source4/lib/ldb/tests/python/acl.py

   1 #!/usr/bin/python
   2 # -*- coding: utf-8 -*-
   3 # This is unit with tests for LDAP access checks
   4
   5 import getopt
   6 import optparse
   7 import sys
   8 import os
   9 import base64
  10 import re
  11
  12 sys.path.append("bin/python")
  13
  14 import samba.getopt as options
  15
  16 from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError
  17 from ldb import ERR_NO_SUCH_OBJECT, ERR_INVALID_DN_SYNTAX, ERR_UNWILLING_TO_PERFORM
  18 from ldb import ERR_INSUFFICIENT_ACCESS_RIGHTS
  19
  20 from samba.ndr import ndr_pack, ndr_unpack
  21 from samba.dcerpc import security
  22
  23 from samba.auth import system_session
  24 from samba import Ldb
  25 from subunit.run import SubunitTestRunner
  26 import unittest
  27
  28 parser = optparse.OptionParser("ldap [options] <host>")
  29 sambaopts = options.SambaOptions(parser)
  30 parser.add_option_group(sambaopts)
  31 parser.add_option_group(options.VersionOptions(parser))
  32
  33 # use command line creds if available
  34 credopts = options.CredentialsOptions(parser)
  35 parser.add_option_group(credopts)
  36 opts, args = parser.parse_args()
  37
  38 if len(args) < 1:
  39     parser.print_usage()
  40     sys.exit(1)
  41
  42 host = args[0]
  43
  44 lp = sambaopts.get_loadparm()
  45 creds = credopts.get_credentials(lp)
  46
  47 #
  48 # Tests start here
  49 #
  50
  51 class AclTests(unittest.TestCase):
  52
  53     def delete_force(self, ldb, dn):
  54         try:
  55             ldb.delete(dn)
  56         except LdbError, (num, _):
  57             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
  58
  59     def find_basedn(self, ldb):
  60         res = ldb.search(base="", expression="", scope=SCOPE_BASE,
  61                          attrs=["defaultNamingContext"])
  62         self.assertEquals(len(res), 1)
  63         return res[0]["defaultNamingContext"][0]
  64
  65     def find_domain_sid(self, ldb):
  66         res = ldb.search(base=self.base_dn, expression="(objectClass=*)", scope=SCOPE_BASE)
  67         return ndr_unpack( security.dom_sid,res[0]["objectSid"][0])
  68
  69     def setUp(self):
  70         self.ldb_admin = ldb
  71         self.base_dn = self.find_basedn(self.ldb_admin)
  72         self.domain_sid = self.find_domain_sid(self.ldb_admin)
  73         self.user_pass = "samba123@"
  74         print "baseDN: %s" % self.base_dn
  75         self.SAMBA = False; self.WIN = False
  76         res = self.ldb_admin.search(base="",expression="", scope=SCOPE_BASE,
  77                                     attrs=["vendorName"])
  78         if res and "vendorName" in res[0].keys() and res[0]["vendorName"][0].find("Samba Team") != -1:
  79             self.SAMBA = True
  80         else:
  81             self.WIN = True
  82
  83     def get_user_dn(self, name):
  84         return "CN=%s,CN=Users,%s" % (name, self.base_dn)
  85
  86     def modify_desc(self, object_dn, desc):
  87         """ Modify security descriptor using either SDDL string
  88             or security.descriptor object
  89         """
  90         assert(isinstance(desc, str) or isinstance(desc, security.descriptor))
  91         mod = """
  92 dn: """ + object_dn + """
  93 changetype: modify
  94 replace: nTSecurityDescriptor
  95 """
  96         if isinstance(desc, str):
  97             mod += "nTSecurityDescriptor: %s" % desc
  98         elif isinstance(desc, security.descriptor):
  99             mod += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
 100         self.ldb_admin.modify_ldif(mod)
 101         return
 102         # Everything below is used in case of emergency or
 103         # double modify verification of some sort
 104         assert(isinstance(desc, security.descriptor))
 105         fn = "/tmp/tmpMod"
 106         f = open(fn, "w"); f.write(mod); f.close()
 107         cmd = "ldapmodify -x -h %s -D %s -w %s -f %s" \
 108                 % (host[7:], self.get_user_dn(creds.get_username()), creds.get_password(), fn)
 109         return os.system( cmd ) == 0
 110
 111     def add_group_member(self, _ldb, group_dn, member_dn):
 112         """ Modify user to ge member of a group
 113             e.g. User to be 'Doamin Admin' group member
 114         """
 115         ldif = """
 116 dn: """ + group_dn + """
 117 changetype: modify
 118 add: member
 119 member: """ + member_dn
 120         _ldb.modify_ldif(ldif)
 121
 122     def create_ou(self, _ldb, ou_dn, desc=None):
 123         ldif = """
 124 dn: """ + ou_dn + """
 125 ou: """ + ou_dn.split(",")[0][3:] + """
 126 objectClass: organizationalUnit
 127 url: www.example.com
 128 """
 129         if desc:
 130             assert(isinstance(desc, str) or isinstance(desc, security.descriptor))
 131             if isinstance(desc, str):
 132                 ldif += "nTSecurityDescriptor: %s" % desc
 133             elif isinstance(desc, security.descriptor):
 134                 ldif += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
 135         _ldb.add_ldif(ldif)
 136
 137     def create_user(self, _ldb, user_dn, desc=None):
 138         ldif = """
 139 dn: """ + user_dn + """
 140 sAMAccountName: """ + user_dn.split(",")[0][3:] + """
 141 objectClass: user
 142 userPassword: """ + self.user_pass + """
 143 url: www.example.com
 144 """
 145         if desc:
 146             assert(isinstance(desc, str) or isinstance(desc, security.descriptor))
 147             if isinstance(desc, str):
 148                 ldif += "nTSecurityDescriptor: %s" % desc
 149             elif isinstance(desc, security.descriptor):
 150                 ldif += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
 151         _ldb.add_ldif(ldif)
 152
 153     def create_group(self, _ldb, group_dn, desc=None):
 154         ldif = """
 155 dn: """ + group_dn + """
 156 objectClass: group
 157 sAMAccountName: """ + group_dn.split(",")[0][3:] + """
 158 groupType: 4
 159 url: www.example.com
 160 """
 161         if desc:
 162             assert(isinstance(desc, str) or isinstance(desc, security.descriptor))
 163             if isinstance(desc, str):
 164                 ldif += "nTSecurityDescriptor: %s" % desc
 165             elif isinstance(desc, security.descriptor):
 166                 ldif += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
 167         _ldb.add_ldif(ldif)
 168
 169     def read_desc(self, object_dn):
 170         res = self.ldb_admin.search(object_dn, SCOPE_BASE, None, ["nTSecurityDescriptor"])
 171         desc = res[0]["nTSecurityDescriptor"][0]
 172         return ndr_unpack( security.descriptor, desc )
 173
 174     def enable_account(self,  user_dn):
 175         """Enable an account.
