source4/dsdb/tests/python/ldap.py

   1 #!/usr/bin/env python
   2 # -*- coding: utf-8 -*-
   3 # This is a port of the original in testprogs/ejs/ldap.js
   4
   5 import optparse
   6 import sys
   7 import time
   8 import base64
   9 import os
  10
  11 sys.path.append("bin/python")
  12 import samba
  13 samba.ensure_external_module("subunit", "subunit/python")
  14 samba.ensure_external_module("testtools", "testtools")
  15
  16 import samba.getopt as options
  17
  18 from samba.auth import system_session
  19 from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError
  20 from ldb import ERR_NO_SUCH_OBJECT, ERR_ATTRIBUTE_OR_VALUE_EXISTS
  21 from ldb import ERR_ENTRY_ALREADY_EXISTS, ERR_UNWILLING_TO_PERFORM
  22 from ldb import ERR_NOT_ALLOWED_ON_NON_LEAF, ERR_OTHER, ERR_INVALID_DN_SYNTAX
  23 from ldb import ERR_NO_SUCH_ATTRIBUTE
  24 from ldb import ERR_OBJECT_CLASS_VIOLATION, ERR_NOT_ALLOWED_ON_RDN
  25 from ldb import ERR_NAMING_VIOLATION, ERR_CONSTRAINT_VIOLATION
  26 from ldb import ERR_UNDEFINED_ATTRIBUTE_TYPE
  27 from ldb import Message, MessageElement, Dn
  28 from ldb import FLAG_MOD_ADD, FLAG_MOD_REPLACE, FLAG_MOD_DELETE
  29 from samba import Ldb
  30 from samba.dsdb import (UF_NORMAL_ACCOUNT, UF_INTERDOMAIN_TRUST_ACCOUNT,
  31     UF_WORKSTATION_TRUST_ACCOUNT, UF_SERVER_TRUST_ACCOUNT,
  32     UF_PARTIAL_SECRETS_ACCOUNT,
  33     UF_PASSWD_NOTREQD, UF_ACCOUNTDISABLE, ATYPE_NORMAL_ACCOUNT,
  34     ATYPE_WORKSTATION_TRUST, SYSTEM_FLAG_DOMAIN_DISALLOW_MOVE)
  35 from samba.dcerpc.security import (DOMAIN_RID_USERS, DOMAIN_RID_DOMAIN_MEMBERS,
  36     DOMAIN_RID_DCS, DOMAIN_RID_READONLY_DCS)
  37
  38 from subunit.run import SubunitTestRunner
  39 import unittest
  40
  41 from samba.ndr import ndr_pack, ndr_unpack
  42 from samba.dcerpc import security
  43
  44 parser = optparse.OptionParser("ldap [options] <host>")
  45 sambaopts = options.SambaOptions(parser)
  46 parser.add_option_group(sambaopts)
  47 parser.add_option_group(options.VersionOptions(parser))
  48 # use command line creds if available
  49 credopts = options.CredentialsOptions(parser)
  50 parser.add_option_group(credopts)
  51 opts, args = parser.parse_args()
  52
  53 if len(args) < 1:
  54     parser.print_usage()
  55     sys.exit(1)
  56
  57 host = args[0]
  58
  59 lp = sambaopts.get_loadparm()
  60 creds = credopts.get_credentials(lp)
  61
  62 class BasicTests(unittest.TestCase):
  63
  64     def delete_force(self, ldb, dn):
  65         try:
  66             ldb.delete(dn)
  67         except LdbError, (num, _):
  68             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
  69
  70     def find_basedn(self, ldb):
  71         res = ldb.search(base="", expression="", scope=SCOPE_BASE,
  72                          attrs=["defaultNamingContext"])
  73         self.assertEquals(len(res), 1)
  74         return res[0]["defaultNamingContext"][0]
  75
  76     def find_configurationdn(self, ldb):
  77         res = ldb.search(base="", expression="", scope=SCOPE_BASE, attrs=["configurationNamingContext"])
  78         self.assertEquals(len(res), 1)
  79         return res[0]["configurationNamingContext"][0]
  80
  81     def find_schemadn(self, ldb):
  82         res = ldb.search(base="", expression="", scope=SCOPE_BASE, attrs=["schemaNamingContext"])
  83         self.assertEquals(len(res), 1)
  84         return res[0]["schemaNamingContext"][0]
  85
  86     def find_domain_sid(self):
  87         res = self.ldb.search(base=self.base_dn, expression="(objectClass=*)", scope=SCOPE_BASE)
  88         return ndr_unpack( security.dom_sid,res[0]["objectSid"][0])
  89
  90     def setUp(self):
  91         super(BasicTests, self).setUp()
  92         self.ldb = ldb
  93         self.gc_ldb = gc_ldb
  94         self.base_dn = self.find_basedn(ldb)
  95         self.configuration_dn = self.find_configurationdn(ldb)
  96         self.schema_dn = self.find_schemadn(ldb)
  97         self.domain_sid = self.find_domain_sid()
  98
  99         print "baseDN: %s\n" % self.base_dn
 100
 101         self.delete_force(self.ldb, "cn=posixuser,cn=users," + self.base_dn)
 102         self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 103         self.delete_force(self.ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
 104         self.delete_force(self.ldb, "cn=ldaptestuser3,cn=users," + self.base_dn)
 105         self.delete_force(self.ldb, "cn=ldaptestuser4,cn=ldaptestcontainer," + self.base_dn)
 106         self.delete_force(self.ldb, "cn=ldaptestuser4,cn=ldaptestcontainer2," + self.base_dn)
 107         self.delete_force(self.ldb, "cn=ldaptestuser5,cn=users," + self.base_dn)
 108         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 109         self.delete_force(self.ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 110         self.delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
 111         self.delete_force(self.ldb, "cn=ldaptest2computer,cn=computers," + self.base_dn)
 112         self.delete_force(self.ldb, "cn=ldaptestcomputer3,cn=computers," + self.base_dn)
 113         self.delete_force(self.ldb, "cn=ldaptestutf8user èùéìòà,cn=users," + self.base_dn)
 114         self.delete_force(self.ldb, "cn=ldaptestutf8user2  èùéìòà,cn=users," + self.base_dn)
 115         self.delete_force(self.ldb, "cn=entry1,cn=ldaptestcontainer," + self.base_dn)
 116         self.delete_force(self.ldb, "cn=entry2,cn=ldaptestcontainer," + self.base_dn)
 117         self.delete_force(self.ldb, "cn=ldaptestcontainer," + self.base_dn)
 118         self.delete_force(self.ldb, "cn=ldaptestcontainer2," + self.base_dn)
 119         self.delete_force(self.ldb, "cn=parentguidtest,cn=users," + self.base_dn)
 120         self.delete_force(self.ldb, "cn=parentguidtest,cn=testotherusers," + self.base_dn)
 121         self.delete_force(self.ldb, "cn=testotherusers," + self.base_dn)
 122         self.delete_force(self.ldb, "cn=ldaptestobject," + self.base_dn)
 123         self.delete_force(self.ldb, "description=xyz,cn=users," + self.base_dn)
 124         self.delete_force(self.ldb, "ou=testou,cn=users," + self.base_dn)
 125         self.delete_force(self.ldb, "cn=testsecret,cn=system," + self.base_dn)
 126
 127     def test_objectclasses(self):
 128         """Test objectClass behaviour"""
 129         print "Test objectClass behaviour"""
 130
 131         # We cannot create LSA-specific objects (oc "secret" or "trustedDomain")
 132         try:
 133             self.ldb.add({
 134                 "dn": "cn=testsecret,cn=system," + self.base_dn,
 135                 "objectClass": "secret" })
 136             self.fail()
 137         except LdbError, (num, _):
 138             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 139
 140         # Invalid objectclass specified
 141         try:
 142             self.ldb.add({
 143                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 144                 "objectClass": "X" })
 145             self.fail()
 146         except LdbError, (num, _):
 147             self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
 148
 149         # Invalid objectCategory specified
 150         try:
 151             self.ldb.add({
 152                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 153                 "objectClass": "person",
 154                 "objectCategory": self.base_dn })
 155             self.fail()
 156         except LdbError, (num, _):
 157             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 158
 159         # Multi-valued "systemFlags"
 160         try:
 161             self.ldb.add({
 162                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 163                 "objectClass": "person",
 164                 "systemFlags": ["0", str(SYSTEM_FLAG_DOMAIN_DISALLOW_MOVE)] })
 165             self.fail()
 166         except LdbError, (num, _):
 167             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 168
 169         # We cannot instanciate from an abstract objectclass
 170         try:
 171             self.ldb.add({
 172                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 173                 "objectClass": "connectionPoint" })
 174             self.fail()
 175         except LdbError, (num, _):
 176             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 177
 178         self.ldb.add({
 179              "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 180              "objectClass": "person" })
 181
 182         # We can remove derivation classes of the structural objectclass
 183         # but they're going to be readded afterwards
 184         m = Message()
 185         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 186         m["objectClass"] = MessageElement("top", FLAG_MOD_DELETE,
 187           "objectClass")
 188         ldb.modify(m)
 189
 190         res = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 191                          scope=SCOPE_BASE, attrs=["objectClass"])
 192         self.assertTrue(len(res) == 1)
 193         self.assertTrue("top" in res[0]["objectClass"])
 194
 195         # The top-most structural class cannot be deleted since there are
 196         # attributes of it in use
 197         m = Message()
 198         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 199         m["objectClass"] = MessageElement("person", FLAG_MOD_DELETE,
 200           "objectClass")
 201         try:
 202             ldb.modify(m)
 203             self.fail()
 204         except LdbError, (num, _):
 205             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 206
 207         # We cannot delete classes which weren't specified
 208         m = Message()
 209         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 210         m["objectClass"] = MessageElement("computer", FLAG_MOD_DELETE,
 211           "objectClass")
 212         try:
 213             ldb.modify(m)
 214             self.fail()
 215         except LdbError, (num, _):
 216             self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
 217
 218         # An invalid class cannot be added
 219         m = Message()
 220         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 221         m["objectClass"] = MessageElement("X", FLAG_MOD_ADD,
 222           "objectClass")
 223         try:
 224             ldb.modify(m)
 225             self.fail()
 226         except LdbError, (num, _):
 227             self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
 228
 229         # The top-most structural class cannot be changed by adding another
 230         # structural one
 231         m = Message()
 232         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 233         m["objectClass"] = MessageElement("user", FLAG_MOD_ADD,
 234           "objectClass")
 235         try:
 236             ldb.modify(m)
 237             self.fail()
 238         except LdbError, (num, _):
 239             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 240
 241         # An already specified objectclass cannot be added another time
 242         m = Message()
 243         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 244         m["objectClass"] = MessageElement("person", FLAG_MOD_ADD,
 245           "objectClass")
 246         try:
 247             ldb.modify(m)
 248             self.fail()
 249         except LdbError, (num, _):
 250             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 251
 252         # Auxiliary classes can always be added
 253         m = Message()
 254         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 255         m["objectClass"] = MessageElement("bootableDevice", FLAG_MOD_ADD,
 256           "objectClass")
 257         ldb.modify(m)
 258
 259         # It's only possible to replace with the same objectclass combination.
 260         # So the replace action on "objectClass" attributes is really useless.
 261         m = Message()
 262         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 263         m["objectClass"] = MessageElement(["top", "person", "bootableDevice"],
 264           FLAG_MOD_REPLACE, "objectClass")
 265         ldb.modify(m)
 266
 267         m = Message()
 268         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 269         m["objectClass"] = MessageElement(["person", "bootableDevice"],
 270           FLAG_MOD_REPLACE, "objectClass")
 271         ldb.modify(m)
 272
 273         m = Message()
 274         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 275         m["objectClass"] = MessageElement(["top", "person", "bootableDevice",
 276           "connectionPoint"], FLAG_MOD_REPLACE, "objectClass")
 277         try:
 278             ldb.modify(m)
 279             self.fail()
 280         except LdbError, (num, _):
 281             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 282
 283         m = Message()
 284         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 285         m["objectClass"] = MessageElement(["top", "computer"], FLAG_MOD_REPLACE,
 286           "objectClass")
 287         try:
 288             ldb.modify(m)
 289             self.fail()
 290         except LdbError, (num, _):
 291             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 292
 293         # Classes can be removed unless attributes of them are used.
 294         m = Message()
 295         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 296         m["objectClass"] = MessageElement("bootableDevice", FLAG_MOD_DELETE,
 297           "objectClass")
 298         ldb.modify(m)
 299
 300         res = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 301                          scope=SCOPE_BASE, attrs=["objectClass"])
 302         self.assertTrue(len(res) == 1)
 303         self.assertFalse("bootableDevice" in res[0]["objectClass"])
 304
 305         m = Message()
 306         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 307         m["objectClass"] = MessageElement("bootableDevice", FLAG_MOD_ADD,
 308           "objectClass")
 309         ldb.modify(m)
 310
 311         # Add an attribute specific to the "bootableDevice" class
 312         m = Message()
 313         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 314         m["bootParameter"] = MessageElement("test", FLAG_MOD_ADD,
 315           "bootParameter")
 316         ldb.modify(m)
 317
 318         # Classes can be removed unless attributes of them are used. Now there
 319         # exist such attributes on the entry.
 320         m = Message()
 321         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 322         m["objectClass"] = MessageElement("bootableDevice", FLAG_MOD_DELETE,
 323           "objectClass")
 324         try:
 325             ldb.modify(m)
 326             self.fail()
 327         except LdbError, (num, _):
 328             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 329
 330         # Remove the previously specified attribute
 331         m = Message()
 332         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 333         m["bootParameter"] = MessageElement("test", FLAG_MOD_DELETE,
 334           "bootParameter")
 335         ldb.modify(m)
 336
 337         # Classes can be removed unless attributes of them are used.
 338         m = Message()
 339         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 340         m["objectClass"] = MessageElement("bootableDevice", FLAG_MOD_DELETE,
 341           "objectClass")
 342         ldb.modify(m)
 343
 344         self.delete_force(self.ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
 345
 346     def test_system_only(self):
 347         """Test systemOnly objects"""
 348         print "Test systemOnly objects"""
 349
 350         try:
 351             self.ldb.add({
 352                 "dn": "cn=ldaptestobject," + self.base_dn,
 353                 "objectclass": "configuration"})
 354             self.fail()
 355         except LdbError, (num, _):
 356             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 357
 358         try:
 359             self.ldb.add({
 360                 "dn": "cn=testsecret,cn=system," + self.base_dn,
 361                 "objectclass": "secret"})
 362             self.fail()
 363         except LdbError, (num, _):
 364             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 365
 366         self.delete_force(self.ldb, "cn=ldaptestobject," + self.base_dn)
 367         self.delete_force(self.ldb, "cn=testsecret,cn=system," + self.base_dn)
 368
 369     def test_invalid_parent(self):
 370         """Test adding an object with invalid parent"""
 371         print "Test adding an object with invalid parent"""
 372
 373         try:
 374             self.ldb.add({
 375                 "dn": "cn=ldaptestgroup,cn=thisdoesnotexist123,"
 376                    + self.base_dn,
 377                 "objectclass": "group"})
 378             self.fail()
 379         except LdbError, (num, _):
 380             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
 381
 382         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=thisdoesnotexist123,"
 383           + self.base_dn)
 384
 385         try:
 386             self.ldb.add({
 387                 "dn": "ou=testou,cn=users," + self.base_dn,
 388                 "objectclass": "organizationalUnit"})
 389             self.fail()
 390         except LdbError, (num, _):
 391             self.assertEquals(num, ERR_NAMING_VIOLATION)
 392
 393         self.delete_force(self.ldb, "ou=testou,cn=users," + self.base_dn)
 394
 395     def test_invalid_attribute(self):
 396         """Test invalid attributes on schema/objectclasses"""
 397         print "Test invalid attributes on schema/objectclasses"""
 398
 399         # attributes not in schema test
 400
 401         # add operation
 402
 403         try:
 404             self.ldb.add({
 405                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 406                 "objectclass": "group",
 407                 "thisdoesnotexist": "x"})
 408             self.fail()
 409         except LdbError, (num, _):
 410             self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
 411
 412         self.ldb.add({
 413              "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 414              "objectclass": "group"})
 415
 416         # modify operation
 417
 418         m = Message()
 419         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 420         m["thisdoesnotexist"] = MessageElement("x", FLAG_MOD_REPLACE,
 421           "thisdoesnotexist")
 422         try:
 423             ldb.modify(m)
 424             self.fail()
 425         except LdbError, (num, _):
 426             self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
 427
 428         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 429
 430         # attributes not in objectclasses and mandatory attributes missing test
 431         # Use here a non-SAM entry since it doesn't have special triggers
 432         # associated which have an impact on the error results.
