source4/dsdb/tests/python/ldap_schema.py

   1 #!/usr/bin/env python
   2 # -*- coding: utf-8 -*-
   3 # This is a port of the original in testprogs/ejs/ldap.js
   4
   5 import optparse
   6 import sys
   7 import time
   8 import random
   9 import os
  10
  11 sys.path.insert(0, "bin/python")
  12 import samba
  13 samba.ensure_external_module("testtools", "testtools")
  14 samba.ensure_external_module("subunit", "subunit/python")
  15
  16 import samba.getopt as options
  17
  18 from samba.auth import system_session
  19 from ldb import SCOPE_ONELEVEL, SCOPE_BASE, LdbError
  20 from ldb import ERR_NO_SUCH_OBJECT
  21 from ldb import ERR_UNWILLING_TO_PERFORM
  22 from ldb import ERR_CONSTRAINT_VIOLATION
  23 from ldb import Message, MessageElement, Dn
  24 from ldb import FLAG_MOD_REPLACE
  25 from samba.samdb import SamDB
  26 from samba.dsdb import DS_DOMAIN_FUNCTION_2003
  27 from samba.tests import delete_force
  28
  29 from subunit.run import SubunitTestRunner
  30 import unittest
  31
  32 parser = optparse.OptionParser("ldap_schema.py [options] <host>")
  33 sambaopts = options.SambaOptions(parser)
  34 parser.add_option_group(sambaopts)
  35 parser.add_option_group(options.VersionOptions(parser))
  36 # use command line creds if available
  37 credopts = options.CredentialsOptions(parser)
  38 parser.add_option_group(credopts)
  39 opts, args = parser.parse_args()
  40
  41 if len(args) < 1:
  42     parser.print_usage()
  43     sys.exit(1)
  44
  45 host = args[0]
  46
  47 lp = sambaopts.get_loadparm()
  48 creds = credopts.get_credentials(lp)
  49
  50
  51 class SchemaTests(samba.tests.TestCase):
  52
  53     def setUp(self):
  54         super(SchemaTests, self).setUp()
  55         self.ldb = ldb
  56         self.base_dn = ldb.domain_dn()
  57         self.schema_dn = ldb.get_schema_basedn().get_linearized()
  58
  59     def test_generated_schema(self):
  60         """Testing we can read the generated schema via LDAP"""
  61         res = self.ldb.search("cn=aggregate,"+self.schema_dn, scope=SCOPE_BASE,
  62                 attrs=["objectClasses", "attributeTypes", "dITContentRules"])
  63         self.assertEquals(len(res), 1)
  64         self.assertTrue("dITContentRules" in res[0])
  65         self.assertTrue("objectClasses" in res[0])
  66         self.assertTrue("attributeTypes" in res[0])
  67
  68     def test_generated_schema_is_operational(self):
  69         """Testing we don't get the generated schema via LDAP by default"""
  70         res = self.ldb.search("cn=aggregate,"+self.schema_dn, scope=SCOPE_BASE,
  71                 attrs=["*"])
  72         self.assertEquals(len(res), 1)
  73         self.assertFalse("dITContentRules" in res[0])
  74         self.assertFalse("objectClasses" in res[0])
  75         self.assertFalse("attributeTypes" in res[0])
  76
  77     def test_schemaUpdateNow(self):
  78         """Testing schemaUpdateNow"""
  79         attr_name = "test-Attr" + time.strftime("%s", time.gmtime())
  80         attr_ldap_display_name = attr_name.replace("-", "")
  81
  82         ldif = """
  83 dn: CN=%s,%s""" % (attr_name, self.schema_dn) + """
  84 objectClass: top
  85 objectClass: attributeSchema
  86 adminDescription: """ + attr_name + """
  87 adminDisplayName: """ + attr_name + """
  88 cn: """ + attr_name + """
  89 attributeId: 1.2.840.""" + str(random.randint(1,100000)) + """.1.5.9940
  90 attributeSyntax: 2.5.5.12
  91 omSyntax: 64
  92 instanceType: 4