 176         :param user_dn: Dn of the account to enable.
 177         """
 178         res = self.ldb_admin.search(user_dn, SCOPE_BASE, None, ["userAccountControl"])
 179         assert len(res) == 1
 180         userAccountControl = res[0]["userAccountControl"][0]
 181         userAccountControl = int(userAccountControl)
 182         if (userAccountControl & 0x2):
 183             userAccountControl = userAccountControl & ~0x2 # remove disabled bit
 184         if (userAccountControl & 0x20):
 185             userAccountControl = userAccountControl & ~0x20 # remove 'no password required' bit
 186         mod = """
 187 dn: """ + user_dn + """
 188 changetype: modify
 189 replace: userAccountControl
 190 userAccountControl: %s""" % userAccountControl
 191         if self.WIN:
 192             mod = re.sub("userAccountControl: \d.*", "userAccountControl: 544", mod)
 193         self.ldb_admin.modify_ldif(mod)
 194
 195     def get_ldb_connection(self, target_username):
 196         username_save = creds.get_username(); password_save = creds.get_password()
 197         creds.set_username(target_username)
 198         creds.set_password(self.user_pass)
 199         ldb_target = Ldb(host, credentials=creds, session_info=system_session(), lp=lp)
 200         creds.set_username(username_save); creds.set_password(password_save)
 201         return ldb_target
 202
 203     def get_object_sid(self, object_dn):
 204         res = self.ldb_admin.search(object_dn)
 205         return ndr_unpack( security.dom_sid, res[0]["objectSid"][0] )
 206
 207     def dacl_add_ace(self, object_dn, ace):
 208         desc = self.read_desc( object_dn )
 209         desc_sddl = desc.as_sddl( self.domain_sid )
 210         if ace in desc_sddl:
 211             return
 212         if desc_sddl.find("(") >= 0:
 213             desc_sddl = desc_sddl[:desc_sddl.index("(")] + ace + desc_sddl[desc_sddl.index("("):]
 214         else:
 215             desc_sddl = desc_sddl + ace
 216         self.modify_desc(object_dn, desc_sddl)
 217
 218     def get_desc_sddl(self, object_dn):
 219         """ Return object nTSecutiryDescriptor in SDDL format
 220         """
 221         desc = self.read_desc(object_dn)
 222         return desc.as_sddl(self.domain_sid)
 223
 224     # Test if we have any additional groups for users than default ones
 225     def assert_user_no_group_member(self, username):
 226         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 227                                          % self.get_user_dn(username) )
 228         try:
 229             self.assertEqual( res[0]["memberOf"][0], "" )
 230         except KeyError:
 231             pass
 232         else:
 233             self.fail()
 234
 235     def create_enable_user(self, username):
 236         self.create_user(self.ldb_admin, self.get_user_dn(username))
 237         self.enable_account(self.get_user_dn(username))
 238
 239 #tests on ldap add operations
 240 class AclAddTests(AclTests):
 241     def setUp(self):
 242         AclTests.setUp(self)
 243         # Domain admin that will be creator of OU parent-child structure
 244         self.usr_admin_owner = "acl_add_user1"
 245         # Second domain admin that will not be creator of OU parent-child structure
 246         self.usr_admin_not_owner = "acl_add_user2"
 247         # Regular user
 248         self.regular_user = "acl_add_user3"
 249         if self.SAMBA:
 250             self.create_enable_user(self.usr_admin_owner)
 251             self.create_enable_user(self.usr_admin_not_owner)
 252             self.create_enable_user(self.regular_user)
 253
 254         if self.WIN:
 255             self.assert_user_no_group_member(self.usr_admin_owner)
 256             self.assert_user_no_group_member(self.usr_admin_not_owner)
 257             self.assert_user_no_group_member(self.regular_user)
 258
 259         # add admins to the Domain Admins group
 260         self.add_group_member(self.ldb_admin, "CN=Domain Admins,CN=Users," + self.base_dn, \
 261                 self.get_user_dn(self.usr_admin_owner))
 262         self.add_group_member(self.ldb_admin, "CN=Domain Admins,CN=Users," + self.base_dn, \
 263                 self.get_user_dn(self.usr_admin_not_owner))
 264
 265         self.ldb_owner = self.get_ldb_connection(self.usr_admin_owner)
 266         self.ldb_notowner = self.get_ldb_connection(self.usr_admin_not_owner)
 267         self.ldb_user = self.get_ldb_connection(self.regular_user)
 268
 269     def tearDown(self):
 270         self.delete_force(self.ldb_admin, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
 271         self.delete_force(self.ldb_admin, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
 272         self.delete_force(self.ldb_admin, "OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
 273         self.delete_force(self.ldb_admin, "OU=test_add_ou1," + self.base_dn)
 274         if self.SAMBA:
 275             self.delete_force(self.ldb_admin, self.get_user_dn(self.usr_admin_owner))
 276             self.delete_force(self.ldb_admin, self.get_user_dn(self.usr_admin_not_owner))
 277             self.delete_force(self.ldb_admin, self.get_user_dn(self.regular_user))
 278
 279     # Make sure top OU is deleted (and so everything under it)
 280     def assert_top_ou_deleted(self):
 281         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s,%s)" \
 282                 % ("OU=test_add_ou1", self.base_dn) )
 283         self.assertEqual( res, [] )
 284
 285     def test_add_u1(self):
 286         """Testing OU with the rights of Doman Admin not creator of the OU """
 287         self.assert_top_ou_deleted()
 288         # Change descriptor for top level OU
 289         self.create_ou(self.ldb_owner, "OU=test_add_ou1," + self.base_dn)
 290         self.create_ou(self.ldb_owner, "OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
 291         user_sid = self.get_object_sid(self.get_user_dn(self.usr_admin_not_owner))
