PEP8: fix E225: missing whitespace around operator
[nivanova/samba-autobuild/.git] / source4 / dsdb / tests / python / acl.py
index 92223360033f806af3cd0dcde2ee95de17bb08c0..4e479ce8b1760c49fb91a44e2a21a292c58b8e21 100755 (executable)
@@ -137,9 +137,9 @@ class AclAddTests(AclTests):
 
         # add admins to the Domain Admins group
         self.ldb_admin.add_remove_group_members("Domain Admins", [self.usr_admin_owner],
-                       add_members_operation=True)
+                                                add_members_operation=True)
         self.ldb_admin.add_remove_group_members("Domain Admins", [self.usr_admin_not_owner],
-                       add_members_operation=True)
+                                                add_members_operation=True)
 
         self.ldb_owner = self.get_ldb_connection(self.usr_admin_owner, self.user_pass)
         self.ldb_notowner = self.get_ldb_connection(self.usr_admin_not_owner, self.user_pass)
@@ -165,7 +165,7 @@ class AclAddTests(AclTests):
     # Make sure top OU is deleted (and so everything under it)
     def assert_top_ou_deleted(self):
         res = self.ldb_admin.search(self.base_dn,
-            expression="(distinguishedName=%s,%s)" % (
+                                    expression="(distinguishedName=%s,%s)" % (
                 "OU=test_add_ou1", self.base_dn))
         self.assertEqual(len(res), 0)
 
@@ -233,14 +233,14 @@ class AclAddTests(AclTests):
             self.fail()
         # Make sure we HAVE created the one of two objects -- user
         res = self.ldb_admin.search(self.base_dn,
-                expression="(distinguishedName=%s,%s)" %
-                ("CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1",
-                    self.base_dn))
+                                    expression="(distinguishedName=%s,%s)" %
+                                    ("CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1",
+                                     self.base_dn))
         self.assertNotEqual(len(res), 0)
         res = self.ldb_admin.search(self.base_dn,
-                expression="(distinguishedName=%s,%s)" %
-                ("CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1",
-                    self.base_dn) )
+                                    expression="(distinguishedName=%s,%s)" %
+                                    ("CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1",
+                                     self.base_dn))
         self.assertEqual(len(res), 0)
 
     def test_add_u4(self):
@@ -255,7 +255,7 @@ class AclAddTests(AclTests):
         res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s,%s)" % ("CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn))
         self.assertTrue(len(res) > 0)
         res = self.ldb_admin.search(self.base_dn,
-                expression="(distinguishedName=%s,%s)" % ("CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn))
+                                    expression="(distinguishedName=%s,%s)" % ("CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn))
         self.assertTrue(len(res) > 0)
 