  93 isSingleValued: TRUE
  94 systemOnly: FALSE
  95 """
  96         self.ldb.add_ldif(ldif)
  97
  98         # Search for created attribute
  99         res = []
 100         res = self.ldb.search("cn=%s,%s" % (attr_name, self.schema_dn), scope=SCOPE_BASE, attrs=["*"])
 101         self.assertEquals(len(res), 1)
 102         self.assertEquals(res[0]["lDAPDisplayName"][0], attr_ldap_display_name)
 103         self.assertTrue("schemaIDGUID" in res[0])
 104
 105         class_name = "test-Class" + time.strftime("%s", time.gmtime())
 106         class_ldap_display_name = class_name.replace("-", "")
 107
 108         # First try to create a class with a wrong "defaultObjectCategory"
 109         ldif = """
 110 dn: CN=%s,%s""" % (class_name, self.schema_dn) + """
 111 objectClass: top
 112 objectClass: classSchema
 113 defaultObjectCategory: CN=_
 114 adminDescription: """ + class_name + """
 115 adminDisplayName: """ + class_name + """
 116 cn: """ + class_name + """
 117 governsId: 1.2.840.""" + str(random.randint(1,100000)) + """.1.5.9939
 118 instanceType: 4
 119 objectClassCategory: 1
 120 subClassOf: organizationalPerson
 121 systemFlags: 16
 122 rDNAttID: cn
 123 systemMustContain: cn
 124 systemMustContain: """ + attr_ldap_display_name + """
 125 systemOnly: FALSE
 126 """
 127         try:
 128                  self.ldb.add_ldif(ldif)
 129                  self.fail()
 130         except LdbError, (num, _):
 131                  self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 132
 133         ldif = """
 134 dn: CN=%s,%s""" % (class_name, self.schema_dn) + """
 135 objectClass: top
 136 objectClass: classSchema
 137 adminDescription: """ + class_name + """
 138 adminDisplayName: """ + class_name + """
 139 cn: """ + class_name + """
 140 governsId: 1.2.840.""" + str(random.randint(1,100000)) + """.1.5.9939
 141 instanceType: 4
 142 objectClassCategory: 1
 143 subClassOf: organizationalPerson
 144 systemFlags: 16
 145 rDNAttID: cn
 146 systemMustContain: cn
 147 systemMustContain: """ + attr_ldap_display_name + """
 148 systemOnly: FALSE
 149 """
 150         self.ldb.add_ldif(ldif)
 151
 152         # Search for created objectclass
 153         res = []
 154         res = self.ldb.search("cn=%s,%s" % (class_name, self.schema_dn), scope=SCOPE_BASE, attrs=["*"])
 155         self.assertEquals(len(res), 1)
 156         self.assertEquals(res[0]["lDAPDisplayName"][0], class_ldap_display_name)
 157         self.assertEquals(res[0]["defaultObjectCategory"][0], res[0]["distinguishedName"][0])
 158         self.assertTrue("schemaIDGUID" in res[0])
 159
 160         ldif = """
 161 dn:
 162 changetype: modify
 163 add: schemaUpdateNow
 164 schemaUpdateNow: 1
 165 """
 166         self.ldb.modify_ldif(ldif)
 167
 168         object_name = "obj" + time.strftime("%s", time.gmtime())
 169
 170         ldif = """
 171 dn: CN=%s,CN=Users,%s"""% (object_name, self.base_dn) + """
 172 objectClass: organizationalPerson
 173 objectClass: person
 174 objectClass: """ + class_ldap_display_name + """
 175 objectClass: top
 176 cn: """ + object_name + """
 177 instanceType: 4
 178 objectCategory: CN=%s,%s"""% (class_name, self.schema_dn) + """
 179 distinguishedName: CN=%s,CN=Users,%s"""% (object_name, self.base_dn) + """
 180 name: """ + object_name + """
 181 """ + attr_ldap_display_name + """: test
 182 """
 183         self.ldb.add_ldif(ldif)
 184
 185         # Search for created object
 186         res = []