 292         mod = "(D;CI;WPCC;;;%s)" % str(user_sid)
 293         self.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
 294         # Test user and group creation with another domain admin's credentials
 295         self.create_user(self.ldb_notowner, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
 296         self.create_group(self.ldb_notowner, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
 297         # Make sure we HAVE created the two objects -- user and group
 298         # !!! We should not be able to do that, but however beacuse of ACE ordering our inherited Deny ACE
 299         # !!! comes after explicit (A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA) that comes from somewhere
 300         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s,%s)" \
 301                 % ("CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn) )
 302         self.assertTrue( len(res) > 0 )
 303         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s,%s)" \
 304                 % ("CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn) )
 305         self.assertTrue( len(res) > 0 )
 306
 307     def test_add_u2(self):
 308         """Testing OU with the regular user that has no rights granted over the OU """
 309         self.assert_top_ou_deleted()
 310         # Create a parent-child OU structure with domain admin credentials
 311         self.create_ou(self.ldb_owner, "OU=test_add_ou1," + self.base_dn)
 312         self.create_ou(self.ldb_owner, "OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
 313         # Test user and group creation with regular user credentials
 314         try:
 315             self.create_user(self.ldb_user, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
 316             self.create_group(self.ldb_user, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
 317         except LdbError, (num, _):
 318             self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
 319         else:
 320             self.fail()
 321         # Make sure we HAVEN'T created any of two objects -- user or group
 322         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s,%s)" \
 323                 % ("CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn) )
 324         self.assertEqual( res, [])
 325         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s,%s)" \
 326                 % ("CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn) )
 327         self.assertEqual( res, [])
 328
 329     def test_add_u3(self):
 330         """Testing OU with the rights of regular user granted the right 'Create User child objects' """
 331         self.assert_top_ou_deleted()
 332         # Change descriptor for top level OU
 333         self.create_ou(self.ldb_owner, "OU=test_add_ou1," + self.base_dn)
 334         user_sid = self.get_object_sid(self.get_user_dn(self.regular_user))
 335         mod = "(OA;CI;CC;bf967aba-0de6-11d0-a285-00aa003049e2;;%s)" % str(user_sid)
 336         self.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
 337         self.create_ou(self.ldb_owner, "OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
 338         # Test user and group creation with granted user only to one of the objects
 339         self.create_user(self.ldb_user, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
 340         try:
 341             self.create_group(self.ldb_user, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
 342         except LdbError, (num, _):
 343             self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
 344         else:
 345             self.fail()
 346         # Make sure we HAVE created the one of two objects -- user
 347         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s,%s)" \
 348                 % ("CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn) )
 349         self.assertNotEqual( len(res), 0 )
 350         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s,%s)" \
 351                 % ("CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn) )
 352         self.assertEqual( res, [])
 353
 354     def test_add_u4(self):
 355         """ 4 Testing OU with the rights of Doman Admin creator of the OU"""
 356         self.assert_top_ou_deleted()
 357         self.create_ou(self.ldb_owner, "OU=test_add_ou1," + self.base_dn)
 358         self.create_ou(self.ldb_owner, "OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
 359         self.create_user(self.ldb_owner, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
 360         self.create_group(self.ldb_owner, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
 361         # Make sure we have successfully created the two objects -- user and group
 362         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s,%s)" \
 363                 % ("CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn) )
 364         self.assertTrue( len(res) > 0 )
 365         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s,%s)" \
 366                 % ("CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn) )
 367         self.assertTrue( len(res) > 0 )
 368
 369 #tests on ldap modify operations
 370 class AclModifyTests(AclTests):
 371
 372     def setUp(self):
 373         AclTests.setUp(self)
 374         self.user_with_wp = "acl_mod_user1"
 375
 376         if self.SAMBA:
 377             # Create regular user
 378             self.create_enable_user(self.user_with_wp)
 379         if self.WIN:
 380             self.assert_user_no_group_member(self.user_with_wp)
 381
 382         self.ldb_user = self.get_ldb_connection(self.user_with_wp)
 383         self.user_sid = self.get_object_sid( self.get_user_dn(self.user_with_wp))
 384
 385     def tearDown(self):
 386         self.delete_force(self.ldb_admin, self.get_user_dn("test_modify_user1"))
 387         self.delete_force(self.ldb_admin, "CN=test_modify_group1,CN=Users," + self.base_dn)