     def test_add_anonymous(self):
@@ -283,7 +283,7 @@ class AclModifyTests(AclTests):
         self.ldb_user = self.get_ldb_connection(self.user_with_wp, self.user_pass)
         self.ldb_user2 = self.get_ldb_connection(self.user_with_sm, self.user_pass)
         self.ldb_user3 = self.get_ldb_connection(self.user_with_group_sm, self.user_pass)
-        self.user_sid = self.sd_utils.get_object_sid( self.get_user_dn(self.user_with_wp))
+        self.user_sid = self.sd_utils.get_object_sid(self.get_user_dn(self.user_with_wp))
         self.ldb_admin.newgroup("test_modify_group2", grouptype=samba.dsdb.GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP)
         self.ldb_admin.newgroup("test_modify_group3", grouptype=samba.dsdb.GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP)
         self.ldb_admin.newuser("test_modify_user2", self.user_pass)
@@ -319,7 +319,7 @@ replace: displayName
 displayName: test_changed"""
         self.ldb_user.modify_ldif(ldif)
         res = self.ldb_admin.search(self.base_dn,
-                expression="(distinguishedName=%s)" % self.get_user_dn("test_modify_user1"))
+                                    expression="(distinguishedName=%s)" % self.get_user_dn("test_modify_user1"))
         self.assertEqual(res[0]["displayName"][0], "test_changed")
         # Second test object -- Group
         print("Testing modify on Group object")
@@ -364,8 +364,8 @@ replace: displayName
 displayName: test_changed"""
         self.ldb_user.modify_ldif(ldif)
         res = self.ldb_admin.search(self.base_dn,
-                expression="(distinguishedName=%s)" %
-                self.get_user_dn("test_modify_user1"))
+                                    expression="(distinguishedName=%s)" %
+                                    self.get_user_dn("test_modify_user1"))
         self.assertEqual(res[0]["displayName"][0], "test_changed")
         # Modify on attribute you do not have rights for granted
         ldif = """
@@ -393,8 +393,8 @@ replace: displayName
 displayName: test_changed"""
         self.ldb_user.modify_ldif(ldif)
         res = self.ldb_admin.search(self.base_dn,
-                expression="(distinguishedName=%s)" %
-                str("CN=test_modify_group1,CN=Users," + self.base_dn))
+                                    expression="(distinguishedName=%s)" %
+                                    str("CN=test_modify_group1,CN=Users," + self.base_dn))
         self.assertEqual(res[0]["displayName"][0], "test_changed")
         # Modify on attribute you do not have rights for granted
         ldif = """
@@ -437,8 +437,8 @@ replace: displayName
 displayName: test_changed"""
         self.ldb_user.modify_ldif(ldif)
         res = self.ldb_admin.search(self.base_dn,
-                expression="(distinguishedName=%s)" % str("OU=test_modify_ou1,"
-                    + self.base_dn))
+                                    expression="(distinguishedName=%s)" % str("OU=test_modify_ou1,"
+                                                                              + self.base_dn))
         self.assertEqual(res[0]["displayName"][0], "test_changed")
         # Modify on attribute you do not have rights for granted
         ldif = """
@@ -535,7 +535,7 @@ adminDescription: blah blah blah"""
         # Modify on attribute you have rights for
         self.ldb_user.modify_ldif(ldif)
         res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s)" \
-                                    % self.get_user_dn(self.user_with_wp), attrs=["adminDescription"] )
+                                    % self.get_user_dn(self.user_with_wp), attrs=["adminDescription"])
         self.assertEqual(res[0]["adminDescription"][0], "blah blah blah")
 
     def test_modify_u5(self):
@@ -544,7 +544,7 @@ adminDescription: blah blah blah"""
 dn: CN=test_modify_group2,CN=Users,""" + self.base_dn + """
 changetype: modify
 add: Member
-Member: """ +  self.get_user_dn(self.user_with_sm)
+Member: """ + self.get_user_dn(self.user_with_sm)
 #the user has no rights granted, this should fail
         try:
             self.ldb_user2.modify_ldif(ldif)
@@ -560,8 +560,8 @@ Member: """ +  self.get_user_dn(self.user_with_sm)
         mod = "(OA;;SW;bf9679c0-0de6-11d0-a285-00aa003049e2;;%s)" % str(user_sid)
         self.sd_utils.dacl_add_ace("CN=test_modify_group2,CN=Users," + self.base_dn, mod)
         self.ldb_user2.modify_ldif(ldif)
-        res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
-                                    % ("CN=test_modify_group2,CN=Users," + self.base_dn), attrs=["Member"])
+        res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s)" \
+                                     % ("CN=test_modify_group2,CN=Users," + self.base_dn), attrs=["Member"])
         self.assertEqual(res[0]["Member"][0], self.get_user_dn(self.user_with_sm))
 #but not other users
         ldif = """
@@ -583,7 +583,7 @@ Member: CN=test_modify_user2,CN=Users,""" + self.base_dn
 dn: CN=test_modify_group2,CN=Users,""" + self.base_dn + """
 changetype: modify
 add: Member
-Member: """ +  self.get_user_dn(self.user_with_sm) + """
+Member: """ + self.get_user_dn(self.user_with_sm) + """
 Member: CN=test_modify_user2,CN=Users,""" + self.base_dn
 
 #grant self-membership, should be able to add himself  but not others at the same time
@@ -608,10 +608,10 @@ Member: CN=test_modify_user2,CN=Users,""" + self.base_dn
 dn: CN=test_modify_group2,CN=Users,""" + self.base_dn + """
 changetype: modify
 add: Member
-Member: """ +  self.get_user_dn(self.user_with_wp)
+Member: """ + self.get_user_dn(self.user_with_wp)
         self.ldb_user.modify_ldif(ldif)
-        res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
-                                    % ("CN=test_modify_group2,CN=Users," + self.base_dn), attrs=["Member"])
+        res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s)" \
+                                     % ("CN=test_modify_group2,CN=Users," + self.base_dn), attrs=["Member"])
         self.assertEqual(res[0]["Member"][0], self.get_user_dn(self.user_with_wp))
         ldif = """
 dn: CN=test_modify_group2,CN=Users,""" + self.base_dn + """
@@ -624,8 +624,8 @@ changetype: modify
 add: Member
 Member: CN=test_modify_user2,CN=Users,""" + self.base_dn
         self.ldb_user.modify_ldif(ldif)
-        res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
-                                    % ("CN=test_modify_group2,CN=Users," + self.base_dn), attrs=["Member"])
+        res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s)" \
+                                     % ("CN=test_modify_group2,CN=Users," + self.base_dn), attrs=["Member"])
         self.assertEqual(res[0]["Member"][0], "CN=test_modify_user2,CN=Users," + self.base_dn)
 
