n"
768 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
769 "objectclass": ["user", "person"]})
772 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
773 "objectclass": "group"})
775 res1 = ldb.search("cn=ldaptestuser, cn=users," + self.base_dn,
776 scope=SCOPE_BASE, attrs=["primaryGroupToken"])
777 self.assertTrue(len(res1) == 1)
778 self.assertFalse("primaryGroupToken" in res1[0])
780 res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
782 self.assertTrue(len(res1) == 1)
783 self.assertFalse("primaryGroupToken" in res1[0])
785 res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
786 scope=SCOPE_BASE, attrs=["primaryGroupToken", "objectSID"])
787 self.assertTrue(len(res1) == 1)
788 primary_group_token = int(res1[0]["primaryGroupToken"][0])
790 rid = dom_sid_to_rid(ldb.schema_format_value("objectSID", res1[0]["objectSID"][0]))
791 self.assertEquals(primary_group_token, rid)
793 # TODO Has to wait until we support read-only generated attributes correctly
795 # m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
796 # m["primaryGroupToken"] = "100"
800 # except LdbError, (num, msg):
802 self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
803 self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
805 def test_wkguid(self):
806 """Test Well known GUID behaviours (including DN+Binary)"""
807 print "Test Well known GUID behaviours (including DN+Binary)"""
809 res = self.ldb.search(base=("<WKGUID=ab1d30f3768811d1aded00c04fd8d5cd,%s>" % self.base_dn), scope=SCOPE_BASE, attrs=[])
810 self.assertEquals(len(res), 1)
812 res2 = self.ldb.search(scope=SCOPE_BASE, attrs=["wellKnownObjects"], expression=("wellKnownObjects=B:32:ab1d30f3768811d1aded00c04fd8d5cd:%s" % res[0].dn))
813 self.assertEquals(len(res2), 1)
815 # Prove that the matching rule is over the whole DN+Binary
816 res2 = self.ldb.search(scope=SCOPE_BASE, attrs=["wellKnownObjects"], expression=("wellKnownObjects=B:32:ab1d30f3768811d1aded00c04fd8d5cd"))
817 self.assertEquals(len(res2), 0)
818 # Prove that the matching rule is over the whole DN+Binary
819 res2 = self.ldb.search(scope=SCOPE_BASE, attrs=["wellKnownObjects"], expression=("wellKnownObjects=%s") % res[0].dn)
820 self.assertEquals(len(res2), 0)
825 print "Testing user add"
828 "dn": "cn=ldaptestuser,cn=uSers," + self.base_dn,
829 "objectclass": ["user", "person"],
830 "cN": "LDAPtestUSER",
835 "dn": "cn=ldaptestgroup,cn=uSers," + self.base_dn,
836 "objectclass": "group",
837 "member": "cn=ldaptestuser,cn=useRs," + self.base_dn})
840 "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
841 "objectclass": "computer",
842 "cN": "LDAPtestCOMPUTER"})
844 ldb.add({"dn": "cn=ldaptest2computer,cn=computers," + self.base_dn,
845 "objectClass": "computer",
846 "cn": "LDAPtest2COMPUTER",
847 "userAccountControl": str(UF_WORKSTATION_TRUST_ACCOUNT),
848 "displayname": "ldap testy"})
851 ldb.add({"dn": "cn=ldaptestcomputer3,cn=computers," + self.base_dn,
852 "objectClass": "computer",
853 "cn": "LDAPtest2COMPUTER"
856 except LdbError, (num, _):
857 self.assertEquals(num, ERR_INVALID_DN_SYNTAX)
860 ldb.add({"dn": "cn=ldaptestcomputer3,cn=computers," + self.base_dn,
861 "objectClass": "computer",
862 "cn": "ldaptestcomputer3",
863 "sAMAccountType": str(ATYPE_NORMAL_ACCOUNT)
866 except LdbError, (num, _):
867 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
869 ldb.add({"dn": "cn=ldaptestcomputer3,cn=computers," + self.base_dn,
870 "objectClass": "computer",
871 "cn": "LDAPtestCOMPUTER3"
874 print "Testing ldb.search for (&(cn=ldaptestcomputer3)(objectClass=user))";
875 res = ldb.search(self.base_dn, expression="(&(cn=ldaptestcomputer3)(objectClass=user))");
876 self.assertEquals(len(res), 1, "Found only %d for (&(cn=ldaptestcomputer3)(objectClass=user))" % len(res))
878 self.assertEquals(str(res[0].dn), ("CN=ldaptestcomputer3,CN=Computers," + self.base_dn));
879 self.assertEquals(res[0]["cn"][0], "ldaptestcomputer3");
880 self.assertEquals(res[0]["name"][0], "ldaptestcomputer3");
881 self.assertEquals(res[0]["objectClass"][0], "top");
882 self.assertEquals(res[0]["objectClass"][1], "person");
883 self.assertEquals(res[0]["objectClass"][2], "organizationalPerson");
884 self.assertEquals(res[0]["objectClass"][3], "user");
885 self.assertEquals(res[0]["objectClass"][4], "computer");
886 self.assertTrue("objectGUID" in res[0])
887 self.assertTrue("whenCreated" in res[0])
888 self.assertEquals(res[0]["objectCategory"][0], ("CN=Computer,CN=Schema,CN=Configuration," + self.base_dn));
889 self.assertEquals(int(res[0]["primaryGroupID"][0]), 513);
890 self.assertEquals(int(res[0]["sAMAccountType"][0]), ATYPE_NORMAL_ACCOUNT);
891 self.assertEquals(int(res[0]["userAccountControl"][0]), UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD | UF_ACCOUNTDISABLE);
893 self.delete_force(self.ldb, "cn=ldaptestcomputer3,cn=computers," + self.base_dn)
895 print "Testing attribute or value exists behaviour"
898 dn: cn=ldaptest2computer,cn=computers,""" + self.base_dn + """
900 replace: servicePrincipalName
901 servicePrincipalName: host/ldaptest2computer
902 servicePrincipalName: host/ldaptest2computer
903 servicePrincipalName: cifs/ldaptest2computer
906 except LdbError, (num, msg):
907 self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
910 dn: cn=ldaptest2computer,cn=computers,""" + self.base_dn + """
912 replace: servicePrincipalName
913 servicePrincipalName: host/ldaptest2computer
914 servicePrincipalName: cifs/ldaptest2computer
918 dn: cn=ldaptest2computer,cn=computers,""" + self.base_dn + """
920 add: servicePrincipalName
921 servicePrincipalName: host/ldaptest2computer
924 except LdbError, (num, msg):
925 self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
927 print "Testing ranged results"
929 dn: cn=ldaptest2computer,cn=computers,""" + self.base_dn + """
931 replace: servicePrincipalName
935 dn: cn=ldaptest2computer,cn=computers,""" + self.base_dn + """
937 add: servicePrincipalName
938 servicePrincipalName: host/ldaptest2computer0
939 servicePrincipalName: host/ldaptest2computer1
940 servicePrincipalName: host/ldaptest2computer2
941 servicePrincipalName: host/ldaptest2computer3
942 servicePrincipalName: host/ldaptest2computer4
943 servicePrincipalName: host/ldaptest2computer5
944 servicePrincipalName: host/ldaptest2computer6
945 servicePrincipalName: host/ldaptest2computer7
946 servicePrincipalName: host/ldaptest2computer8
947 servicePrincipalName: host/ldaptest2computer9
948 servicePrincipalName: host/ldaptest2computer10
949 servicePrincipalName: host/ldaptest2computer11
950 servicePrincipalName: host/ldaptest2computer12
951 servicePrincipalName: host/ldaptest2computer13
952 servicePrincipalName: host/ldaptest2computer14
953 servicePrincipalName: host/ldaptest2computer15
954 servicePrincipalName: host/ldaptest2computer16
955 servicePrincipalName: host/ldaptest2computer17
956 servicePrincipalName: host/ldaptest2computer18
957 servicePrincipalName: host/ldaptest2computer19
958 servicePrincipalName: host/ldaptest2computer20
959 servicePrincipalName: host/ldaptest2computer21
960 servicePrincipalName: host/ldaptest2computer22
961 servicePrincipalName: host/ldaptest2computer23
962 servicePrincipalName: host/ldaptest2computer24
963 servicePrincipalName: host/ldaptest2computer25
964 servicePrincipalName: host/ldaptest2computer26
965 servicePrincipalName: host/ldaptest2computer27
966 servicePrincipalName: host/ldaptest2computer28
967 servicePrincipalName: host/ldaptest2computer29
970 res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE,
971 attrs=["servicePrincipalName;range=0-*"])
972 self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