 433
 434         # add operations
 435
 436         # mandatory attribute missing
 437         try:
 438             self.ldb.add({
 439                 "dn": "cn=ldaptestobject," + self.base_dn,
 440                 "objectclass": "ipProtocol"})
 441             self.fail()
 442         except LdbError, (num, _):
 443             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 444
 445         # inadequate but schema-valid attribute specified
 446         try:
 447             self.ldb.add({
 448                 "dn": "cn=ldaptestobject," + self.base_dn,
 449                 "objectclass": "ipProtocol",
 450                 "ipProtocolNumber": "1",
 451                 "uid" : "0"})
 452             self.fail()
 453         except LdbError, (num, _):
 454             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 455
 456         self.ldb.add({
 457             "dn": "cn=ldaptestobject," + self.base_dn,
 458             "objectclass": "ipProtocol",
 459             "ipProtocolNumber": "1"})
 460
 461         # modify operations
 462
 463         # inadequate but schema-valid attribute add trial
 464         m = Message()
 465         m.dn = Dn(ldb, "cn=ldaptestobject," + self.base_dn)
 466         m["uid"] = MessageElement("0", FLAG_MOD_ADD, "uid")
 467         try:
 468             ldb.modify(m)
 469             self.fail()
 470         except LdbError, (num, _):
 471             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 472
 473         # mandatory attribute delete trial
 474         m = Message()
 475         m.dn = Dn(ldb, "cn=ldaptestobject," + self.base_dn)
 476         m["ipProtocolNumber"] = MessageElement([], FLAG_MOD_DELETE,
 477           "ipProtocolNumber")
 478         try:
 479             ldb.modify(m)
 480             self.fail()
 481         except LdbError, (num, _):
 482             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 483
 484         # mandatory attribute delete trial
 485         m = Message()
 486         m.dn = Dn(ldb, "cn=ldaptestobject," + self.base_dn)
 487         m["ipProtocolNumber"] = MessageElement([], FLAG_MOD_REPLACE,
 488           "ipProtocolNumber")
 489         try:
 490             ldb.modify(m)
 491             self.fail()
 492         except LdbError, (num, _):
 493             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 494
 495         self.delete_force(self.ldb, "cn=ldaptestobject," + self.base_dn)
 496
 497     def test_single_valued_attributes(self):
 498         """Test single-valued attributes"""
 499         print "Test single-valued attributes"""
 500
 501         try:
 502             self.ldb.add({
 503                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 504                 "objectclass": "group",
 505                 "sAMAccountName": ["nam1", "nam2"]})
 506             self.fail()
 507         except LdbError, (num, _):
 508             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 509
 510         self.ldb.add({
 511              "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 512              "objectclass": "group"})
 513
 514         m = Message()
 515         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 516         m["sAMAccountName"] = MessageElement(["nam1","nam2"], FLAG_MOD_REPLACE,
 517           "sAMAccountName")
 518         try:
 519             ldb.modify(m)
 520             self.fail()
 521         except LdbError, (num, _):
 522             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 523
 524         m = Message()
 525         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 526         m["sAMAccountName"] = MessageElement("testgroupXX", FLAG_MOD_REPLACE,
 527           "sAMAccountName")
 528         ldb.modify(m)
 529
 530         m = Message()
 531         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 532         m["sAMAccountName"] = MessageElement("testgroupXX2", FLAG_MOD_ADD,
 533           "sAMAccountName")
 534         try:
 535             ldb.modify(m)
 536             self.fail()
 537         except LdbError, (num, _):
 538             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 539
 540         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 541
 542     def test_multi_valued_attributes(self):
 543         """Test multi-valued attributes"""
 544         print "Test multi-valued attributes"""
 545
 546 # TODO: In this test I added some special tests where I got very unusual
 547 # results back from a real AD. s4 doesn't match them and I've no idea how to
 548 # implement those error cases (maybe there exists a special trigger for
 549 # "description" attributes which handle them)
 550
 551         self.ldb.add({
 552             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 553             "description": "desc2",
 554             "objectclass": "group",
 555             "description": "desc1"})
 556
 557         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 558
 559         self.ldb.add({
 560             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 561             "objectclass": "group",
 562             "description": ["desc1", "desc2"]})
 563
 564 #        m = Message()
 565 #        m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 566 #        m["description"] = MessageElement(["desc1","desc2"], FLAG_MOD_REPLACE,
 567 #          "description")
 568 #        try:
 569 #            ldb.modify(m)
 570 #            self.fail()
 571 #        except LdbError, (num, _):
 572 #            self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 573
 574         m = Message()
 575         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 576         m["description"] = MessageElement("desc1", FLAG_MOD_REPLACE,
 577           "description")
 578         ldb.modify(m)
 579
 580 #        m = Message()
 581 #        m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 582 #        m["description"] = MessageElement("desc3", FLAG_MOD_ADD,
 583 #          "description")
 584 #        try:
 585 #            ldb.modify(m)
 586 #            self.fail()
 587 #        except LdbError, (num, _):
 588 #            self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 589
 590         m = Message()
 591         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 592         m["description"] = MessageElement(["desc1","desc2"], FLAG_MOD_DELETE,
 593           "description")
 594         try:
 595             ldb.modify(m)
 596             self.fail()
 597         except LdbError, (num, _):
 598             self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
 599
 600         m = Message()
 601         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 602         m["description"] = MessageElement("desc1", FLAG_MOD_DELETE,
 603           "description")
 604         ldb.modify(m)
 605
 606 #        m = Message()
 607 #        m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 608 #        m["description"] = MessageElement(["desc1","desc2"], FLAG_MOD_REPLACE,
 609 #          "description")
 610 #        try:
 611 #            ldb.modify(m)
 612 #            self.fail()
 613 #        except LdbError, (num, _):
 614 #            self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 615
 616 #        m = Message()
 617 #        m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 618 #        m["description"] = MessageElement(["desc3", "desc4"], FLAG_MOD_ADD,
 619 #          "description")
 620 #        try:
 621 #            ldb.modify(m)
 622 #            self.fail()
 623 #        except LdbError, (num, _):
 624 #            self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 625
 626         m = Message()
 627         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 628         m["description"] = MessageElement("desc3", FLAG_MOD_ADD,
 629           "description")
 630         ldb.modify(m)
 631
 632         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 633
 634     def test_empty_messages(self):
 635         """Test empty messages"""
 636         print "Test empty messages"""
 637
 638         m = Message()
 639         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 640
 641         try:
 642             ldb.add(m)
 643             self.fail()
 644         except LdbError, (num, _):
 645             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 646
 647         try:
 648             ldb.modify(m)
 649             self.fail()
 650         except LdbError, (num, _):
 651             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 652
 653         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 654
 655     def test_empty_attributes(self):
 656         """Test empty attributes"""
 657         print "Test empty attributes"""
 658
 659         m = Message()
 660         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 661         m["objectClass"] = MessageElement("group", FLAG_MOD_ADD, "objectClass")
 662         m["description"] = MessageElement([], FLAG_MOD_ADD, "description")
 663
 664         try:
 665             ldb.add(m)
 666             self.fail()
 667         except LdbError, (num, _):
 668             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 669
 670         self.ldb.add({
 671             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 672             "objectclass": "group"})
 673
 674         m = Message()
 675         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 676         m["description"] = MessageElement([], FLAG_MOD_ADD, "description")
 677
 678         try:
 679             ldb.modify(m)
 680             self.fail()
 681         except LdbError, (num, _):
 682             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 683
 684         m = Message()
 685         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 686         m["description"] = MessageElement([], FLAG_MOD_REPLACE, "description")
 687         ldb.modify(m)
 688
 689         m = Message()
 690         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 691         m["description"] = MessageElement([], FLAG_MOD_DELETE, "description")
 692         try:
 693             ldb.modify(m)
 694             self.fail()
 695         except LdbError, (num, _):
 696             self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
 697
 698         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 699
 700     def test_instanceType(self):
 701         """Tests the 'instanceType' attribute"""
 702         print "Tests the 'instanceType' attribute"""
 703
 704         # The instance type is single-valued
 705         try:
 706             self.ldb.add({
 707                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 708                 "objectclass": "group",
 709                 "instanceType": ["0", "1"]})
 710             self.fail()
 711         except LdbError, (num, _):
 712             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 713
 714         # The head NC flag cannot be set without the write flag
 715         try:
 716             self.ldb.add({
 717                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 718                 "objectclass": "group",
 719                 "instanceType": "1" })
 720             self.fail()
 721         except LdbError, (num, _):
 722             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 723
 724         # We cannot manipulate NCs without the head NC flag
 725         try:
 726             self.ldb.add({
 727                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 728                 "objectclass": "group",
 729                 "instanceType": "32" })
 730             self.fail()
 731         except LdbError, (num, _):
 732             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 733
 734         self.ldb.add({
 735              "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 736              "objectclass": "group"})
 737
 738         m = Message()
 739         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 740         m["instanceType"] = MessageElement("0", FLAG_MOD_REPLACE,
 741           "instanceType")
 742         try:
 743             ldb.modify(m)
 744             self.fail()
 745         except LdbError, (num, _):
 746             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 747
 748         m = Message()
 749         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 750         m["instanceType"] = MessageElement([], FLAG_MOD_REPLACE,
 751           "instanceType")
 752         try:
 753             ldb.modify(m)
 754             self.fail()
 755         except LdbError, (num, _):
 756             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 757
 758         m = Message()
 759         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 760         m["instanceType"] = MessageElement([], FLAG_MOD_DELETE, "instanceType")
 761         try:
 762             ldb.modify(m)
 763             self.fail()
 764         except LdbError, (num, _):
 765             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 766
 767         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 768
 769     def test_distinguished_name(self):
 770         """Tests the 'distinguishedName' attribute"""
 771         print "Tests the 'distinguishedName' attribute"""
 772
 773         # a wrong "distinguishedName" attribute is obviously tolerated
 774         self.ldb.add({
 775               "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 776               "objectclass": "group",
 777               "distinguishedName": "cn=ldaptest,cn=users," + self.base_dn})
 778
 779         # proof if the DN has been set correctly
 780         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 781                          scope=SCOPE_BASE, attrs=["distinguishedName"])
 782         self.assertTrue(len(res) == 1)
 783         self.assertTrue("distinguishedName" in res[0])
 784         self.assertTrue(Dn(ldb, res[0]["distinguishedName"][0])
 785            == Dn(ldb, "cn=ldaptestgroup, cn=users," + self.base_dn))
 786
 787         m = Message()
 788         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 789         m["distinguishedName"] = MessageElement(
 790           "cn=ldaptestuser,cn=users," + self.base_dn, FLAG_MOD_ADD,
 791           "distinguishedName")
 792
 793         try:
 794             ldb.modify(m)
 795             self.fail()
 796         except LdbError, (num, _):
 797             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 798
 799         m = Message()
 800         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 801         m["distinguishedName"] = MessageElement(
 802           "cn=ldaptestuser,cn=users," + self.base_dn, FLAG_MOD_REPLACE,
 803           "distinguishedName")
 804
 805         try:
 806             ldb.modify(m)
 807             self.fail()
 808         except LdbError, (num, _):
 809             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 810
 811         m = Message()
 812         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 813         m["distinguishedName"] = MessageElement(
 814           "cn=ldaptestuser,cn=users," + self.base_dn, FLAG_MOD_DELETE,
 815           "distinguishedName")
 816
 817         try:
 818             ldb.modify(m)
 819             self.fail()
 820         except LdbError, (num, _):
 821             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 822
 823         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 824
 825     def test_rdn_name(self):
 826         """Tests the RDN"""
 827         print "Tests the RDN"""
 828
 829         try:
 830             self.ldb.add({
 831                  "dn": "description=xyz,cn=users," + self.base_dn,
 832                  "objectclass": "group"})
 833             self.fail()
 834         except LdbError, (num, _):
 835             self.assertEquals(num, ERR_NAMING_VIOLATION)
 836
 837         self.delete_force(self.ldb, "description=xyz,cn=users," + self.base_dn)
 838
 839         # a wrong "name" attribute is obviously tolerated
 840         self.ldb.add({
 841              "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 842              "objectclass": "group",
 843              "name": "ldaptestgroupx"})
 844
 845         # proof if the name has been set correctly
 846         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 847                          scope=SCOPE_BASE, attrs=["name"])
 848         self.assertTrue(len(res) == 1)
 849         self.assertTrue("name" in res[0])
 850         self.assertTrue(res[0]["name"][0] == "ldaptestgroup")
 851
 852         m = Message()
 853         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 854         m["name"] = MessageElement("cn=ldaptestuser", FLAG_MOD_REPLACE,
 855           "name")
 856         try:
 857             ldb.modify(m)
 858             self.fail()
 859         except LdbError, (num, _):
 860             self.assertEquals(num, ERR_NOT_ALLOWED_ON_RDN)
 861
 862         m = Message()
 863         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 864         m["cn"] = MessageElement("ldaptestuser",
 865           FLAG_MOD_REPLACE, "cn")
 866         try:
 867             ldb.modify(m)
 868             self.fail()
 869         except LdbError, (num, _):
 870             self.assertEquals(num, ERR_NOT_ALLOWED_ON_RDN)
 871
 872         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 873
 874
 875         # this test needs to be disabled until we really understand
 876         # what the rDN length constraints are
 877     def DISABLED_test_largeRDN(self):
 878         """Testing large rDN (limit 64 characters)"""
 879         rdn = "CN=a012345678901234567890123456789012345678901234567890123456789012";
 880         self.delete_force(self.ldb, "%s,%s" % (rdn, self.base_dn))
 881         ldif = """
 882 dn: %s,%s""" % (rdn,self.base_dn) + """
 883 objectClass: container
 884 """
 885         self.ldb.add_ldif(ldif)
 886         self.delete_force(self.ldb, "%s,%s" % (rdn, self.base_dn))
 887
 888         rdn = "CN=a0123456789012345678901234567890123456789012345678901234567890120";
 889         self.delete_force(self.ldb, "%s,%s" % (rdn, self.base_dn))
 890         try:
 891             ldif = """
 892 dn: %s,%s""" % (rdn,self.base_dn) + """
 893 objectClass: container
 894 """
 895             self.ldb.add_ldif(ldif)
 896             self.fail()
 897         except LdbError, (num, _):
 898             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 899         self.delete_force(self.ldb, "%s,%s" % (rdn, self.base_dn))
 900
 901     def test_rename(self):
 902         """Tests the rename operation"""
 903         print "Tests the rename operations"""
 904
 905         try:
 906             # cannot rename to be a child of itself
 907             ldb.rename(self.base_dn, "dc=test," + self.base_dn)
 908             self.fail()
 909         except LdbError, (num, _):
 910             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 911
 912         try:
 913             # inexistent object
 914             ldb.rename("cn=ldaptestuser2,cn=users," + self.base_dn, "cn=ldaptestuser2,cn=users," + self.base_dn)
 915             self.fail()
 916         except LdbError, (num, _):
 917             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
 918
 919         self.ldb.add({
 920              "dn": "cn=ldaptestuser2,cn=users," + self.base_dn,
 921              "objectclass": ["user", "person"] })
 922
 923         ldb.rename("cn=ldaptestuser2,cn=users," + self.base_dn, "cn=ldaptestuser2,cn=users," + self.base_dn)
 924         ldb.rename("cn=ldaptestuser2,cn=users," + self.base_dn, "cn=ldaptestuser3,cn=users," + self.base_dn)
 925         ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "cn=ldaptestUSER3,cn=users," + self.base_dn)
 926
 927         try:
 928             # containment problem: a user entry cannot contain user entries
 929             ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "cn=ldaptestuser4,cn=ldaptestuser3,cn=users," + self.base_dn)
 930             self.fail()
 931         except LdbError, (num, _):
 932             self.assertEquals(num, ERR_NAMING_VIOLATION)
 933
 934         try:
 935             # invalid parent
 936             ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "cn=ldaptestuser3,cn=people,cn=users," + self.base_dn)
 937             self.fail()
 938         except LdbError, (num, _):
 939             self.assertEquals(num, ERR_OTHER)
 940
 941         try:
 942             # invalid target DN syntax
 943             ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, ",cn=users," + self.base_dn)
 944             self.fail()
 945         except LdbError, (num, _):
 946             self.assertEquals(num, ERR_INVALID_DN_SYNTAX)
 947
 948         try:
 949             # invalid RDN name
 950             ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "ou=ldaptestuser3,cn=users," + self.base_dn)
 951             self.fail()
 952         except LdbError, (num, _):
 953             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 954
 955         self.delete_force(self.ldb, "cn=ldaptestuser3,cn=users," + self.base_dn)
 956
 957         # Performs some "systemFlags" testing
 958
 959         # Move failing since no "SYSTEM_FLAG_CONFIG_ALLOW_MOVE"
 960         try:
 961             ldb.rename("CN=DisplaySpecifiers," + self.configuration_dn, "CN=DisplaySpecifiers,CN=Services," + self.configuration_dn)
 962             self.fail()
 963         except LdbError, (num, _):
 964             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 965
 966         # Limited move failing since no "SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE"
 967         try:
 968             ldb.rename("CN=Directory Service,CN=Windows NT,CN=Services," + self.configuration_dn, "CN=Directory Service,CN=RRAS,CN=Services," + self.configuration_dn)
 969             self.fail()
 970         except LdbError, (num, _):
 971             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 972
 973         # Rename failing since no "SYSTEM_FLAG_CONFIG_ALLOW_RENAME"
 974         try:
 975             ldb.rename("CN=DisplaySpecifiers," + self.configuration_dn, "CN=DisplaySpecifiers2," + self.configuration_dn)
 976             self.fail()
 977         except LdbError, (num, _):
 978             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 979
 980         # It's not really possible to test moves on the schema partition since
 981         # there don't exist subcontainers on it.