     def test_modify_anonymous(self):
@@ -680,7 +680,7 @@ class AclSearchTests(AclTests):
     def create_clean_ou(self, object_dn):
         """ Base repeating setup for unittests to follow """
         res = self.ldb_admin.search(base=self.base_dn, scope=SCOPE_SUBTREE, \
-                expression="distinguishedName=%s" % object_dn)
+                                    expression="distinguishedName=%s" % object_dn)
         # Make sure top testing OU has been deleted before starting the test
         self.assertEqual(len(res), 0)
         self.ldb_admin.create_ou(object_dn)
@@ -803,20 +803,20 @@ class AclSearchTests(AclTests):
         ok_list = [Dn(self.ldb_admin,  "OU=ou2,OU=ou1," + self.base_dn),
                    Dn(self.ldb_admin,  "OU=ou1," + self.base_dn)]
 
-        res_list = [ x["dn"] for x in res if x["dn"] in ok_list ]
+        res_list = [x["dn"] for x in res if x["dn"] in ok_list]
         self.assertEquals(sorted(res_list), sorted(ok_list))
 
         #these users should see all ous
         res = self.ldb_user.search("OU=ou1," + self.base_dn, expression="(objectClass=*)",
                                    scope=SCOPE_SUBTREE)
         self.assertEquals(len(res), 6)
-        res_list = [ x["dn"] for x in res if x["dn"] in self.full_list ]
+        res_list = [x["dn"] for x in res if x["dn"] in self.full_list]
         self.assertEquals(sorted(res_list), sorted(self.full_list))
 
         res = self.ldb_user2.search("OU=ou1," + self.base_dn, expression="(objectClass=*)",
                                     scope=SCOPE_SUBTREE)
         self.assertEquals(len(res), 6)
-        res_list = [ x["dn"] for x in res if x["dn"] in self.full_list ]
+        res_list = [x["dn"] for x in res if x["dn"] in self.full_list]
         self.assertEquals(sorted(res_list), sorted(self.full_list))
 
     def test_search2(self):
@@ -832,7 +832,7 @@ class AclSearchTests(AclTests):
         res = self.ldb_user3.search("OU=ou1," + self.base_dn, expression="(objectClass=*)",
                                     scope=SCOPE_SUBTREE)
         #this user should see all ous
-        res_list = [ x["dn"] for x in res if x["dn"] in self.full_list ]
+        res_list = [x["dn"] for x in res if x["dn"] in self.full_list]
         self.assertEquals(sorted(res_list), sorted(self.full_list))
 
         #these users should see ou1, 2, 5 and 6 but not 3 and 4
@@ -842,13 +842,13 @@ class AclSearchTests(AclTests):
                    Dn(self.ldb_admin,  "OU=ou1," + self.base_dn),
                    Dn(self.ldb_admin,  "OU=ou5,OU=ou3,OU=ou2,OU=ou1," + self.base_dn),
                    Dn(self.ldb_admin,  "OU=ou6,OU=ou4,OU=ou2,OU=ou1," + self.base_dn)]
-        res_list = [ x["dn"] for x in res if x["dn"] in ok_list ]
+        res_list = [x["dn"] for x in res if x["dn"] in ok_list]
         self.assertEquals(sorted(res_list), sorted(ok_list))
 
         res = self.ldb_user2.search("OU=ou1," + self.base_dn, expression="(objectClass=*)",
                                     scope=SCOPE_SUBTREE)
         self.assertEquals(len(res), 4)
-        res_list = [ x["dn"] for x in res if x["dn"] in ok_list ]
+        res_list = [x["dn"] for x in res if x["dn"] in ok_list]
         self.assertEquals(sorted(res_list), sorted(ok_list))
 