973 #print len(res[0]["servicePrincipalName;range=0-*"])
974 self.assertEquals(len(res[0]["servicePrincipalName;range=0-*"]), 30)
976 res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=0-19"])
977 self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
978 # print res[0]["servicePrincipalName;range=0-19"].length
979 self.assertEquals(len(res[0]["servicePrincipalName;range=0-19"]), 20)
982 res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=0-30"])
983 self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
984 self.assertEquals(len(res[0]["servicePrincipalName;range=0-*"]), 30)
986 res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=0-40"])
987 self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
988 self.assertEquals(len(res[0]["servicePrincipalName;range=0-*"]), 30)
990 res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=30-40"])
991 self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
992 self.assertEquals(len(res[0]["servicePrincipalName;range=30-*"]), 0)
995 res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=10-40"])
996 self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
997 self.assertEquals(len(res[0]["servicePrincipalName;range=10-*"]), 20)
998 # pos_11 = res[0]["servicePrincipalName;range=10-*"][18]
1000 res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=11-40"])
1001 self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
1002 self.assertEquals(len(res[0]["servicePrincipalName;range=11-*"]), 19)
1003 # print res[0]["servicePrincipalName;range=11-*"][18]
1005 # self.assertEquals((res[0]["servicePrincipalName;range=11-*"][18]), pos_11)
1007 res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=11-15"])
1008 self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
1009 self.assertEquals(len(res[0]["servicePrincipalName;range=11-15"]), 5)
1010 # self.assertEquals(res[0]["servicePrincipalName;range=11-15"][4], pos_11)
1012 res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName"])
1013 self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
1014 # print res[0]["servicePrincipalName"][18]
1016 self.assertEquals(len(res[0]["servicePrincipalName"]), 30)
1017 # self.assertEquals(res[0]["servicePrincipalName"][18], pos_11)
1019 self.delete_force(self.ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
1021 "dn": "cn=ldaptestuser2,cn=useRs," + self.base_dn,
1022 "objectClass": ["person", "user"],
1023 "cn": "LDAPtestUSER2",
1024 "givenname": "testy",
1025 "sn": "ldap user2"})
1027 print "Testing Ambigious Name Resolution"
1028 # Testing ldb.search for (&(anr=ldap testy)(objectClass=user))
1029 res = ldb.search(expression="(&(anr=ldap testy)(objectClass=user))")
1030 self.assertEquals(len(res), 3, "Found only %d of 3 for (&(anr=ldap testy)(objectClass=user))" % len(res))
1032 # Testing ldb.search for (&(anr=testy ldap)(objectClass=user))
1033 res = ldb.search(expression="(&(anr=testy ldap)(objectClass=user))")
1034 self.assertEquals(len(res), 2, "Found only %d of 2 for (&(anr=testy ldap)(objectClass=user))" % len(res))
1036 # Testing ldb.search for (&(anr=ldap)(objectClass=user))
1037 res = ldb.search(expression="(&(anr=ldap)(objectClass=user))")
1038 self.assertEquals(len(res), 4, "Found only %d of 4 for (&(anr=ldap)(objectClass=user))" % len(res))
1040 # Testing ldb.search for (&(anr==ldap)(objectClass=user))
1041 res = ldb.search(expression="(&(anr==ldap)(objectClass=user))")
1042 self.assertEquals(len(res), 1, "Could not find (&(anr==ldap)(objectClass=user)). Found only %d for (&(anr=ldap)(objectClass=user))" % len(res))
1044 self.assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + self.base_dn))
1045 self.assertEquals(res[0]["cn"][0], "ldaptestuser")
1046 self.assertEquals(str(res[0]["name"]), "ldaptestuser")
1048 # Testing ldb.search for (&(anr=testy)(objectClass=user))
1049 res = ldb.search(expression="(&(anr=testy)(objectClass=user))")
1050 self.assertEquals(len(res), 2, "Found only %d for (&(anr=testy)(objectClass=user))" % len(res))
1052 # Testing ldb.search for (&(anr=testy ldap)(objectClass=user))
1053 res = ldb.search(expression="(&(anr=testy ldap)(objectClass=user))")
1054 self.assertEquals(len(res), 2, "Found only %d for (&(anr=testy ldap)(objectClass=user))" % len(res))
1056 # Testing ldb.search for (&(anr==testy ldap)(objectClass=user))
1057 # this test disabled for the moment, as anr with == tests are not understood
1058 # res = ldb.search(expression="(&(anr==testy ldap)(objectClass=user))")
1059 # self.assertEquals(len(res), 1, "Found only %d for (&(anr==testy ldap)(objectClass=user))" % len(res))
1061 # self.assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + self.base_dn))
1062 # self.assertEquals(res[0]["cn"][0], "ldaptestuser")
1063 # self.assertEquals(res[0]["name"][0], "ldaptestuser")
1065 # Testing ldb.search for (&(anr==testy ldap)(objectClass=user))
1066 # res = ldb.search(expression="(&(anr==testy ldap)(objectClass=user))")
1067 # self.assertEquals(len(res), 1, "Could not find (&(anr==testy ldap)(objectClass=user))")
1069 # self.assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + self.base_dn))
1070 # self.assertEquals(res[0]["cn"][0], "ldaptestuser")
1071 # self.assertEquals(res[0]["name"][0], "ldaptestuser")
1073 # Testing ldb.search for (&(anr=testy ldap user)(objectClass=user))
1074 res = ldb.search(expression="(&(anr=testy ldap user)(objectClass=user))")
1075 self.assertEquals(len(res), 1, "Could not find (&(anr=testy ldap user)(objectClass=user))")
1077 self.assertEquals(str(res[0].dn), ("CN=ldaptestuser2,CN=Users," + self.base_dn))
1078 self.assertEquals(str(res[0]["cn"]), "ldaptestuser2")
1079 self.assertEquals(str(res[0]["name"]), "ldaptestuser2")
1081 # Testing ldb.search for (&(anr==testy ldap user2)(objectClass=user))
1082 # res = ldb.search(expression="(&(anr==testy ldap user2)(objectClass=user))")
1083 # self.assertEquals(len(res), 1, "Could not find (&(anr==testy ldap user2)(objectClass=user))")
1085 self.assertEquals(str(res[0].dn), ("CN=ldaptestuser2,CN=Users," + self.base_dn))
1086 self.assertEquals(str(res[0]["cn"]), "ldaptestuser2")
1087 self.assertEquals(str(res[0]["name"]), "ldaptestuser2")
1089 # Testing ldb.search for (&(anr==ldap user2)(objectClass=user))
1090 # res = ldb.search(expression="(&(anr==ldap user2)(objectClass=user))")
1091 # self.assertEquals(len(res), 1, "Could not find (&(anr==ldap user2)(objectClass=user))")
1093 self.assertEquals(str(res[0].dn), ("CN=ldaptestuser2,CN=Users," + self.base_dn))
1094 self.assertEquals(str(res[0]["cn"]), "ldaptestuser2")
1095 self.assertEquals(str(res[0]["name"]), "ldaptestuser2")
1097 # Testing ldb.search for (&(anr==not ldap user2)(objectClass=user))
1098 # res = ldb.search(expression="(&(anr==not ldap user2)(objectClass=user))")
1099 # self.assertEquals(len(res), 0, "Must not find (&(anr==not ldap user2)(objectClass=user))")
1101 # Testing ldb.search for (&(anr=not ldap user2)(objectClass=user))
1102 res = ldb.search(expression="(&(anr=not ldap user2)(objectClass=user))")
1103 self.assertEquals(len(res), 0, "Must not find (&(anr=not ldap user2)(objectClass=user))")
1105 # Testing ldb.search for (&(anr="testy ldap")(objectClass=user)) (ie, with quotes)
1106 # res = ldb.search(expression="(&(anr==\"testy ldap\")(objectClass=user))")
1107 # self.assertEquals(len(res), 0, "Found (&(anr==\"testy ldap\")(objectClass=user))")
1109 print "Testing Renames"
1111 attrs = ["objectGUID", "objectSid"]
1112 print "Testing ldb.search for (&(cn=ldaptestUSer2)(objectClass=user))"
1113 res_user = ldb.search(self.base_dn, expression="(&(cn=ldaptestUSer2)(objectClass=user))", scope=SCOPE_SUBTREE, attrs=attrs)