 388         self.delete_force(self.ldb_admin, "OU=test_modify_ou1," + self.base_dn)
 389         if self.SAMBA:
 390             self.delete_force(self.ldb_admin, self.get_user_dn(self.user_with_wp))
 391
 392     def test_modify_u1(self):
 393         """5 Modify one attribute if you have DS_WRITE_PROPERTY for it"""
 394         mod = "(OA;;WP;bf967953-0de6-11d0-a285-00aa003049e2;;%s)" % str(self.user_sid)
 395         # First test object -- User
 396         print "Testing modify on User object"
 397         #self.delete_force(self.ldb_admin, self.get_user_dn("test_modify_user1"))
 398         self.create_user(self.ldb_admin, self.get_user_dn("test_modify_user1"))
 399         self.dacl_add_ace(self.get_user_dn("test_modify_user1"), mod)
 400         ldif = """
 401 dn: """ + self.get_user_dn("test_modify_user1") + """
 402 changetype: modify
 403 replace: displayName
 404 displayName: test_changed"""
 405         self.ldb_user.modify_ldif(ldif)
 406         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 407                                     % self.get_user_dn("test_modify_user1") )
 408         self.assertEqual(res[0]["displayName"][0], "test_changed")
 409         # Second test object -- Group
 410         print "Testing modify on Group object"
 411         #self.delete_force(self.ldb_admin, "CN=test_modify_group1,CN=Users," + self.base_dn)
 412         self.create_group(self.ldb_admin, "CN=test_modify_group1,CN=Users," + self.base_dn)
 413         self.dacl_add_ace("CN=test_modify_group1,CN=Users," + self.base_dn, mod)
 414         ldif = """
 415 dn: CN=test_modify_group1,CN=Users,""" + self.base_dn + """
 416 changetype: modify
 417 replace: displayName
 418 displayName: test_changed"""
 419         self.ldb_user.modify_ldif(ldif)
 420         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 421                                     % str("CN=test_modify_group1,CN=Users," + self.base_dn) )
 422         self.assertEqual(res[0]["displayName"][0], "test_changed")
 423         # Third test object -- Organizational Unit
 424         print "Testing modify on OU object"
 425         #self.delete_force(self.ldb_admin, "OU=test_modify_ou1," + self.base_dn)
 426         self.create_ou(self.ldb_admin, "OU=test_modify_ou1," + self.base_dn)
 427         self.dacl_add_ace("OU=test_modify_ou1," + self.base_dn, mod)
 428         ldif = """
 429 dn: OU=test_modify_ou1,""" + self.base_dn + """
 430 changetype: modify
 431 replace: displayName
 432 displayName: test_changed"""
 433         self.ldb_user.modify_ldif(ldif)
 434         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 435                                     % str("OU=test_modify_ou1," + self.base_dn) )
 436         self.assertEqual(res[0]["displayName"][0], "test_changed")
 437
 438     def test_modify_u2(self):
 439         """6 Modify two attributes as you have DS_WRITE_PROPERTY granted only for one of them"""
 440         mod = "(OA;;WP;bf967953-0de6-11d0-a285-00aa003049e2;;%s)" % str(self.user_sid)
 441         # First test object -- User
 442         print "Testing modify on User object"
 443         #self.delete_force(self.ldb_admin, self.get_user_dn("test_modify_user1"))
 444         self.create_user(self.ldb_admin, self.get_user_dn("test_modify_user1"))
 445         self.dacl_add_ace(self.get_user_dn("test_modify_user1"), mod)
 446         # Modify on attribute you have rights for
 447         ldif = """
 448 dn: """ + self.get_user_dn("test_modify_user1") + """
 449 changetype: modify
 450 replace: displayName
 451 displayName: test_changed"""
 452         self.ldb_user.modify_ldif(ldif)
 453         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 454                                     % self.get_user_dn("test_modify_user1") )
 455         self.assertEqual(res[0]["displayName"][0], "test_changed")
 456         # Modify on attribute you do not have rights for granted
 457         ldif = """
 458 dn: """ + self.get_user_dn("test_modify_user1") + """
 459 changetype: modify
 460 replace: url
 461 url: www.samba.org"""
 462         try:
 463             self.ldb_user.modify_ldif(ldif)
 464         except LdbError, (num, _):
 465             self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
 466         else:
 467             # This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
 468             self.fail()
 469         # Second test object -- Group
 470         print "Testing modify on Group object"
 471         self.create_group(self.ldb_admin, "CN=test_modify_group1,CN=Users," + self.base_dn)
 472         self.dacl_add_ace("CN=test_modify_group1,CN=Users," + self.base_dn, mod)
 473         ldif = """
 474 dn: CN=test_modify_group1,CN=Users,""" + self.base_dn + """
 475 changetype: modify
 476 replace: displayName
 477 displayName: test_changed"""
 478         self.ldb_user.modify_ldif(ldif)
 479         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 480                                     % str("CN=test_modify_group1,CN=Users," + self.base_dn) )
 481         self.assertEqual(res[0]["displayName"][0], "test_changed")
 482         # Modify on attribute you do not have rights for granted
 483         ldif = """
 484 dn: CN=test_modify_group1,CN=Users,""" + self.base_dn + """
 485 changetype: modify
 486 replace: url
 487 url: www.samba.org"""
 488         try:
 489             self.ldb_user.modify_ldif(ldif)
 490         except LdbError, (num, _):
 491             self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
 492         else:
 493             # This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
 494             self.fail()
 495         # Second test object -- Organizational Unit
 496         print "Testing modify on OU object"
 497         self.create_ou(self.ldb_admin, "OU=test_modify_ou1," + self.base_dn)
 498         self.dacl_add_ace("OU=test_modify_ou1," + self.base_dn, mod)
 499         ldif = """
 500 dn: OU=test_modify_ou1,""" + self.base_dn + """