     def test_search3(self):
@@ -882,7 +882,7 @@ class AclSearchTests(AclTests):
 
         res = self.ldb_user3.search("OU=ou1," + self.base_dn, expression="(objectClass=*)",
                                     scope=SCOPE_SUBTREE)
-        res_list = [ x["dn"] for x in res if x["dn"] in ok_list ]
+        res_list = [x["dn"] for x in res if x["dn"] in ok_list]
         self.assertEquals(sorted(res_list), sorted(ok_list))
 
         ok_list = [Dn(self.ldb_admin,  "OU=ou2,OU=ou1," + self.base_dn),
@@ -894,13 +894,13 @@ class AclSearchTests(AclTests):
         res = self.ldb_user.search("OU=ou1," + self.base_dn, expression="(objectClass=*)",
                                    scope=SCOPE_SUBTREE)
         self.assertEquals(len(res), 4)
-        res_list = [ x["dn"] for x in res if x["dn"] in ok_list ]
+        res_list = [x["dn"] for x in res if x["dn"] in ok_list]
         self.assertEquals(sorted(res_list), sorted(ok_list))
 
         res = self.ldb_user2.search("OU=ou1," + self.base_dn, expression="(objectClass=*)",
                                     scope=SCOPE_SUBTREE)
         self.assertEquals(len(res), 4)
-        res_list = [ x["dn"] for x in res if x["dn"] in ok_list ]
+        res_list = [x["dn"] for x in res if x["dn"] in ok_list]
         self.assertEquals(sorted(res_list), sorted(ok_list))
 
     def test_search4(self):
@@ -921,13 +921,13 @@ class AclSearchTests(AclTests):
         res = self.ldb_user3.search("OU=ou1," + self.base_dn, expression="(objectClass=*)",
                                     scope=SCOPE_SUBTREE)
         self.assertEquals(len(res), 2)
-        res_list = [ x["dn"] for x in res if x["dn"] in ok_list ]
+        res_list = [x["dn"] for x in res if x["dn"] in ok_list]
         self.assertEquals(sorted(res_list), sorted(ok_list))
 
         res = self.ldb_user.search("OU=ou1," + self.base_dn, expression="(objectClass=*)",
                                    scope=SCOPE_SUBTREE)
         self.assertEquals(len(res), 2)
-        res_list = [ x["dn"] for x in res if x["dn"] in ok_list ]
+        res_list = [x["dn"] for x in res if x["dn"] in ok_list]
         self.assertEquals(sorted(res_list), sorted(ok_list))
 
     def test_search5(self):
@@ -1119,7 +1119,7 @@ class AclDeleteTests(AclTests):
         # Try to delete User object
         self.ldb_user.delete(user_dn)
         res = self.ldb_admin.search(self.base_dn,
-                expression="(distinguishedName=%s)" % user_dn)
+                                    expression="(distinguishedName=%s)" % user_dn)
         self.assertEqual(len(res), 0)
 
     def test_delete_u3(self):
@@ -1132,7 +1132,7 @@ class AclDeleteTests(AclTests):
         # Try to delete User object
         self.ldb_user.delete(user_dn)
         res = self.ldb_admin.search(self.base_dn,
-                expression="(distinguishedName=%s)" % user_dn)
+                                    expression="(distinguishedName=%s)" % user_dn)
         self.assertEqual(len(res), 0)
 
     def test_delete_anonymous(self):
@@ -1215,10 +1215,10 @@ class AclRenameTests(AclTests):
         # Rename 'User object' having WP to AU
         self.ldb_user.rename(user_dn, rename_user_dn)
         res = self.ldb_admin.search(self.base_dn,
-                expression="(distinguishedName=%s)" % user_dn)
+                                    expression="(distinguishedName=%s)" % user_dn)
         self.assertEqual(len(res), 0)
         res = self.ldb_admin.search(self.base_dn,
-                expression="(distinguishedName=%s)" % rename_user_dn)
+                                    expression="(distinguishedName=%s)" % rename_user_dn)
         self.assertNotEqual(len(res), 0)
 
     def test_rename_u3(self):
@@ -1235,10 +1235,10 @@ class AclRenameTests(AclTests):
         # Rename 'User object' having WP to AU
         self.ldb_user.rename(user_dn, rename_user_dn)
         res = self.ldb_admin.search(self.base_dn,
-                expression="(distinguishedName=%s)" % user_dn)
+                                    expression="(distinguishedName=%s)" % user_dn)
         self.assertEqual(len(res), 0)
         res = self.ldb_admin.search(self.base_dn,
-                expression="(distinguishedName=%s)" % rename_user_dn)
+                                    expression="(distinguishedName=%s)" % rename_user_dn)
         self.assertNotEqual(len(res), 0)
 