 982
 983         # Rename failing since "SYSTEM_FLAG_SCHEMA_BASE_OBJECT"
 984         try:
 985             ldb.rename("CN=Top," + self.schema_dn, "CN=Top2," + self.schema_dn)
 986             self.fail()
 987         except LdbError, (num, _):
 988             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 989
 990         # Move failing since "SYSTEM_FLAG_DOMAIN_DISALLOW_MOVE"
 991         try:
 992             ldb.rename("CN=Users," + self.base_dn, "CN=Users,CN=Computers," + self.base_dn)
 993             self.fail()
 994         except LdbError, (num, _):
 995             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 996
 997         # Rename failing since "SYSTEM_FLAG_DOMAIN_DISALLOW_RENAME"
 998         try:
 999             ldb.rename("CN=Users," + self.base_dn, "CN=Users2," + self.base_dn)
1000             self.fail()
1001         except LdbError, (num, _):
1002             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1003
1004         # Performs some other constraints testing
1005
1006         try:
1007             ldb.rename("CN=Policies,CN=System," + self.base_dn, "CN=Users2," + self.base_dn)
1008             self.fail()
1009         except LdbError, (num, _):
1010             self.assertEquals(num, ERR_OTHER)
1011
1012     def test_rename_twice(self):
1013         """Tests the rename operation twice - this corresponds to a past bug"""
1014         print "Tests the rename twice operation"""
1015
1016         self.ldb.add({
1017              "dn": "cn=ldaptestuser5,cn=users," + self.base_dn,
1018              "objectclass": ["user", "person"] })
1019
1020         ldb.rename("cn=ldaptestuser5,cn=users," + self.base_dn, "cn=ldaptestUSER5,cn=users," + self.base_dn)
1021         self.delete_force(self.ldb, "cn=ldaptestuser5,cn=users," + self.base_dn)
1022         self.ldb.add({
1023              "dn": "cn=ldaptestuser5,cn=users," + self.base_dn,
1024              "objectclass": ["user", "person"] })
1025         ldb.rename("cn=ldaptestuser5,cn=Users," + self.base_dn, "cn=ldaptestUSER5,cn=users," + self.base_dn)
1026         res = ldb.search(expression="cn=ldaptestuser5")
1027         print "Found %u records" % len(res)
1028         self.assertEquals(len(res), 1, "Wrong number of hits for cn=ldaptestuser5")
1029         res = ldb.search(expression="(&(cn=ldaptestuser5)(objectclass=user))")
1030         print "Found %u records" % len(res)
1031         self.assertEquals(len(res), 1, "Wrong number of hits for (&(cn=ldaptestuser5)(objectclass=user))")
1032         self.delete_force(self.ldb, "cn=ldaptestuser5,cn=users," + self.base_dn)
1033
1034     def test_parentGUID(self):
1035         """Test parentGUID behaviour"""
1036         print "Testing parentGUID behaviour\n"
1037
1038         # TODO: This seems to fail on Windows Server. Hidden attribute?
1039
1040         self.ldb.add({
1041             "dn": "cn=parentguidtest,cn=users," + self.base_dn,
1042             "objectclass":"user",
1043             "samaccountname":"parentguidtest"});
1044         res1 = ldb.search(base="cn=parentguidtest,cn=users," + self.base_dn, scope=SCOPE_BASE,
1045                           attrs=["parentGUID", "samaccountname"]);
1046         res2 = ldb.search(base="cn=users," + self.base_dn,scope=SCOPE_BASE,
1047                           attrs=["objectGUID"]);
1048         res3 = ldb.search(base=self.base_dn, scope=SCOPE_BASE,
1049                           attrs=["parentGUID"]);
1050         res4 = ldb.search(base=self.configuration_dn, scope=SCOPE_BASE,
1051                           attrs=["parentGUID"]);
1052         res5 = ldb.search(base=self.schema_dn, scope=SCOPE_BASE,
1053                           attrs=["parentGUID"]);
1054
1055         """Check if the parentGUID is valid """
1056         self.assertEquals(res1[0]["parentGUID"], res2[0]["objectGUID"]);
1057
1058         """Check if it returns nothing when there is no parent object - default NC"""
1059         has_parentGUID = False
1060         for key in res3[0].keys():
1061             if key == "parentGUID":
1062                 has_parentGUID = True
1063                 break
1064         self.assertFalse(has_parentGUID);
1065
1066         """Check if it returns nothing when there is no parent object - configuration NC"""
1067         has_parentGUID = False
1068         for key in res4[0].keys():
1069             if key == "parentGUID":
1070                 has_parentGUID = True
1071                 break
1072         self.assertFalse(has_parentGUID);
1073
1074         """Check if it returns nothing when there is no parent object - schema NC"""
1075         has_parentGUID = False
1076         for key in res5[0].keys():
1077             if key == "parentGUID":
1078                 has_parentGUID = True
1079                 break
1080         self.assertFalse(has_parentGUID);
1081
1082         """Ensures that if you look for another object attribute after the constructed
1083             parentGUID, it will return correctly"""
1084         has_another_attribute = False
1085         for key in res1[0].keys():
1086             if key == "sAMAccountName":
1087                 has_another_attribute = True
1088                 break
1089         self.assertTrue(has_another_attribute)
1090         self.assertTrue(len(res1[0]["samaccountname"]) == 1)
1091         self.assertEquals(res1[0]["samaccountname"][0], "parentguidtest");
1092
1093         print "Testing parentGUID behaviour on rename\n"
1094
1095         self.ldb.add({
1096             "dn": "cn=testotherusers," + self.base_dn,
1097             "objectclass":"container"});
1098         res1 = ldb.search(base="cn=testotherusers," + self.base_dn,scope=SCOPE_BASE,
1099                           attrs=["objectGUID"]);
1100         ldb.rename("cn=parentguidtest,cn=users," + self.base_dn,
1101                    "cn=parentguidtest,cn=testotherusers," + self.base_dn);
1102         res2 = ldb.search(base="cn=parentguidtest,cn=testotherusers," + self.base_dn,
1103                           scope=SCOPE_BASE,
1104                           attrs=["parentGUID"]);
1105         self.assertEquals(res1[0]["objectGUID"], res2[0]["parentGUID"]);
1106
1107         self.delete_force(self.ldb, "cn=parentguidtest,cn=testotherusers," + self.base_dn)
1108         self.delete_force(self.ldb, "cn=testotherusers," + self.base_dn)
1109
1110     def test_groupType_int32(self):
1111         """Test groupType (int32) behaviour (should appear to be casted to a 32 bit signed integer before comparsion)"""
1112         print "Testing groupType (int32) behaviour\n"
1113
1114         res1 = ldb.search(base=self.base_dn, scope=SCOPE_SUBTREE,
1115                           attrs=["groupType"], expression="groupType=2147483653");
1116
1117         res2 = ldb.search(base=self.base_dn, scope=SCOPE_SUBTREE,
1118                           attrs=["groupType"], expression="groupType=-2147483643");
1119
1120         self.assertEquals(len(res1), len(res2))
1121
1122         self.assertTrue(res1.count > 0)
1123
1124         self.assertEquals(res1[0]["groupType"][0], "-2147483643")
1125
1126     def test_linked_attributes(self):
1127         """This tests the linked attribute behaviour"""
1128         print "Testing linked attribute behaviour\n"
1129
1130         ldb.add({
1131             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
1132             "objectclass": "group"})
1133
1134         # This should not work since "memberOf" is linked to "member"
1135         try:
1136             ldb.add({
1137                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1138                 "objectclass": ["user", "person"],
1139                 "memberOf": "cn=ldaptestgroup,cn=users," + self.base_dn})
1140         except LdbError, (num, _):
1141             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1142
1143         ldb.add({
1144             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1145             "objectclass": ["user", "person"]})
1146
1147         m = Message()
1148         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1149         m["memberOf"] = MessageElement("cn=ldaptestgroup,cn=users," + self.base_dn,
1150           FLAG_MOD_ADD, "memberOf")
1151         try:
1152             ldb.modify(m)
1153             self.fail()
1154         except LdbError, (num, _):
1155             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1156
1157         m = Message()
1158         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1159         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
1160           FLAG_MOD_ADD, "member")
1161         ldb.modify(m)
1162
1163         m = Message()
1164         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1165         m["memberOf"] = MessageElement("cn=ldaptestgroup,cn=users," + self.base_dn,
1166           FLAG_MOD_REPLACE, "memberOf")
1167         try:
1168             ldb.modify(m)
1169             self.fail()
1170         except LdbError, (num, _):
1171             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1172
1173         m = Message()
1174         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1175         m["memberOf"] = MessageElement("cn=ldaptestgroup,cn=users," + self.base_dn,
1176           FLAG_MOD_DELETE, "memberOf")
1177         try:
1178             ldb.modify(m)
1179             self.fail()
1180         except LdbError, (num, _):
1181             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1182
1183         m = Message()
1184         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1185         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
1186           FLAG_MOD_DELETE, "member")
1187         ldb.modify(m)
1188
1189         # This should yield no results since the member attribute for
1190         # "ldaptestuser" should have been deleted
1191         res1 = ldb.search("cn=ldaptestgroup, cn=users," + self.base_dn,
1192                           scope=SCOPE_BASE,
1193                           expression="(member=cn=ldaptestuser,cn=users," + self.base_dn + ")",
1194                           attrs=[])
1195         self.assertTrue(len(res1) == 0)
1196
1197         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1198
1199         ldb.add({
1200             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
1201             "objectclass": "group",
1202             "member": "cn=ldaptestuser,cn=users," + self.base_dn})
1203
1204         self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1205
1206         # Make sure that the "member" attribute for "ldaptestuser" has been
1207         # removed
1208         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1209                           scope=SCOPE_BASE, attrs=["member"])
1210         self.assertTrue(len(res) == 1)
1211         self.assertFalse("member" in res[0])
1212
1213         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1214
1215     def test_users_groups(self):
1216         """This tests the SAM users and groups behaviour"""
1217         print "Testing users and groups behaviour\n"
1218
1219         ldb.add({
1220             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
1221             "objectclass": "group"})
1222
1223         ldb.add({
1224             "dn": "cn=ldaptestgroup2,cn=users," + self.base_dn,
1225             "objectclass": "group"})
1226
1227         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1228                           scope=SCOPE_BASE, attrs=["objectSID"])
1229         self.assertTrue(len(res1) == 1)
1230         group_rid_1 = security.dom_sid(ldb.schema_format_value("objectSID",
1231           res1[0]["objectSID"][0])).split()[1]
1232
1233         res1 = ldb.search("cn=ldaptestgroup2,cn=users," + self.base_dn,
1234                           scope=SCOPE_BASE, attrs=["objectSID"])
1235         self.assertTrue(len(res1) == 1)
1236         group_rid_2 = security.dom_sid(ldb.schema_format_value("objectSID",
1237           res1[0]["objectSID"][0])).split()[1]
1238
1239         # Try to create a user with an invalid primary group
1240         try:
1241             ldb.add({
1242                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1243                 "objectclass": ["user", "person"],
1244                 "primaryGroupID": "0"})
1245             self.fail()
1246         except LdbError, (num, _):
1247             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1248         self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1249
1250         # Try to Create a user with a valid primary group
1251         try:
1252             ldb.add({
1253                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1254                 "objectclass": ["user", "person"],
1255                 "primaryGroupID": str(group_rid_1)})
1256             self.fail()
1257         except LdbError, (num, _):
1258             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1259         self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1260
1261         # Test to see how we should behave when the user account doesn't
1262         # exist
1263         m = Message()
1264         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1265         m["primaryGroupID"] = MessageElement("0", FLAG_MOD_REPLACE,
1266           "primaryGroupID")
1267         try:
1268             ldb.modify(m)
1269             self.fail()
1270         except LdbError, (num, _):
1271             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
1272
1273         # Test to see how we should behave when the account isn't a user
1274         m = Message()
1275         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1276         m["primaryGroupID"] = MessageElement("0", FLAG_MOD_REPLACE,
1277           "primaryGroupID")
1278         try:
1279             ldb.modify(m)
1280             self.fail()
1281         except LdbError, (num, _):
1282             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
1283
1284         # Test default primary groups on add operations
1285
1286         ldb.add({
1287             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1288             "objectclass": ["user", "person"]})
1289
1290         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1291                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
1292         self.assertTrue(len(res1) == 1)
1293         self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_USERS))
1294
1295         self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1296
1297         ldb.add({
1298             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1299             "objectclass": ["user", "person"],
1300             "userAccountControl": str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD) })
1301
1302         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1303                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
1304         self.assertTrue(len(res1) == 1)
1305         self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_USERS))
1306
1307         self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1308
1309         # unfortunately the INTERDOMAIN_TRUST_ACCOUNT case cannot be tested
1310         # since such accounts aren't directly creatable (ACCESS_DENIED)
1311
1312         ldb.add({
1313             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1314             "objectclass": ["computer"],
1315             "userAccountControl": str(UF_WORKSTATION_TRUST_ACCOUNT | UF_PASSWD_NOTREQD) })
1316
1317         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1318                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
1319         self.assertTrue(len(res1) == 1)
1320         self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_DOMAIN_MEMBERS))
1321
1322         self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1323
1324         ldb.add({
1325             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1326             "objectclass": ["computer"],
1327             "userAccountControl": str(UF_SERVER_TRUST_ACCOUNT | UF_PASSWD_NOTREQD) })
1328
1329         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1330                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
1331         self.assertTrue(len(res1) == 1)
1332         self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_DCS))
1333
1334         self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1335
1336         # Read-only DC accounts are only creatable by
1337         # UF_WORKSTATION_TRUST_ACCOUNT and work only on DCs >= 2008 (therefore
1338         # we have a fallback in the assertion)
1339         ldb.add({
1340             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1341             "objectclass": ["computer"],
1342             "userAccountControl": str(UF_PARTIAL_SECRETS_ACCOUNT | UF_WORKSTATION_TRUST_ACCOUNT | UF_PASSWD_NOTREQD) })
1343
1344         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1345                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
1346         self.assertTrue(len(res1) == 1)
1347         self.assertTrue(res1[0]["primaryGroupID"][0] == str(DOMAIN_RID_READONLY_DCS) or
1348                         res1[0]["primaryGroupID"][0] == str(DOMAIN_RID_DOMAIN_MEMBERS))
1349
1350         self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1351
1352         # Test default primary groups on modify operations
1353
1354         ldb.add({
1355             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1356             "objectclass": ["user", "person"]})
1357
1358         m = Message()
