source4/dsdb/tests/python/ldap.py

   1 #!/usr/bin/env python
   2 # -*- coding: utf-8 -*-
   3 # This is a port of the original in testprogs/ejs/ldap.js
   4
   5 import optparse
   6 import sys
   7 import time
   8 import base64
   9 import os
  10
  11 sys.path.append("bin/python")
  12 import samba
  13 samba.ensure_external_module("subunit", "subunit/python")
  14 samba.ensure_external_module("testtools", "testtools")
  15
  16 import samba.getopt as options
  17
  18 from samba.auth import system_session
  19 from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError
  20 from ldb import ERR_NO_SUCH_OBJECT, ERR_ATTRIBUTE_OR_VALUE_EXISTS
  21 from ldb import ERR_ENTRY_ALREADY_EXISTS, ERR_UNWILLING_TO_PERFORM
  22 from ldb import ERR_NOT_ALLOWED_ON_NON_LEAF, ERR_OTHER, ERR_INVALID_DN_SYNTAX
  23 from ldb import ERR_NO_SUCH_ATTRIBUTE
  24 from ldb import ERR_OBJECT_CLASS_VIOLATION, ERR_NOT_ALLOWED_ON_RDN
  25 from ldb import ERR_NAMING_VIOLATION, ERR_CONSTRAINT_VIOLATION
  26 from ldb import ERR_UNDEFINED_ATTRIBUTE_TYPE
  27 from ldb import Message, MessageElement, Dn
  28 from ldb import FLAG_MOD_ADD, FLAG_MOD_REPLACE, FLAG_MOD_DELETE
  29 from samba import Ldb
  30 from samba.dsdb import (UF_NORMAL_ACCOUNT, UF_INTERDOMAIN_TRUST_ACCOUNT,
  31     UF_WORKSTATION_TRUST_ACCOUNT, UF_SERVER_TRUST_ACCOUNT,
  32     UF_PARTIAL_SECRETS_ACCOUNT,
  33     UF_PASSWD_NOTREQD, UF_ACCOUNTDISABLE, ATYPE_NORMAL_ACCOUNT,
  34     ATYPE_WORKSTATION_TRUST, SYSTEM_FLAG_DOMAIN_DISALLOW_MOVE,
  35     SYSTEM_FLAG_CONFIG_ALLOW_RENAME, SYSTEM_FLAG_CONFIG_ALLOW_MOVE,
  36     SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE)
  37 from samba.dcerpc.security import (DOMAIN_RID_USERS, DOMAIN_RID_DOMAIN_MEMBERS,
  38     DOMAIN_RID_DCS, DOMAIN_RID_READONLY_DCS)
  39
  40 from subunit.run import SubunitTestRunner
  41 import unittest
  42
  43 from samba.ndr import ndr_pack, ndr_unpack
  44 from samba.dcerpc import security
  45
  46 parser = optparse.OptionParser("ldap.py [options] <host>")
  47 sambaopts = options.SambaOptions(parser)
  48 parser.add_option_group(sambaopts)
  49 parser.add_option_group(options.VersionOptions(parser))
  50 # use command line creds if available
  51 credopts = options.CredentialsOptions(parser)
  52 parser.add_option_group(credopts)
  53 opts, args = parser.parse_args()
  54
  55 if len(args) < 1:
  56     parser.print_usage()
  57     sys.exit(1)
  58
  59 host = args[0]
  60
  61 lp = sambaopts.get_loadparm()
  62 creds = credopts.get_credentials(lp)
  63
  64 class BasicTests(unittest.TestCase):
  65
  66     def delete_force(self, ldb, dn):
  67         try:
  68             ldb.delete(dn)
  69         except LdbError, (num, _):
  70             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
  71
  72     def find_basedn(self, ldb):
  73         res = ldb.search(base="", expression="", scope=SCOPE_BASE,
  74                          attrs=["defaultNamingContext"])
  75         self.assertEquals(len(res), 1)
  76         return res[0]["defaultNamingContext"][0]
  77
  78     def find_configurationdn(self, ldb):
  79         res = ldb.search(base="", expression="", scope=SCOPE_BASE, attrs=["configurationNamingContext"])
  80         self.assertEquals(len(res), 1)
  81         return res[0]["configurationNamingContext"][0]
  82
  83     def find_schemadn(self, ldb):
  84         res = ldb.search(base="", expression="", scope=SCOPE_BASE, attrs=["schemaNamingContext"])
  85         self.assertEquals(len(res), 1)
  86         return res[0]["schemaNamingContext"][0]
  87
  88     def find_domain_sid(self):
  89         res = self.ldb.search(base=self.base_dn, expression="(objectClass=*)", scope=SCOPE_BASE)
  90         return ndr_unpack( security.dom_sid,res[0]["objectSid"][0])
  91
  92     def setUp(self):
  93         super(BasicTests, self).setUp()
  94         self.ldb = ldb
  95         self.gc_ldb = gc_ldb
  96         self.base_dn = self.find_basedn(ldb)
  97         self.configuration_dn = self.find_configurationdn(ldb)
  98         self.schema_dn = self.find_schemadn(ldb)
  99         self.domain_sid = self.find_domain_sid()
 100
 101         print "baseDN: %s\n" % self.base_dn
 102