1114 self.assertEquals(len(res_user), 1, "Could not find (&(cn=ldaptestUSer2)(objectClass=user))")
1116 # Check rename works with extended/alternate DN forms
1117 ldb.rename("<SID=" + ldb.schema_format_value("objectSID", res_user[0]["objectSID"][0]) + ">" , "cn=ldaptestUSER3,cn=users," + self.base_dn)
1119 print "Testing ldb.search for (&(cn=ldaptestuser3)(objectClass=user))"
1120 res = ldb.search(expression="(&(cn=ldaptestuser3)(objectClass=user))")
1121 self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestuser3)(objectClass=user))")
1123 self.assertEquals(str(res[0].dn), ("CN=ldaptestUSER3,CN=Users," + self.base_dn))
1124 self.assertEquals(str(res[0]["cn"]), "ldaptestUSER3")
1125 self.assertEquals(str(res[0]["name"]), "ldaptestUSER3")
1127 #"Testing ldb.search for (&(&(cn=ldaptestuser3)(userAccountControl=*))(objectClass=user))"
1128 res = ldb.search(expression="(&(&(cn=ldaptestuser3)(userAccountControl=*))(objectClass=user))")
1129 self.assertEquals(len(res), 1, "(&(&(cn=ldaptestuser3)(userAccountControl=*))(objectClass=user))")
1131 self.assertEquals(str(res[0].dn), ("CN=ldaptestUSER3,CN=Users," + self.base_dn))
1132 self.assertEquals(str(res[0]["cn"]), "ldaptestUSER3")
1133 self.assertEquals(str(res[0]["name"]), "ldaptestUSER3")
1135 #"Testing ldb.search for (&(&(cn=ldaptestuser3)(userAccountControl=546))(objectClass=user))"
1136 res = ldb.search(expression="(&(&(cn=ldaptestuser3)(userAccountControl=546))(objectClass=user))")
1137 self.assertEquals(len(res), 1, "(&(&(cn=ldaptestuser3)(userAccountControl=546))(objectClass=user))")
1139 self.assertEquals(str(res[0].dn), ("CN=ldaptestUSER3,CN=Users," + self.base_dn))
1140 self.assertEquals(str(res[0]["cn"]), "ldaptestUSER3")
1141 self.assertEquals(str(res[0]["name"]), "ldaptestUSER3")
1143 #"Testing ldb.search for (&(&(cn=ldaptestuser3)(userAccountControl=547))(objectClass=user))"
1144 res = ldb.search(expression="(&(&(cn=ldaptestuser3)(userAccountControl=547))(objectClass=user))")
1145 self.assertEquals(len(res), 0, "(&(&(cn=ldaptestuser3)(userAccountControl=547))(objectClass=user))")
1147 # This is a Samba special, and does not exist in real AD
1148 # print "Testing ldb.search for (dn=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")"
1149 # res = ldb.search("(dn=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")")
1150 # if (res.error != 0 || len(res) != 1) {
1151 # print "Could not find (dn=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")"
1152 # self.assertEquals(len(res), 1)
1154 # self.assertEquals(res[0].dn, ("CN=ldaptestUSER3,CN=Users," + self.base_dn))
1155 # self.assertEquals(res[0].cn, "ldaptestUSER3")
1156 # self.assertEquals(res[0].name, "ldaptestUSER3")
1158 print "Testing ldb.search for (distinguishedName=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")"
1159 res = ldb.search(expression="(distinguishedName=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")")
1160 self.assertEquals(len(res), 1, "Could not find (dn=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")")
1161 self.assertEquals(str(res[0].dn), ("CN=ldaptestUSER3,CN=Users," + self.base_dn))
1162 self.assertEquals(str(res[0]["cn"]), "ldaptestUSER3")
1163 self.assertEquals(str(res[0]["name"]), "ldaptestUSER3")
1165 # ensure we cannot add it again
1167 ldb.add({"dn": "cn=ldaptestuser3,cn=userS," + self.base_dn,
1168 "objectClass": ["person", "user"],
1169 "cn": "LDAPtestUSER3"})
1171 except LdbError, (num, _):
1172 self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
1175 ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "cn=ldaptestuser2,cn=users," + self.base_dn)
1177 # ensure we cannot rename it twice
1179 ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn,
1180 "cn=ldaptestuser2,cn=users," + self.base_dn)
1182 except LdbError, (num, _):
1183 self.assertEquals(num, ERR_NO_SUCH_OBJECT)
1185 # ensure can now use that name
1186 ldb.add({"dn": "cn=ldaptestuser3,cn=users," + self.base_dn,
1187 "objectClass": ["person", "user"],
1188 "cn": "LDAPtestUSER3"})
1190 # ensure we now cannot rename
1192 ldb.rename("cn=ldaptestuser2,cn=users," + self.base_dn, "cn=ldaptestuser3,cn=users," + self.base_dn)
1194 except LdbError, (num, _):
1195 self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
1197 ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "cn=ldaptestuser3,cn=configuration," + self.base_dn)
1199 except LdbError, (num, _):
1200 self.assertTrue(num in (71, 64))
1202 ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "cn=ldaptestuser5,cn=users," + self.base_dn)
1204 ldb.delete("cn=ldaptestuser5,cn=users," + self.base_dn)
1206 self.delete_force(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
1208 ldb.rename("cn=ldaptestgroup,cn=users," + self.base_dn, "cn=ldaptestgroup2,cn=users," + self.base_dn)
1210 print "Testing subtree renames"
1212 ldb.add({"dn": "cn=ldaptestcontainer," + self.base_dn,
1213 "objectClass": "container"})
1215 ldb.add({"dn": "CN=ldaptestuser4,CN=ldaptestcontainer," + self.base_dn,
1216 "objectClass": ["person", "user"],
1217 "cn": "LDAPtestUSER4"})
1220 dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
1223 member: cn=ldaptestuser4,cn=ldaptestcontainer,""" + self.base_dn + """
1224 member: cn=ldaptestcomputer,cn=computers,""" + self.base_dn + """
1225 member: cn=ldaptestuser2,cn=users,""" + self.base_dn + """
1228 print "Testing ldb.rename of cn=ldaptestcontainer," + self.base_dn + " to cn=ldaptestcontainer2," + self.base_dn
1229 ldb.rename("CN=ldaptestcontainer," + self.base_dn, "CN=ldaptestcontainer2," + self.base_dn)
1231 print "Testing ldb.search for (&(cn=ldaptestuser4)(objectClass=user))"
1232 res = ldb.search(expression="(&(cn=ldaptestuser4)(objectClass=user))")
1233 self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestuser4)(objectClass=user))")
1235 print "Testing subtree ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in (just renamed from) cn=ldaptestcontainer," + self.base_dn
1237 res = ldb.search("cn=ldaptestcontainer," + self.base_dn,
1238 expression="(&(cn=ldaptestuser4)(objectClass=user))",
1239 scope=SCOPE_SUBTREE)
1241 except LdbError, (num, _):
1242 self.assertEquals(num, ERR_NO_SUCH_OBJECT)
1244 print "Testing one-level ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in (just renamed from) cn=ldaptestcontainer," + self.base_dn
1246 res = ldb.search("cn=ldaptestcontainer," + self.base_dn,
1247 expression="(&(cn=ldaptestuser4)(objectClass=user))", scope=SCOPE_ONELEVEL)
1249 except LdbError, (num, _):
1250 self.assertEquals(num, ERR_NO_SUCH_OBJECT)
1252 print "Testing ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in renamed container"
1253 res = ldb.search("cn=ldaptestcontainer2," + self.base_dn, expression="(&(cn=ldaptestuser4)(objectClass=user))", scope=SCOPE_SUBTREE)
1254 self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestuser4)(objectClass=user)) under cn=ldaptestcontainer2," + self.base_dn)
1256 self.assertEquals(str(res[0].dn), ("CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn))
1257 self.assertEquals(res[0]["memberOf"][0].upper(), ("CN=ldaptestgroup2,CN=Users," + self.base_dn).upper())
1261 print "Testing ldb.search for (&(member=CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn + ")(objectclass=group)) to check subtree renames and linked attributes"
1262 res = ldb.search(self.base_dn, expression="(&(member=CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn + ")(objectclass=group))", scope=SCOPE_SUBTREE)
1263 self.assertEquals(len(res), 1, "Could not find (&(member=CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn + ")(objectclass=group)), perhaps linked attributes are not consistant with subtree renames?")
