source4/dsdb/tests/python/ldap.py

   1 #!/usr/bin/env python
   2 # -*- coding: utf-8 -*-
   3 # This is a port of the original in testprogs/ejs/ldap.js
   4
   5 import optparse
   6 import sys
   7 import time
   8 import base64
   9 import os
  10
  11 sys.path.append("bin/python")
  12 import samba
  13 samba.ensure_external_module("subunit", "subunit/python")
  14 samba.ensure_external_module("testtools", "testtools")
  15
  16 import samba.getopt as options
  17
  18 from samba.auth import system_session
  19 from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError
  20 from ldb import ERR_NO_SUCH_OBJECT, ERR_ATTRIBUTE_OR_VALUE_EXISTS
  21 from ldb import ERR_ENTRY_ALREADY_EXISTS, ERR_UNWILLING_TO_PERFORM
  22 from ldb import ERR_NOT_ALLOWED_ON_NON_LEAF, ERR_OTHER, ERR_INVALID_DN_SYNTAX
  23 from ldb import ERR_NO_SUCH_ATTRIBUTE
  24 from ldb import ERR_OBJECT_CLASS_VIOLATION, ERR_NOT_ALLOWED_ON_RDN
  25 from ldb import ERR_NAMING_VIOLATION, ERR_CONSTRAINT_VIOLATION
  26 from ldb import ERR_UNDEFINED_ATTRIBUTE_TYPE
  27 from ldb import Message, MessageElement, Dn
  28 from ldb import FLAG_MOD_ADD, FLAG_MOD_REPLACE, FLAG_MOD_DELETE
  29 from samba import Ldb
  30 from samba.dsdb import (UF_NORMAL_ACCOUNT, UF_INTERDOMAIN_TRUST_ACCOUNT,
  31     UF_WORKSTATION_TRUST_ACCOUNT, UF_SERVER_TRUST_ACCOUNT,
  32     UF_PARTIAL_SECRETS_ACCOUNT,
  33     UF_PASSWD_NOTREQD, UF_ACCOUNTDISABLE, ATYPE_NORMAL_ACCOUNT,
  34     ATYPE_WORKSTATION_TRUST, SYSTEM_FLAG_DOMAIN_DISALLOW_MOVE,
  35     SYSTEM_FLAG_CONFIG_ALLOW_RENAME, SYSTEM_FLAG_CONFIG_ALLOW_MOVE,
  36     SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE)
  37 from samba.dcerpc.security import (DOMAIN_RID_USERS, DOMAIN_RID_DOMAIN_MEMBERS,
  38     DOMAIN_RID_DCS, DOMAIN_RID_READONLY_DCS)
  39
  40 from subunit.run import SubunitTestRunner
  41 import unittest
  42
  43 from samba.ndr import ndr_pack, ndr_unpack
  44 from samba.dcerpc import security
  45
  46 parser = optparse.OptionParser("ldap.py [options] <host>")
  47 sambaopts = options.SambaOptions(parser)
  48 parser.add_option_group(sambaopts)
  49 parser.add_option_group(options.VersionOptions(parser))
  50 # use command line creds if available
  51 credopts = options.CredentialsOptions(parser)
  52 parser.add_option_group(credopts)
  53 opts, args = parser.parse_args()
  54
  55 if len(args) < 1:
  56     parser.print_usage()
  57     sys.exit(1)
  58
  59 host = args[0]
  60
  61 lp = sambaopts.get_loadparm()
  62 creds = credopts.get_credentials(lp)
  63
  64 class BasicTests(unittest.TestCase):
  65
  66     def delete_force(self, ldb, dn):
  67         try:
  68             ldb.delete(dn)
  69         except LdbError, (num, _):
  70             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
  71
  72     def find_basedn(self, ldb):
  73         res = ldb.search(base="", expression="", scope=SCOPE_BASE,
  74                          attrs=["defaultNamingContext"])
  75         self.assertEquals(len(res), 1)
  76         return res[0]["defaultNamingContext"][0]
  77
  78     def find_configurationdn(self, ldb):
  79         res = ldb.search(base="", expression="", scope=SCOPE_BASE, attrs=["configurationNamingContext"])
  80         self.assertEquals(len(res), 1)
  81         return res[0]["configurationNamingContext"][0]
  82
  83     def find_schemadn(self, ldb):
  84         res = ldb.search(base="", expression="", scope=SCOPE_BASE, attrs=["schemaNamingContext"])
  85         self.assertEquals(len(res), 1)
  86         return res[0]["schemaNamingContext"][0]
  87
  88     def find_domain_sid(self):
  89         res = self.ldb.search(base=self.base_dn, expression="(objectClass=*)", scope=SCOPE_BASE)
  90         return ndr_unpack( security.dom_sid,res[0]["objectSid"][0])
  91
  92     def setUp(self):
  93         super(BasicTests, self).setUp()
  94         self.ldb = ldb
  95         self.gc_ldb = gc_ldb
  96         self.base_dn = self.find_basedn(ldb)
  97         self.configuration_dn = self.find_configurationdn(ldb)
  98         self.schema_dn = self.find_schemadn(ldb)
  99         self.domain_sid = self.find_domain_sid()
 100
 101         print "baseDN: %s\n" % self.base_dn
 102
 103         self.delete_force(self.ldb, "cn=posixuser,cn=users," + self.base_dn)
 104         self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 105         self.delete_force(self.ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
 106         self.delete_force(self.ldb, "cn=ldaptestuser3,cn=users," + self.base_dn)
 107         self.delete_force(self.ldb, "cn=ldaptestuser4,cn=ldaptestcontainer," + self.base_dn)
 108         self.delete_force(self.ldb, "cn=ldaptestuser4,cn=ldaptestcontainer2," + self.base_dn)
 109         self.delete_force(self.ldb, "cn=ldaptestuser5,cn=users," + self.base_dn)
 110         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 111         self.delete_force(self.ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 112         self.delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
 113         self.delete_force(self.ldb, "cn=ldaptest2computer,cn=computers," + self.base_dn)
 114         self.delete_force(self.ldb, "cn=ldaptestcomputer3,cn=computers," + self.base_dn)
 115         self.delete_force(self.ldb, "cn=ldaptestutf8user èùéìòà,cn=users," + self.base_dn)
 116         self.delete_force(self.ldb, "cn=ldaptestutf8user2  èùéìòà,cn=users," + self.base_dn)
 117         self.delete_force(self.ldb, "cn=ldaptestcontainer," + self.base_dn)
 118         self.delete_force(self.ldb, "cn=ldaptestcontainer2," + self.base_dn)
 119         self.delete_force(self.ldb, "cn=parentguidtest,cn=users," + self.base_dn)
 120         self.delete_force(self.ldb, "cn=parentguidtest,cn=testotherusers," + self.base_dn)
 121         self.delete_force(self.ldb, "cn=testotherusers," + self.base_dn)
 122         self.delete_force(self.ldb, "cn=ldaptestobject," + self.base_dn)
 123         self.delete_force(self.ldb, "description=xyz,cn=users," + self.base_dn)
 124         self.delete_force(self.ldb, "ou=testou,cn=users," + self.base_dn)
 125         self.delete_force(self.ldb, "cn=testsecret,cn=system," + self.base_dn)
 126
 127     def test_objectclasses(self):
 128         """Test objectClass behaviour"""
 129         print "Test objectClass behaviour"""
 130
 131         # We cannot create LSA-specific objects (oc "secret" or "trustedDomain")
 132         try:
 133             self.ldb.add({
 134                 "dn": "cn=testsecret,cn=system," + self.base_dn,
 135                 "objectClass": "secret" })
 136             self.fail()
 137         except LdbError, (num, _):
 138             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 139
 140         # Invalid objectclass specified
 141         try:
 142             self.ldb.add({
 143                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 144                 "objectClass": "X" })
 145             self.fail()
 146         except LdbError, (num, _):
 147             self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
 148
 149         # Invalid objectCategory specified
 150         try:
 151             self.ldb.add({
 152                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 153                 "objectClass": "person",
 154                 "objectCategory": self.base_dn })
 155             self.fail()
 156         except LdbError, (num, _):
 157             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 158
 159         # Multi-valued "systemFlags"
 160         try:
 161             self.ldb.add({
 162                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 163                 "objectClass": "person",
 164                 "systemFlags": ["0", str(SYSTEM_FLAG_DOMAIN_DISALLOW_MOVE)] })
 165             self.fail()
 166         except LdbError, (num, _):
 167             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 168
 169         # We cannot instanciate from an abstract objectclass
 170         try:
 171             self.ldb.add({
 172                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 173                 "objectClass": "connectionPoint" })
 174             self.fail()
 175         except LdbError, (num, _):
 176             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 177
 178         # Test allowed system flags
 179         self.ldb.add({
 180              "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 181              "objectClass": "person",
 182              "systemFlags": str(~(SYSTEM_FLAG_CONFIG_ALLOW_RENAME | SYSTEM_FLAG_CONFIG_ALLOW_MOVE | SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE)) })
 183
 184         res = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 185                          scope=SCOPE_BASE, attrs=["systemFlags"])
 186         self.assertTrue(len(res) == 1)
 187         self.assertEquals(res[0]["systemFlags"][0], "0")
 188
 189         self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 190
 191         self.ldb.add({
 192              "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 193              "objectClass": "person" })
 194
 195         # We can remove derivation classes of the structural objectclass
 196         # but they're going to be readded afterwards
 197         m = Message()
 198         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 199         m["objectClass"] = MessageElement("top", FLAG_MOD_DELETE,
 200           "objectClass")
 201         ldb.modify(m)
 202
 203         res = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 204                          scope=SCOPE_BASE, attrs=["objectClass"])
 205         self.assertTrue(len(res) == 1)
 206         self.assertTrue("top" in res[0]["objectClass"])
 207
 208         # The top-most structural class cannot be deleted since there are
 209         # attributes of it in use
 210         m = Message()
 211         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 212         m["objectClass"] = MessageElement("person", FLAG_MOD_DELETE,
 213           "objectClass")
 214         try:
 215             ldb.modify(m)
 216             self.fail()
 217         except LdbError, (num, _):
 218             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 219
 220         # We cannot delete classes which weren't specified
 221         m = Message()
 222         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 223         m["objectClass"] = MessageElement("computer", FLAG_MOD_DELETE,
 224           "objectClass")
 225         try:
 226             ldb.modify(m)
 227             self.fail()
 228         except LdbError, (num, _):
 229             self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
 230
 231         # An invalid class cannot be added
 232         m = Message()
 233         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 234         m["objectClass"] = MessageElement("X", FLAG_MOD_ADD,
 235           "objectClass")
 236         try:
 237             ldb.modify(m)
 238             self.fail()
 239         except LdbError, (num, _):
 240             self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
 241
 242         # The top-most structural class cannot be changed by adding another
 243         # structural one
 244         m = Message()
 245         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 246         m["objectClass"] = MessageElement("user", FLAG_MOD_ADD,
 247           "objectClass")
 248         try:
 249             ldb.modify(m)
 250             self.fail()
 251         except LdbError, (num, _):
 252             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 253
 254         # An already specified objectclass cannot be added another time
 255         m = Message()
 256         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 257         m["objectClass"] = MessageElement("person", FLAG_MOD_ADD,
 258           "objectClass")
 259         try:
 260             ldb.modify(m)
 261             self.fail()
 262         except LdbError, (num, _):
 263             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 264
 265         # Auxiliary classes can always be added
 266         m = Message()
 267         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 268         m["objectClass"] = MessageElement("bootableDevice", FLAG_MOD_ADD,
 269           "objectClass")
 270         ldb.modify(m)
 271
 272         # It's only possible to replace with the same objectclass combination.
 273         # So the replace action on "objectClass" attributes is really useless.
 274         m = Message()
 275         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 276         m["objectClass"] = MessageElement(["top", "person", "bootableDevice"],
 277           FLAG_MOD_REPLACE, "objectClass")
 278         ldb.modify(m)
 279
 280         m = Message()
 281         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 282         m["objectClass"] = MessageElement(["person", "bootableDevice"],
 283           FLAG_MOD_REPLACE, "objectClass")
 284         ldb.modify(m)
 285
 286         m = Message()
 287         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 288         m["objectClass"] = MessageElement(["top", "person", "bootableDevice",
 289           "connectionPoint"], FLAG_MOD_REPLACE, "objectClass")
 290         try:
 291             ldb.modify(m)
 292             self.fail()
 293         except LdbError, (num, _):
 294             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 295
 296         m = Message()
 297         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 298         m["objectClass"] = MessageElement(["top", "computer"], FLAG_MOD_REPLACE,
 299           "objectClass")
 300         try:
 301             ldb.modify(m)
 302             self.fail()
 303         except LdbError, (num, _):
 304             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 305
 306         # Classes can be removed unless attributes of them are used.
 307         m = Message()
 308         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 309         m["objectClass"] = MessageElement("bootableDevice", FLAG_MOD_DELETE,
 310           "objectClass")
 311         ldb.modify(m)
 312
 313         res = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 314                          scope=SCOPE_BASE, attrs=["objectClass"])
 315         self.assertTrue(len(res) == 1)
 316         self.assertFalse("bootableDevice" in res[0]["objectClass"])
 317
 318         m = Message()
 319         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 320         m["objectClass"] = MessageElement("bootableDevice", FLAG_MOD_ADD,
 321           "objectClass")
 322         ldb.modify(m)
 323
 324         # Add an attribute specific to the "bootableDevice" class
 325         m = Message()
 326         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 327         m["bootParameter"] = MessageElement("test", FLAG_MOD_ADD,
 328           "bootParameter")
 329         ldb.modify(m)
 330
 331         # Classes can be removed unless attributes of them are used. Now there
 332         # exist such attributes on the entry.
 333         m = Message()
 334         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 335         m["objectClass"] = MessageElement("bootableDevice", FLAG_MOD_DELETE,
 336           "objectClass")
 337         try:
 338             ldb.modify(m)
 339             self.fail()
 340         except LdbError, (num, _):
 341             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 342
 343         # Remove the previously specified attribute
 344         m = Message()
 345         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 346         m["bootParameter"] = MessageElement("test", FLAG_MOD_DELETE,
 347           "bootParameter")
 348         ldb.modify(m)
 349
 350         # Classes can be removed unless attributes of them are used.