     def test_rename_u4(self):
@@ -1258,10 +1258,10 @@ class AclRenameTests(AclTests):
         # Rename 'User object' having SD and CC to AU
         self.ldb_user.rename(user_dn, rename_user_dn)
         res = self.ldb_admin.search(self.base_dn,
-                expression="(distinguishedName=%s)" % user_dn)
+                                    expression="(distinguishedName=%s)" % user_dn)
         self.assertEqual(len(res), 0)
         res = self.ldb_admin.search(self.base_dn,
-                expression="(distinguishedName=%s)" % rename_user_dn)
+                                    expression="(distinguishedName=%s)" % rename_user_dn)
         self.assertNotEqual(len(res), 0)
 
     def test_rename_u5(self):
@@ -1282,10 +1282,10 @@ class AclRenameTests(AclTests):
         # Rename 'User object' having SD and CC to AU
         self.ldb_user.rename(user_dn, rename_user_dn)
         res = self.ldb_admin.search(self.base_dn,
-                expression="(distinguishedName=%s)" % user_dn)
+                                    expression="(distinguishedName=%s)" % user_dn)
         self.assertEqual(len(res), 0)
         res = self.ldb_admin.search(self.base_dn,
-                expression="(distinguishedName=%s)" % rename_user_dn)
+                                    expression="(distinguishedName=%s)" % rename_user_dn)
         self.assertNotEqual(len(res), 0)
 
     def test_rename_u6(self):
@@ -1308,10 +1308,10 @@ class AclRenameTests(AclTests):
         # Rename 'User object' having SD and CC to AU
         self.ldb_user.rename(user_dn, rename_user_dn)
         res = self.ldb_admin.search(self.base_dn,
-                expression="(distinguishedName=%s)" % user_dn)
+                                    expression="(distinguishedName=%s)" % user_dn)
         self.assertEqual(len(res), 0)
         res = self.ldb_admin.search(self.base_dn,
-                expression="(distinguishedName=%s)" % rename_user_dn)
+                                    expression="(distinguishedName=%s)" % rename_user_dn)
         self.assertNotEqual(len(res), 0)
 
     def test_rename_u7(self):
@@ -1333,10 +1333,10 @@ class AclRenameTests(AclTests):
         # Rename 'User object' having SD and CC to AU
         self.ldb_user.rename(user_dn, rename_user_dn)
         res = self.ldb_admin.search(self.base_dn,
-                expression="(distinguishedName=%s)" % user_dn)
+                                    expression="(distinguishedName=%s)" % user_dn)
         self.assertEqual(len(res), 0)
         res = self.ldb_admin.search(self.base_dn,
-                expression="(distinguishedName=%s)" % rename_user_dn)
+                                    expression="(distinguishedName=%s)" % rename_user_dn)
         self.assertNotEqual(len(res), 0)
 
     def test_rename_u8(self):
@@ -1774,7 +1774,7 @@ class AclUndeleteTests(AclTests):
         self.testuser5 = "to_be_undeleted5"
         self.testuser6 = "to_be_undeleted6"
 
-        self.new_dn_ou = "CN="+ self.testuser4 + "," + self.ou1 + self.base_dn
+        self.new_dn_ou = "CN=" + self.testuser4 + "," + self.ou1 + self.base_dn
 
         # Create regular user
         self.testuser1_dn = self.get_user_dn(self.testuser1)
@@ -1792,7 +1792,7 @@ class AclUndeleteTests(AclTests):
 
         self.ldb_admin.newuser(self.regular_user, self.user_pass)
         self.ldb_admin.add_remove_group_members("Domain Admins", [self.regular_user],
-                       add_members_operation=True)
+                                                add_members_operation=True)
         self.ldb_user = self.get_ldb_connection(self.regular_user, self.user_pass)
         self.sid = self.sd_utils.get_object_sid(self.get_user_dn(self.regular_user))
 