1265 print "Testing ldb.rename (into itself) of cn=ldaptestcontainer2," + self.base_dn + " to cn=ldaptestcontainer,cn=ldaptestcontainer2," + self.base_dn
1267 ldb.rename("cn=ldaptestcontainer2," + self.base_dn, "cn=ldaptestcontainer,cn=ldaptestcontainer2," + self.base_dn)
1269 except LdbError, (num, _):
1270 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1272 print "Testing ldb.rename (into non-existent container) of cn=ldaptestcontainer2," + self.base_dn + " to cn=ldaptestcontainer,cn=ldaptestcontainer3," + self.base_dn
1274 ldb.rename("cn=ldaptestcontainer2," + self.base_dn, "cn=ldaptestcontainer,cn=ldaptestcontainer3," + self.base_dn)
1276 except LdbError, (num, _):
1277 self.assertTrue(num in (ERR_UNWILLING_TO_PERFORM, ERR_OTHER))
1279 print "Testing delete (should fail, not a leaf node) of renamed cn=ldaptestcontainer2," + self.base_dn
1281 ldb.delete("cn=ldaptestcontainer2," + self.base_dn)
1283 except LdbError, (num, _):
1284 self.assertEquals(num, ERR_NOT_ALLOWED_ON_NON_LEAF)
1286 print "Testing base ldb.search for CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn
1287 res = ldb.search(expression="(objectclass=*)", base=("CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn), scope=SCOPE_BASE)
1288 self.assertEquals(len(res), 1)
1289 res = ldb.search(expression="(cn=ldaptestuser40)", base=("CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn), scope=SCOPE_BASE)
1290 self.assertEquals(len(res), 0)
1292 print "Testing one-level ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in cn=ldaptestcontainer2," + self.base_dn
1293 res = ldb.search(expression="(&(cn=ldaptestuser4)(objectClass=user))", base=("cn=ldaptestcontainer2," + self.base_dn), scope=SCOPE_ONELEVEL)
1294 # FIXME: self.assertEquals(len(res), 0)
1296 print "Testing one-level ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in cn=ldaptestcontainer2," + self.base_dn
1297 res = ldb.search(expression="(&(cn=ldaptestuser4)(objectClass=user))", base=("cn=ldaptestcontainer2," + self.base_dn), scope=SCOPE_SUBTREE)
1298 # FIXME: self.assertEquals(len(res), 0)
1300 print "Testing delete of subtree renamed "+("CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn)
1301 ldb.delete(("CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn))
1302 print "Testing delete of renamed cn=ldaptestcontainer2," + self.base_dn
1303 ldb.delete("cn=ldaptestcontainer2," + self.base_dn)
1305 ldb.add({"dn": "cn=ldaptestutf8user èùéìòà,cn=users," + self.base_dn, "objectClass": "user"})
1307 ldb.add({"dn": "cn=ldaptestutf8user2 èùéìòà,cn=users," + self.base_dn, "objectClass": "user"})
1309 print "Testing ldb.search for (&(cn=ldaptestuser)(objectClass=user))"
1310 res = ldb.search(expression="(&(cn=ldaptestuser)(objectClass=user))")
1311 self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestuser)(objectClass=user))")
1313 self.assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + self.base_dn))
1314 self.assertEquals(str(res[0]["cn"]), "ldaptestuser")
1315 self.assertEquals(str(res[0]["name"]), "ldaptestuser")
1316 self.assertEquals(set(res[0]["objectClass"]), set(["top", "person", "organizationalPerson", "user"]))
1317 self.assertTrue("objectGUID" in res[0])
1318 self.assertTrue("whenCreated" in res[0])
1319 self.assertEquals(str(res[0]["objectCategory"]), ("CN=Person,CN=Schema,CN=Configuration," + self.base_dn))
1320 self.assertEquals(int(res[0]["sAMAccountType"][0]), ATYPE_NORMAL_ACCOUNT)
1321 self.assertEquals(int(res[0]["userAccountControl"][0]), UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD | UF_ACCOUNTDISABLE)
1322 self.assertEquals(res[0]["memberOf"][0].upper(), ("CN=ldaptestgroup2,CN=Users," + self.base_dn).upper())
1323 self.assertEquals(len(res[0]["memberOf"]), 1)
1325 print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=cn=person,cn=schema,cn=configuration," + self.base_dn + "))"
1326 res2 = ldb.search(expression="(&(cn=ldaptestuser)(objectCategory=cn=person,cn=schema,cn=configuration," + self.base_dn + "))")
1327 self.assertEquals(len(res2), 1, "Could not find (&(cn=ldaptestuser)(objectCategory=cn=person,cn=schema,cn=configuration," + self.base_dn + "))")
1329 self.assertEquals(res[0].dn, res2[0].dn)
1331 print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=PerSon))"
1332 res3 = ldb.search(expression="(&(cn=ldaptestuser)(objectCategory=PerSon))")
1333 self.assertEquals(len(res3), 1, "Could not find (&(cn=ldaptestuser)(objectCategory=PerSon)): matched %d" % len(res3))
1335 self.assertEquals(res[0].dn, res3[0].dn)
1337 if gc_ldb is not None:
1338 print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=PerSon)) in Global Catalog"
1339 res3gc = gc_ldb.search(expression="(&(cn=ldaptestuser)(objectCategory=PerSon))")
1340 self.assertEquals(len(res3gc), 1)
1342 self.assertEquals(res[0].dn, res3gc[0].dn)
1344 print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=PerSon)) in with 'phantom root' control"
1346 res3control = gc_ldb.search(self.base_dn, expression="(&(cn=ldaptestuser)(objectCategory=PerSon))", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["search_options:1:2"])
1347 self.assertEquals(len(res3control), 1, "Could not find (&(cn=ldaptestuser)(objectCategory=PerSon)) in Global Catalog")
1349 self.assertEquals(res[0].dn, res3control[0].dn)
1351 ldb.delete(res[0].dn)
1353 print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectClass=user))"
1354 res = ldb.search(expression="(&(cn=ldaptestcomputer)(objectClass=user))")
1355 self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestuser)(objectClass=user))")
1357 self.assertEquals(str(res[0].dn), ("CN=ldaptestcomputer,CN=Computers," + self.base_dn))
1358 self.assertEquals(str(res[0]["cn"]), "ldaptestcomputer")
1359 self.assertEquals(str(res[0]["name"]), "ldaptestcomputer")
1360 self.assertEquals(set(res[0]["objectClass"]), set(["top", "person", "organizationalPerson", "user", "computer"]))
1361 self.assertTrue("objectGUID" in res[0])
1362 self.assertTrue("whenCreated" in res[0])
1363 self.assertEquals(str(res[0]["objectCategory"]), ("CN=Computer,CN=Schema,CN=Configuration," + self.base_dn))
1364 self.assertEquals(int(res[0]["primaryGroupID"][0]), 513)
1365 self.assertEquals(int(res[0]["sAMAccountType"][0]), ATYPE_NORMAL_ACCOUNT)
1366 self.assertEquals(int(res[0]["userAccountControl"][0]), UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD | UF_ACCOUNTDISABLE)
1367 self.assertEquals(res[0]["memberOf"][0].upper(), ("CN=ldaptestgroup2,CN=Users," + self.base_dn).upper())
1368 self.assertEquals(len(res[0]["memberOf"]), 1)
1370 print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + "))"
1371 res2 = ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + "))")
1372 self.assertEquals(len(res2), 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + "))")
1374 self.assertEquals(res[0].dn, res2[0].dn)