 351         m = Message()
 352         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 353         m["objectClass"] = MessageElement("bootableDevice", FLAG_MOD_DELETE,
 354           "objectClass")
 355         ldb.modify(m)
 356
 357         self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 358
 359     def test_system_only(self):
 360         """Test systemOnly objects"""
 361         print "Test systemOnly objects"""
 362
 363         try:
 364             self.ldb.add({
 365                 "dn": "cn=ldaptestobject," + self.base_dn,
 366                 "objectclass": "configuration"})
 367             self.fail()
 368         except LdbError, (num, _):
 369             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 370
 371         try:
 372             self.ldb.add({
 373                 "dn": "cn=testsecret,cn=system," + self.base_dn,
 374                 "objectclass": "secret"})
 375             self.fail()
 376         except LdbError, (num, _):
 377             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 378
 379         self.delete_force(self.ldb, "cn=ldaptestobject," + self.base_dn)
 380         self.delete_force(self.ldb, "cn=testsecret,cn=system," + self.base_dn)
 381
 382         try:
 383             self.ldb.add({
 384                 "dn": "cn=ldaptestcontainer," + self.base_dn,
 385                 "objectclass": "container",
 386                 "isCriticalSystemObject": "TRUE"})
 387             self.fail()
 388         except LdbError, (num, _):
 389             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 390
 391         self.ldb.add({
 392             "dn": "cn=ldaptestcontainer," + self.base_dn,
 393             "objectclass": "container"})
 394
 395         m = Message()
 396         m.dn = Dn(ldb, "cn=ldaptestcontainer," + self.base_dn)
 397         m["isCriticalSystemObject"] = MessageElement("TRUE", FLAG_MOD_REPLACE,
 398           "isCriticalSystemObject")
 399         try:
 400             ldb.modify(m)
 401             self.fail()
 402         except LdbError, (num, _):
 403             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 404
 405         self.delete_force(self.ldb, "cn=ldaptestcontainer," + self.base_dn)
 406
 407         # Proof if DC SAM object has "isCriticalSystemObject" set
 408         res = self.ldb.search("", scope=SCOPE_BASE, attrs=["serverName"])
 409         self.assertTrue(len(res) == 1)
 410         self.assertTrue("serverName" in res[0])
 411         res = self.ldb.search(res[0]["serverName"][0], scope=SCOPE_BASE,
 412                               attrs=["serverReference"])
 413         self.assertTrue(len(res) == 1)
 414         self.assertTrue("serverReference" in res[0])
 415         res = self.ldb.search(res[0]["serverReference"][0], scope=SCOPE_BASE,
 416                               attrs=["isCriticalSystemObject"])
 417         self.assertTrue(len(res) == 1)
 418         self.assertTrue("isCriticalSystemObject" in res[0])
 419         self.assertEquals(res[0]["isCriticalSystemObject"][0], "TRUE")
 420
 421     def test_invalid_parent(self):
 422         """Test adding an object with invalid parent"""
 423         print "Test adding an object with invalid parent"""
 424
 425         try:
 426             self.ldb.add({
 427                 "dn": "cn=ldaptestgroup,cn=thisdoesnotexist123,"
 428                    + self.base_dn,
 429                 "objectclass": "group"})
 430             self.fail()
 431         except LdbError, (num, _):
 432             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
 433
 434         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=thisdoesnotexist123,"
 435           + self.base_dn)
 436
 437         try:
 438             self.ldb.add({
 439                 "dn": "ou=testou,cn=users," + self.base_dn,
 440                 "objectclass": "organizationalUnit"})
 441             self.fail()
 442         except LdbError, (num, _):
 443             self.assertEquals(num, ERR_NAMING_VIOLATION)
 444
 445         self.delete_force(self.ldb, "ou=testou,cn=users," + self.base_dn)
 446
 447     def test_invalid_attribute(self):
 448         """Test invalid attributes on schema/objectclasses"""
 449         print "Test invalid attributes on schema/objectclasses"""
 450
 451         # attributes not in schema test
 452
 453         # add operation
 454
 455         try:
 456             self.ldb.add({
 457                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 458                 "objectclass": "group",
 459                 "thisdoesnotexist": "x"})
 460             self.fail()
 461         except LdbError, (num, _):
 462             self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
 463
 464         self.ldb.add({
 465              "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 466              "objectclass": "group"})
 467
 468         # modify operation
 469
 470         m = Message()
 471         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 472         m["thisdoesnotexist"] = MessageElement("x", FLAG_MOD_REPLACE,
 473           "thisdoesnotexist")
 474         try:
 475             ldb.modify(m)
 476             self.fail()
 477         except LdbError, (num, _):
 478             self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
 479
 480         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 481
 482         # attributes not in objectclasses and mandatory attributes missing test
 483         # Use here a non-SAM entry since it doesn't have special triggers
 484         # associated which have an impact on the error results.
 485
 486         # add operations
 487
 488         # mandatory attribute missing
 489         try:
 490             self.ldb.add({
 491                 "dn": "cn=ldaptestobject," + self.base_dn,
 492                 "objectclass": "ipProtocol"})
 493             self.fail()
 494         except LdbError, (num, _):
 495             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 496
 497         # inadequate but schema-valid attribute specified
 498         try:
 499             self.ldb.add({
 500                 "dn": "cn=ldaptestobject," + self.base_dn,
 501                 "objectclass": "ipProtocol",
 502                 "ipProtocolNumber": "1",
 503                 "uid" : "0"})
 504             self.fail()
 505         except LdbError, (num, _):
 506             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 507
 508         self.ldb.add({
 509             "dn": "cn=ldaptestobject," + self.base_dn,
 510             "objectclass": "ipProtocol",
 511             "ipProtocolNumber": "1"})
 512
 513         # modify operations
 514
 515         # inadequate but schema-valid attribute add trial
 516         m = Message()
 517         m.dn = Dn(ldb, "cn=ldaptestobject," + self.base_dn)
 518         m["uid"] = MessageElement("0", FLAG_MOD_ADD, "uid")
 519         try:
 520             ldb.modify(m)
 521             self.fail()
 522         except LdbError, (num, _):
 523             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 524
 525         # mandatory attribute delete trial
 526         m = Message()
 527         m.dn = Dn(ldb, "cn=ldaptestobject," + self.base_dn)
 528         m["ipProtocolNumber"] = MessageElement([], FLAG_MOD_DELETE,
 529           "ipProtocolNumber")
 530         try:
 531             ldb.modify(m)
 532             self.fail()
 533         except LdbError, (num, _):
 534             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 535
 536         # mandatory attribute delete trial
 537         m = Message()
 538         m.dn = Dn(ldb, "cn=ldaptestobject," + self.base_dn)
 539         m["ipProtocolNumber"] = MessageElement([], FLAG_MOD_REPLACE,
 540           "ipProtocolNumber")
 541         try:
 542             ldb.modify(m)
 543             self.fail()
 544         except LdbError, (num, _):
 545             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 546
 547         self.delete_force(self.ldb, "cn=ldaptestobject," + self.base_dn)
 548
 549     def test_single_valued_attributes(self):
 550         """Test single-valued attributes"""
 551         print "Test single-valued attributes"""
 552
 553         try:
 554             self.ldb.add({
 555                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 556                 "objectclass": "group",
 557                 "sAMAccountName": ["nam1", "nam2"]})
 558             self.fail()
 559         except LdbError, (num, _):
 560             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 561
 562         self.ldb.add({
 563              "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 564              "objectclass": "group"})
 565
 566         m = Message()
 567         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 568         m["sAMAccountName"] = MessageElement(["nam1","nam2"], FLAG_MOD_REPLACE,
 569           "sAMAccountName")
 570         try:
 571             ldb.modify(m)
 572             self.fail()
 573         except LdbError, (num, _):
 574             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 575
 576         m = Message()
 577         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 578         m["sAMAccountName"] = MessageElement("testgroupXX", FLAG_MOD_REPLACE,
 579           "sAMAccountName")
 580         ldb.modify(m)
 581
 582         m = Message()
 583         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 584         m["sAMAccountName"] = MessageElement("testgroupXX2", FLAG_MOD_ADD,
 585           "sAMAccountName")
 586         try:
 587             ldb.modify(m)
 588             self.fail()
 589         except LdbError, (num, _):
 590             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 591
 592         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 593
 594     def test_multi_valued_attributes(self):
 595         """Test multi-valued attributes"""
 596         print "Test multi-valued attributes"""
 597
 598 # TODO: In this test I added some special tests where I got very unusual
 599 # results back from a real AD. s4 doesn't match them and I've no idea how to
 600 # implement those error cases (maybe there exists a special trigger for
 601 # "description" attributes which handle them)
 602
 603         self.ldb.add({
 604             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 605             "description": "desc2",
 606             "objectclass": "group",
 607             "description": "desc1"})
 608
 609         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 610
 611         self.ldb.add({
 612             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 613             "objectclass": "group",
 614             "description": ["desc1", "desc2"]})
 615
 616 #        m = Message()
 617 #        m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 618 #        m["description"] = MessageElement(["desc1","desc2"], FLAG_MOD_REPLACE,
 619 #          "description")
 620 #        try:
 621 #            ldb.modify(m)
 622 #            self.fail()
 623 #        except LdbError, (num, _):
 624 #            self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 625
 626         m = Message()
 627         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 628         m["description"] = MessageElement("desc1", FLAG_MOD_REPLACE,
 629           "description")
 630         ldb.modify(m)
 631
 632 #        m = Message()
 633 #        m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 634 #        m["description"] = MessageElement("desc3", FLAG_MOD_ADD,
 635 #          "description")
 636 #        try:
 637 #            ldb.modify(m)
 638 #            self.fail()
 639 #        except LdbError, (num, _):
 640 #            self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 641
 642         m = Message()
 643         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 644         m["description"] = MessageElement(["desc1","desc2"], FLAG_MOD_DELETE,
 645           "description")
 646         try:
 647             ldb.modify(m)
 648             self.fail()
 649         except LdbError, (num, _):
 650             self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
 651
 652         m = Message()
 653         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 654         m["description"] = MessageElement("desc1", FLAG_MOD_DELETE,
 655           "description")
 656         ldb.modify(m)
 657
 658 #        m = Message()
 659 #        m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 660 #        m["description"] = MessageElement(["desc1","desc2"], FLAG_MOD_REPLACE,
 661 #          "description")
 662 #        try:
 663 #            ldb.modify(m)
 664 #            self.fail()
 665 #        except LdbError, (num, _):
 666 #            self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 667
 668 #        m = Message()
 669 #        m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 670 #        m["description"] = MessageElement(["desc3", "desc4"], FLAG_MOD_ADD,
 671 #          "description")
 672 #        try:
 673 #            ldb.modify(m)
 674 #            self.fail()
 675 #        except LdbError, (num, _):
 676 #            self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 677
 678         m = Message()
 679         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 680         m["description"] = MessageElement("desc3", FLAG_MOD_ADD,
 681           "description")
 682         ldb.modify(m)
 683
 684         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 685
 686     def test_empty_messages(self):
 687         """Test empty messages"""
 688         print "Test empty messages"""
 689
 690         m = Message()
 691         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 692
 693         try:
 694             ldb.add(m)
 695             self.fail()
 696         except LdbError, (num, _):
 697             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 698
 699         try:
 700             ldb.modify(m)
 701             self.fail()
 702         except LdbError, (num, _):
 703             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 704
 705         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 706
 707     def test_empty_attributes(self):
 708         """Test empty attributes"""
 709         print "Test empty attributes"""
 710
 711         m = Message()
 712         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 713         m["objectClass"] = MessageElement("group", FLAG_MOD_ADD, "objectClass")
 714         m["description"] = MessageElement([], FLAG_MOD_ADD, "description")
 715
 716         try:
 717             ldb.add(m)
 718             self.fail()
 719         except LdbError, (num, _):
 720             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 721
 722         self.ldb.add({
 723             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 724             "objectclass": "group"})
 725
 726         m = Message()
 727         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 728         m["description"] = MessageElement([], FLAG_MOD_ADD, "description")
 729
 730         try:
 731             ldb.modify(m)
 732             self.fail()
 733         except LdbError, (num, _):
 734             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 735
 736         m = Message()
 737         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 738         m["description"] = MessageElement([], FLAG_MOD_REPLACE, "description")