 103         self.delete_force(self.ldb, "cn=posixuser,cn=users," + self.base_dn)
 104         self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 105         self.delete_force(self.ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
 106         self.delete_force(self.ldb, "cn=ldaptestuser3,cn=users," + self.base_dn)
 107         self.delete_force(self.ldb, "cn=ldaptestuser4,cn=ldaptestcontainer," + self.base_dn)
 108         self.delete_force(self.ldb, "cn=ldaptestuser4,cn=ldaptestcontainer2," + self.base_dn)
 109         self.delete_force(self.ldb, "cn=ldaptestuser5,cn=users," + self.base_dn)
 110         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 111         self.delete_force(self.ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 112         self.delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
 113         self.delete_force(self.ldb, "cn=ldaptest2computer,cn=computers," + self.base_dn)
 114         self.delete_force(self.ldb, "cn=ldaptestcomputer3,cn=computers," + self.base_dn)
 115         self.delete_force(self.ldb, "cn=ldaptestutf8user èùéìòà,cn=users," + self.base_dn)
 116         self.delete_force(self.ldb, "cn=ldaptestutf8user2  èùéìòà,cn=users," + self.base_dn)
 117         self.delete_force(self.ldb, "cn=ldaptestcontainer," + self.base_dn)
 118         self.delete_force(self.ldb, "cn=ldaptestcontainer2," + self.base_dn)
 119         self.delete_force(self.ldb, "cn=parentguidtest,cn=users," + self.base_dn)
 120         self.delete_force(self.ldb, "cn=parentguidtest,cn=testotherusers," + self.base_dn)
 121         self.delete_force(self.ldb, "cn=testotherusers," + self.base_dn)
 122         self.delete_force(self.ldb, "cn=ldaptestobject," + self.base_dn)
 123         self.delete_force(self.ldb, "description=xyz,cn=users," + self.base_dn)
 124         self.delete_force(self.ldb, "ou=testou,cn=users," + self.base_dn)
 125         self.delete_force(self.ldb, "cn=testsecret,cn=system," + self.base_dn)
 126
 127     def test_objectclasses(self):
 128         """Test objectClass behaviour"""
 129         print "Test objectClass behaviour"""
 130
 131         # We cannot create LSA-specific objects (oc "secret" or "trustedDomain")
 132         try:
 133             self.ldb.add({
 134                 "dn": "cn=testsecret,cn=system," + self.base_dn,
 135                 "objectClass": "secret" })
 136             self.fail()
 137         except LdbError, (num, _):
 138             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 139
 140         # Invalid objectclass specified
 141         try:
 142             self.ldb.add({
 143                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 144                 "objectClass": "X" })
 145             self.fail()
 146         except LdbError, (num, _):
 147             self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
 148
 149         # Invalid objectCategory specified
 150         try:
 151             self.ldb.add({
 152                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 153                 "objectClass": "person",
 154                 "objectCategory": self.base_dn })
 155             self.fail()
 156         except LdbError, (num, _):
 157             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 158
 159         # Multi-valued "systemFlags"
 160         try:
 161             self.ldb.add({
 162                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 163                 "objectClass": "person",
 164                 "systemFlags": ["0", str(SYSTEM_FLAG_DOMAIN_DISALLOW_MOVE)] })
 165             self.fail()
 166         except LdbError, (num, _):
 167             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 168
 169         # We cannot instanciate from an abstract objectclass
 170         try:
 171             self.ldb.add({
 172                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 173                 "objectClass": "connectionPoint" })
 174             self.fail()
 175         except LdbError, (num, _):
 176             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 177
 178         # Test allowed system flags
 179         self.ldb.add({