1376 if gc_ldb is not None:
1377 print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + ")) in Global Catlog"
1378 res2gc = gc_ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + "))")
1379 self.assertEquals(len(res2gc), 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + ")) in Global Catlog")
1381 self.assertEquals(res[0].dn, res2gc[0].dn)
1383 print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=compuTER))"
1384 res3 = ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=compuTER))")
1385 self.assertEquals(len(res3), 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=compuTER))")
1387 self.assertEquals(res[0].dn, res3[0].dn)
1389 if gc_ldb is not None:
1390 print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=compuTER)) in Global Catalog"
1391 res3gc = gc_ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=compuTER))")
1392 self.assertEquals(len(res3gc), 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=compuTER)) in Global Catalog")
1394 self.assertEquals(res[0].dn, res3gc[0].dn)
1396 print "Testing ldb.search for (&(cn=ldaptestcomp*r)(objectCategory=compuTER))"
1397 res4 = ldb.search(expression="(&(cn=ldaptestcomp*r)(objectCategory=compuTER))")
1398 self.assertEquals(len(res4), 1, "Could not find (&(cn=ldaptestcomp*r)(objectCategory=compuTER))")
1400 self.assertEquals(res[0].dn, res4[0].dn)
1402 print "Testing ldb.search for (&(cn=ldaptestcomput*)(objectCategory=compuTER))"
1403 res5 = ldb.search(expression="(&(cn=ldaptestcomput*)(objectCategory=compuTER))")
1404 self.assertEquals(len(res5), 1, "Could not find (&(cn=ldaptestcomput*)(objectCategory=compuTER))")
1406 self.assertEquals(res[0].dn, res5[0].dn)
1408 print "Testing ldb.search for (&(cn=*daptestcomputer)(objectCategory=compuTER))"
1409 res6 = ldb.search(expression="(&(cn=*daptestcomputer)(objectCategory=compuTER))")
1410 self.assertEquals(len(res6), 1, "Could not find (&(cn=*daptestcomputer)(objectCategory=compuTER))")
1412 self.assertEquals(res[0].dn, res6[0].dn)
1414 ldb.delete("<GUID=" + ldb.schema_format_value("objectGUID", res[0]["objectGUID"][0]) + ">")
1416 print "Testing ldb.search for (&(cn=ldaptest2computer)(objectClass=user))"
1417 res = ldb.search(expression="(&(cn=ldaptest2computer)(objectClass=user))")
1418 self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptest2computer)(objectClass=user))")
1420 self.assertEquals(str(res[0].dn), "CN=ldaptest2computer,CN=Computers," + self.base_dn)
1421 self.assertEquals(str(res[0]["cn"]), "ldaptest2computer")
1422 self.assertEquals(str(res[0]["name"]), "ldaptest2computer")
1423 self.assertEquals(list(res[0]["objectClass"]), ["top", "person", "organizationalPerson", "user", "computer"])
1424 self.assertTrue("objectGUID" in res[0])
1425 self.assertTrue("whenCreated" in res[0])
1426 self.assertEquals(res[0]["objectCategory"][0], "CN=Computer,CN=Schema,CN=Configuration," + self.base_dn)
1427 self.assertEquals(int(res[0]["sAMAccountType"][0]), ATYPE_WORKSTATION_TRUST)
1428 self.assertEquals(int(res[0]["userAccountControl"][0]), UF_WORKSTATION_TRUST_ACCOUNT)
1430 ldb.delete("<SID=" + ldb.schema_format_value("objectSID", res[0]["objectSID"][0]) + ">")
1432 attrs = ["cn", "name", "objectClass", "objectGUID", "objectSID", "whenCreated", "nTSecurityDescriptor", "memberOf", "allowedAttributes", "allowedAttributesEffective"]
1433 print "Testing ldb.search for (&(cn=ldaptestUSer2)(objectClass=user))"
1434 res_user = ldb.search(self.base_dn, expression="(&(cn=ldaptestUSer2)(objectClass=user))", scope=SCOPE_SUBTREE, attrs=attrs)
1435 self.assertEquals(len(res_user), 1, "Could not find (&(cn=ldaptestUSer2)(objectClass=user))")
1437 self.assertEquals(str(res_user[0].dn), ("CN=ldaptestuser2,CN=Users," + self.base_dn))
1438 self.assertEquals(str(res_user[0]["cn"]), "ldaptestuser2")
1439 self.assertEquals(str(res_user[0]["name"]), "ldaptestuser2")
1440 self.assertEquals(list(res_user[0]["objectClass"]), ["top", "person", "organizationalPerson", "user"])
1441 self.assertTrue("objectSid" in res_user[0])
1442 self.assertTrue("objectGUID" in res_user[0])
1443 self.assertTrue("whenCreated" in res_user[0])
1444 self.assertTrue("nTSecurityDescriptor" in res_user[0])
1445 self.assertTrue("allowedAttributes" in res_user[0])
1446 self.assertTrue("allowedAttributesEffective" in res_user[0])
1447 self.assertEquals(res_user[0]["memberOf"][0].upper(), ("CN=ldaptestgroup2,CN=Users," + self.base_dn).upper())
1449 ldaptestuser2_sid = res_user[0]["objectSid"][0]
1450 ldaptestuser2_guid = res_user[0]["objectGUID"][0]
1452 attrs = ["cn", "name", "objectClass", "objectGUID", "objectSID", "whenCreated", "nTSecurityDescriptor", "member", "allowedAttributes", "allowedAttributesEffective"]
1453 print "Testing ldb.search for (&(cn=ldaptestgroup2)(objectClass=group))"
1454 res = ldb.search(self.base_dn, expression="(&(cn=ldaptestgroup2)(objectClass=group))", scope=SCOPE_SUBTREE, attrs=attrs)
1455 self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group))")
1457 self.assertEquals(str(res[0].dn), ("CN=ldaptestgroup2,CN=Users," + self.base_dn))
1458 self.assertEquals(str(res[0]["cn"]), "ldaptestgroup2")
1459 self.assertEquals(str(res[0]["name"]), "ldaptestgroup2")
1460 self.assertEquals(list(res[0]["objectClass"]), ["top", "group"])
1461 self.assertTrue("objectGUID" in res[0])
1462 self.assertTrue("objectSid" in res[0])
1463 self.assertTrue("whenCreated" in res[0])
1464 self.assertTrue("nTSecurityDescriptor" in res[0])
1465 self.assertTrue("allowedAttributes" in res[0])
1466 self.assertTrue("allowedAttributesEffective" in res[0])
1468 for m in res[0]["member"]:
1469 memberUP.append(m.upper())
1470 self.assertTrue(("CN=ldaptestuser2,CN=Users," + self.base_dn).upper() in memberUP)
1472 res = ldb.search(self.base_dn, expression="(&(cn=ldaptestgroup2)(objectClass=group))", scope=SCOPE_SUBTREE, attrs=attrs, controls=["extended_dn:1:1"])
1473 self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group))")
1475 print res[0]["member"]
1477 for m in res[0]["member"]:
1478 memberUP.append(m.upper())
1479 print ("<GUID=" + ldb.schema_format_value("objectGUID", ldaptestuser2_guid) + ">;<SID=" + ldb.schema_format_value("objectSid", ldaptestuser2_sid) + ">;CN=ldaptestuser2,CN=Users," + self.base_dn).upper()
1481 self.assertTrue(("<GUID=" + ldb.schema_format_value("objectGUID", ldaptestuser2_guid) + ">;<SID=" + ldb.schema_format_value("objectSid", ldaptestuser2_sid) + ">;CN=ldaptestuser2,CN=Users," + self.base_dn).upper() in memberUP)
1483 print "Testing Linked attribute behaviours"
1485 dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
1488 member: CN=ldaptestuser2,CN=Users,""" + self.base_dn + """
1489 member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + self.base_dn + """
1493 dn: <GUID=""" + ldb.schema_format_value("objectGUID", res[0]["objectGUID"][0]) + """>