 187         res = self.ldb.search("cn=%s,cn=Users,%s" % (object_name, self.base_dn), scope=SCOPE_BASE, attrs=["*"])
 188         self.assertEquals(len(res), 1)
 189         # Delete the object
 190         delete_force(self.ldb, "cn=%s,cn=Users,%s" % (object_name, self.base_dn))
 191
 192     def test_subClassOf(self):
 193         """ Testing usage of custom child schamaClass
 194         """
 195
 196         class_name = "my-Class" + time.strftime("%s", time.gmtime())
 197         class_ldap_display_name = class_name.replace("-", "")
 198
 199         ldif = """
 200 dn: CN=%s,%s""" % (class_name, self.schema_dn) + """
 201 objectClass: top
 202 objectClass: classSchema
 203 adminDescription: """ + class_name + """
 204 adminDisplayName: """ + class_name + """
 205 cn: """ + class_name + """
 206 governsId: 1.2.840.""" + str(random.randint(1,100000)) + """.1.5.9939
 207 instanceType: 4
 208 objectClassCategory: 1
 209 subClassOf: organizationalUnit
 210 systemFlags: 16
 211 systemOnly: FALSE
 212 """
 213         self.ldb.add_ldif(ldif)
 214
 215         # Search for created objectclass
 216         res = []
 217         res = self.ldb.search("cn=%s,%s" % (class_name, self.schema_dn), scope=SCOPE_BASE, attrs=["*"])
 218         self.assertEquals(len(res), 1)
 219         self.assertEquals(res[0]["lDAPDisplayName"][0], class_ldap_display_name)
 220         self.assertEquals(res[0]["defaultObjectCategory"][0], res[0]["distinguishedName"][0])
 221         self.assertTrue("schemaIDGUID" in res[0])
 222
 223         ldif = """
 224 dn:
 225 changetype: modify
 226 add: schemaUpdateNow
 227 schemaUpdateNow: 1
 228 """
 229         self.ldb.modify_ldif(ldif)
 230
 231         object_name = "org" + time.strftime("%s", time.gmtime())
 232
 233         ldif = """
 234 dn: OU=%s,%s""" % (object_name, self.base_dn) + """
 235 objectClass: """ + class_ldap_display_name + """
 236 ou: """ + object_name + """
 237 instanceType: 4
 238 """
 239         self.ldb.add_ldif(ldif)
 240
 241         # Search for created object
 242         res = []
 243         res = self.ldb.search("ou=%s,%s" % (object_name, self.base_dn), scope=SCOPE_BASE, attrs=["*"])
 244         self.assertEquals(len(res), 1)
 245         # Delete the object
 246         delete_force(self.ldb, "ou=%s,%s" % (object_name, self.base_dn))
 247
 248
 249 class SchemaTests_msDS_IntId(samba.tests.TestCase):
 250
 251     def setUp(self):
 252         super(SchemaTests_msDS_IntId, self).setUp()
 253         self.ldb = ldb
 254         res = ldb.search(base="", expression="", scope=SCOPE_BASE, attrs=["*"])
 255         self.assertEquals(len(res), 1)
 256         self.schema_dn = res[0]["schemaNamingContext"][0]
 257         self.base_dn = res[0]["defaultNamingContext"][0]
 258         self.forest_level = int(res[0]["forestFunctionality"][0])
 259
 260     def _ldap_schemaUpdateNow(self):
 261         ldif = """
 262 dn:
 263 changetype: modify
 264 add: schemaUpdateNow
 265 schemaUpdateNow: 1
 266 """
 267         self.ldb.modify_ldif(ldif)
 268
 269     def _make_obj_names(self, prefix):
 270         class_name = prefix + time.strftime("%s", time.gmtime())
 271         class_ldap_name = class_name.replace("-", "")
 272         class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
 273         return (class_name, class_ldap_name, class_dn)
 274
 275     def _is_schema_base_object(self, ldb_msg):
 276         """Test systemFlags for SYSTEM_FLAG_SCHEMA_BASE_OBJECT (16)"""