 501 changetype: modify
 502 replace: displayName
 503 displayName: test_changed"""
 504         self.ldb_user.modify_ldif(ldif)
 505         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 506                                     % str("OU=test_modify_ou1," + self.base_dn) )
 507         self.assertEqual(res[0]["displayName"][0], "test_changed")
 508         # Modify on attribute you do not have rights for granted
 509         ldif = """
 510 dn: OU=test_modify_ou1,""" + self.base_dn + """
 511 changetype: modify
 512 replace: url
 513 url: www.samba.org"""
 514         try:
 515             self.ldb_user.modify_ldif(ldif)
 516         except LdbError, (num, _):
 517             self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
 518         else:
 519             # This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
 520             self.fail()
 521
 522     def test_modify_u3(self):
 523         """7 Modify one attribute as you have no what so ever rights granted"""
 524         # First test object -- User
 525         print "Testing modify on User object"
 526         self.create_user(self.ldb_admin, self.get_user_dn("test_modify_user1"))
 527         # Modify on attribute you do not have rights for granted
 528         ldif = """
 529 dn: """ + self.get_user_dn("test_modify_user1") + """
 530 changetype: modify
 531 replace: url
 532 url: www.samba.org"""
 533         try:
 534             self.ldb_user.modify_ldif(ldif)
 535         except LdbError, (num, _):
 536             self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
 537         else:
 538             # This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
 539             self.fail()
 540
 541         # Second test object -- Group
 542         print "Testing modify on Group object"
 543         self.create_group(self.ldb_admin, "CN=test_modify_group1,CN=Users," + self.base_dn)
 544         # Modify on attribute you do not have rights for granted
 545         ldif = """
 546 dn: CN=test_modify_group1,CN=Users,""" + self.base_dn + """
 547 changetype: modify
 548 replace: url
 549 url: www.samba.org"""
 550         try:
 551             self.ldb_user.modify_ldif(ldif)
 552         except LdbError, (num, _):
 553             self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
 554         else:
 555             # This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
 556             self.fail()
 557
 558         # Second test object -- Organizational Unit
 559         print "Testing modify on OU object"
 560         #self.delete_force(self.ldb_admin, "OU=test_modify_ou1," + self.base_dn)
 561         self.create_ou(self.ldb_admin, "OU=test_modify_ou1," + self.base_dn)
 562         # Modify on attribute you do not have rights for granted
 563         ldif = """
 564 dn: OU=test_modify_ou1,""" + self.base_dn + """
 565 changetype: modify
 566 replace: url
 567 url: www.samba.org"""
 568         try:
 569             self.ldb_user.modify_ldif(ldif)
 570         except LdbError, (num, _):
 571             self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
 572         else:
 573             # This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
 574             self.fail()
 575
 576
 577     def test_modify_u4(self):
 578         """11 Grant WP to PRINCIPAL_SELF and test modify"""
 579         ldif = """
 580 dn: """ + self.get_user_dn(self.user_with_wp) + """
 581 changetype: modify
 582 add: adminDescription
 583 adminDescription: blah blah blah"""
 584         try:
 585             self.ldb_user.modify_ldif(ldif)
 586         except LdbError, (num, _):
 587             self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
 588         else:
 589             # This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
 590             self.fail()
 591
 592         mod = "(OA;;WP;bf967919-0de6-11d0-a285-00aa003049e2;;PS)"
 593         self.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
 594         # Modify on attribute you have rights for
 595         self.ldb_user.modify_ldif(ldif)
 596         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 597                                     % self.get_user_dn(self.user_with_wp), attrs=["adminDescription"] )
 598         self.assertEqual(res[0]["adminDescription"][0], "blah blah blah")
 599
 600
 601 #enable these when we have search implemented
 602 class AclSearchTests(AclTests):
 603
 604     def setUp(self):
 605         AclTests.setUp(self)
 606         self.regular_user = "acl_search_user1"
 607
 608         if self.SAMBA:
 609             # Create regular user
 610             self.create_enable_user(self.regular_user)
 611         if self.WIN:
 612             self.assert_user_no_group_member(self.regular_user)
 613
 614         self.ldb_user = self.get_ldb_connection(self.regular_user)
 615
 616     def tearDown(self):
 617         self.delete_force(self.ldb_admin, "CN=test_search_user1,OU=test_search_ou1," + self.base_dn)
 618         self.delete_force(self.ldb_admin, "OU=test_search_ou1," + self.base_dn)
 619         if self.SAMBA:
 620             self.delete_force(self.ldb_admin, self.get_user_dn(self.regular_user))
 621
 622     def test_search_u1(self):
 623         """See if can prohibit user to read another User object"""
 624         ou_dn = "OU=test_search_ou1," + self.base_dn
 625         user_dn = "CN=test_search_user1," + ou_dn
 626         # Create clean OU
 627         self.delete_force(self.ldb_admin, ou_dn)
 628         self.create_ou(self.ldb_admin, ou_dn)
 629         desc = self.read_desc( ou_dn )
 630         desc_sddl = desc.as_sddl( self.domain_sid )
 631         # Parse descriptor's SDDL and remove all inherited ACEs reffering
 632         # to 'Registered Users' or 'Authenticated Users'
 633         desc_aces = re.findall("\(.*?\)", desc_sddl)
 634         for ace in desc_aces:
 635             if ("I" in ace) and (("RU" in ace) or ("AU" in ace)):