 180              "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 181              "objectClass": "person",
 182              "systemFlags": str(~(SYSTEM_FLAG_CONFIG_ALLOW_RENAME | SYSTEM_FLAG_CONFIG_ALLOW_MOVE | SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE)) })
 183
 184         res = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 185                          scope=SCOPE_BASE, attrs=["systemFlags"])
 186         self.assertTrue(len(res) == 1)
 187         self.assertEquals(res[0]["systemFlags"][0], "0")
 188
 189         self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 190
 191         self.ldb.add({
 192              "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 193              "objectClass": "person" })
 194
 195         # We can remove derivation classes of the structural objectclass
 196         # but they're going to be readded afterwards
 197         m = Message()
 198         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 199         m["objectClass"] = MessageElement("top", FLAG_MOD_DELETE,
 200           "objectClass")
 201         ldb.modify(m)
 202
 203         res = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 204                          scope=SCOPE_BASE, attrs=["objectClass"])
 205         self.assertTrue(len(res) == 1)
 206         self.assertTrue("top" in res[0]["objectClass"])
 207
 208         # The top-most structural class cannot be deleted since there are
 209         # attributes of it in use
 210         m = Message()
 211         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 212         m["objectClass"] = MessageElement("person", FLAG_MOD_DELETE,
 213           "objectClass")
 214         try:
 215             ldb.modify(m)
 216             self.fail()
 217         except LdbError, (num, _):
 218             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 219
 220         # We cannot delete classes which weren't specified
 221         m = Message()
 222         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 223         m["objectClass"] = MessageElement("computer", FLAG_MOD_DELETE,
 224           "objectClass")
 225         try:
 226             ldb.modify(m)
 227             self.fail()
 228         except LdbError, (num, _):
 229             self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
 230
 231         # An invalid class cannot be added
 232         m = Message()
 233         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 234         m["objectClass"] = MessageElement("X", FLAG_MOD_ADD,
 235           "objectClass")
 236         try:
 237             ldb.modify(m)
 238             self.fail()
 239         except LdbError, (num, _):
 240             self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
 241
 242         # The top-most structural class cannot be changed by adding another
 243         # structural one
 244         m = Message()
 245         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 246         m["objectClass"] = MessageElement("user", FLAG_MOD_ADD,
 247           "objectClass")
 248         try:
 249             ldb.modify(m)
 250             self.fail()
 251         except LdbError, (num, _):
 252             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 253
 254         # An already specified objectclass cannot be added another time
 255         m = Message()
 256         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 257         m["objectClass"] = MessageElement("person", FLAG_MOD_ADD,
 258           "objectClass")
 259         try:
 260             ldb.modify(m)
 261             self.fail()
 262         except LdbError, (num, _):
 263             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 264
 265         # Auxiliary classes can always be added
 266         m = Message()
 267         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 268         m["objectClass"] = MessageElement("bootableDevice", FLAG_MOD_ADD,
 269           "objectClass")
 270         ldb.modify(m)
 271
 272         # It's only possible to replace with the same objectclass combination.
 273         # So the replace action on "objectClass" attributes is really useless.