 277         systemFlags = 0
 278         if "systemFlags" in ldb_msg:
 279             systemFlags = int(ldb_msg["systemFlags"][0])
 280         return (systemFlags & 16) != 0
 281
 282     def _make_attr_ldif(self, attr_name, attr_dn):
 283         ldif = """
 284 dn: """ + attr_dn + """
 285 objectClass: top
 286 objectClass: attributeSchema
 287 adminDescription: """ + attr_name + """
 288 adminDisplayName: """ + attr_name + """
 289 cn: """ + attr_name + """
 290 attributeId: 1.2.840.""" + str(random.randint(1,100000)) + """.1.5.9940
 291 attributeSyntax: 2.5.5.12
 292 omSyntax: 64
 293 instanceType: 4
 294 isSingleValued: TRUE
 295 systemOnly: FALSE
 296 """
 297         return ldif
 298
 299     def test_msDS_IntId_on_attr(self):
 300         """Testing msDs-IntId creation for Attributes.
 301         See MS-ADTS - 3.1.1.Attributes
 302
 303         This test should verify that:
 304         - Creating attribute with 'msDS-IntId' fails with ERR_UNWILLING_TO_PERFORM
 305         - Adding 'msDS-IntId' on existing attribute fails with ERR_CONSTRAINT_VIOLATION
 306         - Creating attribute with 'msDS-IntId' set and FLAG_SCHEMA_BASE_OBJECT flag
 307           set fails with ERR_UNWILLING_TO_PERFORM
 308         - Attributes created with FLAG_SCHEMA_BASE_OBJECT not set have
 309           'msDS-IntId' attribute added internally
 310         """
 311
 312         # 1. Create attribute without systemFlags
 313         # msDS-IntId should be created if forest functional
 314         # level is >= DS_DOMAIN_FUNCTION_2003
 315         # and missing otherwise
 316         (attr_name, attr_ldap_name, attr_dn) = self._make_obj_names("msDS-IntId-Attr-1-")
 317         ldif = self._make_attr_ldif(attr_name, attr_dn)
 318
 319         # try to add msDS-IntId during Attribute creation
 320         ldif_fail = ldif + "msDS-IntId: -1993108831\n"
 321         try:
 322             self.ldb.add_ldif(ldif_fail)
 323             self.fail("Adding attribute with preset msDS-IntId should fail")
 324         except LdbError, (num, _):
 325             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 326
 327         # add the new attribute and update schema
 328         self.ldb.add_ldif(ldif)
 329         self._ldap_schemaUpdateNow()
 330
 331         # Search for created attribute
 332         res = []
 333         res = self.ldb.search(attr_dn, scope=SCOPE_BASE, attrs=["*"])
 334         self.assertEquals(len(res), 1)
 335         self.assertEquals(res[0]["lDAPDisplayName"][0], attr_ldap_name)
 336         if self.forest_level >= DS_DOMAIN_FUNCTION_2003:
 337             if self._is_schema_base_object(res[0]):
 338                 self.assertTrue("msDS-IntId" not in res[0])
 339             else:
 340                 self.assertTrue("msDS-IntId" in res[0])
 341         else:
 342             self.assertTrue("msDS-IntId" not in res[0])
 343
 344         msg = Message()
 345         msg.dn = Dn(self.ldb, attr_dn)
 346         msg["msDS-IntId"] = MessageElement("-1993108831", FLAG_MOD_REPLACE, "msDS-IntId")
 347         try:
 348             self.ldb.modify(msg)
 349             self.fail("Modifying msDS-IntId should return error")
 350         except LdbError, (num, _):
 351             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 352
 353         # 2. Create attribute with systemFlags = FLAG_SCHEMA_BASE_OBJECT
 354         # msDS-IntId should be created if forest functional
 355         # level is >= DS_DOMAIN_FUNCTION_2003