 739         ldb.modify(m)
 740
 741         m = Message()
 742         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 743         m["description"] = MessageElement([], FLAG_MOD_DELETE, "description")
 744         try:
 745             ldb.modify(m)
 746             self.fail()
 747         except LdbError, (num, _):
 748             self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
 749
 750         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 751
 752     def test_instanceType(self):
 753         """Tests the 'instanceType' attribute"""
 754         print "Tests the 'instanceType' attribute"""
 755
 756         # The instance type is single-valued
 757         try:
 758             self.ldb.add({
 759                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 760                 "objectclass": "group",
 761                 "instanceType": ["0", "1"]})
 762             self.fail()
 763         except LdbError, (num, _):
 764             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 765
 766         # The head NC flag cannot be set without the write flag
 767         try:
 768             self.ldb.add({
 769                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 770                 "objectclass": "group",
 771                 "instanceType": "1" })
 772             self.fail()
 773         except LdbError, (num, _):
 774             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 775
 776         # We cannot manipulate NCs without the head NC flag
 777         try:
 778             self.ldb.add({
 779                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 780                 "objectclass": "group",
 781                 "instanceType": "32" })
 782             self.fail()
 783         except LdbError, (num, _):
 784             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 785
 786         self.ldb.add({
 787              "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 788              "objectclass": "group"})
 789
 790         m = Message()
 791         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 792         m["instanceType"] = MessageElement("0", FLAG_MOD_REPLACE,
 793           "instanceType")
 794         try:
 795             ldb.modify(m)
 796             self.fail()
 797         except LdbError, (num, _):
 798             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 799
 800         m = Message()
 801         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 802         m["instanceType"] = MessageElement([], FLAG_MOD_REPLACE,
 803           "instanceType")
 804         try:
 805             ldb.modify(m)
 806             self.fail()
 807         except LdbError, (num, _):
 808             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 809
 810         m = Message()
 811         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 812         m["instanceType"] = MessageElement([], FLAG_MOD_DELETE, "instanceType")
 813         try:
 814             ldb.modify(m)
 815             self.fail()
 816         except LdbError, (num, _):
 817             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 818
 819         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 820
 821     def test_distinguished_name(self):
 822         """Tests the 'distinguishedName' attribute"""
 823         print "Tests the 'distinguishedName' attribute"""
 824
 825         # a wrong "distinguishedName" attribute is obviously tolerated
 826         self.ldb.add({
 827               "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 828               "objectclass": "group",
 829               "distinguishedName": "cn=ldaptest,cn=users," + self.base_dn})
 830
 831         # proof if the DN has been set correctly
 832         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 833                          scope=SCOPE_BASE, attrs=["distinguishedName"])
 834         self.assertTrue(len(res) == 1)
 835         self.assertTrue("distinguishedName" in res[0])
 836         self.assertTrue(Dn(ldb, res[0]["distinguishedName"][0])
 837            == Dn(ldb, "cn=ldaptestgroup, cn=users," + self.base_dn))
 838
 839         m = Message()
 840         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 841         m["distinguishedName"] = MessageElement(
 842           "cn=ldaptestuser,cn=users," + self.base_dn, FLAG_MOD_ADD,
 843           "distinguishedName")
 844
 845         try:
 846             ldb.modify(m)
 847             self.fail()
 848         except LdbError, (num, _):
 849             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 850
 851         m = Message()
 852         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 853         m["distinguishedName"] = MessageElement(
 854           "cn=ldaptestuser,cn=users," + self.base_dn, FLAG_MOD_REPLACE,
 855           "distinguishedName")
 856
 857         try:
 858             ldb.modify(m)
 859             self.fail()
 860         except LdbError, (num, _):
 861             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 862
 863         m = Message()
 864         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 865         m["distinguishedName"] = MessageElement(
 866           "cn=ldaptestuser,cn=users," + self.base_dn, FLAG_MOD_DELETE,
 867           "distinguishedName")
 868
 869         try:
 870             ldb.modify(m)
 871             self.fail()
 872         except LdbError, (num, _):
 873             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 874
 875         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 876
 877     def test_rdn_name(self):
 878         """Tests the RDN"""
 879         print "Tests the RDN"""
 880
 881         try:
 882             self.ldb.add({
 883                  "dn": "description=xyz,cn=users," + self.base_dn,
 884                  "objectclass": "group"})
 885             self.fail()
 886         except LdbError, (num, _):
 887             self.assertEquals(num, ERR_NAMING_VIOLATION)
 888
 889         self.delete_force(self.ldb, "description=xyz,cn=users," + self.base_dn)
 890
 891         # a wrong "name" attribute is obviously tolerated
 892         self.ldb.add({
 893              "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 894              "objectclass": "group",
 895              "name": "ldaptestgroupx"})
 896
 897         # proof if the name has been set correctly
 898         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 899                          scope=SCOPE_BASE, attrs=["name"])
 900         self.assertTrue(len(res) == 1)
 901         self.assertTrue("name" in res[0])
 902         self.assertTrue(res[0]["name"][0] == "ldaptestgroup")
 903
 904         m = Message()
 905         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 906         m["name"] = MessageElement("cn=ldaptestuser", FLAG_MOD_REPLACE,
 907           "name")
 908         try:
 909             ldb.modify(m)
 910             self.fail()
 911         except LdbError, (num, _):
 912             self.assertEquals(num, ERR_NOT_ALLOWED_ON_RDN)
 913
 914         m = Message()
 915         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 916         m["cn"] = MessageElement("ldaptestuser",
 917           FLAG_MOD_REPLACE, "cn")
 918         try:
 919             ldb.modify(m)
 920             self.fail()
 921         except LdbError, (num, _):
 922             self.assertEquals(num, ERR_NOT_ALLOWED_ON_RDN)
 923
 924         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 925
 926
 927         # this test needs to be disabled until we really understand
 928         # what the rDN length constraints are
 929     def DISABLED_test_largeRDN(self):
 930         """Testing large rDN (limit 64 characters)"""
 931         rdn = "CN=a012345678901234567890123456789012345678901234567890123456789012";
 932         self.delete_force(self.ldb, "%s,%s" % (rdn, self.base_dn))
 933         ldif = """
 934 dn: %s,%s""" % (rdn,self.base_dn) + """
 935 objectClass: container
 936 """
 937         self.ldb.add_ldif(ldif)
 938         self.delete_force(self.ldb, "%s,%s" % (rdn, self.base_dn))
 939
 940         rdn = "CN=a0123456789012345678901234567890123456789012345678901234567890120";
 941         self.delete_force(self.ldb, "%s,%s" % (rdn, self.base_dn))
 942         try:
 943             ldif = """
 944 dn: %s,%s""" % (rdn,self.base_dn) + """
 945 objectClass: container
 946 """
 947             self.ldb.add_ldif(ldif)
 948             self.fail()
 949         except LdbError, (num, _):
 950             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 951         self.delete_force(self.ldb, "%s,%s" % (rdn, self.base_dn))
 952
 953     def test_rename(self):
 954         """Tests the rename operation"""
 955         print "Tests the rename operations"""
 956
 957         try:
 958             # cannot rename to be a child of itself
 959             ldb.rename(self.base_dn, "dc=test," + self.base_dn)
 960             self.fail()
 961         except LdbError, (num, _):
 962             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 963
 964         try:
 965             # inexistent object
 966             ldb.rename("cn=ldaptestuser2,cn=users," + self.base_dn, "cn=ldaptestuser2,cn=users," + self.base_dn)
 967             self.fail()
 968         except LdbError, (num, _):
 969             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
 970
 971         self.ldb.add({
 972              "dn": "cn=ldaptestuser2,cn=users," + self.base_dn,
 973              "objectclass": ["user", "person"] })
 974
 975         ldb.rename("cn=ldaptestuser2,cn=users," + self.base_dn, "cn=ldaptestuser2,cn=users," + self.base_dn)
 976         ldb.rename("cn=ldaptestuser2,cn=users," + self.base_dn, "cn=ldaptestuser3,cn=users," + self.base_dn)
 977         ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "cn=ldaptestUSER3,cn=users," + self.base_dn)
 978
 979         try:
 980             # containment problem: a user entry cannot contain user entries
 981             ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "cn=ldaptestuser4,cn=ldaptestuser3,cn=users," + self.base_dn)
 982             self.fail()
 983         except LdbError, (num, _):
 984             self.assertEquals(num, ERR_NAMING_VIOLATION)
 985
 986         try:
 987             # invalid parent
 988             ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "cn=ldaptestuser3,cn=people,cn=users," + self.base_dn)
 989             self.fail()
 990         except LdbError, (num, _):
 991             self.assertEquals(num, ERR_OTHER)
 992
 993         try:
 994             # invalid target DN syntax
 995             ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, ",cn=users," + self.base_dn)
 996             self.fail()
 997         except LdbError, (num, _):
 998             self.assertEquals(num, ERR_INVALID_DN_SYNTAX)
 999
1000         try:
1001             # invalid RDN name
1002             ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "ou=ldaptestuser3,cn=users," + self.base_dn)
1003             self.fail()
1004         except LdbError, (num, _):
1005             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1006
1007         self.delete_force(self.ldb, "cn=ldaptestuser3,cn=users," + self.base_dn)
1008
1009         # Performs some "systemFlags" testing
1010
1011         # Move failing since no "SYSTEM_FLAG_CONFIG_ALLOW_MOVE"
1012         try:
1013             ldb.rename("CN=DisplaySpecifiers," + self.configuration_dn, "CN=DisplaySpecifiers,CN=Services," + self.configuration_dn)
1014             self.fail()
1015         except LdbError, (num, _):
1016             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1017
1018         # Limited move failing since no "SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE"
1019         try:
1020             ldb.rename("CN=Directory Service,CN=Windows NT,CN=Services," + self.configuration_dn, "CN=Directory Service,CN=RRAS,CN=Services," + self.configuration_dn)
1021             self.fail()
1022         except LdbError, (num, _):
1023             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1024
1025         # Rename failing since no "SYSTEM_FLAG_CONFIG_ALLOW_RENAME"
1026         try:
1027             ldb.rename("CN=DisplaySpecifiers," + self.configuration_dn, "CN=DisplaySpecifiers2," + self.configuration_dn)
1028             self.fail()
1029         except LdbError, (num, _):
1030             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1031
1032         # It's not really possible to test moves on the schema partition since
1033         # there don't exist subcontainers on it.
1034
1035         # Rename failing since "SYSTEM_FLAG_SCHEMA_BASE_OBJECT"
1036         try:
1037             ldb.rename("CN=Top," + self.schema_dn, "CN=Top2," + self.schema_dn)
1038             self.fail()
1039         except LdbError, (num, _):
1040             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1041
1042         # Move failing since "SYSTEM_FLAG_DOMAIN_DISALLOW_MOVE"
1043         try:
1044             ldb.rename("CN=Users," + self.base_dn, "CN=Users,CN=Computers," + self.base_dn)
1045             self.fail()
1046         except LdbError, (num, _):
1047             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1048
1049         # Rename failing since "SYSTEM_FLAG_DOMAIN_DISALLOW_RENAME"
1050         try:
1051             ldb.rename("CN=Users," + self.base_dn, "CN=Users2," + self.base_dn)
1052             self.fail()
1053         except LdbError, (num, _):
1054             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1055
1056         # Performs some other constraints testing
1057
1058         try:
1059             ldb.rename("CN=Policies,CN=System," + self.base_dn, "CN=Users2," + self.base_dn)
1060             self.fail()
1061         except LdbError, (num, _):
1062             self.assertEquals(num, ERR_OTHER)
1063
1064     def test_rename_twice(self):
1065         """Tests the rename operation twice - this corresponds to a past bug"""
1066         print "Tests the rename twice operation"""
1067
1068         self.ldb.add({
1069              "dn": "cn=ldaptestuser5,cn=users," + self.base_dn,
1070              "objectclass": ["user", "person"] })
1071
1072         ldb.rename("cn=ldaptestuser5,cn=users," + self.base_dn, "cn=ldaptestUSER5,cn=users," + self.base_dn)
1073         self.delete_force(self.ldb, "cn=ldaptestuser5,cn=users," + self.base_dn)
1074         self.ldb.add({
1075              "dn": "cn=ldaptestuser5,cn=users," + self.base_dn,
1076              "objectclass": ["user", "person"] })
1077         ldb.rename("cn=ldaptestuser5,cn=Users," + self.base_dn, "cn=ldaptestUSER5,cn=users," + self.base_dn)
1078         res = ldb.search(expression="cn=ldaptestuser5")
1079         print "Found %u records" % len(res)
1080         self.assertEquals(len(res), 1, "Wrong number of hits for cn=ldaptestuser5")
1081         res = ldb.search(expression="(&(cn=ldaptestuser5)(objectclass=user))")
1082         print "Found %u records" % len(res)
1083         self.assertEquals(len(res), 1, "Wrong number of hits for (&(cn=ldaptestuser5)(objectclass=user))")
1084         self.delete_force(self.ldb, "cn=ldaptestuser5,cn=users," + self.base_dn)
1085
1086     def test_parentGUID(self):
1087         """Test parentGUID behaviour"""
1088         print "Testing parentGUID behaviour\n"
1089
1090         # TODO: This seems to fail on Windows Server. Hidden attribute?