1359         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1360         m["userAccountControl"] = MessageElement(str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD), FLAG_MOD_REPLACE,
1361           "userAccountControl")
1362         ldb.modify(m)
1363
1364         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1365                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
1366         self.assertTrue(len(res1) == 1)
1367         self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_USERS))
1368
1369         # unfortunately the INTERDOMAIN_TRUST_ACCOUNT case cannot be tested
1370         # since such accounts aren't directly creatable (ACCESS_DENIED)
1371
1372         self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1373
1374         ldb.add({
1375             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1376             "objectclass": ["computer"]})
1377
1378         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1379                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
1380         self.assertTrue(len(res1) == 1)
1381         self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_USERS))
1382
1383         m = Message()
1384         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1385         m["userAccountControl"] = MessageElement(str(UF_WORKSTATION_TRUST_ACCOUNT | UF_PASSWD_NOTREQD), FLAG_MOD_REPLACE,
1386           "userAccountControl")
1387         ldb.modify(m)
1388
1389         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1390                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
1391         self.assertTrue(len(res1) == 1)
1392         self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_DOMAIN_MEMBERS))
1393
1394         m = Message()
1395         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1396         m["userAccountControl"] = MessageElement(str(UF_SERVER_TRUST_ACCOUNT | UF_PASSWD_NOTREQD), FLAG_MOD_REPLACE,
1397           "userAccountControl")
1398         ldb.modify(m)
1399
1400         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1401                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
1402         self.assertTrue(len(res1) == 1)
1403         self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_DCS))
1404
1405         # Read-only DC accounts are only creatable by
1406         # UF_WORKSTATION_TRUST_ACCOUNT and work only on DCs >= 2008 (therefore
1407         # we have a fallback in the assertion)
1408         m = Message()
1409         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1410         m["userAccountControl"] = MessageElement(str(UF_PARTIAL_SECRETS_ACCOUNT | UF_WORKSTATION_TRUST_ACCOUNT | UF_PASSWD_NOTREQD), FLAG_MOD_REPLACE,
1411           "userAccountControl")
1412         ldb.modify(m)
1413
1414         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1415                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
1416         self.assertTrue(len(res1) == 1)
1417         self.assertTrue(res1[0]["primaryGroupID"][0] == str(DOMAIN_RID_READONLY_DCS) or
1418                         res1[0]["primaryGroupID"][0] == str(DOMAIN_RID_DOMAIN_MEMBERS))
1419
1420         self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1421
1422         # Recreate account for further tests
1423
1424         ldb.add({
1425             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1426             "objectclass": ["user", "person"]})
1427
1428         # We should be able to reset our actual primary group
1429         m = Message()
1430         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1431         m["primaryGroupID"] = MessageElement(str(DOMAIN_RID_USERS), FLAG_MOD_REPLACE,
1432           "primaryGroupID")
1433         ldb.modify(m)
1434
1435         # Try to add invalid primary group
1436         m = Message()
1437         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1438         m["primaryGroupID"] = MessageElement("0", FLAG_MOD_REPLACE,
1439           "primaryGroupID")
1440         try:
1441             ldb.modify(m)
1442             self.fail()
1443         except LdbError, (num, _):
1444             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1445
1446         # Try to make group 1 primary - should be denied since it is not yet
1447         # secondary
1448         m = Message()
1449         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1450         m["primaryGroupID"] = MessageElement(str(group_rid_1),
1451           FLAG_MOD_REPLACE, "primaryGroupID")
1452         try:
1453             ldb.modify(m)
1454             self.fail()
1455         except LdbError, (num, _):
1456             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1457
1458         # Make group 1 secondary
1459         m = Message()
1460         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1461         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
1462                                      FLAG_MOD_REPLACE, "member")
1463         ldb.modify(m)
1464
1465         # Make group 1 primary
1466         m = Message()
1467         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1468         m["primaryGroupID"] = MessageElement(str(group_rid_1),
1469           FLAG_MOD_REPLACE, "primaryGroupID")
1470         ldb.modify(m)
1471
1472         # Try to delete group 1 - should be denied
1473         try:
1474             ldb.delete("cn=ldaptestgroup,cn=users," + self.base_dn)
1475             self.fail()
1476         except LdbError, (num, _):
1477             self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
1478
1479         # Try to add group 1 also as secondary - should be denied
1480         m = Message()
1481         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1482         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
1483                                      FLAG_MOD_ADD, "member")
1484         try:
1485             ldb.modify(m)
1486             self.fail()
1487         except LdbError, (num, _):
1488             self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
1489
1490         # Try to add invalid member to group 1 - should be denied
1491         m = Message()
1492         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1493         m["member"] = MessageElement(
1494           "cn=ldaptestuser3,cn=users," + self.base_dn,
1495           FLAG_MOD_ADD, "member")
1496         try:
1497             ldb.modify(m)
1498             self.fail()
1499         except LdbError, (num, _):
1500             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
1501
1502         # Make group 2 secondary
1503         m = Message()
1504         m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
1505         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
1506                                      FLAG_MOD_ADD, "member")
1507         ldb.modify(m)
1508
1509         # Swap the groups
1510         m = Message()
1511         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1512         m["primaryGroupID"] = MessageElement(str(group_rid_2),
1513           FLAG_MOD_REPLACE, "primaryGroupID")
1514         ldb.modify(m)
1515
1516         # Old primary group should contain a "member" attribute for the user,
1517         # the new shouldn't contain anymore one
1518         res1 = ldb.search("cn=ldaptestgroup, cn=users," + self.base_dn,
1519                           scope=SCOPE_BASE, attrs=["member"])
1520         self.assertTrue(len(res1) == 1)
1521         self.assertTrue(len(res1[0]["member"]) == 1)
1522         self.assertEquals(res1[0]["member"][0].lower(),
1523           ("cn=ldaptestuser,cn=users," + self.base_dn).lower())
1524
1525         res1 = ldb.search("cn=ldaptestgroup2, cn=users," + self.base_dn,
1526                           scope=SCOPE_BASE, attrs=["member"])
1527         self.assertTrue(len(res1) == 1)
1528         self.assertFalse("member" in res1[0])
1529
1530         # Also this should be denied
1531         try:
1532             ldb.add({
1533               "dn": "cn=ldaptestuser1,cn=users," + self.base_dn,
1534               "objectclass": ["user", "person"],
1535               "primaryGroupID": "0"})
1536             self.fail()
1537         except LdbError, (num, _):
1538             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1539
1540         self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1541         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1542         self.delete_force(self.ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
1543
1544     def test_sam_attributes(self):
1545         """Test the behaviour of special attributes of SAM objects"""
1546         print "Testing the behaviour of special attributes of SAM objects\n"""
1547
1548         ldb.add({
1549             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1550             "objectclass": ["user", "person"]})
1551         ldb.add({
1552             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
1553             "objectclass": "group"})
1554
1555         m = Message()
1556         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1557         m["groupType"] = MessageElement("0", FLAG_MOD_ADD,
1558           "groupType")
1559         try:
1560             ldb.modify(m)
1561             self.fail()
1562         except LdbError, (num, _):
1563             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
1564
1565         m = Message()
1566         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1567         m["groupType"] = MessageElement([], FLAG_MOD_DELETE,
1568           "groupType")
1569         try:
1570             ldb.modify(m)
1571             self.fail()
1572         except LdbError, (num, _):
1573             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1574
1575         m = Message()
1576         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1577         m["primaryGroupID"] = MessageElement("0", FLAG_MOD_ADD,
1578           "primaryGroupID")
1579         try:
1580             ldb.modify(m)
1581             self.fail()
1582         except LdbError, (num, _):
1583             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
1584
1585         m = Message()
1586         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1587         m["primaryGroupID"] = MessageElement([], FLAG_MOD_DELETE,
1588           "primaryGroupID")
1589         try:
1590             ldb.modify(m)
1591             self.fail()
1592         except LdbError, (num, _):
1593             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1594
1595         m = Message()
1596         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1597         m["userAccountControl"] = MessageElement("0", FLAG_MOD_ADD,
1598           "userAccountControl")
1599         try:
1600             ldb.modify(m)
1601             self.fail()
1602         except LdbError, (num, _):
1603             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
1604
1605         m = Message()
1606         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1607         m["userAccountControl"] = MessageElement([], FLAG_MOD_DELETE,
1608           "userAccountControl")
1609         try:
1610             ldb.modify(m)
1611             self.fail()
1612         except LdbError, (num, _):
1613             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1614
1615         m = Message()
1616         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1617         m["sAMAccountType"] = MessageElement("0", FLAG_MOD_ADD,
1618           "sAMAccountType")
1619         try:
1620             ldb.modify(m)
1621             self.fail()
1622         except LdbError, (num, _):
1623             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1624
1625         m = Message()
1626         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1627         m["sAMAccountType"] = MessageElement([], FLAG_MOD_REPLACE,
1628           "sAMAccountType")
1629         try:
1630             ldb.modify(m)
1631             self.fail()
1632         except LdbError, (num, _):
1633             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1634
1635         m = Message()
1636         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1637         m["sAMAccountType"] = MessageElement([], FLAG_MOD_DELETE,
1638           "sAMAccountType")
1639         try:
1640             ldb.modify(m)
1641             self.fail()
1642         except LdbError, (num, _):
1643             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1644
1645         self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1646         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1647
1648     def test_primary_group_token_constructed(self):
1649         """Test the primary group token behaviour (hidden-generated-readonly attribute on groups) and some other constructed attributes"""
1650         print "Testing primary group token behaviour and other constructed attributes\n"
1651
1652         try:
1653             ldb.add({
1654                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
1655                 "objectclass": "group",
1656                 "primaryGroupToken": "100"})
1657             self.fail()
1658         except LdbError, (num, _):
1659             self.assertEquals(num, ERR_UNDEFINED_ATTRIBUTE_TYPE)
1660         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1661
1662         ldb.add({
1663             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1664             "objectclass": ["user", "person"]})
1665
1666         ldb.add({
1667             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
1668             "objectclass": "group"})
1669
1670         # Testing for one invalid, and one valid operational attribute, but also the things they are built from
1671         res1 = ldb.search(self.base_dn,
1672                           scope=SCOPE_BASE, attrs=["primaryGroupToken", "canonicalName", "objectClass", "objectSid"])
1673         self.assertTrue(len(res1) == 1)
1674         self.assertFalse("primaryGroupToken" in res1[0])
1675         self.assertTrue("canonicalName" in res1[0])
1676         self.assertTrue("objectClass" in res1[0])
1677         self.assertTrue("objectSid" in res1[0])
1678
1679         res1 = ldb.search(self.base_dn,
1680                           scope=SCOPE_BASE, attrs=["primaryGroupToken", "canonicalName"])
1681         self.assertTrue(len(res1) == 1)
1682         self.assertFalse("primaryGroupToken" in res1[0])
1683         self.assertFalse("objectSid" in res1[0])
1684         self.assertFalse("objectClass" in res1[0])
1685         self.assertTrue("canonicalName" in res1[0])
1686
1687         res1 = ldb.search("cn=users,"+self.base_dn,
1688                           scope=SCOPE_BASE, attrs=["primaryGroupToken"])
1689         self.assertTrue(len(res1) == 1)
1690         self.assertFalse("primaryGroupToken" in res1[0])
1691
1692         res1 = ldb.search("cn=ldaptestuser, cn=users," + self.base_dn,
1693                           scope=SCOPE_BASE, attrs=["primaryGroupToken"])
1694         self.assertTrue(len(res1) == 1)
1695         self.assertFalse("primaryGroupToken" in res1[0])
1696
1697         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1698                           scope=SCOPE_BASE)
1699         self.assertTrue(len(res1) == 1)
1700         self.assertFalse("primaryGroupToken" in res1[0])
1701
1702         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1703                           scope=SCOPE_BASE, attrs=["primaryGroupToken", "objectSID"])
1704         self.assertTrue(len(res1) == 1)
1705         primary_group_token = int(res1[0]["primaryGroupToken"][0])
1706
1707         rid = security.dom_sid(ldb.schema_format_value("objectSID", res1[0]["objectSID"][0])).split()[1]
1708         self.assertEquals(primary_group_token, rid)
1709
1710         m = Message()
1711         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1712         m["primaryGroupToken"] = "100"
1713         try:
1714             ldb.modify(m)
1715             self.fail()
1716         except LdbError, (num, _):
1717             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
1718
1719         self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1720         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1721
1722     def test_tokenGroups(self):
1723         """Test the tokenGroups behaviour (hidden-generated-readonly attribute on SAM objects)"""
1724         print "Testing tokenGroups behaviour\n"
1725
1726         # The domain object shouldn't contain any "tokenGroups" entry
1727         res = ldb.search(self.base_dn, scope=SCOPE_BASE, attrs=["tokenGroups"])
1728         self.assertTrue(len(res) == 1)
1729         self.assertFalse("tokenGroups" in res[0])
1730
1731         # The domain administrator should contain "tokenGroups" entries
1732         # (the exact number depends on the domain/forest function level and the
1733         # DC software versions)
1734         res = ldb.search("cn=Administrator,cn=Users," + self.base_dn,
1735                          scope=SCOPE_BASE, attrs=["tokenGroups"])
1736         self.assertTrue(len(res) == 1)
1737         self.assertTrue("tokenGroups" in res[0])
1738
1739         ldb.add({
1740             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1741             "objectclass": ["user", "person"]})
1742
1743         # This testuser should contain at least two "tokenGroups" entries
1744         # (exactly two on an unmodified "Domain Users" and "Users" group)
1745         res = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1746                          scope=SCOPE_BASE, attrs=["tokenGroups"])
1747         self.assertTrue(len(res) == 1)