 356         # and missing otherwise
 357         (attr_name, attr_ldap_name, attr_dn) = self._make_obj_names("msDS-IntId-Attr-2-")
 358         ldif = self._make_attr_ldif(attr_name, attr_dn)
 359         ldif += "systemFlags: 16\n"
 360
 361         # try to add msDS-IntId during Attribute creation
 362         ldif_fail = ldif + "msDS-IntId: -1993108831\n"
 363         try:
 364             self.ldb.add_ldif(ldif_fail)
 365             self.fail("Adding attribute with preset msDS-IntId should fail")
 366         except LdbError, (num, _):
 367             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 368
 369         # add the new attribute and update schema
 370         self.ldb.add_ldif(ldif)
 371         self._ldap_schemaUpdateNow()
 372
 373         # Search for created attribute
 374         res = []
 375         res = self.ldb.search(attr_dn, scope=SCOPE_BASE, attrs=["*"])
 376         self.assertEquals(len(res), 1)
 377         self.assertEquals(res[0]["lDAPDisplayName"][0], attr_ldap_name)
 378         if self.forest_level >= DS_DOMAIN_FUNCTION_2003:
 379             if self._is_schema_base_object(res[0]):
 380                 self.assertTrue("msDS-IntId" not in res[0])
 381             else:
 382                 self.assertTrue("msDS-IntId" in res[0])
 383         else:
 384             self.assertTrue("msDS-IntId" not in res[0])
 385
 386         msg = Message()
 387         msg.dn = Dn(self.ldb, attr_dn)
 388         msg["msDS-IntId"] = MessageElement("-1993108831", FLAG_MOD_REPLACE, "msDS-IntId")
 389         try:
 390             self.ldb.modify(msg)
 391             self.fail("Modifying msDS-IntId should return error")
 392         except LdbError, (num, _):
 393             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 394
 395
 396     def _make_class_ldif(self, class_dn, class_name):
 397         ldif = """
 398 dn: """ + class_dn + """
 399 objectClass: top
 400 objectClass: classSchema
 401 adminDescription: """ + class_name + """
 402 adminDisplayName: """ + class_name + """
 403 cn: """ + class_name + """
 404 governsId: 1.2.840.""" + str(random.randint(1,100000)) + """.1.5.9939
 405 instanceType: 4
 406 objectClassCategory: 1
 407 subClassOf: organizationalPerson
 408 rDNAttID: cn
 409 systemMustContain: cn
 410 systemOnly: FALSE
 411 """
 412         return ldif
 413
 414     def test_msDS_IntId_on_class(self):
 415         """Testing msDs-IntId creation for Class
 416            Reference: MS-ADTS - 3.1.1.2.4.8 Class classSchema"""
 417
 418         # 1. Create Class without systemFlags
 419         # msDS-IntId should be created if forest functional
 420         # level is >= DS_DOMAIN_FUNCTION_2003
 421         # and missing otherwise
 422         (class_name, class_ldap_name, class_dn) = self._make_obj_names("msDS-IntId-Class-1-")
 423         ldif = self._make_class_ldif(class_dn, class_name)
 424
 425         # try to add msDS-IntId during Class creation
 426         ldif_add = ldif + "msDS-IntId: -1993108831\n"
 427         self.ldb.add_ldif(ldif_add)
 428         self._ldap_schemaUpdateNow()
 429
 430         res = self.ldb.search(class_dn, scope=SCOPE_BASE, attrs=["*"])
 431         self.assertEquals(len(res), 1)
 432         self.assertEquals(res[0]["msDS-IntId"][0], "-1993108831")
 433
 434         # add a new Class and update schema
 435         (class_name, class_ldap_name, class_dn) = self._make_obj_names("msDS-IntId-Class-2-")