1091
1092         self.ldb.add({
1093             "dn": "cn=parentguidtest,cn=users," + self.base_dn,
1094             "objectclass":"user",
1095             "samaccountname":"parentguidtest"});
1096         res1 = ldb.search(base="cn=parentguidtest,cn=users," + self.base_dn, scope=SCOPE_BASE,
1097                           attrs=["parentGUID", "samaccountname"]);
1098         res2 = ldb.search(base="cn=users," + self.base_dn,scope=SCOPE_BASE,
1099                           attrs=["objectGUID"]);
1100         res3 = ldb.search(base=self.base_dn, scope=SCOPE_BASE,
1101                           attrs=["parentGUID"]);
1102         res4 = ldb.search(base=self.configuration_dn, scope=SCOPE_BASE,
1103                           attrs=["parentGUID"]);
1104         res5 = ldb.search(base=self.schema_dn, scope=SCOPE_BASE,
1105                           attrs=["parentGUID"]);
1106
1107         """Check if the parentGUID is valid """
1108         self.assertEquals(res1[0]["parentGUID"], res2[0]["objectGUID"]);
1109
1110         """Check if it returns nothing when there is no parent object - default NC"""
1111         has_parentGUID = False
1112         for key in res3[0].keys():
1113             if key == "parentGUID":
1114                 has_parentGUID = True
1115                 break
1116         self.assertFalse(has_parentGUID);
1117
1118         """Check if it returns nothing when there is no parent object - configuration NC"""
1119         has_parentGUID = False
1120         for key in res4[0].keys():
1121             if key == "parentGUID":
1122                 has_parentGUID = True
1123                 break
1124         self.assertFalse(has_parentGUID);
1125
1126         """Check if it returns nothing when there is no parent object - schema NC"""
1127         has_parentGUID = False
1128         for key in res5[0].keys():
1129             if key == "parentGUID":
1130                 has_parentGUID = True
1131                 break
1132         self.assertFalse(has_parentGUID);
1133
1134         """Ensures that if you look for another object attribute after the constructed
1135             parentGUID, it will return correctly"""
1136         has_another_attribute = False
1137         for key in res1[0].keys():
1138             if key == "sAMAccountName":
1139                 has_another_attribute = True
1140                 break
1141         self.assertTrue(has_another_attribute)
1142         self.assertTrue(len(res1[0]["samaccountname"]) == 1)
1143         self.assertEquals(res1[0]["samaccountname"][0], "parentguidtest");
1144
1145         print "Testing parentGUID behaviour on rename\n"
1146
1147         self.ldb.add({
1148             "dn": "cn=testotherusers," + self.base_dn,
1149             "objectclass":"container"});
1150         res1 = ldb.search(base="cn=testotherusers," + self.base_dn,scope=SCOPE_BASE,
1151                           attrs=["objectGUID"]);
1152         ldb.rename("cn=parentguidtest,cn=users," + self.base_dn,
1153                    "cn=parentguidtest,cn=testotherusers," + self.base_dn);
1154         res2 = ldb.search(base="cn=parentguidtest,cn=testotherusers," + self.base_dn,
1155                           scope=SCOPE_BASE,
1156                           attrs=["parentGUID"]);
1157         self.assertEquals(res1[0]["objectGUID"], res2[0]["parentGUID"]);
1158
1159         self.delete_force(self.ldb, "cn=parentguidtest,cn=testotherusers," + self.base_dn)
1160         self.delete_force(self.ldb, "cn=testotherusers," + self.base_dn)
1161
1162     def test_groupType_int32(self):
1163         """Test groupType (int32) behaviour (should appear to be casted to a 32 bit signed integer before comparsion)"""
1164         print "Testing groupType (int32) behaviour\n"
1165
1166         res1 = ldb.search(base=self.base_dn, scope=SCOPE_SUBTREE,
1167                           attrs=["groupType"], expression="groupType=2147483653");
1168
1169         res2 = ldb.search(base=self.base_dn, scope=SCOPE_SUBTREE,
1170                           attrs=["groupType"], expression="groupType=-2147483643");
1171
1172         self.assertEquals(len(res1), len(res2))
1173
1174         self.assertTrue(res1.count > 0)
1175
1176         self.assertEquals(res1[0]["groupType"][0], "-2147483643")
1177
1178     def test_linked_attributes(self):
1179         """This tests the linked attribute behaviour"""
1180         print "Testing linked attribute behaviour\n"
1181
1182         ldb.add({
1183             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
1184             "objectclass": "group"})
1185
1186         # This should not work since "memberOf" is linked to "member"
1187         try:
1188             ldb.add({
1189                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1190                 "objectclass": ["user", "person"],
1191                 "memberOf": "cn=ldaptestgroup,cn=users," + self.base_dn})
1192         except LdbError, (num, _):
1193             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1194
1195         ldb.add({
1196             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1197             "objectclass": ["user", "person"]})
1198
1199         m = Message()
1200         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1201         m["memberOf"] = MessageElement("cn=ldaptestgroup,cn=users," + self.base_dn,
1202           FLAG_MOD_ADD, "memberOf")
1203         try:
1204             ldb.modify(m)
1205             self.fail()
1206         except LdbError, (num, _):
1207             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1208
1209         m = Message()
1210         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1211         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
1212           FLAG_MOD_ADD, "member")
1213         ldb.modify(m)
1214
1215         m = Message()
1216         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1217         m["memberOf"] = MessageElement("cn=ldaptestgroup,cn=users," + self.base_dn,
1218           FLAG_MOD_REPLACE, "memberOf")
1219         try:
1220             ldb.modify(m)
1221             self.fail()
1222         except LdbError, (num, _):
1223             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1224
1225         m = Message()
1226         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1227         m["memberOf"] = MessageElement("cn=ldaptestgroup,cn=users," + self.base_dn,
1228           FLAG_MOD_DELETE, "memberOf")
1229         try:
1230             ldb.modify(m)
1231             self.fail()
1232         except LdbError, (num, _):
1233             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1234
1235         m = Message()
1236         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1237         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
1238           FLAG_MOD_DELETE, "member")
1239         ldb.modify(m)
1240
1241         # This should yield no results since the member attribute for
1242         # "ldaptestuser" should have been deleted
1243         res1 = ldb.search("cn=ldaptestgroup, cn=users," + self.base_dn,
1244                           scope=SCOPE_BASE,
1245                           expression="(member=cn=ldaptestuser,cn=users," + self.base_dn + ")",
1246                           attrs=[])
1247         self.assertTrue(len(res1) == 0)
1248
1249         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1250
1251         ldb.add({
1252             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
1253             "objectclass": "group",
1254             "member": "cn=ldaptestuser,cn=users," + self.base_dn})
1255
1256         self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1257
1258         # Make sure that the "member" attribute for "ldaptestuser" has been
1259         # removed
1260         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1261                           scope=SCOPE_BASE, attrs=["member"])
1262         self.assertTrue(len(res) == 1)
1263         self.assertFalse("member" in res[0])
1264
1265         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1266
1267     def test_wkguid(self):
1268         """Test Well known GUID behaviours (including DN+Binary)"""
1269         print "Test Well known GUID behaviours (including DN+Binary)"""
1270
1271         res = self.ldb.search(base=("<WKGUID=ab1d30f3768811d1aded00c04fd8d5cd,%s>" % self.base_dn), scope=SCOPE_BASE, attrs=[])
1272         self.assertEquals(len(res), 1)
1273
1274         res2 = self.ldb.search(scope=SCOPE_BASE, attrs=["wellKnownObjects"], expression=("wellKnownObjects=B:32:ab1d30f3768811d1aded00c04fd8d5cd:%s" % res[0].dn))
1275         self.assertEquals(len(res2), 1)
1276
1277         # Prove that the matching rule is over the whole DN+Binary
1278         res2 = self.ldb.search(scope=SCOPE_BASE, attrs=["wellKnownObjects"], expression=("wellKnownObjects=B:32:ab1d30f3768811d1aded00c04fd8d5cd"))
1279         self.assertEquals(len(res2), 0)
1280         # Prove that the matching rule is over the whole DN+Binary
1281         res2 = self.ldb.search(scope=SCOPE_BASE, attrs=["wellKnownObjects"], expression=("wellKnownObjects=%s") % res[0].dn)
1282         self.assertEquals(len(res2), 0)
1283
1284     def test_subschemasubentry(self):
1285         """Test subSchemaSubEntry appears when requested, but not when not requested"""
1286         print "Test subSchemaSubEntry"""
1287
1288         res = self.ldb.search(base=self.base_dn, scope=SCOPE_BASE, attrs=["subSchemaSubEntry"])
1289         self.assertEquals(len(res), 1)
1290         self.assertEquals(res[0]["subSchemaSubEntry"][0], "CN=Aggregate,"+self.schema_dn)
1291
1292         res = self.ldb.search(base=self.base_dn, scope=SCOPE_BASE, attrs=["*"])
1293         self.assertEquals(len(res), 1)
1294         self.assertTrue("subScheamSubEntry" not in res[0])
1295
1296     def test_all(self):
1297         """Basic tests"""
1298
1299         print "Testing user add"
1300
1301         ldb.add({
1302             "dn": "cn=ldaptestuser,cn=uSers," + self.base_dn,
1303             "objectclass": ["user", "person"],
1304             "cN": "LDAPtestUSER",
1305             "givenname": "ldap",
1306             "sn": "testy"})
1307
1308         ldb.add({
1309             "dn": "cn=ldaptestgroup,cn=uSers," + self.base_dn,
1310             "objectclass": "group",
1311             "member": "cn=ldaptestuser,cn=useRs," + self.base_dn})
1312
1313         ldb.add({
1314             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1315             "objectclass": "computer",
1316             "cN": "LDAPtestCOMPUTER"})
1317
1318         ldb.add({"dn": "cn=ldaptest2computer,cn=computers," + self.base_dn,
1319             "objectClass": "computer",
1320             "cn": "LDAPtest2COMPUTER",
1321             "userAccountControl": str(UF_WORKSTATION_TRUST_ACCOUNT),
1322             "displayname": "ldap testy"})
1323
1324         try:
1325             ldb.add({"dn": "cn=ldaptestcomputer3,cn=computers," + self.base_dn,
1326                      "objectClass": "computer",
1327                      "cn": "LDAPtest2COMPUTER"
1328                      })
1329             self.fail()
1330         except LdbError, (num, _):
1331             self.assertEquals(num, ERR_INVALID_DN_SYNTAX)
1332
1333         try:
1334             ldb.add({"dn": "cn=ldaptestcomputer3,cn=computers," + self.base_dn,
1335                      "objectClass": "computer",
1336                      "cn": "ldaptestcomputer3",
1337                      "sAMAccountType": str(ATYPE_NORMAL_ACCOUNT)
1338                 })
1339             self.fail()
1340         except LdbError, (num, _):
1341             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1342
1343         ldb.add({"dn": "cn=ldaptestcomputer3,cn=computers," + self.base_dn,
1344                  "objectClass": "computer",
1345                  "cn": "LDAPtestCOMPUTER3"
1346                  })
1347
1348         print "Testing ldb.search for (&(cn=ldaptestcomputer3)(objectClass=user))";
1349         res = ldb.search(self.base_dn, expression="(&(cn=ldaptestcomputer3)(objectClass=user))");
1350         self.assertEquals(len(res), 1, "Found only %d for (&(cn=ldaptestcomputer3)(objectClass=user))" % len(res))
1351
1352         self.assertEquals(str(res[0].dn), ("CN=ldaptestcomputer3,CN=Computers," + self.base_dn));
1353         self.assertEquals(res[0]["cn"][0], "ldaptestcomputer3");
1354         self.assertEquals(res[0]["name"][0], "ldaptestcomputer3");
1355         self.assertEquals(res[0]["objectClass"][0], "top");
1356         self.assertEquals(res[0]["objectClass"][1], "person");
1357         self.assertEquals(res[0]["objectClass"][2], "organizationalPerson");
1358         self.assertEquals(res[0]["objectClass"][3], "user");
1359         self.assertEquals(res[0]["objectClass"][4], "computer");
1360         self.assertTrue("objectGUID" in res[0])
1361         self.assertTrue("whenCreated" in res[0])
1362         self.assertEquals(res[0]["objectCategory"][0], ("CN=Computer,CN=Schema,CN=Configuration," + self.base_dn));
1363         self.assertEquals(int(res[0]["primaryGroupID"][0]), 513);
1364         self.assertEquals(int(res[0]["sAMAccountType"][0]), ATYPE_NORMAL_ACCOUNT);
1365         self.assertEquals(int(res[0]["userAccountControl"][0]), UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD | UF_ACCOUNTDISABLE);
1366
1367         self.delete_force(self.ldb, "cn=ldaptestcomputer3,cn=computers," + self.base_dn)
1368
1369         print "Testing attribute or value exists behaviour"
1370         try:
1371             ldb.modify_ldif("""
1372 dn: cn=ldaptest2computer,cn=computers,""" + self.base_dn + """
1373 changetype: modify
1374 replace: servicePrincipalName
1375 servicePrincipalName: host/ldaptest2computer
1376 servicePrincipalName: host/ldaptest2computer
1377 servicePrincipalName: cifs/ldaptest2computer
1378 """)
1379             self.fail()
1380         except LdbError, (num, msg):
1381             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
1382
1383         ldb.modify_ldif("""
1384 dn: cn=ldaptest2computer,cn=computers,""" + self.base_dn + """
1385 changetype: modify
1386 replace: servicePrincipalName
1387 servicePrincipalName: host/ldaptest2computer
1388 servicePrincipalName: cifs/ldaptest2computer
1389 """)
1390         try:
1391             ldb.modify_ldif("""
1392 dn: cn=ldaptest2computer,cn=computers,""" + self.base_dn + """
1393 changetype: modify
1394 add: servicePrincipalName
1395 servicePrincipalName: host/ldaptest2computer
1396 """)
1397             self.fail()
1398         except LdbError, (num, msg):
1399             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
1400
1401         print "Testing ranged results"
1402         ldb.modify_ldif("""
1403 dn: cn=ldaptest2computer,cn=computers,""" + self.base_dn + """
1404 changetype: modify
1405 replace: servicePrincipalName
1406 """)
1407
1408         ldb.modify_ldif("""
1409 dn: cn=ldaptest2computer,cn=computers,""" + self.base_dn + """
1410 changetype: modify
1411 add: servicePrincipalName
1412 servicePrincipalName: host/ldaptest2computer0
1413 servicePrincipalName: host/ldaptest2computer1
1414 servicePrincipalName: host/ldaptest2computer2
1415 servicePrincipalName: host/ldaptest2computer3
1416 servicePrincipalName: host/ldaptest2computer4
1417 servicePrincipalName: host/ldaptest2computer5
1418 servicePrincipalName: host/ldaptest2computer6
1419 servicePrincipalName: host/ldaptest2computer7
1420 servicePrincipalName: host/ldaptest2computer8
1421 servicePrincipalName: host/ldaptest2computer9
1422 servicePrincipalName: host/ldaptest2computer10
1423 servicePrincipalName: host/ldaptest2computer11
1424 servicePrincipalName: host/ldaptest2computer12
1425 servicePrincipalName: host/ldaptest2computer13
1426 servicePrincipalName: host/ldaptest2computer14
1427 servicePrincipalName: host/ldaptest2computer15
1428 servicePrincipalName: host/ldaptest2computer16
1429 servicePrincipalName: host/ldaptest2computer17
1430 servicePrincipalName: host/ldaptest2computer18
1431 servicePrincipalName: host/ldaptest2computer19
1432 servicePrincipalName: host/ldaptest2computer20
1433 servicePrincipalName: host/ldaptest2computer21
1434 servicePrincipalName: host/ldaptest2computer22
1435 servicePrincipalName: host/ldaptest2computer23
1436 servicePrincipalName: host/ldaptest2computer24
1437 servicePrincipalName: host/ldaptest2computer25
1438 servicePrincipalName: host/ldaptest2computer26
1439 servicePrincipalName: host/ldaptest2computer27
1440 servicePrincipalName: host/ldaptest2computer28
1441 servicePrincipalName: host/ldaptest2computer29
1442 """)
1443
1444         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE,
1445                          attrs=["servicePrincipalName;range=0-*"])
1446         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
1447         #print len(res[0]["servicePrincipalName;range=0-*"])
1448         self.assertEquals(len(res[0]["servicePrincipalName;range=0-*"]), 30)
1449
1450         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=0-19"])
1451         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
1452             # print res[0]["servicePrincipalName;range=0-19"].length
1453         self.assertEquals(len(res[0]["servicePrincipalName;range=0-19"]), 20)
1454
1455
1456         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=0-30"])