 636                 desc_sddl = desc_sddl.replace(ace, "")
 637         # Add 'P' in the DACL so it breaks further inheritance
 638         desc_sddl = desc_sddl.replace("D:AI(", "D:PAI(")
 639         # Create a security descriptor object and OU with that descriptor
 640         desc = security.descriptor.from_sddl( desc_sddl, self.domain_sid )
 641         self.delete_force(self.ldb_admin, ou_dn)
 642         self.create_ou(self.ldb_admin, ou_dn, desc)
 643         # Create clean user
 644         self.delete_force(self.ldb_admin, user_dn)
 645         self.create_user(self.ldb_admin, user_dn)
 646         desc = self.read_desc( user_dn )
 647         desc_sddl = desc.as_sddl( self.domain_sid )
 648         # Parse security descriptor SDDL and remove all 'Read' ACEs
 649         # reffering to AU
 650         desc_aces = re.findall("\(.*?\)", desc_sddl)
 651         for ace in desc_aces:
 652             if ("AU" in ace) and ("R" in ace):
 653                 desc_sddl = desc_sddl.replace(ace, "")
 654         # Create user with the edited descriptor
 655         desc = security.descriptor.from_sddl( desc_sddl, self.domain_sid )
 656         self.delete_force(self.ldb_admin, user_dn)
 657         self.create_user(self.ldb_admin, user_dn, desc)
 658
 659         res = ldb_user.search( self.base_dn, expression="(distinguishedName=%s)" \
 660                                     % user_dn )
 661         self.assertEqual( res, [] )
 662
 663     def test_search_u2(self):
 664         """User's group ACEs cleared and after that granted RIGHT_DS_READ_PROPERTY to another User object"""
 665         ou_dn = "OU=test_search_ou1," + self.base_dn
 666         user_dn = "CN=test_search_user1," + ou_dn
 667         # Create clean OU
 668         self.delete_force(self.ldb_admin, ou_dn)
 669         self.create_ou(self.ldb_admin, ou_dn)
 670         desc = self.read_desc( ou_dn )
 671         desc_sddl = desc.as_sddl( self.domain_sid )
 672         # Parse descriptor's SDDL and remove all inherited ACEs reffering
 673         # to 'Registered Users' or 'Authenticated Users'
 674         desc_aces = re.findall("\(.*?\)", desc_sddl)
 675         for ace in desc_aces:
 676             if ("I" in ace) and (("RU" in ace) or ("AU" in ace)):
 677                 desc_sddl = desc_sddl.replace(ace, "")
 678         # Add 'P' in the DACL so it breaks further inheritance
 679         desc_sddl = desc_sddl.replace("D:AI(", "D:PAI(")
 680         # Create a security descriptor object and OU with that descriptor
 681         desc = security.descriptor.from_sddl( desc_sddl, self.domain_sid )
 682         self.delete_force(self.ldb_admin, ou_dn)
 683         self.create_ou(self.ldb_admin, ou_dn, desc)
 684         # Create clean user
 685         self.delete_force(self.ldb_admin, user_dn)
 686         self.create_user(self.ldb_admin, user_dn)
 687         # Parse security descriptor SDDL and remove all 'Read' ACEs
 688         # reffering to AU
 689         desc_aces = re.findall("\(.*?\)", desc_sddl)
 690         for ace in desc_aces:
 691             if ("AU" in ace) and ("R" in ace):
 692                 desc_sddl = desc_sddl.replace(ace, "")
 693         #mod = "(OA;;RP;e48d0154-bcf8-11d1-8702-00c04fb96050;;AU)"
 694         mod = "(A;;RP;;;AU)"
 695         self.dacl_add_ace(user_dn, mod)
 696         res = self.ldb_user.search( self.base_dn, expression="(distinguishedName=%s)" \
 697                                     % user_dn )
 698         self.assertNotEqual( res, [] )
 699
 700 #tests on ldap delete operations
 701 class AclDeleteTests(AclTests):
 702
 703     def setUp(self):
 704         AclTests.setUp(self)
 705         self.regular_user = "acl_delete_user1"
 706
 707         if self.SAMBA:
 708             # Create regular user
 709             self.create_enable_user(self.regular_user)
 710         if self.WIN:
 711             self.assert_user_no_group_member(self.regular_user)
 712
 713         self.ldb_user = self.get_ldb_connection(self.regular_user)
 714
 715     def tearDown(self):
 716         self.delete_force(self.ldb_admin, self.get_user_dn("test_delete_user1"))
 717         if self.SAMBA:
 718             self.delete_force(self.ldb_admin, self.get_user_dn(self.regular_user))
 719
 720     def test_delete_u1(self):
 721         """User is prohibited by default to delete another User object"""
 722         # Create user that we try to delete
 723         self.create_user(self.ldb_admin, self.get_user_dn("test_delete_user1"))
 724         # Here delete User object should ALWAYS through exception
 725         try:
 726             self.ldb_user.delete(self.get_user_dn("test_delete_user1"))
 727         except LdbError, (num, _):
 728             self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
 729         else:
 730             self.fail()
 731
 732     def test_delete_u2(self):
 733         """User's group has RIGHT_DELETE to another User object"""
 734         user_dn = self.get_user_dn("test_delete_user1")
 735         # Create user that we try to delete
 736         self.create_user(self.ldb_admin, user_dn)
 737         mod = "(A;;SD;;;AU)"
 738         self.dacl_add_ace(user_dn, mod)
 739         # Try to delete User object
 740         self.ldb_user.delete( user_dn )
 741         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 742                 % user_dn )
 743         self.assertEqual( res, [] )
 744
 745     def test_delete_u3(self):
 746         """User indentified by SID has RIGHT_DELETE to another User object"""
 747         user_dn = self.get_user_dn("test_delete_user1")
 748         # Create user that we try to delete
 749         self.create_user(self.ldb_admin, user_dn)
 750         mod = "(A;;SD;;;%s)" % str( self.get_object_sid(self.get_user_dn(self.regular_user)))
 751         self.dacl_add_ace(user_dn, mod)
 752         # Try to delete User object
 753         self.ldb_user.delete( user_dn )
 754         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 755                 % user_dn )