1748         self.assertTrue(len(res[0]["tokenGroups"]) >= 2)
1749
1750         # one entry which we need to find should point to domains "Domain Users"
1751         # group and another entry should point to the builtin "Users"group
1752         domain_users_group_found = False
1753         users_group_found = False
1754         for sid in res[0]["tokenGroups"]:
1755             rid = security.dom_sid(ldb.schema_format_value("objectSID", sid)).split()[1]
1756             if rid == 513:
1757                 domain_users_group_found = True
1758             if rid == 545:
1759                 users_group_found = True
1760
1761         self.assertTrue(domain_users_group_found)
1762         self.assertTrue(users_group_found)
1763
1764         self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1765
1766     def test_wkguid(self):
1767         """Test Well known GUID behaviours (including DN+Binary)"""
1768         print "Test Well known GUID behaviours (including DN+Binary)"""
1769
1770         res = self.ldb.search(base=("<WKGUID=ab1d30f3768811d1aded00c04fd8d5cd,%s>" % self.base_dn), scope=SCOPE_BASE, attrs=[])
1771         self.assertEquals(len(res), 1)
1772
1773         res2 = self.ldb.search(scope=SCOPE_BASE, attrs=["wellKnownObjects"], expression=("wellKnownObjects=B:32:ab1d30f3768811d1aded00c04fd8d5cd:%s" % res[0].dn))
1774         self.assertEquals(len(res2), 1)
1775
1776         # Prove that the matching rule is over the whole DN+Binary
1777         res2 = self.ldb.search(scope=SCOPE_BASE, attrs=["wellKnownObjects"], expression=("wellKnownObjects=B:32:ab1d30f3768811d1aded00c04fd8d5cd"))
1778         self.assertEquals(len(res2), 0)
1779         # Prove that the matching rule is over the whole DN+Binary
1780         res2 = self.ldb.search(scope=SCOPE_BASE, attrs=["wellKnownObjects"], expression=("wellKnownObjects=%s") % res[0].dn)
1781         self.assertEquals(len(res2), 0)
1782
1783     def test_subschemasubentry(self):
1784         """Test subSchemaSubEntry appears when requested, but not when not requested"""
1785         print "Test subSchemaSubEntry"""
1786
1787         res = self.ldb.search(base=self.base_dn, scope=SCOPE_BASE, attrs=["subSchemaSubEntry"])
1788         self.assertEquals(len(res), 1)
1789         self.assertEquals(res[0]["subSchemaSubEntry"][0], "CN=Aggregate,"+self.schema_dn)
1790
1791         res = self.ldb.search(base=self.base_dn, scope=SCOPE_BASE, attrs=["*"])
1792         self.assertEquals(len(res), 1)
1793         self.assertTrue("subScheamSubEntry" not in res[0])
1794
1795     def test_delete(self):
1796         """Tests the delete operation"""
1797         print "Tests the delete operations"""
1798
1799         ldb.add({
1800             "dn": "cn=ldaptestcontainer," + self.base_dn,
1801             "objectclass": "container"})
1802         ldb.add({
1803             "dn": "cn=entry1,cn=ldaptestcontainer," + self.base_dn,
1804             "objectclass": "container"})
1805         ldb.add({
1806             "dn": "cn=entry2,cn=ldaptestcontainer," + self.base_dn,
1807             "objectclass": "container"})
1808
1809         try:
1810             ldb.delete("cn=ldaptestcontainer," + self.base_dn)
1811             self.fail()
1812         except LdbError, (num, _):
1813             self.assertEquals(num, ERR_NOT_ALLOWED_ON_NON_LEAF)
1814
1815         ldb.delete("cn=ldaptestcontainer," + self.base_dn, ["tree_delete:0"])
1816
1817         try:
1818             res = ldb.search("cn=ldaptestcontainer," + self.base_dn,
1819                              scope=SCOPE_BASE, attrs=[])
1820             self.fail()
1821         except LdbError, (num, _):
1822             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
1823         try:
1824             res = ldb.search("cn=entry1,cn=ldaptestcontainer," + self.base_dn,
1825                              scope=SCOPE_BASE, attrs=[])
1826             self.fail()
1827         except LdbError, (num, _):
1828             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
1829         try:
1830             res = ldb.search("cn=entry2,cn=ldaptestcontainer," + self.base_dn,
1831                              scope=SCOPE_BASE, attrs=[])
1832             self.fail()
1833         except LdbError, (num, _):
1834             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
1835
1836         self.delete_force(self.ldb, "cn=entry1,cn=ldaptestcontainer," + self.base_dn)
1837         self.delete_force(self.ldb, "cn=entry2,cn=ldaptestcontainer," + self.base_dn)
1838         self.delete_force(self.ldb, "cn=ldaptestcontainer," + self.base_dn)
1839
1840         # Performs some protected object delete testing
1841
1842         res = ldb.search(base="", expression="", scope=SCOPE_BASE,
1843                          attrs=["dsServiceName", "dNSHostName"])
1844         self.assertEquals(len(res), 1)
1845
1846         try:
1847             ldb.delete(res[0]["dsServiceName"][0])
1848             self.fail()
1849         except LdbError, (num, _):
1850             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1851
1852         res = ldb.search(self.base_dn, scope=SCOPE_SUBTREE,
1853                          attrs=["rIDSetReferences"],
1854                          expression="(&(objectClass=computer)(dNSHostName=" + res[0]["dNSHostName"][0] + "))")
1855         self.assertEquals(len(res), 1)
1856
1857         try:
1858             ldb.delete(res[0]["rIDSetReferences"][0])
1859             self.fail()
1860         except LdbError, (num, _):
1861             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1862
1863         try:
1864             ldb.delete("cn=Enterprise Schema,cn=Partitions," + self.configuration_dn)
1865             self.fail()
1866         except LdbError, (num, _):
1867             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1868
1869 # TODO: This fails with LDB_ERR_NOT_ALLOWED_ON_NON_LEAF on Windows
1870 #        try:
1871 #            ldb.delete("cn=Enterprise Configuration,cn=Partitions," + self.configuration_dn)
1872 #            self.fail()
1873 #        except LdbError, (num, _):
1874 #            self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1875
1876         # Performs some "systemFlags" testing
1877
1878         # Delete failing since "SYSTEM_FLAG_DISALLOW_DELETE"
1879         try:
1880             ldb.delete("CN=Users," + self.base_dn)
1881             self.fail()
1882         except LdbError, (num, _):
1883             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1884
1885     def test_all(self):
1886         """Basic tests"""
1887
1888         print "Testing user add"
1889
1890         ldb.add({
1891             "dn": "cn=ldaptestuser,cn=uSers," + self.base_dn,
1892             "objectclass": ["user", "person"],
1893             "cN": "LDAPtestUSER",
1894             "givenname": "ldap",
1895             "sn": "testy"})
1896
1897         ldb.add({
1898             "dn": "cn=ldaptestgroup,cn=uSers," + self.base_dn,
1899             "objectclass": "group",
1900             "member": "cn=ldaptestuser,cn=useRs," + self.base_dn})
1901
1902         ldb.add({
1903             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1904             "objectclass": "computer",
1905             "cN": "LDAPtestCOMPUTER"})
1906
1907         ldb.add({"dn": "cn=ldaptest2computer,cn=computers," + self.base_dn,
1908             "objectClass": "computer",
1909             "cn": "LDAPtest2COMPUTER",
1910             "userAccountControl": str(UF_WORKSTATION_TRUST_ACCOUNT),
1911             "displayname": "ldap testy"})
1912
1913         try:
1914             ldb.add({"dn": "cn=ldaptestcomputer3,cn=computers," + self.base_dn,
1915                      "objectClass": "computer",
1916                      "cn": "LDAPtest2COMPUTER"
1917                      })
1918             self.fail()
1919         except LdbError, (num, _):
1920             self.assertEquals(num, ERR_INVALID_DN_SYNTAX)
1921
1922         try:
1923             ldb.add({"dn": "cn=ldaptestcomputer3,cn=computers," + self.base_dn,
1924                      "objectClass": "computer",
1925                      "cn": "ldaptestcomputer3",
1926                      "sAMAccountType": str(ATYPE_NORMAL_ACCOUNT)
1927                 })
1928             self.fail()
1929         except LdbError, (num, _):
1930             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1931
1932         ldb.add({"dn": "cn=ldaptestcomputer3,cn=computers," + self.base_dn,
1933                  "objectClass": "computer",
1934                  "cn": "LDAPtestCOMPUTER3"
1935                  })
1936
1937         print "Testing ldb.search for (&(cn=ldaptestcomputer3)(objectClass=user))";
1938         res = ldb.search(self.base_dn, expression="(&(cn=ldaptestcomputer3)(objectClass=user))");
1939         self.assertEquals(len(res), 1, "Found only %d for (&(cn=ldaptestcomputer3)(objectClass=user))" % len(res))
1940
1941         self.assertEquals(str(res[0].dn), ("CN=ldaptestcomputer3,CN=Computers," + self.base_dn));
1942         self.assertEquals(res[0]["cn"][0], "ldaptestcomputer3");
1943         self.assertEquals(res[0]["name"][0], "ldaptestcomputer3");
1944         self.assertEquals(res[0]["objectClass"][0], "top");
1945         self.assertEquals(res[0]["objectClass"][1], "person");
1946         self.assertEquals(res[0]["objectClass"][2], "organizationalPerson");
1947         self.assertEquals(res[0]["objectClass"][3], "user");
1948         self.assertEquals(res[0]["objectClass"][4], "computer");
1949         self.assertTrue("objectGUID" in res[0])
1950         self.assertTrue("whenCreated" in res[0])
1951         self.assertEquals(res[0]["objectCategory"][0], ("CN=Computer,CN=Schema,CN=Configuration," + self.base_dn));
1952         self.assertEquals(int(res[0]["primaryGroupID"][0]), 513);
1953         self.assertEquals(int(res[0]["sAMAccountType"][0]), ATYPE_NORMAL_ACCOUNT);
1954         self.assertEquals(int(res[0]["userAccountControl"][0]), UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD | UF_ACCOUNTDISABLE);
1955
1956         self.delete_force(self.ldb, "cn=ldaptestcomputer3,cn=computers," + self.base_dn)
1957
1958         print "Testing attribute or value exists behaviour"
1959         try:
1960             ldb.modify_ldif("""
1961 dn: cn=ldaptest2computer,cn=computers,""" + self.base_dn + """
1962 changetype: modify
1963 replace: servicePrincipalName
1964 servicePrincipalName: host/ldaptest2computer
1965 servicePrincipalName: host/ldaptest2computer
1966 servicePrincipalName: cifs/ldaptest2computer
1967 """)
1968             self.fail()
1969         except LdbError, (num, msg):
1970             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
1971
1972         ldb.modify_ldif("""
1973 dn: cn=ldaptest2computer,cn=computers,""" + self.base_dn + """
1974 changetype: modify
1975 replace: servicePrincipalName
1976 servicePrincipalName: host/ldaptest2computer
1977 servicePrincipalName: cifs/ldaptest2computer
1978 """)
1979         try:
1980             ldb.modify_ldif("""
1981 dn: cn=ldaptest2computer,cn=computers,""" + self.base_dn + """
1982 changetype: modify
1983 add: servicePrincipalName
1984 servicePrincipalName: host/ldaptest2computer
1985 """)
1986             self.fail()
1987         except LdbError, (num, msg):
1988             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
1989
1990         print "Testing ranged results"
1991         ldb.modify_ldif("""
1992 dn: cn=ldaptest2computer,cn=computers,""" + self.base_dn + """
1993 changetype: modify
1994 replace: servicePrincipalName
1995 """)
1996
1997         ldb.modify_ldif("""
1998 dn: cn=ldaptest2computer,cn=computers,""" + self.base_dn + """
1999 changetype: modify
2000 add: servicePrincipalName
2001 servicePrincipalName: host/ldaptest2computer0
2002 servicePrincipalName: host/ldaptest2computer1
2003 servicePrincipalName: host/ldaptest2computer2
2004 servicePrincipalName: host/ldaptest2computer3
2005 servicePrincipalName: host/ldaptest2computer4
2006 servicePrincipalName: host/ldaptest2computer5
2007 servicePrincipalName: host/ldaptest2computer6
2008 servicePrincipalName: host/ldaptest2computer7
2009 servicePrincipalName: host/ldaptest2computer8
2010 servicePrincipalName: host/ldaptest2computer9
2011 servicePrincipalName: host/ldaptest2computer10
2012 servicePrincipalName: host/ldaptest2computer11
2013 servicePrincipalName: host/ldaptest2computer12
2014 servicePrincipalName: host/ldaptest2computer13
2015 servicePrincipalName: host/ldaptest2computer14
2016 servicePrincipalName: host/ldaptest2computer15
2017 servicePrincipalName: host/ldaptest2computer16
2018 servicePrincipalName: host/ldaptest2computer17
2019 servicePrincipalName: host/ldaptest2computer18
2020 servicePrincipalName: host/ldaptest2computer19
2021 servicePrincipalName: host/ldaptest2computer20
2022 servicePrincipalName: host/ldaptest2computer21
2023 servicePrincipalName: host/ldaptest2computer22
2024 servicePrincipalName: host/ldaptest2computer23
2025 servicePrincipalName: host/ldaptest2computer24
2026 servicePrincipalName: host/ldaptest2computer25
2027 servicePrincipalName: host/ldaptest2computer26
2028 servicePrincipalName: host/ldaptest2computer27
2029 servicePrincipalName: host/ldaptest2computer28
2030 servicePrincipalName: host/ldaptest2computer29
2031 """)
2032
2033         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE,
2034                          attrs=["servicePrincipalName;range=0-*"])
2035         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
2036         #print len(res[0]["servicePrincipalName;range=0-*"])
2037         self.assertEquals(len(res[0]["servicePrincipalName;range=0-*"]), 30)
2038
2039         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=0-19"])
2040         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
2041             # print res[0]["servicePrincipalName;range=0-19"].length
2042         self.assertEquals(len(res[0]["servicePrincipalName;range=0-19"]), 20)
2043
2044
2045         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=0-30"])
2046         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
2047         self.assertEquals(len(res[0]["servicePrincipalName;range=0-*"]), 30)
2048
2049         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=0-40"])
2050         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
2051         self.assertEquals(len(res[0]["servicePrincipalName;range=0-*"]), 30)
2052
2053         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=30-40"])
2054         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
2055         self.assertEquals(len(res[0]["servicePrincipalName;range=30-*"]), 0)
2056
2057
2058         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=10-40"])
2059         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
2060         self.assertEquals(len(res[0]["servicePrincipalName;range=10-*"]), 20)
2061         # pos_11 = res[0]["servicePrincipalName;range=10-*"][18]
2062
2063         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=11-40"])
2064         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
2065         self.assertEquals(len(res[0]["servicePrincipalName;range=11-*"]), 19)
2066             # print res[0]["servicePrincipalName;range=11-*"][18]
2067             # print pos_11
2068             # self.assertEquals((res[0]["servicePrincipalName;range=11-*"][18]), pos_11)
2069
2070         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=11-15"])
2071         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
2072         self.assertEquals(len(res[0]["servicePrincipalName;range=11-15"]), 5)
2073             # self.assertEquals(res[0]["servicePrincipalName;range=11-15"][4], pos_11)
2074
2075         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName"])
2076         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
2077             # print res[0]["servicePrincipalName"][18]
2078             # print pos_11
2079         self.assertEquals(len(res[0]["servicePrincipalName"]), 30)
2080             # self.assertEquals(res[0]["servicePrincipalName"][18], pos_11)
2081
2082         self.delete_force(self.ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
2083         ldb.add({
2084             "dn": "cn=ldaptestuser2,cn=useRs," + self.base_dn,
2085             "objectClass": ["person", "user"],
2086             "cn": "LDAPtestUSER2",
2087             "givenname": "testy",
2088             "sn": "ldap user2"})
2089
2090         print "Testing Ambigious Name Resolution"
2091         # Testing ldb.search for (&(anr=ldap testy)(objectClass=user))
2092         res = ldb.search(expression="(&(anr=ldap testy)(objectClass=user))")
2093         self.assertEquals(len(res), 3, "Found only %d of 3 for (&(anr=ldap testy)(objectClass=user))" % len(res))
2094
2095         # Testing ldb.search for (&(anr=testy ldap)(objectClass=user))
2096         res = ldb.search(expression="(&(anr=testy ldap)(objectClass=user))")
2097         self.assertEquals(len(res), 2, "Found only %d of 2 for (&(anr=testy ldap)(objectClass=user))" % len(res))
2098
2099         # Testing ldb.search for (&(anr=ldap)(objectClass=user))
2100         res = ldb.search(expression="(&(anr=ldap)(objectClass=user))")
2101         self.assertEquals(len(res), 4, "Found only %d of 4 for (&(anr=ldap)(objectClass=user))" % len(res))
2102
2103         # Testing ldb.search for (&(anr==ldap)(objectClass=user))
2104         res = ldb.search(expression="(&(anr==ldap)(objectClass=user))")
2105         self.assertEquals(len(res), 1, "Could not find (&(anr==ldap)(objectClass=user)). Found only %d for (&(anr=ldap)(objectClass=user))" % len(res))
2106
2107         self.assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + self.base_dn))