1457         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
1458         self.assertEquals(len(res[0]["servicePrincipalName;range=0-*"]), 30)
1459
1460         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=0-40"])
1461         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
1462         self.assertEquals(len(res[0]["servicePrincipalName;range=0-*"]), 30)
1463
1464         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=30-40"])
1465         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
1466         self.assertEquals(len(res[0]["servicePrincipalName;range=30-*"]), 0)
1467
1468
1469         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=10-40"])
1470         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
1471         self.assertEquals(len(res[0]["servicePrincipalName;range=10-*"]), 20)
1472         # pos_11 = res[0]["servicePrincipalName;range=10-*"][18]
1473
1474         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=11-40"])
1475         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
1476         self.assertEquals(len(res[0]["servicePrincipalName;range=11-*"]), 19)
1477             # print res[0]["servicePrincipalName;range=11-*"][18]
1478             # print pos_11
1479             # self.assertEquals((res[0]["servicePrincipalName;range=11-*"][18]), pos_11)
1480
1481         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=11-15"])
1482         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
1483         self.assertEquals(len(res[0]["servicePrincipalName;range=11-15"]), 5)
1484             # self.assertEquals(res[0]["servicePrincipalName;range=11-15"][4], pos_11)
1485
1486         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName"])
1487         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
1488             # print res[0]["servicePrincipalName"][18]
1489             # print pos_11
1490         self.assertEquals(len(res[0]["servicePrincipalName"]), 30)
1491             # self.assertEquals(res[0]["servicePrincipalName"][18], pos_11)
1492
1493         self.delete_force(self.ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
1494         ldb.add({
1495             "dn": "cn=ldaptestuser2,cn=useRs," + self.base_dn,
1496             "objectClass": ["person", "user"],
1497             "cn": "LDAPtestUSER2",
1498             "givenname": "testy",
1499             "sn": "ldap user2"})
1500
1501         print "Testing Ambigious Name Resolution"
1502         # Testing ldb.search for (&(anr=ldap testy)(objectClass=user))
1503         res = ldb.search(expression="(&(anr=ldap testy)(objectClass=user))")
1504         self.assertEquals(len(res), 3, "Found only %d of 3 for (&(anr=ldap testy)(objectClass=user))" % len(res))
1505
1506         # Testing ldb.search for (&(anr=testy ldap)(objectClass=user))
1507         res = ldb.search(expression="(&(anr=testy ldap)(objectClass=user))")
1508         self.assertEquals(len(res), 2, "Found only %d of 2 for (&(anr=testy ldap)(objectClass=user))" % len(res))
1509
1510         # Testing ldb.search for (&(anr=ldap)(objectClass=user))
1511         res = ldb.search(expression="(&(anr=ldap)(objectClass=user))")
1512         self.assertEquals(len(res), 4, "Found only %d of 4 for (&(anr=ldap)(objectClass=user))" % len(res))
1513
1514         # Testing ldb.search for (&(anr==ldap)(objectClass=user))
1515         res = ldb.search(expression="(&(anr==ldap)(objectClass=user))")
1516         self.assertEquals(len(res), 1, "Could not find (&(anr==ldap)(objectClass=user)). Found only %d for (&(anr=ldap)(objectClass=user))" % len(res))
1517
1518         self.assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + self.base_dn))
1519         self.assertEquals(res[0]["cn"][0], "ldaptestuser")
1520         self.assertEquals(str(res[0]["name"]), "ldaptestuser")
1521
1522         # Testing ldb.search for (&(anr=testy)(objectClass=user))
1523         res = ldb.search(expression="(&(anr=testy)(objectClass=user))")
1524         self.assertEquals(len(res), 2, "Found only %d for (&(anr=testy)(objectClass=user))" % len(res))
1525
1526         # Testing ldb.search for (&(anr=testy ldap)(objectClass=user))
1527         res = ldb.search(expression="(&(anr=testy ldap)(objectClass=user))")
1528         self.assertEquals(len(res), 2, "Found only %d for (&(anr=testy ldap)(objectClass=user))" % len(res))
1529
1530         # Testing ldb.search for (&(anr==testy ldap)(objectClass=user))
1531 # this test disabled for the moment, as anr with == tests are not understood
1532 #        res = ldb.search(expression="(&(anr==testy ldap)(objectClass=user))")
1533 #        self.assertEquals(len(res), 1, "Found only %d for (&(anr==testy ldap)(objectClass=user))" % len(res))
1534
1535 #        self.assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + self.base_dn))
1536 #        self.assertEquals(res[0]["cn"][0], "ldaptestuser")
1537 #        self.assertEquals(res[0]["name"][0], "ldaptestuser")
1538
1539         # Testing ldb.search for (&(anr==testy ldap)(objectClass=user))
1540 #        res = ldb.search(expression="(&(anr==testy ldap)(objectClass=user))")
1541 #        self.assertEquals(len(res), 1, "Could not find (&(anr==testy ldap)(objectClass=user))")
1542
1543 #        self.assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + self.base_dn))
1544 #        self.assertEquals(res[0]["cn"][0], "ldaptestuser")
1545 #        self.assertEquals(res[0]["name"][0], "ldaptestuser")
1546
1547         # Testing ldb.search for (&(anr=testy ldap user)(objectClass=user))
1548         res = ldb.search(expression="(&(anr=testy ldap user)(objectClass=user))")
1549         self.assertEquals(len(res), 1, "Could not find (&(anr=testy ldap user)(objectClass=user))")
1550
1551         self.assertEquals(str(res[0].dn), ("CN=ldaptestuser2,CN=Users," + self.base_dn))
1552         self.assertEquals(str(res[0]["cn"]), "ldaptestuser2")
1553         self.assertEquals(str(res[0]["name"]), "ldaptestuser2")
1554
1555         # Testing ldb.search for (&(anr==testy ldap user2)(objectClass=user))
1556 #        res = ldb.search(expression="(&(anr==testy ldap user2)(objectClass=user))")
1557 #        self.assertEquals(len(res), 1, "Could not find (&(anr==testy ldap user2)(objectClass=user))")
1558
1559         self.assertEquals(str(res[0].dn), ("CN=ldaptestuser2,CN=Users," + self.base_dn))
1560         self.assertEquals(str(res[0]["cn"]), "ldaptestuser2")
1561         self.assertEquals(str(res[0]["name"]), "ldaptestuser2")
1562
1563         # Testing ldb.search for (&(anr==ldap user2)(objectClass=user))
1564 #        res = ldb.search(expression="(&(anr==ldap user2)(objectClass=user))")
1565 #        self.assertEquals(len(res), 1, "Could not find (&(anr==ldap user2)(objectClass=user))")
1566
1567         self.assertEquals(str(res[0].dn), ("CN=ldaptestuser2,CN=Users," + self.base_dn))
1568         self.assertEquals(str(res[0]["cn"]), "ldaptestuser2")
1569         self.assertEquals(str(res[0]["name"]), "ldaptestuser2")
1570
1571         # Testing ldb.search for (&(anr==not ldap user2)(objectClass=user))
1572 #        res = ldb.search(expression="(&(anr==not ldap user2)(objectClass=user))")
1573 #        self.assertEquals(len(res), 0, "Must not find (&(anr==not ldap user2)(objectClass=user))")
1574
1575         # Testing ldb.search for (&(anr=not ldap user2)(objectClass=user))
1576         res = ldb.search(expression="(&(anr=not ldap user2)(objectClass=user))")
1577         self.assertEquals(len(res), 0, "Must not find (&(anr=not ldap user2)(objectClass=user))")
1578
1579         # Testing ldb.search for (&(anr="testy ldap")(objectClass=user)) (ie, with quotes)
1580 #        res = ldb.search(expression="(&(anr==\"testy ldap\")(objectClass=user))")
1581 #        self.assertEquals(len(res), 0, "Found (&(anr==\"testy ldap\")(objectClass=user))")
1582
1583         print "Testing Renames"
1584
1585         attrs = ["objectGUID", "objectSid"]
1586         print "Testing ldb.search for (&(cn=ldaptestUSer2)(objectClass=user))"
1587         res_user = ldb.search(self.base_dn, expression="(&(cn=ldaptestUSer2)(objectClass=user))", scope=SCOPE_SUBTREE, attrs=attrs)
1588         self.assertEquals(len(res_user), 1, "Could not find (&(cn=ldaptestUSer2)(objectClass=user))")
1589
1590         # Check rename works with extended/alternate DN forms
1591         ldb.rename("<SID=" + ldb.schema_format_value("objectSID", res_user[0]["objectSID"][0]) + ">" , "cn=ldaptestUSER3,cn=users," + self.base_dn)
1592
1593         print "Testing ldb.search for (&(cn=ldaptestuser3)(objectClass=user))"
1594         res = ldb.search(expression="(&(cn=ldaptestuser3)(objectClass=user))")
1595         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestuser3)(objectClass=user))")
1596
1597         self.assertEquals(str(res[0].dn), ("CN=ldaptestUSER3,CN=Users," + self.base_dn))
1598         self.assertEquals(str(res[0]["cn"]), "ldaptestUSER3")
1599         self.assertEquals(str(res[0]["name"]), "ldaptestUSER3")
1600
1601          #"Testing ldb.search for (&(&(cn=ldaptestuser3)(userAccountControl=*))(objectClass=user))"
1602         res = ldb.search(expression="(&(&(cn=ldaptestuser3)(userAccountControl=*))(objectClass=user))")
1603         self.assertEquals(len(res), 1, "(&(&(cn=ldaptestuser3)(userAccountControl=*))(objectClass=user))")
1604
1605         self.assertEquals(str(res[0].dn), ("CN=ldaptestUSER3,CN=Users," + self.base_dn))
1606         self.assertEquals(str(res[0]["cn"]), "ldaptestUSER3")
1607         self.assertEquals(str(res[0]["name"]), "ldaptestUSER3")
1608
1609          #"Testing ldb.search for (&(&(cn=ldaptestuser3)(userAccountControl=546))(objectClass=user))"
1610         res = ldb.search(expression="(&(&(cn=ldaptestuser3)(userAccountControl=546))(objectClass=user))")
1611         self.assertEquals(len(res), 1, "(&(&(cn=ldaptestuser3)(userAccountControl=546))(objectClass=user))")
1612
1613         self.assertEquals(str(res[0].dn), ("CN=ldaptestUSER3,CN=Users," + self.base_dn))
1614         self.assertEquals(str(res[0]["cn"]), "ldaptestUSER3")
1615         self.assertEquals(str(res[0]["name"]), "ldaptestUSER3")
1616
1617          #"Testing ldb.search for (&(&(cn=ldaptestuser3)(userAccountControl=547))(objectClass=user))"
1618         res = ldb.search(expression="(&(&(cn=ldaptestuser3)(userAccountControl=547))(objectClass=user))")
1619         self.assertEquals(len(res), 0, "(&(&(cn=ldaptestuser3)(userAccountControl=547))(objectClass=user))")
1620
1621         # This is a Samba special, and does not exist in real AD
1622         #    print "Testing ldb.search for (dn=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")"
1623         #    res = ldb.search("(dn=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")")
1624         #    if (res.error != 0 || len(res) != 1) {
1625         #        print "Could not find (dn=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")"
1626         #        self.assertEquals(len(res), 1)
1627         #    }
1628         #    self.assertEquals(res[0].dn, ("CN=ldaptestUSER3,CN=Users," + self.base_dn))
1629         #    self.assertEquals(res[0].cn, "ldaptestUSER3")
1630         #    self.assertEquals(res[0].name, "ldaptestUSER3")
1631
1632         print "Testing ldb.search for (distinguishedName=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")"
1633         res = ldb.search(expression="(distinguishedName=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")")
1634         self.assertEquals(len(res), 1, "Could not find (dn=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")")
1635         self.assertEquals(str(res[0].dn), ("CN=ldaptestUSER3,CN=Users," + self.base_dn))
1636         self.assertEquals(str(res[0]["cn"]), "ldaptestUSER3")
1637         self.assertEquals(str(res[0]["name"]), "ldaptestUSER3")
1638
1639         # ensure we cannot add it again
1640         try:
1641             ldb.add({"dn": "cn=ldaptestuser3,cn=userS," + self.base_dn,
1642                       "objectClass": ["person", "user"],
1643                       "cn": "LDAPtestUSER3"})
1644             self.fail()
1645         except LdbError, (num, _):
1646             self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
1647
1648         # rename back
1649         ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "cn=ldaptestuser2,cn=users," + self.base_dn)
1650
1651         # ensure we cannot rename it twice
1652         try:
1653             ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn,
1654                        "cn=ldaptestuser2,cn=users," + self.base_dn)
1655             self.fail()
1656         except LdbError, (num, _):
1657             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
1658
1659         # ensure can now use that name
1660         ldb.add({"dn": "cn=ldaptestuser3,cn=users," + self.base_dn,
1661                       "objectClass": ["person", "user"],
1662                       "cn": "LDAPtestUSER3"})
1663
1664         # ensure we now cannot rename
1665         try:
1666             ldb.rename("cn=ldaptestuser2,cn=users," + self.base_dn, "cn=ldaptestuser3,cn=users," + self.base_dn)
1667             self.fail()
1668         except LdbError, (num, _):
1669             self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
1670         try:
1671             ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "cn=ldaptestuser3,cn=configuration," + self.base_dn)
1672             self.fail()
1673         except LdbError, (num, _):
1674             self.assertTrue(num in (71, 64))
1675
1676         ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "cn=ldaptestuser5,cn=users," + self.base_dn)
1677
1678         ldb.delete("cn=ldaptestuser5,cn=users," + self.base_dn)
1679
1680         self.delete_force(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
1681
1682         ldb.rename("cn=ldaptestgroup,cn=users," + self.base_dn, "cn=ldaptestgroup2,cn=users," + self.base_dn)
1683
1684         print "Testing subtree renames"
1685
1686         ldb.add({"dn": "cn=ldaptestcontainer," + self.base_dn,
1687                  "objectClass": "container"})
1688
1689         ldb.add({"dn": "CN=ldaptestuser4,CN=ldaptestcontainer," + self.base_dn,
1690                  "objectClass": ["person", "user"],
1691                  "cn": "LDAPtestUSER4"})
1692
1693         ldb.modify_ldif("""
1694 dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
1695 changetype: modify
1696 add: member
1697 member: cn=ldaptestuser4,cn=ldaptestcontainer,""" + self.base_dn + """
1698 member: cn=ldaptestcomputer,cn=computers,""" + self.base_dn + """
1699 member: cn=ldaptestuser2,cn=users,""" + self.base_dn + """
1700 """)
1701
1702         print "Testing ldb.rename of cn=ldaptestcontainer," + self.base_dn + " to cn=ldaptestcontainer2," + self.base_dn
1703         ldb.rename("CN=ldaptestcontainer," + self.base_dn, "CN=ldaptestcontainer2," + self.base_dn)
1704
1705         print "Testing ldb.search for (&(cn=ldaptestuser4)(objectClass=user))"
1706         res = ldb.search(expression="(&(cn=ldaptestuser4)(objectClass=user))")
1707         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestuser4)(objectClass=user))")
1708
1709         print "Testing subtree ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in (just renamed from) cn=ldaptestcontainer," + self.base_dn
1710         try:
1711             res = ldb.search("cn=ldaptestcontainer," + self.base_dn,
1712                     expression="(&(cn=ldaptestuser4)(objectClass=user))",
1713                     scope=SCOPE_SUBTREE)
1714             self.fail(res)
1715         except LdbError, (num, _):
1716             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
1717
1718         print "Testing one-level ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in (just renamed from) cn=ldaptestcontainer," + self.base_dn
1719         try:
1720             res = ldb.search("cn=ldaptestcontainer," + self.base_dn,
1721                     expression="(&(cn=ldaptestuser4)(objectClass=user))", scope=SCOPE_ONELEVEL)
1722             self.fail()
1723         except LdbError, (num, _):
1724             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
1725
1726         print "Testing ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in renamed container"
1727         res = ldb.search("cn=ldaptestcontainer2," + self.base_dn, expression="(&(cn=ldaptestuser4)(objectClass=user))", scope=SCOPE_SUBTREE)
1728         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestuser4)(objectClass=user)) under cn=ldaptestcontainer2," + self.base_dn)
1729
1730         self.assertEquals(str(res[0].dn), ("CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn))
1731         self.assertEquals(res[0]["memberOf"][0].upper(), ("CN=ldaptestgroup2,CN=Users," + self.base_dn).upper())
1732
1733         time.sleep(4)
1734
1735         print "Testing ldb.search for (&(member=CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn + ")(objectclass=group)) to check subtree renames and linked attributes"
1736         res = ldb.search(self.base_dn, expression="(&(member=CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn + ")(objectclass=group))", scope=SCOPE_SUBTREE)
1737         self.assertEquals(len(res), 1, "Could not find (&(member=CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn + ")(objectclass=group)), perhaps linked attributes are not consistant with subtree renames?")