 756         self.assertEqual( res, [] )
 757
 758 #tests on ldap rename operations
 759 class AclRenameTests(AclTests):
 760
 761     def setUp(self):
 762         AclTests.setUp(self)
 763         self.regular_user = "acl_rename_user1"
 764
 765         if self.SAMBA:
 766             # Create regular user
 767             self.create_enable_user(self.regular_user)
 768         if self.WIN:
 769             self.assert_user_no_group_member(self.regular_user)
 770
 771         self.ldb_user = self.get_ldb_connection(self.regular_user)
 772
 773     def tearDown(self):
 774         # Rename OU3
 775         self.delete_force(self.ldb_admin, "CN=test_rename_user1,OU=test_rename_ou3,OU=test_rename_ou2," + self.base_dn)
 776         self.delete_force(self.ldb_admin, "CN=test_rename_user2,OU=test_rename_ou3,OU=test_rename_ou2," + self.base_dn)
 777         self.delete_force(self.ldb_admin, "CN=test_rename_user5,OU=test_rename_ou3,OU=test_rename_ou2," + self.base_dn)
 778         self.delete_force(self.ldb_admin, "OU=test_rename_ou3,OU=test_rename_ou2," + self.base_dn)
 779         # Rename OU2
 780         self.delete_force(self.ldb_admin, "CN=test_rename_user1,OU=test_rename_ou2," + self.base_dn)
 781         self.delete_force(self.ldb_admin, "CN=test_rename_user2,OU=test_rename_ou2," + self.base_dn)
 782         self.delete_force(self.ldb_admin, "CN=test_rename_user5,OU=test_rename_ou2," + self.base_dn)
 783         self.delete_force(self.ldb_admin, "OU=test_rename_ou2," + self.base_dn)
 784         # Rename OU1
 785         self.delete_force(self.ldb_admin, "CN=test_rename_user1,OU=test_rename_ou1," + self.base_dn)
 786         self.delete_force(self.ldb_admin, "CN=test_rename_user2,OU=test_rename_ou1," + self.base_dn)
 787         self.delete_force(self.ldb_admin, "CN=test_rename_user5,OU=test_rename_ou1," + self.base_dn)
 788         self.delete_force(self.ldb_admin, "OU=test_rename_ou3,OU=test_rename_ou1," + self.base_dn)
 789         self.delete_force(self.ldb_admin, "OU=test_rename_ou1," + self.base_dn)
 790         if self.SAMBA:
 791             self.delete_force(self.ldb_admin, self.get_user_dn(self.regular_user))
 792
 793     def test_rename_u1(self):
 794         """Regular user fails to rename 'User object' within single OU"""
 795         # Create OU structure
 796         self.create_ou(self.ldb_admin, "OU=test_rename_ou1," + self.base_dn)
 797         self.create_user(self.ldb_admin, "CN=test_rename_user1,OU=test_rename_ou1," + self.base_dn)
 798         try:
 799             self.ldb_user.rename("CN=test_rename_user1,OU=test_rename_ou1," + self.base_dn, \
 800                     "CN=test_rename_user5,OU=test_rename_ou1," + self.base_dn)
 801         except LdbError, (num, _):
 802             self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
 803         else:
 804             self.fail()
 805
 806     def test_rename_u2(self):
 807         """Grant WRITE_PROPERTY to AU so regular user can rename 'User object' within single OU"""
 808         ou_dn = "OU=test_rename_ou1," + self.base_dn
 809         user_dn = "CN=test_rename_user1," + ou_dn
 810         rename_user_dn = "CN=test_rename_user5," + ou_dn
 811         # Create OU structure
 812         self.create_ou(self.ldb_admin, ou_dn)
 813         self.create_user(self.ldb_admin, user_dn)
 814         mod = "(A;;WP;;;AU)"
 815         self.dacl_add_ace(user_dn, mod)
 816         # Rename 'User object' having WP to AU
 817         self.ldb_user.rename(user_dn, rename_user_dn)
 818         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 819                 % user_dn )
 820         self.assertEqual( res, [] )
 821         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 822                 % rename_user_dn )
 823         self.assertNotEqual( res, [] )
 824
 825     def test_rename_u3(self):
 826         """Test rename with rights granted to 'User object' SID"""
 827         ou_dn = "OU=test_rename_ou1," + self.base_dn
 828         user_dn = "CN=test_rename_user1," + ou_dn
 829         rename_user_dn = "CN=test_rename_user5," + ou_dn
 830         # Create OU structure
 831         self.create_ou(self.ldb_admin, ou_dn)
 832         self.create_user(self.ldb_admin, user_dn)
 833         sid = self.get_object_sid(self.get_user_dn(self.regular_user))
 834         mod = "(A;;WP;;;%s)" % str(sid)
 835         self.dacl_add_ace(user_dn, mod)
 836         # Rename 'User object' having WP to AU
 837         self.ldb_user.rename(user_dn, rename_user_dn)
 838         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 839                 % user_dn )
 840         self.assertEqual( res, [] )
 841         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 842                 % rename_user_dn )
 843         self.assertNotEqual( res, [] )
 844
 845     def test_rename_u4(self):
 846         """Rename 'User object' cross OU with WP, SD and CC right granted on reg. user to AU"""
 847         ou1_dn = "OU=test_rename_ou1," + self.base_dn
 848         ou2_dn = "OU=test_rename_ou2," + self.base_dn
 849         user_dn = "CN=test_rename_user2," + ou1_dn
 850         rename_user_dn = "CN=test_rename_user5," + ou2_dn
 851         # Create OU structure
 852         self.create_ou(self.ldb_admin, ou1_dn)
 853         self.create_ou(self.ldb_admin, ou2_dn)
 854         self.create_user(self.ldb_admin, user_dn)
 855         mod = "(A;;WPSD;;;AU)"
 856         self.dacl_add_ace(user_dn, mod)
 857         mod = "(A;;CC;;;AU)"
 858         self.dacl_add_ace(ou2_dn, mod)
 859         # Rename 'User object' having SD and CC to AU
 860         self.ldb_user.rename(user_dn, rename_user_dn)
 861         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 862                 % user_dn )
 863         self.assertEqual( res, [] )
 864         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 865                 % rename_user_dn )
 866         self.assertNotEqual( res, [] )