2108         self.assertEquals(res[0]["cn"][0], "ldaptestuser")
2109         self.assertEquals(str(res[0]["name"]), "ldaptestuser")
2110
2111         # Testing ldb.search for (&(anr=testy)(objectClass=user))
2112         res = ldb.search(expression="(&(anr=testy)(objectClass=user))")
2113         self.assertEquals(len(res), 2, "Found only %d for (&(anr=testy)(objectClass=user))" % len(res))
2114
2115         # Testing ldb.search for (&(anr=testy ldap)(objectClass=user))
2116         res = ldb.search(expression="(&(anr=testy ldap)(objectClass=user))")
2117         self.assertEquals(len(res), 2, "Found only %d for (&(anr=testy ldap)(objectClass=user))" % len(res))
2118
2119         # Testing ldb.search for (&(anr==testy ldap)(objectClass=user))
2120 # this test disabled for the moment, as anr with == tests are not understood
2121 #        res = ldb.search(expression="(&(anr==testy ldap)(objectClass=user))")
2122 #        self.assertEquals(len(res), 1, "Found only %d for (&(anr==testy ldap)(objectClass=user))" % len(res))
2123
2124 #        self.assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + self.base_dn))
2125 #        self.assertEquals(res[0]["cn"][0], "ldaptestuser")
2126 #        self.assertEquals(res[0]["name"][0], "ldaptestuser")
2127
2128         # Testing ldb.search for (&(anr==testy ldap)(objectClass=user))
2129 #        res = ldb.search(expression="(&(anr==testy ldap)(objectClass=user))")
2130 #        self.assertEquals(len(res), 1, "Could not find (&(anr==testy ldap)(objectClass=user))")
2131
2132 #        self.assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + self.base_dn))
2133 #        self.assertEquals(res[0]["cn"][0], "ldaptestuser")
2134 #        self.assertEquals(res[0]["name"][0], "ldaptestuser")
2135
2136         # Testing ldb.search for (&(anr=testy ldap user)(objectClass=user))
2137         res = ldb.search(expression="(&(anr=testy ldap user)(objectClass=user))")
2138         self.assertEquals(len(res), 1, "Could not find (&(anr=testy ldap user)(objectClass=user))")
2139
2140         self.assertEquals(str(res[0].dn), ("CN=ldaptestuser2,CN=Users," + self.base_dn))
2141         self.assertEquals(str(res[0]["cn"]), "ldaptestuser2")
2142         self.assertEquals(str(res[0]["name"]), "ldaptestuser2")
2143
2144         # Testing ldb.search for (&(anr==testy ldap user2)(objectClass=user))
2145 #        res = ldb.search(expression="(&(anr==testy ldap user2)(objectClass=user))")
2146 #        self.assertEquals(len(res), 1, "Could not find (&(anr==testy ldap user2)(objectClass=user))")
2147
2148         self.assertEquals(str(res[0].dn), ("CN=ldaptestuser2,CN=Users," + self.base_dn))
2149         self.assertEquals(str(res[0]["cn"]), "ldaptestuser2")
2150         self.assertEquals(str(res[0]["name"]), "ldaptestuser2")
2151
2152         # Testing ldb.search for (&(anr==ldap user2)(objectClass=user))
2153 #        res = ldb.search(expression="(&(anr==ldap user2)(objectClass=user))")
2154 #        self.assertEquals(len(res), 1, "Could not find (&(anr==ldap user2)(objectClass=user))")
2155
2156         self.assertEquals(str(res[0].dn), ("CN=ldaptestuser2,CN=Users," + self.base_dn))
2157         self.assertEquals(str(res[0]["cn"]), "ldaptestuser2")
2158         self.assertEquals(str(res[0]["name"]), "ldaptestuser2")
2159
2160         # Testing ldb.search for (&(anr==not ldap user2)(objectClass=user))
2161 #        res = ldb.search(expression="(&(anr==not ldap user2)(objectClass=user))")
2162 #        self.assertEquals(len(res), 0, "Must not find (&(anr==not ldap user2)(objectClass=user))")
2163
2164         # Testing ldb.search for (&(anr=not ldap user2)(objectClass=user))
2165         res = ldb.search(expression="(&(anr=not ldap user2)(objectClass=user))")
2166         self.assertEquals(len(res), 0, "Must not find (&(anr=not ldap user2)(objectClass=user))")
2167
2168         # Testing ldb.search for (&(anr="testy ldap")(objectClass=user)) (ie, with quotes)
2169 #        res = ldb.search(expression="(&(anr==\"testy ldap\")(objectClass=user))")
2170 #        self.assertEquals(len(res), 0, "Found (&(anr==\"testy ldap\")(objectClass=user))")
2171
2172         print "Testing Renames"
2173
2174         attrs = ["objectGUID", "objectSid"]
2175         print "Testing ldb.search for (&(cn=ldaptestUSer2)(objectClass=user))"
2176         res_user = ldb.search(self.base_dn, expression="(&(cn=ldaptestUSer2)(objectClass=user))", scope=SCOPE_SUBTREE, attrs=attrs)
2177         self.assertEquals(len(res_user), 1, "Could not find (&(cn=ldaptestUSer2)(objectClass=user))")
2178
2179         # Check rename works with extended/alternate DN forms
2180         ldb.rename("<SID=" + ldb.schema_format_value("objectSID", res_user[0]["objectSID"][0]) + ">" , "cn=ldaptestUSER3,cn=users," + self.base_dn)
2181
2182         print "Testing ldb.search for (&(cn=ldaptestuser3)(objectClass=user))"
2183         res = ldb.search(expression="(&(cn=ldaptestuser3)(objectClass=user))")
2184         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestuser3)(objectClass=user))")
2185
2186         self.assertEquals(str(res[0].dn), ("CN=ldaptestUSER3,CN=Users," + self.base_dn))
2187         self.assertEquals(str(res[0]["cn"]), "ldaptestUSER3")
2188         self.assertEquals(str(res[0]["name"]), "ldaptestUSER3")
2189
2190          #"Testing ldb.search for (&(&(cn=ldaptestuser3)(userAccountControl=*))(objectClass=user))"
2191         res = ldb.search(expression="(&(&(cn=ldaptestuser3)(userAccountControl=*))(objectClass=user))")
2192         self.assertEquals(len(res), 1, "(&(&(cn=ldaptestuser3)(userAccountControl=*))(objectClass=user))")
2193
2194         self.assertEquals(str(res[0].dn), ("CN=ldaptestUSER3,CN=Users," + self.base_dn))
2195         self.assertEquals(str(res[0]["cn"]), "ldaptestUSER3")
2196         self.assertEquals(str(res[0]["name"]), "ldaptestUSER3")
2197
2198          #"Testing ldb.search for (&(&(cn=ldaptestuser3)(userAccountControl=546))(objectClass=user))"
2199         res = ldb.search(expression="(&(&(cn=ldaptestuser3)(userAccountControl=546))(objectClass=user))")
2200         self.assertEquals(len(res), 1, "(&(&(cn=ldaptestuser3)(userAccountControl=546))(objectClass=user))")
2201
2202         self.assertEquals(str(res[0].dn), ("CN=ldaptestUSER3,CN=Users," + self.base_dn))
2203         self.assertEquals(str(res[0]["cn"]), "ldaptestUSER3")
2204         self.assertEquals(str(res[0]["name"]), "ldaptestUSER3")
2205
2206          #"Testing ldb.search for (&(&(cn=ldaptestuser3)(userAccountControl=547))(objectClass=user))"
2207         res = ldb.search(expression="(&(&(cn=ldaptestuser3)(userAccountControl=547))(objectClass=user))")
2208         self.assertEquals(len(res), 0, "(&(&(cn=ldaptestuser3)(userAccountControl=547))(objectClass=user))")
2209
2210         # This is a Samba special, and does not exist in real AD
2211         #    print "Testing ldb.search for (dn=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")"
2212         #    res = ldb.search("(dn=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")")
2213         #    if (res.error != 0 || len(res) != 1) {
2214         #        print "Could not find (dn=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")"
2215         #        self.assertEquals(len(res), 1)
2216         #    }
2217         #    self.assertEquals(res[0].dn, ("CN=ldaptestUSER3,CN=Users," + self.base_dn))
2218         #    self.assertEquals(res[0].cn, "ldaptestUSER3")
2219         #    self.assertEquals(res[0].name, "ldaptestUSER3")
2220
2221         print "Testing ldb.search for (distinguishedName=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")"
2222         res = ldb.search(expression="(distinguishedName=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")")
2223         self.assertEquals(len(res), 1, "Could not find (dn=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")")
2224         self.assertEquals(str(res[0].dn), ("CN=ldaptestUSER3,CN=Users," + self.base_dn))
2225         self.assertEquals(str(res[0]["cn"]), "ldaptestUSER3")
2226         self.assertEquals(str(res[0]["name"]), "ldaptestUSER3")
2227
2228         # ensure we cannot add it again
2229         try:
2230             ldb.add({"dn": "cn=ldaptestuser3,cn=userS," + self.base_dn,
2231                       "objectClass": ["person", "user"],
2232                       "cn": "LDAPtestUSER3"})
2233             self.fail()
2234         except LdbError, (num, _):
2235             self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
2236
2237         # rename back
2238         ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "cn=ldaptestuser2,cn=users," + self.base_dn)
2239
2240         # ensure we cannot rename it twice
2241         try:
2242             ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn,
2243                        "cn=ldaptestuser2,cn=users," + self.base_dn)
2244             self.fail()
2245         except LdbError, (num, _):
2246             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
2247
2248         # ensure can now use that name
2249         ldb.add({"dn": "cn=ldaptestuser3,cn=users," + self.base_dn,
2250                       "objectClass": ["person", "user"],
2251                       "cn": "LDAPtestUSER3"})
2252
2253         # ensure we now cannot rename
2254         try:
2255             ldb.rename("cn=ldaptestuser2,cn=users," + self.base_dn, "cn=ldaptestuser3,cn=users," + self.base_dn)
2256             self.fail()
2257         except LdbError, (num, _):
2258             self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
2259         try:
2260             ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "cn=ldaptestuser3,cn=configuration," + self.base_dn)
2261             self.fail()
2262         except LdbError, (num, _):
2263             self.assertTrue(num in (71, 64))
2264
2265         ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "cn=ldaptestuser5,cn=users," + self.base_dn)
2266
2267         ldb.delete("cn=ldaptestuser5,cn=users," + self.base_dn)
2268
2269         self.delete_force(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
2270
2271         ldb.rename("cn=ldaptestgroup,cn=users," + self.base_dn, "cn=ldaptestgroup2,cn=users," + self.base_dn)
2272
2273         print "Testing subtree renames"
2274
2275         ldb.add({"dn": "cn=ldaptestcontainer," + self.base_dn,
2276                  "objectClass": "container"})
2277
2278         ldb.add({"dn": "CN=ldaptestuser4,CN=ldaptestcontainer," + self.base_dn,
2279                  "objectClass": ["person", "user"],
2280                  "cn": "LDAPtestUSER4"})
2281
2282         ldb.modify_ldif("""
2283 dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
2284 changetype: modify
2285 add: member
2286 member: cn=ldaptestuser4,cn=ldaptestcontainer,""" + self.base_dn + """
2287 member: cn=ldaptestcomputer,cn=computers,""" + self.base_dn + """
2288 member: cn=ldaptestuser2,cn=users,""" + self.base_dn + """
2289 """)
2290
2291         print "Testing ldb.rename of cn=ldaptestcontainer," + self.base_dn + " to cn=ldaptestcontainer2," + self.base_dn
2292         ldb.rename("CN=ldaptestcontainer," + self.base_dn, "CN=ldaptestcontainer2," + self.base_dn)
2293
2294         print "Testing ldb.search for (&(cn=ldaptestuser4)(objectClass=user))"
2295         res = ldb.search(expression="(&(cn=ldaptestuser4)(objectClass=user))")
2296         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestuser4)(objectClass=user))")
2297
2298         print "Testing subtree ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in (just renamed from) cn=ldaptestcontainer," + self.base_dn
2299         try:
2300             res = ldb.search("cn=ldaptestcontainer," + self.base_dn,
2301                     expression="(&(cn=ldaptestuser4)(objectClass=user))",
2302                     scope=SCOPE_SUBTREE)
2303             self.fail(res)
2304         except LdbError, (num, _):
2305             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
2306
2307         print "Testing one-level ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in (just renamed from) cn=ldaptestcontainer," + self.base_dn
2308         try:
2309             res = ldb.search("cn=ldaptestcontainer," + self.base_dn,
2310                     expression="(&(cn=ldaptestuser4)(objectClass=user))", scope=SCOPE_ONELEVEL)
2311             self.fail()
2312         except LdbError, (num, _):
2313             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
2314
2315         print "Testing ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in renamed container"
2316         res = ldb.search("cn=ldaptestcontainer2," + self.base_dn, expression="(&(cn=ldaptestuser4)(objectClass=user))", scope=SCOPE_SUBTREE)
2317         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestuser4)(objectClass=user)) under cn=ldaptestcontainer2," + self.base_dn)
2318
2319         self.assertEquals(str(res[0].dn), ("CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn))
2320         self.assertEquals(res[0]["memberOf"][0].upper(), ("CN=ldaptestgroup2,CN=Users," + self.base_dn).upper())
2321
2322         time.sleep(4)
2323
2324         print "Testing ldb.search for (&(member=CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn + ")(objectclass=group)) to check subtree renames and linked attributes"
2325         res = ldb.search(self.base_dn, expression="(&(member=CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn + ")(objectclass=group))", scope=SCOPE_SUBTREE)
2326         self.assertEquals(len(res), 1, "Could not find (&(member=CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn + ")(objectclass=group)), perhaps linked attributes are not consistant with subtree renames?")
2327
2328         print "Testing ldb.rename (into itself) of cn=ldaptestcontainer2," + self.base_dn + " to cn=ldaptestcontainer,cn=ldaptestcontainer2," + self.base_dn
2329         try:
2330             ldb.rename("cn=ldaptestcontainer2," + self.base_dn, "cn=ldaptestcontainer,cn=ldaptestcontainer2," + self.base_dn)
2331             self.fail()
2332         except LdbError, (num, _):
2333             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
2334
2335         print "Testing ldb.rename (into non-existent container) of cn=ldaptestcontainer2," + self.base_dn + " to cn=ldaptestcontainer,cn=ldaptestcontainer3," + self.base_dn
2336         try:
2337             ldb.rename("cn=ldaptestcontainer2," + self.base_dn, "cn=ldaptestcontainer,cn=ldaptestcontainer3," + self.base_dn)
2338             self.fail()
2339         except LdbError, (num, _):
2340             self.assertTrue(num in (ERR_UNWILLING_TO_PERFORM, ERR_OTHER))
2341
2342         print "Testing delete (should fail, not a leaf node) of renamed cn=ldaptestcontainer2," + self.base_dn
2343         try:
2344             ldb.delete("cn=ldaptestcontainer2," + self.base_dn)
2345             self.fail()
2346         except LdbError, (num, _):
2347             self.assertEquals(num, ERR_NOT_ALLOWED_ON_NON_LEAF)
2348
2349         print "Testing base ldb.search for CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn
2350         res = ldb.search(expression="(objectclass=*)", base=("CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn), scope=SCOPE_BASE)
2351         self.assertEquals(len(res), 1)
2352         res = ldb.search(expression="(cn=ldaptestuser40)", base=("CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn), scope=SCOPE_BASE)
2353         self.assertEquals(len(res), 0)
2354
2355         print "Testing one-level ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in cn=ldaptestcontainer2," + self.base_dn
2356         res = ldb.search(expression="(&(cn=ldaptestuser4)(objectClass=user))", base=("cn=ldaptestcontainer2," + self.base_dn), scope=SCOPE_ONELEVEL)
2357         # FIXME: self.assertEquals(len(res), 0)
2358
2359         print "Testing one-level ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in cn=ldaptestcontainer2," + self.base_dn
2360         res = ldb.search(expression="(&(cn=ldaptestuser4)(objectClass=user))", base=("cn=ldaptestcontainer2," + self.base_dn), scope=SCOPE_SUBTREE)
2361         # FIXME: self.assertEquals(len(res), 0)
2362
2363         print "Testing delete of subtree renamed "+("CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn)
2364         ldb.delete(("CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn))
2365         print "Testing delete of renamed cn=ldaptestcontainer2," + self.base_dn
2366         ldb.delete("cn=ldaptestcontainer2," + self.base_dn)
2367
2368         ldb.add({"dn": "cn=ldaptestutf8user èùéìòà,cn=users," + self.base_dn, "objectClass": "user"})
2369
2370         ldb.add({"dn": "cn=ldaptestutf8user2  èùéìòà,cn=users," + self.base_dn, "objectClass": "user"})
2371
2372         print "Testing ldb.search for (&(cn=ldaptestuser)(objectClass=user))"
2373         res = ldb.search(expression="(&(cn=ldaptestuser)(objectClass=user))")
2374         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestuser)(objectClass=user))")
2375
2376         self.assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + self.base_dn))
2377         self.assertEquals(str(res[0]["cn"]), "ldaptestuser")
2378         self.assertEquals(str(res[0]["name"]), "ldaptestuser")
2379         self.assertEquals(set(res[0]["objectClass"]), set(["top", "person", "organizationalPerson", "user"]))
2380         self.assertTrue("objectGUID" in res[0])
2381         self.assertTrue("whenCreated" in res[0])
2382         self.assertEquals(str(res[0]["objectCategory"]), ("CN=Person,CN=Schema,CN=Configuration," + self.base_dn))
2383         self.assertEquals(int(res[0]["sAMAccountType"][0]), ATYPE_NORMAL_ACCOUNT)