 274         m = Message()
 275         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 276         m["objectClass"] = MessageElement(["top", "person", "bootableDevice"],
 277           FLAG_MOD_REPLACE, "objectClass")
 278         ldb.modify(m)
 279
 280         m = Message()
 281         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 282         m["objectClass"] = MessageElement(["person", "bootableDevice"],
 283           FLAG_MOD_REPLACE, "objectClass")
 284         ldb.modify(m)
 285
 286         m = Message()
 287         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 288         m["objectClass"] = MessageElement(["top", "person", "bootableDevice",
 289           "connectionPoint"], FLAG_MOD_REPLACE, "objectClass")
 290         try:
 291             ldb.modify(m)
 292             self.fail()
 293         except LdbError, (num, _):
 294             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 295
 296         m = Message()
 297         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 298         m["objectClass"] = MessageElement(["top", "computer"], FLAG_MOD_REPLACE,
 299           "objectClass")
 300         try:
 301             ldb.modify(m)
 302             self.fail()
 303         except LdbError, (num, _):
 304             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 305
 306         # Classes can be removed unless attributes of them are used.
 307         m = Message()
 308         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 309         m["objectClass"] = MessageElement("bootableDevice", FLAG_MOD_DELETE,
 310           "objectClass")
 311         ldb.modify(m)
 312
 313         res = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 314                          scope=SCOPE_BASE, attrs=["objectClass"])
 315         self.assertTrue(len(res) == 1)
 316         self.assertFalse("bootableDevice" in res[0]["objectClass"])
 317
 318         m = Message()
 319         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 320         m["objectClass"] = MessageElement("bootableDevice", FLAG_MOD_ADD,
 321           "objectClass")
 322         ldb.modify(m)
 323
 324         # Add an attribute specific to the "bootableDevice" class
 325         m = Message()
 326         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 327         m["bootParameter"] = MessageElement("test", FLAG_MOD_ADD,
 328           "bootParameter")
 329         ldb.modify(m)
 330
 331         # Classes can be removed unless attributes of them are used. Now there
 332         # exist such attributes on the entry.
 333         m = Message()
 334         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 335         m["objectClass"] = MessageElement("bootableDevice", FLAG_MOD_DELETE,
 336           "objectClass")
 337         try:
 338             ldb.modify(m)
 339             self.fail()
 340         except LdbError, (num, _):
 341             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 342
 343         # Remove the previously specified attribute
 344         m = Message()
 345         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 346         m["bootParameter"] = MessageElement("test", FLAG_MOD_DELETE,
 347           "bootParameter")
 348         ldb.modify(m)
 349
 350         # Classes can be removed unless attributes of them are used.
 351         m = Message()
 352         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 353         m["objectClass"] = MessageElement("bootableDevice", FLAG_MOD_DELETE,
 354           "objectClass")
 355         ldb.modify(m)
 356
 357         self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 358
 359     def test_system_only(self):
 360         """Test systemOnly objects"""
 361         print "Test systemOnly objects"""
 362
 363         try:
 364             self.ldb.add({
 365                 "dn": "cn=ldaptestobject," + self.base_dn,
 366                 "objectclass": "configuration"})
 367             self.fail()
 368         except LdbError, (num, _):
 369             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 370
 371         try:
 372             self.ldb.add({
 373                 "dn": "cn=testsecret,cn=system," + self.base_dn,
 374                 "objectclass": "secret"})
 375             self.fail()
 376         except LdbError, (num, _):
 377             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 378
 379         self.delete_force(self.ldb, "cn=ldaptestobject," + self.base_dn)
 380         self.delete_force(self.ldb, "cn=testsecret,cn=system," + self.base_dn)
 381
 382         try:
 383             self.ldb.add({
 384                 "dn": "cn=ldaptestcontainer," + self.base_dn,
 385                 "objectclass": "container",
 386                 "isCriticalSystemObject": "TRUE"})
 387             self.fail()
 388         except LdbError, (num, _):
 389             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 390
 391         self.ldb.add({
 392             "dn": "cn=ldaptestcontainer," + self.base_dn,
 393             "objectclass": "container"})
 394
 395         m = Message()
 396         m.dn = Dn(ldb, "cn=ldaptestcontainer," + self.base_dn)
 397         m["isCriticalSystemObject"] = MessageElement("TRUE", FLAG_MOD_REPLACE,