@@ -1822,7 +1822,7 @@ class AclUndeleteTests(AclTests):
         guid = res[0]["objectGUID"][0]
         self.ldb_admin.delete(self.get_user_dn(new_user))
         res = self.ldb_admin.search(base="<GUID=%s>" % self.GUID_string(guid),
-                         scope=SCOPE_BASE, controls=["show_deleted:1"])
+                                    scope=SCOPE_BASE, controls=["show_deleted:1"])
         self.assertEquals(len(res), 1)
         return str(res[0].dn)
 
@@ -1959,15 +1959,15 @@ class AclSPNTests(AclTests):
 
     # same as for join_RODC, but do not set any SPNs
     def create_rodc(self, ctx):
-        ctx.nc_list = [ ctx.base_dn, ctx.config_dn, ctx.schema_dn ]
-        ctx.full_nc_list = [ ctx.base_dn, ctx.config_dn, ctx.schema_dn ]
+        ctx.nc_list = [ctx.base_dn, ctx.config_dn, ctx.schema_dn]
+        ctx.full_nc_list = [ctx.base_dn, ctx.config_dn, ctx.schema_dn]
         ctx.krbtgt_dn = "CN=krbtgt_%s,CN=Users,%s" % (ctx.myname, ctx.base_dn)
 
-        ctx.never_reveal_sid = [ "<SID=%s-%s>" % (ctx.domsid, security.DOMAIN_RID_RODC_DENY),
+        ctx.never_reveal_sid = ["<SID=%s-%s>" % (ctx.domsid, security.DOMAIN_RID_RODC_DENY),
                                  "<SID=%s>" % security.SID_BUILTIN_ADMINISTRATORS,
                                  "<SID=%s>" % security.SID_BUILTIN_SERVER_OPERATORS,
                                  "<SID=%s>" % security.SID_BUILTIN_BACKUP_OPERATORS,
-                                 "<SID=%s>" % security.SID_BUILTIN_ACCOUNT_OPERATORS ]
+                                 "<SID=%s>" % security.SID_BUILTIN_ACCOUNT_OPERATORS]
         ctx.reveal_sid = "<SID=%s-%s>" % (ctx.domsid, security.DOMAIN_RID_RODC_ALLOW)
 
         mysid = ctx.get_mysid()
@@ -1975,23 +1975,23 @@ class AclSPNTests(AclTests):
         ctx.managedby = admin_dn
 
         ctx.userAccountControl = (samba.dsdb.UF_WORKSTATION_TRUST_ACCOUNT |
-                             samba.dsdb.UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION |
-                             samba.dsdb.UF_PARTIAL_SECRETS_ACCOUNT)
+                                  samba.dsdb.UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION |
+                                  samba.dsdb.UF_PARTIAL_SECRETS_ACCOUNT)
 
         ctx.connection_dn = "CN=RODC Connection (FRS),%s" % ctx.ntds_dn
         ctx.secure_channel_type = misc.SEC_CHAN_RODC
         ctx.RODC = True
-        ctx.replica_flags  =  (drsuapi.DRSUAPI_DRS_INIT_SYNC |
-                               drsuapi.DRSUAPI_DRS_PER_SYNC |
-                               drsuapi.DRSUAPI_DRS_GET_ANC |
-                               drsuapi.DRSUAPI_DRS_NEVER_SYNCED |
-                               drsuapi.DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING)
+        ctx.replica_flags = (drsuapi.DRSUAPI_DRS_INIT_SYNC |
+                             drsuapi.DRSUAPI_DRS_PER_SYNC |
+                             drsuapi.DRSUAPI_DRS_GET_ANC |
+                             drsuapi.DRSUAPI_DRS_NEVER_SYNCED |
+                             drsuapi.DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING)
 
         ctx.join_add_objects()
 
     def create_dc(self, ctx):
-        ctx.nc_list = [ ctx.base_dn, ctx.config_dn, ctx.schema_dn ]
-        ctx.full_nc_list = [ ctx.base_dn, ctx.config_dn, ctx.schema_dn ]
+        ctx.nc_list = [ctx.base_dn, ctx.config_dn, ctx.schema_dn]
+        ctx.full_nc_list = [ctx.base_dn, ctx.config_dn, ctx.schema_dn]
         ctx.userAccountControl = samba.dsdb.UF_SERVER_TRUST_ACCOUNT | samba.dsdb.UF_TRUSTED_FOR_DELEGATION
         ctx.secure_channel_type = misc.SEC_CHAN_BDC
         ctx.replica_flags = (drsuapi.DRSUAPI_DRS_WRIT_REP |