2384         self.assertEquals(int(res[0]["userAccountControl"][0]), UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD | UF_ACCOUNTDISABLE)
2385         self.assertEquals(res[0]["memberOf"][0].upper(), ("CN=ldaptestgroup2,CN=Users," + self.base_dn).upper())
2386         self.assertEquals(len(res[0]["memberOf"]), 1)
2387
2388         print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=cn=person,cn=schema,cn=configuration," + self.base_dn + "))"
2389         res2 = ldb.search(expression="(&(cn=ldaptestuser)(objectCategory=cn=person,cn=schema,cn=configuration," + self.base_dn + "))")
2390         self.assertEquals(len(res2), 1, "Could not find (&(cn=ldaptestuser)(objectCategory=cn=person,cn=schema,cn=configuration," + self.base_dn + "))")
2391
2392         self.assertEquals(res[0].dn, res2[0].dn)
2393
2394         print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=PerSon))"
2395         res3 = ldb.search(expression="(&(cn=ldaptestuser)(objectCategory=PerSon))")
2396         self.assertEquals(len(res3), 1, "Could not find (&(cn=ldaptestuser)(objectCategory=PerSon)): matched %d" % len(res3))
2397
2398         self.assertEquals(res[0].dn, res3[0].dn)
2399
2400         if gc_ldb is not None:
2401             print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=PerSon)) in Global Catalog"
2402             res3gc = gc_ldb.search(expression="(&(cn=ldaptestuser)(objectCategory=PerSon))")
2403             self.assertEquals(len(res3gc), 1)
2404
2405             self.assertEquals(res[0].dn, res3gc[0].dn)
2406
2407         print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=PerSon)) in with 'phantom root' control"
2408
2409         if gc_ldb is not None:
2410             res3control = gc_ldb.search(self.base_dn, expression="(&(cn=ldaptestuser)(objectCategory=PerSon))", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["search_options:1:2"])
2411             self.assertEquals(len(res3control), 1, "Could not find (&(cn=ldaptestuser)(objectCategory=PerSon)) in Global Catalog")
2412
2413             self.assertEquals(res[0].dn, res3control[0].dn)
2414
2415         ldb.delete(res[0].dn)
2416
2417         print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectClass=user))"
2418         res = ldb.search(expression="(&(cn=ldaptestcomputer)(objectClass=user))")
2419         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestuser)(objectClass=user))")
2420
2421         self.assertEquals(str(res[0].dn), ("CN=ldaptestcomputer,CN=Computers," + self.base_dn))
2422         self.assertEquals(str(res[0]["cn"]), "ldaptestcomputer")
2423         self.assertEquals(str(res[0]["name"]), "ldaptestcomputer")
2424         self.assertEquals(set(res[0]["objectClass"]), set(["top", "person", "organizationalPerson", "user", "computer"]))
2425         self.assertTrue("objectGUID" in res[0])
2426         self.assertTrue("whenCreated" in res[0])
2427         self.assertEquals(str(res[0]["objectCategory"]), ("CN=Computer,CN=Schema,CN=Configuration," + self.base_dn))
2428         self.assertEquals(int(res[0]["primaryGroupID"][0]), 513)
2429         self.assertEquals(int(res[0]["sAMAccountType"][0]), ATYPE_NORMAL_ACCOUNT)
2430         self.assertEquals(int(res[0]["userAccountControl"][0]), UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD | UF_ACCOUNTDISABLE)
2431         self.assertEquals(res[0]["memberOf"][0].upper(), ("CN=ldaptestgroup2,CN=Users," + self.base_dn).upper())
2432         self.assertEquals(len(res[0]["memberOf"]), 1)
2433
2434         print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + "))"
2435         res2 = ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + "))")
2436         self.assertEquals(len(res2), 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + "))")
2437
2438         self.assertEquals(res[0].dn, res2[0].dn)
2439
2440         if gc_ldb is not None:
2441             print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + ")) in Global Catlog"
2442             res2gc = gc_ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + "))")
2443             self.assertEquals(len(res2gc), 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + ")) in Global Catlog")
2444
2445             self.assertEquals(res[0].dn, res2gc[0].dn)
2446
2447         print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=compuTER))"
2448         res3 = ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=compuTER))")
2449         self.assertEquals(len(res3), 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=compuTER))")
2450
2451         self.assertEquals(res[0].dn, res3[0].dn)
2452
2453         if gc_ldb is not None:
2454             print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=compuTER)) in Global Catalog"
2455             res3gc = gc_ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=compuTER))")
2456             self.assertEquals(len(res3gc), 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=compuTER)) in Global Catalog")
2457
2458             self.assertEquals(res[0].dn, res3gc[0].dn)
2459
2460         print "Testing ldb.search for (&(cn=ldaptestcomp*r)(objectCategory=compuTER))"
2461         res4 = ldb.search(expression="(&(cn=ldaptestcomp*r)(objectCategory=compuTER))")
2462         self.assertEquals(len(res4), 1, "Could not find (&(cn=ldaptestcomp*r)(objectCategory=compuTER))")
2463
2464         self.assertEquals(res[0].dn, res4[0].dn)
2465
2466         print "Testing ldb.search for (&(cn=ldaptestcomput*)(objectCategory=compuTER))"
2467         res5 = ldb.search(expression="(&(cn=ldaptestcomput*)(objectCategory=compuTER))")
2468         self.assertEquals(len(res5), 1, "Could not find (&(cn=ldaptestcomput*)(objectCategory=compuTER))")
2469
2470         self.assertEquals(res[0].dn, res5[0].dn)
2471
2472         print "Testing ldb.search for (&(cn=*daptestcomputer)(objectCategory=compuTER))"
2473         res6 = ldb.search(expression="(&(cn=*daptestcomputer)(objectCategory=compuTER))")
2474         self.assertEquals(len(res6), 1, "Could not find (&(cn=*daptestcomputer)(objectCategory=compuTER))")
2475
2476         self.assertEquals(res[0].dn, res6[0].dn)
2477
2478         ldb.delete("<GUID=" + ldb.schema_format_value("objectGUID", res[0]["objectGUID"][0]) + ">")
2479
2480         print "Testing ldb.search for (&(cn=ldaptest2computer)(objectClass=user))"
2481         res = ldb.search(expression="(&(cn=ldaptest2computer)(objectClass=user))")
2482         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptest2computer)(objectClass=user))")
2483
2484         self.assertEquals(str(res[0].dn), "CN=ldaptest2computer,CN=Computers," + self.base_dn)
2485         self.assertEquals(str(res[0]["cn"]), "ldaptest2computer")
2486         self.assertEquals(str(res[0]["name"]), "ldaptest2computer")
2487         self.assertEquals(list(res[0]["objectClass"]), ["top", "person", "organizationalPerson", "user", "computer"])
2488         self.assertTrue("objectGUID" in res[0])
2489         self.assertTrue("whenCreated" in res[0])
2490         self.assertEquals(res[0]["objectCategory"][0], "CN=Computer,CN=Schema,CN=Configuration," + self.base_dn)
2491         self.assertEquals(int(res[0]["sAMAccountType"][0]), ATYPE_WORKSTATION_TRUST)
2492         self.assertEquals(int(res[0]["userAccountControl"][0]), UF_WORKSTATION_TRUST_ACCOUNT)
2493
2494         ldb.delete("<SID=" + ldb.schema_format_value("objectSID", res[0]["objectSID"][0]) + ">")
2495
2496         attrs = ["cn", "name", "objectClass", "objectGUID", "objectSID", "whenCreated", "nTSecurityDescriptor", "memberOf", "allowedAttributes", "allowedAttributesEffective"]
2497         print "Testing ldb.search for (&(cn=ldaptestUSer2)(objectClass=user))"
2498         res_user = ldb.search(self.base_dn, expression="(&(cn=ldaptestUSer2)(objectClass=user))", scope=SCOPE_SUBTREE, attrs=attrs)
2499         self.assertEquals(len(res_user), 1, "Could not find (&(cn=ldaptestUSer2)(objectClass=user))")
2500
2501         self.assertEquals(str(res_user[0].dn), ("CN=ldaptestuser2,CN=Users," + self.base_dn))
2502         self.assertEquals(str(res_user[0]["cn"]), "ldaptestuser2")
2503         self.assertEquals(str(res_user[0]["name"]), "ldaptestuser2")
2504         self.assertEquals(list(res_user[0]["objectClass"]), ["top", "person", "organizationalPerson", "user"])
2505         self.assertTrue("objectSid" in res_user[0])
2506         self.assertTrue("objectGUID" in res_user[0])
2507         self.assertTrue("whenCreated" in res_user[0])
2508         self.assertTrue("nTSecurityDescriptor" in res_user[0])
2509         self.assertTrue("allowedAttributes" in res_user[0])
2510         self.assertTrue("allowedAttributesEffective" in res_user[0])
2511         self.assertEquals(res_user[0]["memberOf"][0].upper(), ("CN=ldaptestgroup2,CN=Users," + self.base_dn).upper())
2512
2513         ldaptestuser2_sid = res_user[0]["objectSid"][0]
2514         ldaptestuser2_guid = res_user[0]["objectGUID"][0]
2515
2516         attrs = ["cn", "name", "objectClass", "objectGUID", "objectSID", "whenCreated", "nTSecurityDescriptor", "member", "allowedAttributes", "allowedAttributesEffective"]
2517         print "Testing ldb.search for (&(cn=ldaptestgroup2)(objectClass=group))"
2518         res = ldb.search(self.base_dn, expression="(&(cn=ldaptestgroup2)(objectClass=group))", scope=SCOPE_SUBTREE, attrs=attrs)
2519         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group))")
2520
2521         self.assertEquals(str(res[0].dn), ("CN=ldaptestgroup2,CN=Users," + self.base_dn))
2522         self.assertEquals(str(res[0]["cn"]), "ldaptestgroup2")
2523         self.assertEquals(str(res[0]["name"]), "ldaptestgroup2")
2524         self.assertEquals(list(res[0]["objectClass"]), ["top", "group"])
2525         self.assertTrue("objectGUID" in res[0])
2526         self.assertTrue("objectSid" in res[0])
2527         self.assertTrue("whenCreated" in res[0])
2528         self.assertTrue("nTSecurityDescriptor" in res[0])
2529         self.assertTrue("allowedAttributes" in res[0])
2530         self.assertTrue("allowedAttributesEffective" in res[0])
2531         memberUP = []
2532         for m in res[0]["member"]:
2533             memberUP.append(m.upper())
2534         self.assertTrue(("CN=ldaptestuser2,CN=Users," + self.base_dn).upper() in memberUP)
2535
2536         res = ldb.search(self.base_dn, expression="(&(cn=ldaptestgroup2)(objectClass=group))", scope=SCOPE_SUBTREE, attrs=attrs, controls=["extended_dn:1:1"])
2537         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group))")
2538
2539         print res[0]["member"]
2540         memberUP = []
2541         for m in res[0]["member"]:
2542             memberUP.append(m.upper())
2543         print ("<GUID=" + ldb.schema_format_value("objectGUID", ldaptestuser2_guid) + ">;<SID=" + ldb.schema_format_value("objectSid", ldaptestuser2_sid) + ">;CN=ldaptestuser2,CN=Users," + self.base_dn).upper()
2544
2545         self.assertTrue(("<GUID=" + ldb.schema_format_value("objectGUID", ldaptestuser2_guid) + ">;<SID=" + ldb.schema_format_value("objectSid", ldaptestuser2_sid) + ">;CN=ldaptestuser2,CN=Users," + self.base_dn).upper() in memberUP)
2546
2547         print "Quicktest for linked attributes"
2548         ldb.modify_ldif("""
2549 dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
2550 changetype: modify
2551 replace: member
2552 member: CN=ldaptestuser2,CN=Users,""" + self.base_dn + """
2553 member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + self.base_dn + """
2554 """)
2555
2556         ldb.modify_ldif("""
2557 dn: <GUID=""" + ldb.schema_format_value("objectGUID", res[0]["objectGUID"][0]) + """>
2558 changetype: modify
2559 replace: member
2560 member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + self.base_dn + """
2561 """)
2562
2563         ldb.modify_ldif("""
2564 dn: <SID=""" + ldb.schema_format_value("objectSid", res[0]["objectSid"][0]) + """>
2565 changetype: modify
2566 delete: member
2567 """)
2568
2569         ldb.modify_ldif("""
2570 dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
2571 changetype: modify
2572 add: member
2573 member: <GUID=""" + ldb.schema_format_value("objectGUID", res[0]["objectGUID"][0]) + """>
2574 member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + self.base_dn + """
2575 """)
2576
2577         ldb.modify_ldif("""
2578 dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
2579 changetype: modify
2580 replace: member
2581 """)
2582
2583         ldb.modify_ldif("""
2584 dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
2585 changetype: modify
2586 add: member
2587 member: <SID=""" + ldb.schema_format_value("objectSid", res_user[0]["objectSid"][0]) + """>
2588 member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + self.base_dn + """
2589 """)
2590
2591         ldb.modify_ldif("""
2592 dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
2593 changetype: modify
2594 delete: member
2595 member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + self.base_dn + """
2596 """)
2597
2598         res = ldb.search(self.base_dn, expression="(&(cn=ldaptestgroup2)(objectClass=group))", scope=SCOPE_SUBTREE, attrs=attrs)
2599         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group))")
2600
2601         self.assertEquals(str(res[0].dn), ("CN=ldaptestgroup2,CN=Users," + self.base_dn))
2602         self.assertEquals(res[0]["member"][0], ("CN=ldaptestuser2,CN=Users," + self.base_dn))
2603         self.assertEquals(len(res[0]["member"]), 1)
2604
2605         ldb.delete(("CN=ldaptestuser2,CN=Users," + self.base_dn))
2606
2607         time.sleep(4)
2608
2609         attrs = ["cn", "name", "objectClass", "objectGUID", "whenCreated", "nTSecurityDescriptor", "member"]
2610         print "Testing ldb.search for (&(cn=ldaptestgroup2)(objectClass=group)) to check linked delete"
2611         res = ldb.search(self.base_dn, expression="(&(cn=ldaptestgroup2)(objectClass=group))", scope=SCOPE_SUBTREE, attrs=attrs)
2612         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group)) to check linked delete")
2613
2614         self.assertEquals(str(res[0].dn), ("CN=ldaptestgroup2,CN=Users," + self.base_dn))
2615         self.assertTrue("member" not in res[0])
2616
2617         print "Testing ldb.search for (&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))"
2618 # TODO UTF8 users don't seem to work fully anymore
2619 #        res = ldb.search(expression="(&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))")
2620         res = ldb.search(expression="(&(cn=ldaptestutf8user èùéìòà)(objectclass=user))")
2621         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))")
2622
2623         self.assertEquals(str(res[0].dn), ("CN=ldaptestutf8user èùéìòà,CN=Users," + self.base_dn))
2624         self.assertEquals(str(res[0]["cn"]), "ldaptestutf8user èùéìòà")
2625         self.assertEquals(str(res[0]["name"]), "ldaptestutf8user èùéìòà")
2626         self.assertEquals(list(res[0]["objectClass"]), ["top", "person", "organizationalPerson", "user"])
2627         self.assertTrue("objectGUID" in res[0])
2628         self.assertTrue("whenCreated" in res[0])
2629
2630         ldb.delete(res[0].dn)
2631
2632         print "Testing ldb.search for (&(cn=ldaptestutf8user2*)(objectClass=user))"
2633         res = ldb.search(expression="(&(cn=ldaptestutf8user2*)(objectClass=user))")
2634         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestutf8user2*)(objectClass=user))")
2635
2636         ldb.delete(res[0].dn)
2637
2638         ldb.delete(("CN=ldaptestgroup2,CN=Users," + self.base_dn))
2639
2640         print "Testing ldb.search for (&(cn=ldaptestutf8user2 ÈÙÉÌÒÀ)(objectClass=user))"
2641 # TODO UTF8 users don't seem to work fully anymore
2642 #        res = ldb.search(expression="(&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))")
2643 #        self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))")
2644
2645         print "Testing that we can't get at the configuration DN from the main search base"
2646         res = ldb.search(self.base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
2647         self.assertEquals(len(res), 0)
2648
2649         print "Testing that we can get at the configuration DN from the main search base on the LDAP port with the 'phantom root' search_options control"
2650         res = ldb.search(self.base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["search_options:1:2"])
2651         self.assertTrue(len(res) > 0)
2652
2653         if gc_ldb is not None:
2654             print "Testing that we can get at the configuration DN from the main search base on the GC port with the search_options control == 0"
2655
2656             res = gc_ldb.search(self.base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["search_options:1:0"])
2657             self.assertTrue(len(res) > 0)
2658
2659             print "Testing that we do find configuration elements in the global catlog"
2660             res = gc_ldb.search(self.base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
2661             self.assertTrue(len(res) > 0)
2662
2663             print "Testing that we do find configuration elements and user elements at the same time"
2664             res = gc_ldb.search(self.base_dn, expression="(|(objectClass=crossRef)(objectClass=person))", scope=SCOPE_SUBTREE, attrs=["cn"])
2665             self.assertTrue(len(res) > 0)
2666
2667             print "Testing that we do find configuration elements in the global catlog, with the configuration basedn"
2668             res = gc_ldb.search(self.configuration_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
2669             self.assertTrue(len(res) > 0)
2670
2671         print "Testing that we can get at the configuration DN on the main LDAP port"