1496 member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + self.base_dn + """
1500 dn: <SID=""" + ldb.schema_format_value("objectSid", res[0]["objectSid"][0]) + """>
1506 dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
1509 member: <GUID=""" + ldb.schema_format_value("objectGUID", res[0]["objectGUID"][0]) + """>
1510 member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + self.base_dn + """
1514 dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
1520 dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
1523 member: <SID=""" + ldb.schema_format_value("objectSid", res_user[0]["objectSid"][0]) + """>
1524 member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + self.base_dn + """
1528 dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
1531 member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + self.base_dn + """
1534 res = ldb.search(self.base_dn, expression="(&(cn=ldaptestgroup2)(objectClass=group))", scope=SCOPE_SUBTREE, attrs=attrs)
1535 self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group))")
1537 self.assertEquals(str(res[0].dn), ("CN=ldaptestgroup2,CN=Users," + self.base_dn))
1538 self.assertEquals(res[0]["member"][0], ("CN=ldaptestuser2,CN=Users," + self.base_dn))
1539 self.assertEquals(len(res[0]["member"]), 1)
1541 ldb.delete(("CN=ldaptestuser2,CN=Users," + self.base_dn))
1545 attrs = ["cn", "name", "objectClass", "objectGUID", "whenCreated", "nTSecurityDescriptor", "member"]
1546 print "Testing ldb.search for (&(cn=ldaptestgroup2)(objectClass=group)) to check linked delete"
1547 res = ldb.search(self.base_dn, expression="(&(cn=ldaptestgroup2)(objectClass=group))", scope=SCOPE_SUBTREE, attrs=attrs)
1548 self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group)) to check linked delete")
1550 self.assertEquals(str(res[0].dn), ("CN=ldaptestgroup2,CN=Users," + self.base_dn))
1551 self.assertTrue("member" not in res[0])
1553 print "Testing ldb.search for (&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))"
1554 # TODO UTF8 users don't seem to work fully anymore
1555 # res = ldb.search(expression="(&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))")
1556 res = ldb.search(expression="(&(cn=ldaptestutf8user èùéìòà)(objectclass=user))")
1557 self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))")
1559 self.assertEquals(str(res[0].dn), ("CN=ldaptestutf8user èùéìòà,CN=Users," + self.base_dn))
1560 self.assertEquals(str(res[0]["cn"]), "ldaptestutf8user èùéìòà")
1561 self.assertEquals(str(res[0]["name"]), "ldaptestutf8user èùéìòà")
1562 self.assertEquals(list(res[0]["objectClass"]), ["top", "person", "organizationalPerson", "user"])
1563 self.assertTrue("objectGUID" in res[0])
1564 self.assertTrue("whenCreated" in res[0])
1566 ldb.delete(res[0].dn)
1568 print "Testing ldb.search for (&(cn=ldaptestutf8user2*)(objectClass=user))"
1569 res = ldb.search(expression="(&(cn=ldaptestutf8user2*)(objectClass=user))")
1570 self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestutf8user2*)(objectClass=user))")
1572 ldb.delete(res[0].dn)
1574 ldb.delete(("CN=ldaptestgroup2,CN=Users," + self.base_dn))
1576 print "Testing ldb.search for (&(cn=ldaptestutf8user2 ÈÙÉÌÒÀ)(objectClass=user))"
1577 # TODO UTF8 users don't seem to work fully anymore
1578 # res = ldb.search(expression="(&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))")
1579 # self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))")
1581 print "Testing that we can't get at the configuration DN from the main search base"
1582 res = ldb.search(self.base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
1583 self.assertEquals(len(res), 0)
1585 print "Testing that we can get at the configuration DN from the main search base on the LDAP port with the 'phantom root' search_options control"
1586 res = ldb.search(self.base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["search_options:1:2"])
1587 self.assertTrue(len(res) > 0)
1589 if gc_ldb is not None:
1590 print "Testing that we can get at the configuration DN from the main search base on the GC port with the search_options control == 0"
1592 res = gc_ldb.search(self.base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["search_options:1:0"])
1593 self.assertTrue(len(res) > 0)
1595 print "Testing that we do find configuration elements in the global catlog"
1596 res = gc_ldb.search(self.base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
1597 self.assertTrue(len(res) > 0)
1599 print "Testing that we do find configuration elements and user elements at the same time"
1600 res = gc_ldb.search(self.base_dn, expression="(|(objectClass=crossRef)(objectClass=person))", scope=SCOPE_SUBTREE, attrs=["cn"])
1601 self.assertTrue(len(res) > 0)
1603 print "Testing that we do find configuration elements in the global catlog, with the configuration basedn"
1604 res = gc_ldb.search(self.configuration_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
1605 self.assertTrue(len(res) > 0)
1607 print "Testing that we can get at the configuration DN on the main LDAP port"
1608 res = ldb.search(self.configuration_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
1609 self.assertTrue(len(res) > 0)
1611 print "Testing objectCategory canonacolisation"
1612 res = ldb.search(self.configuration_dn, expression="objectCategory=ntDsDSA", scope=SCOPE_SUBTREE, attrs=["cn"])
1613 self.assertTrue(len(res) > 0, "Didn't find any records with objectCategory=ntDsDSA")
1614 self.assertTrue(len(res) != 0)
1616 res = ldb.search(self.configuration_dn, expression="objectCategory=CN=ntDs-DSA," + self.schema_dn, scope=SCOPE_SUBTREE, attrs=["cn"])
1617 self.assertTrue(len(res) > 0, "Didn't find any records with objectCategory=CN=ntDs-DSA," + self.schema_dn)
1618 self.assertTrue(len(res) != 0)
1620 print "Testing objectClass attribute order on "+ self.base_dn
1621 res = ldb.search(expression="objectClass=domain", base=self.base_dn,
1622 scope=SCOPE_BASE, attrs=["objectClass"])
1623 self.assertEquals(len(res), 1)
1625 self.assertEquals(list(res[0]["objectClass"]), ["top", "domain", "domainDNS"])
1629 print "Testing ldb.search for objectCategory=person"
1630 res = ldb.search(self.base_dn, expression="objectCategory=person", scope=SCOPE_SUBTREE, attrs=["cn"])
1631 self.assertTrue(len(res) > 0)
1633 print "Testing ldb.search for objectCategory=person with domain scope control"
1634 res = ldb.search(self.base_dn, expression="objectCategory=person", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["domain_scope:1"])
1635 self.assertTrue(len(res) > 0)
1637 print "Testing ldb.search for objectCategory=user"
1638 res = ldb.search(self.base_dn, expression="objectCategory=user", scope=SCOPE_SUBTREE, attrs=["cn"])
1639 self.assertTrue(len(res) > 0)