 436         ldif = self._make_class_ldif(class_dn, class_name)
 437
 438         self.ldb.add_ldif(ldif)
 439         self._ldap_schemaUpdateNow()
 440
 441         # Search for created Class
 442         res = self.ldb.search(class_dn, scope=SCOPE_BASE, attrs=["*"])
 443         self.assertEquals(len(res), 1)
 444         self.assertFalse("msDS-IntId" in res[0])
 445
 446         msg = Message()
 447         msg.dn = Dn(self.ldb, class_dn)
 448         msg["msDS-IntId"] = MessageElement("-1993108831", FLAG_MOD_REPLACE, "msDS-IntId")
 449         try:
 450             self.ldb.modify(msg)
 451             self.fail("Modifying msDS-IntId should return error")
 452         except LdbError, (num, _):
 453             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 454
 455         # 2. Create Class with systemFlags = FLAG_SCHEMA_BASE_OBJECT
 456         # msDS-IntId should be created if forest functional
 457         # level is >= DS_DOMAIN_FUNCTION_2003
 458         # and missing otherwise
 459         (class_name, class_ldap_name, class_dn) = self._make_obj_names("msDS-IntId-Class-3-")
 460         ldif = self._make_class_ldif(class_dn, class_name)
 461         ldif += "systemFlags: 16\n"
 462
 463         # try to add msDS-IntId during Class creation
 464         ldif_add = ldif + "msDS-IntId: -1993108831\n"
 465         self.ldb.add_ldif(ldif_add)
 466
 467         res = self.ldb.search(class_dn, scope=SCOPE_BASE, attrs=["*"])
 468         self.assertEquals(len(res), 1)
 469         self.assertEquals(res[0]["msDS-IntId"][0], "-1993108831")
 470
 471         # add the new Class and update schema
 472         (class_name, class_ldap_name, class_dn) = self._make_obj_names("msDS-IntId-Class-4-")
 473         ldif = self._make_class_ldif(class_dn, class_name)
 474         ldif += "systemFlags: 16\n"
 475
 476         self.ldb.add_ldif(ldif)
 477         self._ldap_schemaUpdateNow()
 478
 479         # Search for created Class
 480         res = self.ldb.search(class_dn, scope=SCOPE_BASE, attrs=["*"])
 481         self.assertEquals(len(res), 1)
 482         self.assertFalse("msDS-IntId" in res[0])
 483
 484         msg = Message()
 485         msg.dn = Dn(self.ldb, class_dn)
 486         msg["msDS-IntId"] = MessageElement("-1993108831", FLAG_MOD_REPLACE, "msDS-IntId")
 487         try:
 488             self.ldb.modify(msg)
 489             self.fail("Modifying msDS-IntId should return error")
 490         except LdbError, (num, _):
 491             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 492         res = self.ldb.search(class_dn, scope=SCOPE_BASE, attrs=["*"])
 493         self.assertEquals(len(res), 1)
 494         self.assertFalse("msDS-IntId" in res[0])
 495
 496
 497     def test_verify_msDS_IntId(self):
 498         """Verify msDS-IntId exists only on attributes without FLAG_SCHEMA_BASE_OBJECT flag set"""
 499         count = 0
 500         res = self.ldb.search(self.schema_dn, scope=SCOPE_ONELEVEL,
 501                               expression="objectClass=attributeSchema",
 502                               attrs=["systemFlags", "msDS-IntId", "attributeID", "cn"])
 503         self.assertTrue(len(res) > 1)
 504         for ldb_msg in res:
 505             if self.forest_level >= DS_DOMAIN_FUNCTION_2003:
 506                 if self._is_schema_base_object(ldb_msg):
 507                     self.assertTrue("msDS-IntId" not in ldb_msg)
 508                 else:
 509                     # don't assert here as there are plenty of