 867
 868     def test_rename_u5(self):
 869         """Test rename with rights granted to 'User object' SID"""
 870         ou1_dn = "OU=test_rename_ou1," + self.base_dn
 871         ou2_dn = "OU=test_rename_ou2," + self.base_dn
 872         user_dn = "CN=test_rename_user2," + ou1_dn
 873         rename_user_dn = "CN=test_rename_user5," + ou2_dn
 874         # Create OU structure
 875         self.create_ou(self.ldb_admin, ou1_dn)
 876         self.create_ou(self.ldb_admin, ou2_dn)
 877         self.create_user(self.ldb_admin, user_dn)
 878         sid = self.get_object_sid(self.get_user_dn(self.regular_user))
 879         mod = "(A;;WPSD;;;%s)" % str(sid)
 880         self.dacl_add_ace(user_dn, mod)
 881         mod = "(A;;CC;;;%s)" % str(sid)
 882         self.dacl_add_ace(ou2_dn, mod)
 883         # Rename 'User object' having SD and CC to AU
 884         self.ldb_user.rename(user_dn, rename_user_dn)
 885         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 886                 % user_dn )
 887         self.assertEqual( res, [] )
 888         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 889                 % rename_user_dn )
 890         self.assertNotEqual( res, [] )
 891
 892     def test_rename_u6(self):
 893         """Rename 'User object' cross OU with WP, DC and CC right granted on OU & user to AU"""
 894         ou1_dn = "OU=test_rename_ou1," + self.base_dn
 895         ou2_dn = "OU=test_rename_ou2," + self.base_dn
 896         user_dn = "CN=test_rename_user2," + ou1_dn
 897         rename_user_dn = "CN=test_rename_user2," + ou2_dn
 898         # Create OU structure
 899         self.create_ou(self.ldb_admin, ou1_dn)
 900         self.create_ou(self.ldb_admin, ou2_dn)
 901         #mod = "(A;CI;DCWP;;;AU)"
 902         mod = "(A;;DC;;;AU)"
 903         self.dacl_add_ace(ou1_dn, mod)
 904         mod = "(A;;CC;;;AU)"
 905         self.dacl_add_ace(ou2_dn, mod)
 906         self.create_user(self.ldb_admin, user_dn)
 907         mod = "(A;;WP;;;AU)"
 908         self.dacl_add_ace(user_dn, mod)
 909         # Rename 'User object' having SD and CC to AU
 910         self.ldb_user.rename(user_dn, rename_user_dn)
 911         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 912                 % user_dn )
 913         self.assertEqual( res, [] )
 914         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 915                 % rename_user_dn )
 916         self.assertNotEqual( res, [] )
 917
 918     def test_rename_u7(self):
 919         """Rename 'User object' cross OU (second level) with WP, DC and CC right granted on OU to AU"""
 920         ou1_dn = "OU=test_rename_ou1," + self.base_dn
 921         ou2_dn = "OU=test_rename_ou2," + self.base_dn
 922         ou3_dn = "OU=test_rename_ou3," + ou2_dn
 923         user_dn = "CN=test_rename_user2," + ou1_dn
 924         rename_user_dn = "CN=test_rename_user5," + ou3_dn
 925         # Create OU structure
 926         self.create_ou(self.ldb_admin, ou1_dn)
 927         self.create_ou(self.ldb_admin, ou2_dn)
 928         self.create_ou(self.ldb_admin, ou3_dn)
 929         mod = "(A;CI;WPDC;;;AU)"
 930         self.dacl_add_ace(ou1_dn, mod)
 931         mod = "(A;;CC;;;AU)"
 932         self.dacl_add_ace(ou3_dn, mod)
 933         self.create_user(self.ldb_admin, user_dn)
 934         # Rename 'User object' having SD and CC to AU
 935         self.ldb_user.rename(user_dn, rename_user_dn)
 936         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 937                 % user_dn )
 938         self.assertEqual( res, [] )
 939         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 940                 % rename_user_dn )
 941         self.assertNotEqual( res, [] )
 942
 943     def test_rename_u8(self):
 944         """Test rename on an object with and without modify access on the RDN attribute"""
 945         ou1_dn = "OU=test_rename_ou1," + self.base_dn
 946         ou2_dn = "OU=test_rename_ou2," + ou1_dn
 947         ou3_dn = "OU=test_rename_ou3," + ou1_dn
 948         # Create OU structure
 949         self.create_ou(self.ldb_admin, ou1_dn)
 950         self.create_ou(self.ldb_admin, ou2_dn)
 951         sid = self.get_object_sid(self.get_user_dn(self.regular_user))
 952         mod = "(OA;;WP;bf967a0e-0de6-11d0-a285-00aa003049e2;;%s)" % str(sid)
 953         self.dacl_add_ace(ou2_dn, mod)
 954         mod = "(OD;;WP;bf9679f0-0de6-11d0-a285-00aa003049e2;;%s)" % str(sid)
 955         self.dacl_add_ace(ou2_dn, mod)
 956         try:
 957             self.ldb_user.rename(ou2_dn, ou3_dn)
 958         except LdbError, (num, _):
 959             self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
 960         else:
 961             # This rename operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
 962             self.fail()
 963         sid = self.get_object_sid(self.get_user_dn(self.regular_user))
 964         mod = "(A;;WP;bf9679f0-0de6-11d0-a285-00aa003049e2;;%s)" % str(sid)
 965         self.dacl_add_ace(ou2_dn, mod)
 966         self.ldb_user.rename(ou2_dn, ou3_dn)
 967         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 968                 % ou2_dn )
 969         self.assertEqual( res, [] )
 970         res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
 971                 % ou3_dn )
 972         self.assertNotEqual( res, [] )
 973
 974 # Important unit running information
 975
 976 if not "://" in host:
 977     host = "ldap://%s" % host
 978 ldb = Ldb(host, credentials=creds, session_info=system_session(), lp=lp)
 979
 980 runner = SubunitTestRunner()
 981 rc = 0
 982 if not runner.run(unittest.makeSuite(AclAddTests)).wasSuccessful():
 983     rc = 1
 984 if not runner.run(unittest.makeSuite(AclModifyTests)).wasSuccessful():
 985     rc = 1
 986 if not runner.run(unittest.makeSuite(AclDeleteTests)).wasSuccessful():
 987     rc = 1
 988 if not runner.run(unittest.makeSuite(AclRenameTests)).wasSuccessful():
 989     rc = 1
 990 sys.exit(rc)