1738
1739         print "Testing ldb.rename (into itself) of cn=ldaptestcontainer2," + self.base_dn + " to cn=ldaptestcontainer,cn=ldaptestcontainer2," + self.base_dn
1740         try:
1741             ldb.rename("cn=ldaptestcontainer2," + self.base_dn, "cn=ldaptestcontainer,cn=ldaptestcontainer2," + self.base_dn)
1742             self.fail()
1743         except LdbError, (num, _):
1744             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1745
1746         print "Testing ldb.rename (into non-existent container) of cn=ldaptestcontainer2," + self.base_dn + " to cn=ldaptestcontainer,cn=ldaptestcontainer3," + self.base_dn
1747         try:
1748             ldb.rename("cn=ldaptestcontainer2," + self.base_dn, "cn=ldaptestcontainer,cn=ldaptestcontainer3," + self.base_dn)
1749             self.fail()
1750         except LdbError, (num, _):
1751             self.assertTrue(num in (ERR_UNWILLING_TO_PERFORM, ERR_OTHER))
1752
1753         print "Testing delete (should fail, not a leaf node) of renamed cn=ldaptestcontainer2," + self.base_dn
1754         try:
1755             ldb.delete("cn=ldaptestcontainer2," + self.base_dn)
1756             self.fail()
1757         except LdbError, (num, _):
1758             self.assertEquals(num, ERR_NOT_ALLOWED_ON_NON_LEAF)
1759
1760         print "Testing base ldb.search for CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn
1761         res = ldb.search(expression="(objectclass=*)", base=("CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn), scope=SCOPE_BASE)
1762         self.assertEquals(len(res), 1)
1763         res = ldb.search(expression="(cn=ldaptestuser40)", base=("CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn), scope=SCOPE_BASE)
1764         self.assertEquals(len(res), 0)
1765
1766         print "Testing one-level ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in cn=ldaptestcontainer2," + self.base_dn
1767         res = ldb.search(expression="(&(cn=ldaptestuser4)(objectClass=user))", base=("cn=ldaptestcontainer2," + self.base_dn), scope=SCOPE_ONELEVEL)
1768         # FIXME: self.assertEquals(len(res), 0)
1769
1770         print "Testing one-level ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in cn=ldaptestcontainer2," + self.base_dn
1771         res = ldb.search(expression="(&(cn=ldaptestuser4)(objectClass=user))", base=("cn=ldaptestcontainer2," + self.base_dn), scope=SCOPE_SUBTREE)
1772         # FIXME: self.assertEquals(len(res), 0)
1773
1774         print "Testing delete of subtree renamed "+("CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn)
1775         ldb.delete(("CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn))
1776         print "Testing delete of renamed cn=ldaptestcontainer2," + self.base_dn
1777         ldb.delete("cn=ldaptestcontainer2," + self.base_dn)
1778
1779         ldb.add({"dn": "cn=ldaptestutf8user èùéìòà,cn=users," + self.base_dn, "objectClass": "user"})
1780
1781         ldb.add({"dn": "cn=ldaptestutf8user2  èùéìòà,cn=users," + self.base_dn, "objectClass": "user"})
1782
1783         print "Testing ldb.search for (&(cn=ldaptestuser)(objectClass=user))"
1784         res = ldb.search(expression="(&(cn=ldaptestuser)(objectClass=user))")
1785         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestuser)(objectClass=user))")
1786
1787         self.assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + self.base_dn))
1788         self.assertEquals(str(res[0]["cn"]), "ldaptestuser")
1789         self.assertEquals(str(res[0]["name"]), "ldaptestuser")
1790         self.assertEquals(set(res[0]["objectClass"]), set(["top", "person", "organizationalPerson", "user"]))
1791         self.assertTrue("objectGUID" in res[0])
1792         self.assertTrue("whenCreated" in res[0])
1793         self.assertEquals(str(res[0]["objectCategory"]), ("CN=Person,CN=Schema,CN=Configuration," + self.base_dn))
1794         self.assertEquals(int(res[0]["sAMAccountType"][0]), ATYPE_NORMAL_ACCOUNT)
1795         self.assertEquals(int(res[0]["userAccountControl"][0]), UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD | UF_ACCOUNTDISABLE)
1796         self.assertEquals(res[0]["memberOf"][0].upper(), ("CN=ldaptestgroup2,CN=Users," + self.base_dn).upper())
1797         self.assertEquals(len(res[0]["memberOf"]), 1)
1798
1799         print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=cn=person,cn=schema,cn=configuration," + self.base_dn + "))"
1800         res2 = ldb.search(expression="(&(cn=ldaptestuser)(objectCategory=cn=person,cn=schema,cn=configuration," + self.base_dn + "))")
1801         self.assertEquals(len(res2), 1, "Could not find (&(cn=ldaptestuser)(objectCategory=cn=person,cn=schema,cn=configuration," + self.base_dn + "))")
1802
1803         self.assertEquals(res[0].dn, res2[0].dn)
1804
1805         print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=PerSon))"
1806         res3 = ldb.search(expression="(&(cn=ldaptestuser)(objectCategory=PerSon))")
1807         self.assertEquals(len(res3), 1, "Could not find (&(cn=ldaptestuser)(objectCategory=PerSon)): matched %d" % len(res3))
1808
1809         self.assertEquals(res[0].dn, res3[0].dn)
1810
1811         if gc_ldb is not None:
1812             print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=PerSon)) in Global Catalog"
1813             res3gc = gc_ldb.search(expression="(&(cn=ldaptestuser)(objectCategory=PerSon))")
1814             self.assertEquals(len(res3gc), 1)
1815
1816             self.assertEquals(res[0].dn, res3gc[0].dn)
1817
1818         print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=PerSon)) in with 'phantom root' control"
1819
1820         if gc_ldb is not None:
1821             res3control = gc_ldb.search(self.base_dn, expression="(&(cn=ldaptestuser)(objectCategory=PerSon))", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["search_options:1:2"])
1822             self.assertEquals(len(res3control), 1, "Could not find (&(cn=ldaptestuser)(objectCategory=PerSon)) in Global Catalog")
1823
1824             self.assertEquals(res[0].dn, res3control[0].dn)
1825
1826         ldb.delete(res[0].dn)
1827
1828         print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectClass=user))"
1829         res = ldb.search(expression="(&(cn=ldaptestcomputer)(objectClass=user))")
1830         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestuser)(objectClass=user))")
1831
1832         self.assertEquals(str(res[0].dn), ("CN=ldaptestcomputer,CN=Computers," + self.base_dn))
1833         self.assertEquals(str(res[0]["cn"]), "ldaptestcomputer")
1834         self.assertEquals(str(res[0]["name"]), "ldaptestcomputer")
1835         self.assertEquals(set(res[0]["objectClass"]), set(["top", "person", "organizationalPerson", "user", "computer"]))
1836         self.assertTrue("objectGUID" in res[0])
1837         self.assertTrue("whenCreated" in res[0])
1838         self.assertEquals(str(res[0]["objectCategory"]), ("CN=Computer,CN=Schema,CN=Configuration," + self.base_dn))
1839         self.assertEquals(int(res[0]["primaryGroupID"][0]), 513)
1840         self.assertEquals(int(res[0]["sAMAccountType"][0]), ATYPE_NORMAL_ACCOUNT)
1841         self.assertEquals(int(res[0]["userAccountControl"][0]), UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD | UF_ACCOUNTDISABLE)
1842         self.assertEquals(res[0]["memberOf"][0].upper(), ("CN=ldaptestgroup2,CN=Users," + self.base_dn).upper())
1843         self.assertEquals(len(res[0]["memberOf"]), 1)
1844
1845         print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + "))"
1846         res2 = ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + "))")
1847         self.assertEquals(len(res2), 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + "))")
1848
1849         self.assertEquals(res[0].dn, res2[0].dn)
1850
1851         if gc_ldb is not None:
1852             print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + ")) in Global Catlog"
1853             res2gc = gc_ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + "))")
1854             self.assertEquals(len(res2gc), 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + ")) in Global Catlog")
1855
1856             self.assertEquals(res[0].dn, res2gc[0].dn)
1857
1858         print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=compuTER))"
1859         res3 = ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=compuTER))")
1860         self.assertEquals(len(res3), 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=compuTER))")
1861
1862         self.assertEquals(res[0].dn, res3[0].dn)
1863
1864         if gc_ldb is not None:
1865             print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=compuTER)) in Global Catalog"
1866             res3gc = gc_ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=compuTER))")
1867             self.assertEquals(len(res3gc), 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=compuTER)) in Global Catalog")
1868
1869             self.assertEquals(res[0].dn, res3gc[0].dn)
1870
1871         print "Testing ldb.search for (&(cn=ldaptestcomp*r)(objectCategory=compuTER))"
1872         res4 = ldb.search(expression="(&(cn=ldaptestcomp*r)(objectCategory=compuTER))")
1873         self.assertEquals(len(res4), 1, "Could not find (&(cn=ldaptestcomp*r)(objectCategory=compuTER))")
1874
1875         self.assertEquals(res[0].dn, res4[0].dn)
1876
1877         print "Testing ldb.search for (&(cn=ldaptestcomput*)(objectCategory=compuTER))"
1878         res5 = ldb.search(expression="(&(cn=ldaptestcomput*)(objectCategory=compuTER))")
1879         self.assertEquals(len(res5), 1, "Could not find (&(cn=ldaptestcomput*)(objectCategory=compuTER))")
1880
1881         self.assertEquals(res[0].dn, res5[0].dn)
1882
1883         print "Testing ldb.search for (&(cn=*daptestcomputer)(objectCategory=compuTER))"
1884         res6 = ldb.search(expression="(&(cn=*daptestcomputer)(objectCategory=compuTER))")
1885         self.assertEquals(len(res6), 1, "Could not find (&(cn=*daptestcomputer)(objectCategory=compuTER))")
1886
1887         self.assertEquals(res[0].dn, res6[0].dn)
1888
1889         ldb.delete("<GUID=" + ldb.schema_format_value("objectGUID", res[0]["objectGUID"][0]) + ">")
1890
1891         print "Testing ldb.search for (&(cn=ldaptest2computer)(objectClass=user))"
1892         res = ldb.search(expression="(&(cn=ldaptest2computer)(objectClass=user))")
1893         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptest2computer)(objectClass=user))")
1894
1895         self.assertEquals(str(res[0].dn), "CN=ldaptest2computer,CN=Computers," + self.base_dn)
1896         self.assertEquals(str(res[0]["cn"]), "ldaptest2computer")
1897         self.assertEquals(str(res[0]["name"]), "ldaptest2computer")
1898         self.assertEquals(list(res[0]["objectClass"]), ["top", "person", "organizationalPerson", "user", "computer"])
1899         self.assertTrue("objectGUID" in res[0])
1900         self.assertTrue("whenCreated" in res[0])
1901         self.assertEquals(res[0]["objectCategory"][0], "CN=Computer,CN=Schema,CN=Configuration," + self.base_dn)
1902         self.assertEquals(int(res[0]["sAMAccountType"][0]), ATYPE_WORKSTATION_TRUST)
1903         self.assertEquals(int(res[0]["userAccountControl"][0]), UF_WORKSTATION_TRUST_ACCOUNT)
1904
1905         ldb.delete("<SID=" + ldb.schema_format_value("objectSID", res[0]["objectSID"][0]) + ">")
1906
1907         attrs = ["cn", "name", "objectClass", "objectGUID", "objectSID", "whenCreated", "nTSecurityDescriptor", "memberOf", "allowedAttributes", "allowedAttributesEffective"]
1908         print "Testing ldb.search for (&(cn=ldaptestUSer2)(objectClass=user))"
1909         res_user = ldb.search(self.base_dn, expression="(&(cn=ldaptestUSer2)(objectClass=user))", scope=SCOPE_SUBTREE, attrs=attrs)
1910         self.assertEquals(len(res_user), 1, "Could not find (&(cn=ldaptestUSer2)(objectClass=user))")
1911
1912         self.assertEquals(str(res_user[0].dn), ("CN=ldaptestuser2,CN=Users," + self.base_dn))
1913         self.assertEquals(str(res_user[0]["cn"]), "ldaptestuser2")
1914         self.assertEquals(str(res_user[0]["name"]), "ldaptestuser2")
1915         self.assertEquals(list(res_user[0]["objectClass"]), ["top", "person", "organizationalPerson", "user"])
1916         self.assertTrue("objectSid" in res_user[0])
1917         self.assertTrue("objectGUID" in res_user[0])
1918         self.assertTrue("whenCreated" in res_user[0])
1919         self.assertTrue("nTSecurityDescriptor" in res_user[0])
1920         self.assertTrue("allowedAttributes" in res_user[0])
1921         self.assertTrue("allowedAttributesEffective" in res_user[0])
1922         self.assertEquals(res_user[0]["memberOf"][0].upper(), ("CN=ldaptestgroup2,CN=Users," + self.base_dn).upper())
1923
1924         ldaptestuser2_sid = res_user[0]["objectSid"][0]
1925         ldaptestuser2_guid = res_user[0]["objectGUID"][0]
1926
1927         attrs = ["cn", "name", "objectClass", "objectGUID", "objectSID", "whenCreated", "nTSecurityDescriptor", "member", "allowedAttributes", "allowedAttributesEffective"]
1928         print "Testing ldb.search for (&(cn=ldaptestgroup2)(objectClass=group))"