 510                     # attributes under w2k8 that are not part of
 511                     # Base Schema (SYSTEM_FLAG_SCHEMA_BASE_OBJECT flag not set)
 512                     # has not msDS-IntId attribute set
 513                     #self.assertTrue("msDS-IntId" in ldb_msg, "msDS-IntId expected on: %s" % ldb_msg.dn)
 514                     if "msDS-IntId" not in ldb_msg:
 515                         count = count + 1
 516                         print "%3d warning: msDS-IntId expected on: %-30s %s" % (count, ldb_msg["attributeID"], ldb_msg["cn"])
 517             else:
 518                 self.assertTrue("msDS-IntId" not in ldb_msg)
 519
 520
 521 class SchemaTests_msDS_isRODC(samba.tests.TestCase):
 522
 523     def setUp(self):
 524         super(SchemaTests_msDS_isRODC, self).setUp()
 525         self.ldb = ldb
 526         res = ldb.search(base="", expression="", scope=SCOPE_BASE, attrs=["*"])
 527         self.assertEquals(len(res), 1)
 528         self.base_dn = res[0]["defaultNamingContext"][0]
 529
 530     def test_objectClass_ntdsdsa(self):
 531         res = self.ldb.search(self.base_dn, expression="objectClass=nTDSDSA",
 532                               attrs=["msDS-isRODC"], controls=["search_options:1:2"])
 533         for ldb_msg in res:
 534             self.assertTrue("msDS-isRODC" in ldb_msg)
 535
 536     def test_objectClass_server(self):
 537         res = self.ldb.search(self.base_dn, expression="objectClass=server",
 538                               attrs=["msDS-isRODC"], controls=["search_options:1:2"])
 539         for ldb_msg in res:
 540             ntds_search_dn = "CN=NTDS Settings,%s" % ldb_msg['dn']
 541             try:
 542                 res_check = self.ldb.search(ntds_search_dn, attrs=["objectCategory"])
 543             except LdbError, (num, _):
 544                 self.assertEquals(num, ERR_NO_SUCH_OBJECT)
 545                 print("Server entry %s doesn't have a NTDS settings object" % res[0]['dn'])
 546             else:
 547                 self.assertTrue("objectCategory" in res_check[0])
 548                 self.assertTrue("msDS-isRODC" in ldb_msg)
 549
 550     def test_objectClass_computer(self):
 551         res = self.ldb.search(self.base_dn, expression="objectClass=computer",
 552                               attrs=["serverReferenceBL","msDS-isRODC"], controls=["search_options:1:2"])
 553         for ldb_msg in res:
 554             if "serverReferenceBL" not in ldb_msg:
 555                 print("Computer entry %s doesn't have a serverReferenceBL attribute" % ldb_msg['dn'])
 556             else:
 557                 self.assertTrue("msDS-isRODC" in ldb_msg)
 558
 559 if not "://" in host:
 560     if os.path.isfile(host):
 561         host = "tdb://%s" % host
 562     else:
 563         host = "ldap://%s" % host
 564
 565 ldb_options = []
 566 if host.startswith("ldap://"):
 567     # user 'paged_search' module when connecting remotely
 568     ldb_options = ["modules:paged_searches"]
 569
 570 ldb = SamDB(host, credentials=creds, session_info=system_session(lp), lp=lp, options=ldb_options)
 571
 572 runner = SubunitTestRunner()
 573 rc = 0
 574 if not runner.run(unittest.makeSuite(SchemaTests)).wasSuccessful():
 575     rc = 1
 576 if not runner.run(unittest.makeSuite(SchemaTests_msDS_IntId)).wasSuccessful():
 577     rc = 1
 578 if not runner.run(unittest.makeSuite(SchemaTests_msDS_isRODC)).wasSuccessful():
 579     rc = 1
 580
 581 sys.exit(rc)