2672         res = ldb.search(self.configuration_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
2673         self.assertTrue(len(res) > 0)
2674
2675         print "Testing objectCategory canonacolisation"
2676         res = ldb.search(self.configuration_dn, expression="objectCategory=ntDsDSA", scope=SCOPE_SUBTREE, attrs=["cn"])
2677         self.assertTrue(len(res) > 0, "Didn't find any records with objectCategory=ntDsDSA")
2678         self.assertTrue(len(res) != 0)
2679
2680         res = ldb.search(self.configuration_dn, expression="objectCategory=CN=ntDs-DSA," + self.schema_dn, scope=SCOPE_SUBTREE, attrs=["cn"])
2681         self.assertTrue(len(res) > 0, "Didn't find any records with objectCategory=CN=ntDs-DSA," + self.schema_dn)
2682         self.assertTrue(len(res) != 0)
2683
2684         print "Testing objectClass attribute order on "+ self.base_dn
2685         res = ldb.search(expression="objectClass=domain", base=self.base_dn,
2686                          scope=SCOPE_BASE, attrs=["objectClass"])
2687         self.assertEquals(len(res), 1)
2688
2689         self.assertEquals(list(res[0]["objectClass"]), ["top", "domain", "domainDNS"])
2690
2691     #  check enumeration
2692
2693         print "Testing ldb.search for objectCategory=person"
2694         res = ldb.search(self.base_dn, expression="objectCategory=person", scope=SCOPE_SUBTREE, attrs=["cn"])
2695         self.assertTrue(len(res) > 0)
2696
2697         print "Testing ldb.search for objectCategory=person with domain scope control"
2698         res = ldb.search(self.base_dn, expression="objectCategory=person", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["domain_scope:1"])
2699         self.assertTrue(len(res) > 0)
2700
2701         print "Testing ldb.search for objectCategory=user"
2702         res = ldb.search(self.base_dn, expression="objectCategory=user", scope=SCOPE_SUBTREE, attrs=["cn"])
2703         self.assertTrue(len(res) > 0)
2704
2705         print "Testing ldb.search for objectCategory=user with domain scope control"
2706         res = ldb.search(self.base_dn, expression="objectCategory=user", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["domain_scope:1"])
2707         self.assertTrue(len(res) > 0)
2708
2709         print "Testing ldb.search for objectCategory=group"
2710         res = ldb.search(self.base_dn, expression="objectCategory=group", scope=SCOPE_SUBTREE, attrs=["cn"])
2711         self.assertTrue(len(res) > 0)
2712
2713         print "Testing ldb.search for objectCategory=group with domain scope control"
2714         res = ldb.search(self.base_dn, expression="objectCategory=group", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["domain_scope:1"])
2715         self.assertTrue(len(res) > 0)
2716
2717         print "Testing creating a user with the posixAccount objectClass"
2718         self.ldb.add_ldif("""dn: cn=posixuser,CN=Users,%s
2719 objectClass: top
2720 objectClass: person
2721 objectClass: posixAccount
2722 objectClass: user
2723 objectClass: organizationalPerson
2724 cn: posixuser
2725 uid: posixuser
2726 sn: posixuser
2727 uidNumber: 10126
2728 gidNumber: 10126
2729 homeDirectory: /home/posixuser
2730 loginShell: /bin/bash
2731 gecos: Posix User;;;
2732 description: A POSIX user"""% (self.base_dn))
2733
2734         print "Testing removing the posixAccount objectClass from an existing user"
2735         self.ldb.modify_ldif("""dn: cn=posixuser,CN=Users,%s
2736 changetype: modify
2737 delete: objectClass
2738 objectClass: posixAccount"""% (self.base_dn))
2739
2740         print "Testing adding the posixAccount objectClass to an existing user"
2741         self.ldb.modify_ldif("""dn: cn=posixuser,CN=Users,%s
2742 changetype: modify
2743 add: objectClass
2744 objectClass: posixAccount"""% (self.base_dn))
2745
2746         self.delete_force(self.ldb, "cn=posixuser,cn=users," + self.base_dn)
2747         self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
2748         self.delete_force(self.ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
2749         self.delete_force(self.ldb, "cn=ldaptestuser3,cn=users," + self.base_dn)
2750         self.delete_force(self.ldb, "cn=ldaptestuser4,cn=ldaptestcontainer," + self.base_dn)
2751         self.delete_force(self.ldb, "cn=ldaptestuser4,cn=ldaptestcontainer2," + self.base_dn)
2752         self.delete_force(self.ldb, "cn=ldaptestuser5,cn=users," + self.base_dn)
2753         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2754         self.delete_force(self.ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
2755         self.delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2756         self.delete_force(self.ldb, "cn=ldaptest2computer,cn=computers," + self.base_dn)
2757         self.delete_force(self.ldb, "cn=ldaptestcomputer3,cn=computers," + self.base_dn)
2758         self.delete_force(self.ldb, "cn=ldaptestutf8user èùéìòà,cn=users," + self.base_dn)
2759         self.delete_force(self.ldb, "cn=ldaptestutf8user2  èùéìòà,cn=users," + self.base_dn)
2760         self.delete_force(self.ldb, "cn=ldaptestcontainer," + self.base_dn)
2761         self.delete_force(self.ldb, "cn=ldaptestcontainer2," + self.base_dn)
2762
2763     def test_security_descriptor_add(self):
2764         """ Testing ldb.add_ldif() for nTSecurityDescriptor """
2765         user_name = "testdescriptoruser1"
2766         user_dn = "CN=%s,CN=Users,%s" % (user_name, self.base_dn)
2767         #
2768         # Test add_ldif() with SDDL security descriptor input
2769         #
2770         self.delete_force(self.ldb, user_dn)
2771         try:
2772             sddl = "O:DUG:DUD:PAI(A;;RPWP;;;AU)S:PAI"
2773             self.ldb.add_ldif("""
2774 dn: """ + user_dn + """
2775 objectclass: user
2776 sAMAccountName: """ + user_name + """
2777 nTSecurityDescriptor: """ + sddl)
2778             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2779             desc = res[0]["nTSecurityDescriptor"][0]
2780             desc = ndr_unpack( security.descriptor, desc )
2781             desc_sddl = desc.as_sddl( self.domain_sid )
2782             self.assertEqual(desc_sddl, sddl)
2783         finally:
2784             self.delete_force(self.ldb, user_dn)
2785         #
2786         # Test add_ldif() with BASE64 security descriptor
2787         #
2788         try:
2789             sddl = "O:DUG:DUD:PAI(A;;RPWP;;;AU)S:PAI"
2790             desc = security.descriptor.from_sddl(sddl, self.domain_sid)
2791             desc_binary = ndr_pack(desc)
2792             desc_base64 = base64.b64encode(desc_binary)
2793             self.ldb.add_ldif("""
2794 dn: """ + user_dn + """
2795 objectclass: user
2796 sAMAccountName: """ + user_name + """
2797 nTSecurityDescriptor:: """ + desc_base64)
2798             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2799             desc = res[0]["nTSecurityDescriptor"][0]
2800             desc = ndr_unpack(security.descriptor, desc)
2801             desc_sddl = desc.as_sddl(self.domain_sid)
2802             self.assertEqual(desc_sddl, sddl)
2803         finally:
2804             self.delete_force(self.ldb, user_dn)
2805
2806     def test_security_descriptor_add_neg(self):
2807         """Test add_ldif() with BASE64 security descriptor input using WRONG domain SID
2808             Negative test
2809         """
2810         user_name = "testdescriptoruser1"
2811         user_dn = "CN=%s,CN=Users,%s" % (user_name, self.base_dn)
2812         self.delete_force(self.ldb, user_dn)
2813         try:
2814             sddl = "O:DUG:DUD:PAI(A;;RPWP;;;AU)S:PAI"
2815             desc = security.descriptor.from_sddl(sddl, security.dom_sid('S-1-5-21'))
2816             desc_base64 = base64.b64encode( ndr_pack(desc) )
2817             self.ldb.add_ldif("""
2818 dn: """ + user_dn + """
2819 objectclass: user
2820 sAMAccountName: """ + user_name + """
2821 nTSecurityDescriptor:: """ + desc_base64)
2822             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2823             self.assertTrue("nTSecurityDescriptor" in res[0])
2824         finally:
2825             self.delete_force(self.ldb, user_dn)
2826
2827     def test_security_descriptor_modify(self):
2828         """ Testing ldb.modify_ldif() for nTSecurityDescriptor """
2829         user_name = "testdescriptoruser2"
2830         user_dn = "CN=%s,CN=Users,%s" % (user_name, self.base_dn)
2831         #
2832         # Delete user object and test modify_ldif() with SDDL security descriptor input
2833         # Add ACE to the original descriptor test
2834         #
2835         try:
2836             self.delete_force(self.ldb, user_dn)
2837             self.ldb.add_ldif("""
2838 dn: """ + user_dn + """
2839 objectclass: user
2840 sAMAccountName: """ + user_name)
2841             # Modify descriptor
2842             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2843             desc = res[0]["nTSecurityDescriptor"][0]
2844             desc = ndr_unpack(security.descriptor, desc)
2845             desc_sddl = desc.as_sddl(self.domain_sid)
2846             sddl = desc_sddl[:desc_sddl.find("(")] + "(A;;RPWP;;;AU)" + desc_sddl[desc_sddl.find("("):]
2847             mod = """
2848 dn: """ + user_dn + """
2849 changetype: modify
2850 replace: nTSecurityDescriptor
2851 nTSecurityDescriptor: """ + sddl
2852             self.ldb.modify_ldif(mod)
2853             # Read modified descriptor
2854             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2855             desc = res[0]["nTSecurityDescriptor"][0]
2856             desc = ndr_unpack(security.descriptor, desc)
2857             desc_sddl = desc.as_sddl(self.domain_sid)
2858             self.assertEqual(desc_sddl, sddl)
2859         finally:
2860             self.delete_force(self.ldb, user_dn)
2861         #
2862         # Test modify_ldif() with SDDL security descriptor input
2863         # New desctiptor test
2864         #
2865         try:
2866             self.ldb.add_ldif("""
2867 dn: """ + user_dn + """
2868 objectclass: user
2869 sAMAccountName: """ + user_name)
2870             # Modify descriptor
2871             sddl = "O:DUG:DUD:PAI(A;;RPWP;;;AU)S:PAI"
2872             mod = """
2873 dn: """ + user_dn + """
2874 changetype: modify
2875 replace: nTSecurityDescriptor
2876 nTSecurityDescriptor: """ + sddl
2877             self.ldb.modify_ldif(mod)
2878             # Read modified descriptor
2879             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2880             desc = res[0]["nTSecurityDescriptor"][0]
2881             desc = ndr_unpack(security.descriptor, desc)
2882             desc_sddl = desc.as_sddl(self.domain_sid)
2883             self.assertEqual(desc_sddl, sddl)
2884         finally:
2885             self.delete_force(self.ldb, user_dn)
2886         #
2887         # Test modify_ldif() with BASE64 security descriptor input
2888         # Add ACE to the original descriptor test
2889         #
2890         try:
2891             self.ldb.add_ldif("""
2892 dn: """ + user_dn + """
2893 objectclass: user
2894 sAMAccountName: """ + user_name)
2895             # Modify descriptor
2896             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2897             desc = res[0]["nTSecurityDescriptor"][0]
2898             desc = ndr_unpack(security.descriptor, desc)
2899             desc_sddl = desc.as_sddl(self.domain_sid)
2900             sddl = desc_sddl[:desc_sddl.find("(")] + "(A;;RPWP;;;AU)" + desc_sddl[desc_sddl.find("("):]
2901             desc = security.descriptor.from_sddl(sddl, self.domain_sid)
2902             desc_base64 = base64.b64encode(ndr_pack(desc))
2903             mod = """
2904 dn: """ + user_dn + """
2905 changetype: modify
2906 replace: nTSecurityDescriptor
2907 nTSecurityDescriptor:: """ + desc_base64
2908             self.ldb.modify_ldif(mod)
2909             # Read modified descriptor
2910             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2911             desc = res[0]["nTSecurityDescriptor"][0]
2912             desc = ndr_unpack(security.descriptor, desc)
2913             desc_sddl = desc.as_sddl(self.domain_sid)
2914             self.assertEqual(desc_sddl, sddl)
2915         finally:
2916             self.delete_force(self.ldb, user_dn)
2917         #
2918         # Test modify_ldif() with BASE64 security descriptor input
2919         # New descriptor test
2920         #
2921         try:
2922             self.delete_force(self.ldb, user_dn)
2923             self.ldb.add_ldif("""
2924 dn: """ + user_dn + """
2925 objectclass: user
2926 sAMAccountName: """ + user_name)
2927             # Modify descriptor
2928             sddl = "O:DUG:DUD:PAI(A;;RPWP;;;AU)S:PAI"
2929             desc = security.descriptor.from_sddl(sddl, self.domain_sid)
2930             desc_base64 = base64.b64encode(ndr_pack(desc))
2931             mod = """
2932 dn: """ + user_dn + """
2933 changetype: modify
2934 replace: nTSecurityDescriptor
2935 nTSecurityDescriptor:: """ + desc_base64
2936             self.ldb.modify_ldif(mod)
2937             # Read modified descriptor
2938             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2939             desc = res[0]["nTSecurityDescriptor"][0]
2940             desc = ndr_unpack(security.descriptor, desc)
2941             desc_sddl = desc.as_sddl(self.domain_sid)
2942             self.assertEqual(desc_sddl, sddl)
2943         finally:
2944             self.delete_force(self.ldb, user_dn)
2945
2946
2947 class BaseDnTests(unittest.TestCase):
2948
2949     def setUp(self):
2950         super(BaseDnTests, self).setUp()
2951         self.ldb = ldb
2952
2953     def test_rootdse_attrs(self):
2954         """Testing for all rootDSE attributes"""
2955         res = self.ldb.search(scope=SCOPE_BASE, attrs=[])
2956         self.assertEquals(len(res), 1)
2957
2958     def test_highestcommittedusn(self):
2959         """Testing for highestCommittedUSN"""
2960         res = self.ldb.search("", scope=SCOPE_BASE, attrs=["highestCommittedUSN"])
2961         self.assertEquals(len(res), 1)
2962         self.assertTrue(int(res[0]["highestCommittedUSN"][0]) != 0)
2963
2964     def test_netlogon(self):
2965         """Testing for netlogon via LDAP"""
2966         res = self.ldb.search("", scope=SCOPE_BASE, attrs=["netlogon"])
2967         self.assertEquals(len(res), 0)
2968
2969     def test_netlogon_highestcommitted_usn(self):
2970         """Testing for netlogon and highestCommittedUSN via LDAP"""
2971         res = self.ldb.search("", scope=SCOPE_BASE,
2972                 attrs=["netlogon", "highestCommittedUSN"])
2973         self.assertEquals(len(res), 0)
2974
2975     def test_namingContexts(self):
2976         """Testing for namingContexts in rootDSE"""
2977         res = self.ldb.search("", scope=SCOPE_BASE,
2978                 attrs=["namingContexts", "defaultNamingContext", "schemaNamingContext", "configurationNamingContext"])
2979         self.assertEquals(len(res), 1)
2980
2981         ncs = set([])
2982         for nc in res[0]["namingContexts"]:
2983             self.assertTrue(nc not in ncs)
2984             ncs.add(nc)
2985
2986         self.assertTrue(res[0]["defaultNamingContext"][0] in ncs)
2987         self.assertTrue(res[0]["configurationNamingContext"][0] in ncs)
2988         self.assertTrue(res[0]["schemaNamingContext"][0] in ncs)
2989
2990     def test_serverPath(self):
2991         """Testing the server paths in rootDSE"""
2992         res = self.ldb.search("", scope=SCOPE_BASE,
2993                               attrs=["dsServiceName", "serverName"])
2994         self.assertEquals(len(res), 1)
2995
2996         self.assertTrue("CN=Servers" in res[0]["dsServiceName"][0])
2997         self.assertTrue("CN=Sites" in res[0]["dsServiceName"][0])
2998         self.assertTrue("CN=NTDS Settings" in res[0]["dsServiceName"][0])
2999         self.assertTrue("CN=Servers" in res[0]["serverName"][0])
3000         self.assertTrue("CN=Sites" in res[0]["serverName"][0])
3001         self.assertFalse("CN=NTDS Settings" in res[0]["serverName"][0])
3002
3003     def test_dnsHostname(self):
3004         """Testing the DNS hostname in rootDSE"""
3005         res = self.ldb.search("", scope=SCOPE_BASE,
3006                               attrs=["dnsHostName", "serverName"])
3007         self.assertEquals(len(res), 1)
3008
3009         res2 = self.ldb.search(res[0]["serverName"][0], scope=SCOPE_BASE,
3010                                attrs=["dNSHostName"])
3011         self.assertEquals(len(res2), 1)
3012
3013         self.assertEquals(res[0]["dnsHostName"][0], res2[0]["dNSHostName"][0])
3014
3015     def test_ldapServiceName(self):
3016         """Testing the ldap service name in rootDSE"""
3017         res = self.ldb.search("", scope=SCOPE_BASE,
3018                               attrs=["ldapServiceName", "dNSHostName"])
3019         self.assertEquals(len(res), 1)
3020
3021         (hostname, _, dns_domainname) = res[0]["dNSHostName"][0].partition(".")
3022         self.assertTrue(":%s$@%s" % (hostname, dns_domainname.upper())
3023                         in res[0]["ldapServiceName"][0])
3024
3025 if not "://" in host:
3026     if os.path.isfile(host):
3027         host = "tdb://%s" % host
3028     else:
3029         host = "ldap://%s" % host
3030
3031 ldb = Ldb(host, credentials=creds, session_info=system_session(), lp=lp)
3032 if not "tdb://" in host:
3033     gc_ldb = Ldb("%s:3268" % host, credentials=creds,
3034                  session_info=system_session(), lp=lp)
3035 else:
3036     gc_ldb = None
3037
3038 runner = SubunitTestRunner()
3039 rc = 0
3040 if not runner.run(unittest.makeSuite(BaseDnTests)).wasSuccessful():
3041     rc = 1
3042 if not runner.run(unittest.makeSuite(BasicTests)).wasSuccessful():
3043     rc = 1
3044 sys.exit(rc)