1929         res = ldb.search(self.base_dn, expression="(&(cn=ldaptestgroup2)(objectClass=group))", scope=SCOPE_SUBTREE, attrs=attrs)
1930         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group))")
1931
1932         self.assertEquals(str(res[0].dn), ("CN=ldaptestgroup2,CN=Users," + self.base_dn))
1933         self.assertEquals(str(res[0]["cn"]), "ldaptestgroup2")
1934         self.assertEquals(str(res[0]["name"]), "ldaptestgroup2")
1935         self.assertEquals(list(res[0]["objectClass"]), ["top", "group"])
1936         self.assertTrue("objectGUID" in res[0])
1937         self.assertTrue("objectSid" in res[0])
1938         self.assertTrue("whenCreated" in res[0])
1939         self.assertTrue("nTSecurityDescriptor" in res[0])
1940         self.assertTrue("allowedAttributes" in res[0])
1941         self.assertTrue("allowedAttributesEffective" in res[0])
1942         memberUP = []
1943         for m in res[0]["member"]:
1944             memberUP.append(m.upper())
1945         self.assertTrue(("CN=ldaptestuser2,CN=Users," + self.base_dn).upper() in memberUP)
1946
1947         res = ldb.search(self.base_dn, expression="(&(cn=ldaptestgroup2)(objectClass=group))", scope=SCOPE_SUBTREE, attrs=attrs, controls=["extended_dn:1:1"])
1948         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group))")
1949
1950         print res[0]["member"]
1951         memberUP = []
1952         for m in res[0]["member"]:
1953             memberUP.append(m.upper())
1954         print ("<GUID=" + ldb.schema_format_value("objectGUID", ldaptestuser2_guid) + ">;<SID=" + ldb.schema_format_value("objectSid", ldaptestuser2_sid) + ">;CN=ldaptestuser2,CN=Users," + self.base_dn).upper()
1955
1956         self.assertTrue(("<GUID=" + ldb.schema_format_value("objectGUID", ldaptestuser2_guid) + ">;<SID=" + ldb.schema_format_value("objectSid", ldaptestuser2_sid) + ">;CN=ldaptestuser2,CN=Users," + self.base_dn).upper() in memberUP)
1957
1958         print "Quicktest for linked attributes"
1959         ldb.modify_ldif("""
1960 dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
1961 changetype: modify
1962 replace: member
1963 member: CN=ldaptestuser2,CN=Users,""" + self.base_dn + """
1964 member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + self.base_dn + """
1965 """)
1966
1967         ldb.modify_ldif("""
1968 dn: <GUID=""" + ldb.schema_format_value("objectGUID", res[0]["objectGUID"][0]) + """>
1969 changetype: modify
1970 replace: member
1971 member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + self.base_dn + """
1972 """)
1973
1974         ldb.modify_ldif("""
1975 dn: <SID=""" + ldb.schema_format_value("objectSid", res[0]["objectSid"][0]) + """>
1976 changetype: modify
1977 delete: member
1978 """)
1979
1980         ldb.modify_ldif("""
1981 dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
1982 changetype: modify
1983 add: member
1984 member: <GUID=""" + ldb.schema_format_value("objectGUID", res[0]["objectGUID"][0]) + """>
1985 member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + self.base_dn + """
1986 """)
1987
1988         ldb.modify_ldif("""
1989 dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
1990 changetype: modify
1991 replace: member
1992 """)
1993
1994         ldb.modify_ldif("""
1995 dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
1996 changetype: modify
1997 add: member
1998 member: <SID=""" + ldb.schema_format_value("objectSid", res_user[0]["objectSid"][0]) + """>
1999 member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + self.base_dn + """
2000 """)
2001
2002         ldb.modify_ldif("""
2003 dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
2004 changetype: modify
2005 delete: member
2006 member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + self.base_dn + """
2007 """)
2008
2009         res = ldb.search(self.base_dn, expression="(&(cn=ldaptestgroup2)(objectClass=group))", scope=SCOPE_SUBTREE, attrs=attrs)
2010         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group))")
2011
2012         self.assertEquals(str(res[0].dn), ("CN=ldaptestgroup2,CN=Users," + self.base_dn))
2013         self.assertEquals(res[0]["member"][0], ("CN=ldaptestuser2,CN=Users," + self.base_dn))
2014         self.assertEquals(len(res[0]["member"]), 1)
2015
2016         ldb.delete(("CN=ldaptestuser2,CN=Users," + self.base_dn))
2017
2018         time.sleep(4)
2019
2020         attrs = ["cn", "name", "objectClass", "objectGUID", "whenCreated", "nTSecurityDescriptor", "member"]
2021         print "Testing ldb.search for (&(cn=ldaptestgroup2)(objectClass=group)) to check linked delete"
2022         res = ldb.search(self.base_dn, expression="(&(cn=ldaptestgroup2)(objectClass=group))", scope=SCOPE_SUBTREE, attrs=attrs)
2023         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group)) to check linked delete")
2024
2025         self.assertEquals(str(res[0].dn), ("CN=ldaptestgroup2,CN=Users," + self.base_dn))
2026         self.assertTrue("member" not in res[0])
2027
2028         print "Testing ldb.search for (&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))"
2029 # TODO UTF8 users don't seem to work fully anymore
2030 #        res = ldb.search(expression="(&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))")
2031         res = ldb.search(expression="(&(cn=ldaptestutf8user èùéìòà)(objectclass=user))")
2032         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))")
2033
2034         self.assertEquals(str(res[0].dn), ("CN=ldaptestutf8user èùéìòà,CN=Users," + self.base_dn))
2035         self.assertEquals(str(res[0]["cn"]), "ldaptestutf8user èùéìòà")
2036         self.assertEquals(str(res[0]["name"]), "ldaptestutf8user èùéìòà")
2037         self.assertEquals(list(res[0]["objectClass"]), ["top", "person", "organizationalPerson", "user"])
2038         self.assertTrue("objectGUID" in res[0])
2039         self.assertTrue("whenCreated" in res[0])
2040
2041         ldb.delete(res[0].dn)
2042
2043         print "Testing ldb.search for (&(cn=ldaptestutf8user2*)(objectClass=user))"
2044         res = ldb.search(expression="(&(cn=ldaptestutf8user2*)(objectClass=user))")
2045         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestutf8user2*)(objectClass=user))")
2046
2047         ldb.delete(res[0].dn)
2048
2049         ldb.delete(("CN=ldaptestgroup2,CN=Users," + self.base_dn))
2050
2051         print "Testing ldb.search for (&(cn=ldaptestutf8user2 ÈÙÉÌÒÀ)(objectClass=user))"
2052 # TODO UTF8 users don't seem to work fully anymore
2053 #        res = ldb.search(expression="(&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))")
2054 #        self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))")
2055
2056         print "Testing that we can't get at the configuration DN from the main search base"
2057         res = ldb.search(self.base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
2058         self.assertEquals(len(res), 0)
2059
2060         print "Testing that we can get at the configuration DN from the main search base on the LDAP port with the 'phantom root' search_options control"
2061         res = ldb.search(self.base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["search_options:1:2"])
2062         self.assertTrue(len(res) > 0)
2063
2064         if gc_ldb is not None:
2065             print "Testing that we can get at the configuration DN from the main search base on the GC port with the search_options control == 0"
2066
2067             res = gc_ldb.search(self.base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["search_options:1:0"])
2068             self.assertTrue(len(res) > 0)
2069
2070             print "Testing that we do find configuration elements in the global catlog"
2071             res = gc_ldb.search(self.base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
2072             self.assertTrue(len(res) > 0)
2073
2074             print "Testing that we do find configuration elements and user elements at the same time"
2075             res = gc_ldb.search(self.base_dn, expression="(|(objectClass=crossRef)(objectClass=person))", scope=SCOPE_SUBTREE, attrs=["cn"])
2076             self.assertTrue(len(res) > 0)
2077
2078             print "Testing that we do find configuration elements in the global catlog, with the configuration basedn"
2079             res = gc_ldb.search(self.configuration_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
2080             self.assertTrue(len(res) > 0)
2081
2082         print "Testing that we can get at the configuration DN on the main LDAP port"
2083         res = ldb.search(self.configuration_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
2084         self.assertTrue(len(res) > 0)
2085
2086         print "Testing objectCategory canonacolisation"
2087         res = ldb.search(self.configuration_dn, expression="objectCategory=ntDsDSA", scope=SCOPE_SUBTREE, attrs=["cn"])
2088         self.assertTrue(len(res) > 0, "Didn't find any records with objectCategory=ntDsDSA")
2089         self.assertTrue(len(res) != 0)
2090
2091         res = ldb.search(self.configuration_dn, expression="objectCategory=CN=ntDs-DSA," + self.schema_dn, scope=SCOPE_SUBTREE, attrs=["cn"])
2092         self.assertTrue(len(res) > 0, "Didn't find any records with objectCategory=CN=ntDs-DSA," + self.schema_dn)
2093         self.assertTrue(len(res) != 0)
2094
2095         print "Testing objectClass attribute order on "+ self.base_dn
2096         res = ldb.search(expression="objectClass=domain", base=self.base_dn,
2097                          scope=SCOPE_BASE, attrs=["objectClass"])
2098         self.assertEquals(len(res), 1)
2099
2100         self.assertEquals(list(res[0]["objectClass"]), ["top", "domain", "domainDNS"])
2101
2102     #  check enumeration
2103
2104         print "Testing ldb.search for objectCategory=person"
2105         res = ldb.search(self.base_dn, expression="objectCategory=person", scope=SCOPE_SUBTREE, attrs=["cn"])
2106         self.assertTrue(len(res) > 0)
2107
2108         print "Testing ldb.search for objectCategory=person with domain scope control"
2109         res = ldb.search(self.base_dn, expression="objectCategory=person", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["domain_scope:1"])
2110         self.assertTrue(len(res) > 0)
2111
2112         print "Testing ldb.search for objectCategory=user"
2113         res = ldb.search(self.base_dn, expression="objectCategory=user", scope=SCOPE_SUBTREE, attrs=["cn"])
2114         self.assertTrue(len(res) > 0)
2115
2116         print "Testing ldb.search for objectCategory=user with domain scope control"
2117         res = ldb.search(self.base_dn, expression="objectCategory=user", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["domain_scope:1"])
2118         self.assertTrue(len(res) > 0)
2119
2120         print "Testing ldb.search for objectCategory=group"
2121         res = ldb.search(self.base_dn, expression="objectCategory=group", scope=SCOPE_SUBTREE, attrs=["cn"])
2122         self.assertTrue(len(res) > 0)
2123
2124         print "Testing ldb.search for objectCategory=group with domain scope control"
2125         res = ldb.search(self.base_dn, expression="objectCategory=group", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["domain_scope:1"])
2126         self.assertTrue(len(res) > 0)
2127
2128         print "Testing creating a user with the posixAccount objectClass"
2129         self.ldb.add_ldif("""dn: cn=posixuser,CN=Users,%s
2130 objectClass: top
2131 objectClass: person
2132 objectClass: posixAccount
2133 objectClass: user
2134 objectClass: organizationalPerson
2135 cn: posixuser
2136 uid: posixuser
2137 sn: posixuser
2138 uidNumber: 10126
2139 gidNumber: 10126
2140 homeDirectory: /home/posixuser
2141 loginShell: /bin/bash
2142 gecos: Posix User;;;
2143 description: A POSIX user"""% (self.base_dn))
2144
2145         print "Testing removing the posixAccount objectClass from an existing user"
2146         self.ldb.modify_ldif("""dn: cn=posixuser,CN=Users,%s
2147 changetype: modify
2148 delete: objectClass
2149 objectClass: posixAccount"""% (self.base_dn))
2150
2151         print "Testing adding the posixAccount objectClass to an existing user"
2152         self.ldb.modify_ldif("""dn: cn=posixuser,CN=Users,%s
2153 changetype: modify
2154 add: objectClass
2155 objectClass: posixAccount"""% (self.base_dn))
2156
2157         self.delete_force(self.ldb, "cn=posixuser,cn=users," + self.base_dn)
2158         self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
2159         self.delete_force(self.ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
2160         self.delete_force(self.ldb, "cn=ldaptestuser3,cn=users," + self.base_dn)
2161         self.delete_force(self.ldb, "cn=ldaptestuser4,cn=ldaptestcontainer," + self.base_dn)
2162         self.delete_force(self.ldb, "cn=ldaptestuser4,cn=ldaptestcontainer2," + self.base_dn)
2163         self.delete_force(self.ldb, "cn=ldaptestuser5,cn=users," + self.base_dn)
2164         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2165         self.delete_force(self.ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