1641 print "Testing ldb.search for objectCategory=user with domain scope control"
1642 res = ldb.search(self.base_dn, expression="objectCategory=user", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["domain_scope:1"])
1643 self.assertTrue(len(res) > 0)
1645 print "Testing ldb.search for objectCategory=group"
1646 res = ldb.search(self.base_dn, expression="objectCategory=group", scope=SCOPE_SUBTREE, attrs=["cn"])
1647 self.assertTrue(len(res) > 0)
1649 print "Testing ldb.search for objectCategory=group with domain scope control"
1650 res = ldb.search(self.base_dn, expression="objectCategory=group", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["domain_scope:1"])
1651 self.assertTrue(len(res) > 0)
1653 self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1654 self.delete_force(self.ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
1655 self.delete_force(self.ldb, "cn=ldaptestuser3,cn=users," + self.base_dn)
1656 self.delete_force(self.ldb, "cn=ldaptestuser4,cn=ldaptestcontainer," + self.base_dn)
1657 self.delete_force(self.ldb, "cn=ldaptestuser4,cn=ldaptestcontainer2," + self.base_dn)
1658 self.delete_force(self.ldb, "cn=ldaptestuser5,cn=users," + self.base_dn)
1659 self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1660 self.delete_force(self.ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
1661 self.delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1662 self.delete_force(self.ldb, "cn=ldaptest2computer,cn=computers," + self.base_dn)
1663 self.delete_force(self.ldb, "cn=ldaptestcomputer3,cn=computers," + self.base_dn)
1664 self.delete_force(self.ldb, "cn=ldaptestutf8user èùéìòà,cn=users," + self.base_dn)
1665 self.delete_force(self.ldb, "cn=ldaptestutf8user2 èùéìòà,cn=users," + self.base_dn)
1666 self.delete_force(self.ldb, "cn=ldaptestcontainer," + self.base_dn)
1667 self.delete_force(self.ldb, "cn=ldaptestcontainer2," + self.base_dn)
1669 def test_security_descriptor_add(self):
1670 """ Testing ldb.add_ldif() for nTSecurityDescriptor """
1671 user_name = "testdescriptoruser1"
1672 user_dn = "CN=%s,CN=Users,%s" % (user_name, self.base_dn)
1674 # Test add_ldif() with SDDL security descriptor input
1676 self.delete_force(self.ldb, user_dn)
1678 sddl = "O:DUG:DUD:PAI(A;;RPWP;;;AU)S:PAI"
1679 self.ldb.add_ldif("""
1680 dn: """ + user_dn + """
1682 sAMAccountName: """ + user_name + """
1683 nTSecurityDescriptor: """ + sddl)
1684 res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
1685 desc = res[0]["nTSecurityDescriptor"][0]
1686 desc = ndr_unpack( security.descriptor, desc )
1687 desc_sddl = desc.as_sddl( self.domain_sid )
1688 self.assertEqual(desc_sddl, sddl)
1690 self.delete_force(self.ldb, user_dn)
1692 # Test add_ldif() with BASE64 security descriptor
1695 sddl = "O:DUG:DUD:PAI(A;;RPWP;;;AU)S:PAI"
1696 desc = security.descriptor.from_sddl(sddl, self.domain_sid)
1697 desc_binary = ndr_pack(desc)
1698 desc_base64 = base64.b64encode(desc_binary)
1699 self.ldb.add_ldif("""
1700 dn: """ + user_dn + """
1702 sAMAccountName: """ + user_name + """
1703 nTSecurityDescriptor:: """ + desc_base64)
1704 res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
1705 desc = res[0]["nTSecurityDescriptor"][0]
1706 desc = ndr_unpack(security.descriptor, desc)
1707 desc_sddl = desc.as_sddl(self.domain_sid)
1708 self.assertEqual(desc_sddl, sddl)
1710 self.delete_force(self.ldb, user_dn)
1712 def test_security_descriptor_add_neg(self):
1713 """Test add_ldif() with BASE64 security descriptor input using WRONG domain SID
1716 user_name = "testdescriptoruser1"
1717 user_dn = "CN=%s,CN=Users,%s" % (user_name, self.base_dn)
1718 self.delete_force(self.ldb, user_dn)
1720 sddl = "O:DUG:DUD:PAI(A;;RPWP;;;AU)S:PAI"
1721 desc = security.descriptor.from_sddl(sddl, security.dom_sid('S-1-5-21'))
1722 desc_base64 = base64.b64encode( ndr_pack(desc) )
1723 self.ldb.add_ldif("""
1724 dn: """ + user_dn + """
1726 sAMAccountName: """ + user_name + """
1727 nTSecurityDescriptor:: """ + desc_base64)
1728 res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
1730 self.assertRaises(KeyError, lambda: res[0]["nTSecurityDescriptor"])
1732 self.delete_force(self.ldb, user_dn)
1734 def test_security_descriptor_modify(self):
1735 """ Testing ldb.modify_ldif() for nTSecurityDescriptor """
1736 user_name = "testdescriptoruser2"
1737 user_dn = "CN=%s,CN=Users,%s" % (user_name, self.base_dn)
1739 # Delete user object and test modify_ldif() with SDDL security descriptor input
1740 # Add ACE to the original descriptor test
1743 self.delete_force(self.ldb, user_dn)
1744 self.ldb.add_ldif("""
1745 dn: """ + user_dn + """
1747 sAMAccountName: """ + user_name)
1749 res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
1750 desc = res[0]["nTSecurityDescriptor"][0]
1751 desc = ndr_unpack(security.descriptor, desc)
1752 desc_sddl = desc.as_sddl(self.domain_sid)
1753 sddl = desc_sddl[:desc_sddl.find("(")] + "(A;;RPWP;;;AU)" + desc_sddl[desc_sddl.find("("):]
1755 dn: """ + user_dn + """
1757 replace: nTSecurityDescriptor
1758 nTSecurityDescriptor: """ + sddl
1759 self.ldb.modify_ldif(mod)
1760 # Read modified descriptor
1761 res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
1762 desc = res[0]["nTSecurityDescriptor"][0]
1763 desc = ndr_unpack(security.descriptor, desc)
1764 desc_sddl = desc.as_sddl(self.domain_sid)
1765 self.assertEqual(desc_sddl, sddl)
1767 self.delete_force(self.ldb, user_dn)
1769 # Test modify_ldif() with SDDL security descriptor input
1770 # New desctiptor test
1773 self.ldb.add_ldif("""
1774 dn: """ + user_dn + """
1776 sAMAccountName: """ + user_name)
1778 sddl = "O:DUG:DUD:PAI(A;;RPWP;;;AU)S:PAI"
1780 dn: """ + user_dn + """
1782 replace: nTSecurityDescriptor
1783 nTSecurityDescriptor: """ + sddl
1784 self.ldb.modify_ldif(mod)
1785 # Read modified descriptor
1786 res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
1787 desc = res[0]["nTSecurityDescriptor"][0]
1788 desc = ndr_unpack(security.descriptor, desc)
1789 desc_sddl = desc.as_sddl(self.domain_sid)
1790 self.assertEqual(desc_sddl, sddl)
1792 self.delete_force(self.ldb, user_dn)
1794 # Test modify_ldif() with BASE64 security descriptor input
1795 # Add ACE to the original descriptor test
1798 self.ldb.add_ldif("""
1799 dn: """ + user_dn + """
1801 sAMAccountName: """ + user_name)
1803 res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
1804 desc = res[0]["nTSecurityDescriptor"][0]
1805 desc = ndr_unpack(security.descriptor, desc)
1806 desc_sddl = desc.as_sddl(self.domain_sid)
1807 sddl = desc_sddl[:desc_sddl.find("(")] + "(A;;RPWP;;;AU)" + desc_sddl[desc_sddl.find("("):]
1808 desc = security.descriptor.from_sddl(sddl, self.domain_sid)
1809 desc_base64 = base64.b64encode(ndr_pack(desc))
1811 dn: """ + user_dn + """
1813 replace: nTSecurityDescriptor
1814 nTSecurityDescriptor:: """ + desc_base64
1815 self.ldb.modify_ldif(mod)
1816 # Read modified descriptor
1817 res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
1818 desc = res[0]["nTSecurityDescriptor"][0]
1819 desc = ndr_unpack(security.descriptor, desc)
1820 desc_sddl = desc.as_sddl(self.domain_sid)
1821 self.assertEqual(desc_sddl, sddl)
1823 self.delete_force(self.ldb, user_dn)
1825 # Test modify_ldif() with BASE64 security descriptor input
1826 # New descriptor test
1829 self.delete_force(self.ldb, user_dn)
1830 self.ldb.add_ldif("""
1831 dn: """ + user_dn + """
1833 sAMAccountName: """ + user_name)
1835 sddl = "O:DUG:DUD:PAI(A;;RPWP;;;AU)S:PAI"
1836 desc = security.descriptor.from_sddl(sddl, self.domain_sid)
1837 desc_base64 = base64.b64encode(ndr_pack(desc))
1839 dn: """ + user_dn + """
1841 replace: nTSecurityDescriptor
1842 nTSecurityDescriptor:: """ + desc_base64
1843 self.ldb.modify_ldif(mod)
1844 # Read modified descriptor
1845 res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
1846 desc = res[0]["nTSecurityDescriptor"][0]
1847 desc = ndr_unpack(security.descriptor, desc)
1848 desc_sddl = desc.as_sddl(self.domain_sid)
1849 self.assertEqual(desc_sddl, sddl)
1851 self.delete_force(self.ldb, user_dn)
1853 class BaseDnTests(unittest.TestCase):
1857 def test_rootdse_attrs(self):
1858 """Testing for all rootDSE attributes"""
1859 res = self.ldb.search(scope=SCOPE_BASE, attrs=[])
1860 self.assertEquals(len(res), 1)
1862 def test_highestcommittedusn(self):
1863 """Testing for highestCommittedUSN"""
1864 res = self.ldb.search("", scope=SCOPE_BASE, attrs=["highestCommittedUSN"])
1865 self.assertEquals(len(res), 1)
1866 self.assertTrue(int(res[0]["highestCommittedUSN"][0]) != 0)
1868 def test_netlogon(self):
1869 """Testing for netlogon via LDAP"""
1870 res = self.ldb.search("", scope=SCOPE_BASE, attrs=["netlogon"])
1871 self.assertEquals(len(res), 0)
1873 def test_netlogon_highestcommitted_usn(self):
1874 """Testing for netlogon and highestCommittedUSN via LDAP"""
1875 res = self.ldb.search("", scope=SCOPE_BASE,
1876 attrs=["netlogon", "highestCommittedUSN"])
1877 self.assertEquals(len(res), 0)
1879 class SchemaTests(unittest.TestCase):
1880 def delete_force(self, ldb, dn):
1883 except LdbError, (num, _):
1884 self.assertEquals(num, ERR_NO_SUCH_OBJECT)
1886 def find_schemadn(self, ldb):
1887 res = ldb.search(base="", expression="", scope=SCOPE_BASE, attrs=["schemaNamingContext"])
1888 self.assertEquals(len(res), 1)
1889 return res[0]["schemaNamingContext"][0]
1891 def find_basedn(self, ldb):
1892 res = ldb.search(base="", expression="", scope=SCOPE_BASE,
1893 attrs=["defaultNamingContext"])
1894 self.assertEquals(len(res), 1)
1895 return res[0]["defaultNamingContext"][0]
1899 self.schema_dn = self.find_schemadn(ldb)
1900 self.base_dn = self.find_basedn(ldb)
1902 def test_generated_schema(self):
1903 """Testing we can read the generated schema via LDAP"""
1904 res = self.ldb.search("cn=aggregate,"+self.schema_dn, scope=SCOPE_BASE,
1905 attrs=["objectClasses", "attributeTypes", "dITContentRules"])
1906 self.assertEquals(len(res), 1)
1907 self.assertTrue("dITContentRules" in res[0])
1908 self.assertTrue("objectClasses" in res[0])
1909 self.assertTrue("attributeTypes" in res[0])
1911 def test_generated_schema_is_operational(self):
1912 """Testing we don't get the generated schema via LDAP by default"""
1913 res = self.ldb.search("cn=aggregate,"+self.schema_dn, scope=SCOPE_BASE,
1915 self.assertEquals(len(res), 1)
1916 self.assertFalse("dITContentRules" in res[0])
1917 self.assertFalse("objectClasses" in res[0])
1918 self.assertFalse("attributeTypes" in res[0])
1921 def test_schemaUpdateNow(self):
1922 """Testing schemaUpdateNow"""
1923 attr_name = "test-Attr" + time.strftime("%s", time.gmtime())
1924 attr_ldap_display_name = attr_name.replace("-", "")
1927 dn: CN=%s,%s""" % (attr_name, self.schema_dn) + """
1929 objectClass: attributeSchema
1930 adminDescription: """ + attr_name + """
1931 adminDisplayName: """ + attr_name + """
1932 cn: """ + attr_name + """
1933 attributeId: 1.2.840.""" + str(random.randint(1,100000)) + """.1.5.9940
1934 attributeSyntax: 2.5.5.12
1937 isSingleValued: TRUE
1940 self.ldb.add_ldif(ldif)
1942 class_name = "test-Class" + time.strftime("%s", time.gmtime())
1943 class_ldap_display_name = class_name.replace("-", "")
1946 dn: CN=%s,%s""" % (class_name, self.schema_dn) + """
1948 objectClass: classSchema
1949 adminDescription: """ + class_name + """
1950 adminDisplayName: """ + class_name + """
1951 cn: """ + class_name + """
1952 governsId: 1.2.840.""" + str(random.randint(1,100000)) + """.1.5.9939
1954 objectClassCategory: 1
1955 subClassOf: organizationalPerson
1958 systemMustContain: cn, """ + attr_ldap_display_name + """
1961 self.ldb.add_ldif(ldif)
1966 add: schemaUpdateNow
1969 self.ldb.modify_ldif(ldif)
1971 object_name = "obj" + time.strftime("%s", time.gmtime())
1974 dn: CN=%s,CN=Users,%s"""% (object_name, self.base_dn) + """
1975 objectClass: organizationalPerson
1977 objectClass: """ + class_ldap_display_name + """
1979 cn: """ + object_name + """
1981 objectCategory: CN=%s,%s"""% (class_name, self.schema_dn) + """
1982 distinguishedName: CN=%s,CN=Users,%s"""% (object_name, self.base_dn) + """
1983 name: """ + object_name + """
1984 """ + attr_ldap_display_name + """: test
1986 self.ldb.add_ldif(ldif)
1988 # Search for created attribute
1990 res = self.ldb.search("cn=%s,%s" % (attr_name, self.schema_dn), scope=SCOPE_BASE, attrs=["*"])
1991 self.assertEquals(len(res), 1)
1992 self.assertEquals(res[0]["lDAPDisplayName"][0], attr_ldap_display_name)
1993 self.assertTrue("schemaIDGUID" in res[0])
1995 # Search for created objectclass
1997 res = self.ldb.search("cn=%s,%s" % (class_name, self.schema_dn), scope=SCOPE_BASE, attrs=["*"])
1998 self.assertEquals(len(res), 1)
1999 self.assertEquals(res[0]["lDAPDisplayName"][0], class_ldap_display_name)
2000 self.assertEquals(res[0]["defaultObjectCategory"][0], res[0]["distinguishedName"][0])
2001 self.assertTrue("schemaIDGUID" in res[0])
2003 # Search for created object
2005 res = self.ldb.search("cn=%s,cn=Users,%s" % (object_name, self.base_dn), scope=SCOPE_BASE, attrs=["*"])
2006 self.assertEquals(len(res), 1)
2008 self.delete_force(self.ldb, "cn=%s,cn=Users,%s" % (object_name, self.base_dn))
2010 if not "://" in host:
2011 if os.path.isfile(host):
2012 host = "tdb://%s" % host
2014 host = "ldap://%s" % host
2016 ldb = Ldb(host, credentials=creds, session_info=system_session(), lp=lp)
2017 gc_ldb = Ldb("%s:3268" % host, credentials=creds,
2018 session_info=system_session(), lp=lp)
2020 runner = SubunitTestRunner()
2022 if not runner.run(unittest.makeSuite(BaseDnTests)).wasSuccessful():
2024 if not runner.run(unittest.makeSuite(BasicTests)).wasSuccessful():
2026 if not runner.run(unittest.makeSuite(SchemaTests)).wasSuccessful():