2166         self.delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2167         self.delete_force(self.ldb, "cn=ldaptest2computer,cn=computers," + self.base_dn)
2168         self.delete_force(self.ldb, "cn=ldaptestcomputer3,cn=computers," + self.base_dn)
2169         self.delete_force(self.ldb, "cn=ldaptestutf8user èùéìòà,cn=users," + self.base_dn)
2170         self.delete_force(self.ldb, "cn=ldaptestutf8user2  èùéìòà,cn=users," + self.base_dn)
2171         self.delete_force(self.ldb, "cn=ldaptestcontainer," + self.base_dn)
2172         self.delete_force(self.ldb, "cn=ldaptestcontainer2," + self.base_dn)
2173
2174     def test_security_descriptor_add(self):
2175         """ Testing ldb.add_ldif() for nTSecurityDescriptor """
2176         user_name = "testdescriptoruser1"
2177         user_dn = "CN=%s,CN=Users,%s" % (user_name, self.base_dn)
2178         #
2179         # Test add_ldif() with SDDL security descriptor input
2180         #
2181         self.delete_force(self.ldb, user_dn)
2182         try:
2183             sddl = "O:DUG:DUD:PAI(A;;RPWP;;;AU)S:PAI"
2184             self.ldb.add_ldif("""
2185 dn: """ + user_dn + """
2186 objectclass: user
2187 sAMAccountName: """ + user_name + """
2188 nTSecurityDescriptor: """ + sddl)
2189             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2190             desc = res[0]["nTSecurityDescriptor"][0]
2191             desc = ndr_unpack( security.descriptor, desc )
2192             desc_sddl = desc.as_sddl( self.domain_sid )
2193             self.assertEqual(desc_sddl, sddl)
2194         finally:
2195             self.delete_force(self.ldb, user_dn)
2196         #
2197         # Test add_ldif() with BASE64 security descriptor
2198         #
2199         try:
2200             sddl = "O:DUG:DUD:PAI(A;;RPWP;;;AU)S:PAI"
2201             desc = security.descriptor.from_sddl(sddl, self.domain_sid)
2202             desc_binary = ndr_pack(desc)
2203             desc_base64 = base64.b64encode(desc_binary)
2204             self.ldb.add_ldif("""
2205 dn: """ + user_dn + """
2206 objectclass: user
2207 sAMAccountName: """ + user_name + """
2208 nTSecurityDescriptor:: """ + desc_base64)
2209             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2210             desc = res[0]["nTSecurityDescriptor"][0]
2211             desc = ndr_unpack(security.descriptor, desc)
2212             desc_sddl = desc.as_sddl(self.domain_sid)
2213             self.assertEqual(desc_sddl, sddl)
2214         finally:
2215             self.delete_force(self.ldb, user_dn)
2216
2217     def test_security_descriptor_add_neg(self):
2218         """Test add_ldif() with BASE64 security descriptor input using WRONG domain SID
2219             Negative test
2220         """
2221         user_name = "testdescriptoruser1"
2222         user_dn = "CN=%s,CN=Users,%s" % (user_name, self.base_dn)
2223         self.delete_force(self.ldb, user_dn)
2224         try:
2225             sddl = "O:DUG:DUD:PAI(A;;RPWP;;;AU)S:PAI"
2226             desc = security.descriptor.from_sddl(sddl, security.dom_sid('S-1-5-21'))
2227             desc_base64 = base64.b64encode( ndr_pack(desc) )
2228             self.ldb.add_ldif("""
2229 dn: """ + user_dn + """
2230 objectclass: user
2231 sAMAccountName: """ + user_name + """
2232 nTSecurityDescriptor:: """ + desc_base64)
2233             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2234             self.assertTrue("nTSecurityDescriptor" in res[0])
2235         finally:
2236             self.delete_force(self.ldb, user_dn)
2237
2238     def test_security_descriptor_modify(self):
2239         """ Testing ldb.modify_ldif() for nTSecurityDescriptor """
2240         user_name = "testdescriptoruser2"
2241         user_dn = "CN=%s,CN=Users,%s" % (user_name, self.base_dn)
2242         #
2243         # Delete user object and test modify_ldif() with SDDL security descriptor input
2244         # Add ACE to the original descriptor test
2245         #
2246         try:
2247             self.delete_force(self.ldb, user_dn)
2248             self.ldb.add_ldif("""
2249 dn: """ + user_dn + """
2250 objectclass: user
2251 sAMAccountName: """ + user_name)
2252             # Modify descriptor
2253             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2254             desc = res[0]["nTSecurityDescriptor"][0]
2255             desc = ndr_unpack(security.descriptor, desc)
2256             desc_sddl = desc.as_sddl(self.domain_sid)
2257             sddl = desc_sddl[:desc_sddl.find("(")] + "(A;;RPWP;;;AU)" + desc_sddl[desc_sddl.find("("):]
2258             mod = """
2259 dn: """ + user_dn + """
2260 changetype: modify
2261 replace: nTSecurityDescriptor
2262 nTSecurityDescriptor: """ + sddl
2263             self.ldb.modify_ldif(mod)
2264             # Read modified descriptor
2265             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2266             desc = res[0]["nTSecurityDescriptor"][0]
2267             desc = ndr_unpack(security.descriptor, desc)
2268             desc_sddl = desc.as_sddl(self.domain_sid)
2269             self.assertEqual(desc_sddl, sddl)
2270         finally:
2271             self.delete_force(self.ldb, user_dn)
2272         #
2273         # Test modify_ldif() with SDDL security descriptor input
2274         # New desctiptor test
2275         #
2276         try:
2277             self.ldb.add_ldif("""
2278 dn: """ + user_dn + """
2279 objectclass: user
2280 sAMAccountName: """ + user_name)
2281             # Modify descriptor
2282             sddl = "O:DUG:DUD:PAI(A;;RPWP;;;AU)S:PAI"
2283             mod = """
2284 dn: """ + user_dn + """
2285 changetype: modify
2286 replace: nTSecurityDescriptor
2287 nTSecurityDescriptor: """ + sddl
2288             self.ldb.modify_ldif(mod)
2289             # Read modified descriptor
2290             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2291             desc = res[0]["nTSecurityDescriptor"][0]
2292             desc = ndr_unpack(security.descriptor, desc)
2293             desc_sddl = desc.as_sddl(self.domain_sid)
2294             self.assertEqual(desc_sddl, sddl)
2295         finally:
2296             self.delete_force(self.ldb, user_dn)
2297         #
2298         # Test modify_ldif() with BASE64 security descriptor input
2299         # Add ACE to the original descriptor test
2300         #
2301         try:
2302             self.ldb.add_ldif("""
2303 dn: """ + user_dn + """
2304 objectclass: user
2305 sAMAccountName: """ + user_name)
2306             # Modify descriptor
2307             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2308             desc = res[0]["nTSecurityDescriptor"][0]
2309             desc = ndr_unpack(security.descriptor, desc)
2310             desc_sddl = desc.as_sddl(self.domain_sid)
2311             sddl = desc_sddl[:desc_sddl.find("(")] + "(A;;RPWP;;;AU)" + desc_sddl[desc_sddl.find("("):]
2312             desc = security.descriptor.from_sddl(sddl, self.domain_sid)
2313             desc_base64 = base64.b64encode(ndr_pack(desc))
2314             mod = """
2315 dn: """ + user_dn + """
2316 changetype: modify
2317 replace: nTSecurityDescriptor
2318 nTSecurityDescriptor:: """ + desc_base64
2319             self.ldb.modify_ldif(mod)
2320             # Read modified descriptor
2321             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2322             desc = res[0]["nTSecurityDescriptor"][0]
2323             desc = ndr_unpack(security.descriptor, desc)
2324             desc_sddl = desc.as_sddl(self.domain_sid)
2325             self.assertEqual(desc_sddl, sddl)
2326         finally:
2327             self.delete_force(self.ldb, user_dn)
2328         #
2329         # Test modify_ldif() with BASE64 security descriptor input
2330         # New descriptor test
2331         #
2332         try:
2333             self.delete_force(self.ldb, user_dn)
2334             self.ldb.add_ldif("""
2335 dn: """ + user_dn + """
2336 objectclass: user
2337 sAMAccountName: """ + user_name)
2338             # Modify descriptor
2339             sddl = "O:DUG:DUD:PAI(A;;RPWP;;;AU)S:PAI"
2340             desc = security.descriptor.from_sddl(sddl, self.domain_sid)
2341             desc_base64 = base64.b64encode(ndr_pack(desc))
2342             mod = """
2343 dn: """ + user_dn + """
2344 changetype: modify
2345 replace: nTSecurityDescriptor
2346 nTSecurityDescriptor:: """ + desc_base64
2347             self.ldb.modify_ldif(mod)
2348             # Read modified descriptor
2349             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2350             desc = res[0]["nTSecurityDescriptor"][0]
2351             desc = ndr_unpack(security.descriptor, desc)
2352             desc_sddl = desc.as_sddl(self.domain_sid)
2353             self.assertEqual(desc_sddl, sddl)
2354         finally:
2355             self.delete_force(self.ldb, user_dn)
2356
2357
2358 class BaseDnTests(unittest.TestCase):
2359
2360     def setUp(self):
2361         super(BaseDnTests, self).setUp()
2362         self.ldb = ldb
2363
2364     def test_rootdse_attrs(self):
2365         """Testing for all rootDSE attributes"""
2366         res = self.ldb.search(scope=SCOPE_BASE, attrs=[])
2367         self.assertEquals(len(res), 1)
2368
2369     def test_highestcommittedusn(self):
2370         """Testing for highestCommittedUSN"""
2371         res = self.ldb.search("", scope=SCOPE_BASE, attrs=["highestCommittedUSN"])
2372         self.assertEquals(len(res), 1)
2373         self.assertTrue(int(res[0]["highestCommittedUSN"][0]) != 0)
2374
2375     def test_netlogon(self):
2376         """Testing for netlogon via LDAP"""
2377         res = self.ldb.search("", scope=SCOPE_BASE, attrs=["netlogon"])
2378         self.assertEquals(len(res), 0)
2379
2380     def test_netlogon_highestcommitted_usn(self):
2381         """Testing for netlogon and highestCommittedUSN via LDAP"""
2382         res = self.ldb.search("", scope=SCOPE_BASE,
2383                 attrs=["netlogon", "highestCommittedUSN"])
2384         self.assertEquals(len(res), 0)
2385
2386     def test_namingContexts(self):
2387         """Testing for namingContexts in rootDSE"""
2388         res = self.ldb.search("", scope=SCOPE_BASE,
2389                 attrs=["namingContexts", "defaultNamingContext", "schemaNamingContext", "configurationNamingContext"])
2390         self.assertEquals(len(res), 1)
2391
2392         ncs = set([])
2393         for nc in res[0]["namingContexts"]:
2394             self.assertTrue(nc not in ncs)
2395             ncs.add(nc)
2396
2397         self.assertTrue(res[0]["defaultNamingContext"][0] in ncs)
2398         self.assertTrue(res[0]["configurationNamingContext"][0] in ncs)
2399         self.assertTrue(res[0]["schemaNamingContext"][0] in ncs)
2400
2401     def test_serverPath(self):
2402         """Testing the server paths in rootDSE"""
2403         res = self.ldb.search("", scope=SCOPE_BASE,
2404                               attrs=["dsServiceName", "serverName"])
2405         self.assertEquals(len(res), 1)
2406
2407         self.assertTrue("CN=Servers" in res[0]["dsServiceName"][0])
2408         self.assertTrue("CN=Sites" in res[0]["dsServiceName"][0])
2409         self.assertTrue("CN=NTDS Settings" in res[0]["dsServiceName"][0])
2410         self.assertTrue("CN=Servers" in res[0]["serverName"][0])
2411         self.assertTrue("CN=Sites" in res[0]["serverName"][0])
2412         self.assertFalse("CN=NTDS Settings" in res[0]["serverName"][0])
2413
2414     def test_dnsHostname(self):
2415         """Testing the DNS hostname in rootDSE"""
2416         res = self.ldb.search("", scope=SCOPE_BASE,
2417                               attrs=["dnsHostName", "serverName"])
2418         self.assertEquals(len(res), 1)
2419
2420         res2 = self.ldb.search(res[0]["serverName"][0], scope=SCOPE_BASE,
2421                                attrs=["dNSHostName"])
2422         self.assertEquals(len(res2), 1)
2423
2424         self.assertEquals(res[0]["dnsHostName"][0], res2[0]["dNSHostName"][0])
2425
2426     def test_ldapServiceName(self):
2427         """Testing the ldap service name in rootDSE"""
2428         res = self.ldb.search("", scope=SCOPE_BASE,
2429                               attrs=["ldapServiceName", "dNSHostName"])
2430         self.assertEquals(len(res), 1)
2431
2432         (hostname, _, dns_domainname) = res[0]["dNSHostName"][0].partition(".")
2433         self.assertTrue(":%s$@%s" % (hostname, dns_domainname.upper())
2434                         in res[0]["ldapServiceName"][0])
2435
2436 if not "://" in host:
2437     if os.path.isfile(host):
2438         host = "tdb://%s" % host
2439     else:
2440         host = "ldap://%s" % host
2441
2442 ldb = Ldb(host, credentials=creds, session_info=system_session(), lp=lp)
2443 if not "tdb://" in host:
2444     gc_ldb = Ldb("%s:3268" % host, credentials=creds,
2445                  session_info=system_session(), lp=lp)
2446 else:
2447     gc_ldb = None
2448
2449 runner = SubunitTestRunner()
2450 rc = 0
2451 if not runner.run(unittest.makeSuite(BaseDnTests)).wasSuccessful():
2452     rc = 1
2453 if not runner.run(unittest.makeSuite(BasicTests)).wasSuccessful():
2454     rc = 1
2455 sys.exit(rc)