 398           "isCriticalSystemObject")
 399         try:
 400             ldb.modify(m)
 401             self.fail()
 402         except LdbError, (num, _):
 403             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 404
 405         self.delete_force(self.ldb, "cn=ldaptestcontainer," + self.base_dn)
 406
 407         # Proof if DC SAM object has "isCriticalSystemObject" set
 408         res = self.ldb.search("", scope=SCOPE_BASE, attrs=["serverName"])
 409         self.assertTrue(len(res) == 1)
 410         self.assertTrue("serverName" in res[0])
 411         res = self.ldb.search(res[0]["serverName"][0], scope=SCOPE_BASE,
 412                               attrs=["serverReference"])
 413         self.assertTrue(len(res) == 1)
 414         self.assertTrue("serverReference" in res[0])
 415         res = self.ldb.search(res[0]["serverReference"][0], scope=SCOPE_BASE,
 416                               attrs=["isCriticalSystemObject"])
 417         self.assertTrue(len(res) == 1)
 418         self.assertTrue("isCriticalSystemObject" in res[0])
 419         self.assertEquals(res[0]["isCriticalSystemObject"][0], "TRUE")
 420
 421     def test_invalid_parent(self):
 422         """Test adding an object with invalid parent"""
 423         print "Test adding an object with invalid parent"""
 424
 425         try:
 426             self.ldb.add({
 427                 "dn": "cn=ldaptestgroup,cn=thisdoesnotexist123,"
 428                    + self.base_dn,
 429                 "objectclass": "group"})
 430             self.fail()
 431         except LdbError, (num, _):
 432             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
 433
 434         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=thisdoesnotexist123,"
 435           + self.base_dn)
 436
 437         try:
 438             self.ldb.add({
 439                 "dn": "ou=testou,cn=users," + self.base_dn,
 440                 "objectclass": "organizationalUnit"})
 441             self.fail()
 442         except LdbError, (num, _):
 443             self.assertEquals(num, ERR_NAMING_VIOLATION)
 444
 445         self.delete_force(self.ldb, "ou=testou,cn=users," + self.base_dn)
 446
 447     def test_invalid_attribute(self):
 448         """Test invalid attributes on schema/objectclasses"""
 449         print "Test invalid attributes on schema/objectclasses"""
 450
 451         # attributes not in schema test
 452
 453         # add operation
 454
 455         try:
 456             self.ldb.add({
 457                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 458                 "objectclass": "group",
 459                 "thisdoesnotexist": "x"})
 460             self.fail()
 461         except LdbError, (num, _):
 462             self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
 463
 464         self.ldb.add({
 465              "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 466              "objectclass": "group"})
 467
 468         # modify operation
 469
 470         m = Message()
 471         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 472         m["thisdoesnotexist"] = MessageElement("x", FLAG_MOD_REPLACE,
 473           "thisdoesnotexist")
 474         try:
 475             ldb.modify(m)
 476             self.fail()
 477         except LdbError, (num, _):
 478             self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
 479
 480         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 481
 482         # attributes not in objectclasses and mandatory attributes missing test
 483         # Use here a non-SAM entry since it doesn't have special triggers
 484         # associated which have an impact on the error results.
 485
 486         # add operations
 487
 488         # mandatory attribute missing
 489         try:
 490             self.ldb.add({
 491                 "dn": "cn=ldaptestobject," + self.base_dn,
 492                 "objectclass": "ipProtocol"})
 493             self.fail()
 494         except LdbError, (num, _):
 495             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 496
 497         # inadequate but schema-valid attribute specified
 498         try:
 499             self.ldb.add({
 500                 "dn": "cn=ldaptestobject," + self.base_dn,
 501                 "objectclass": "ipProtocol",
 502                 "ipProtocolNumber": "1",
 503                 "uid" : "0"})
 504             self.fail()
 505         except LdbError, (num, _):
 506             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 507
 508         self.ldb.add({
 509             "dn": "cn=ldaptestobject," + self.base_dn,
 510             "objectclass": "ipProtocol",
 511             "ipProtocolNumber": "1"})
 512
 513         # modify operations
 514
 515         # inadequate but schema-valid attribute add trial
 516         m = Message()
 517         m.dn = Dn(ldb, "cn=ldaptestobject," + self.base_dn)
 518         m["uid"] = MessageElement("0", FLAG_MOD_ADD, "uid")
 519         try:
 520             ldb.modify(m)
 521             self.fail()
 522         except LdbError, (num, _):
 523             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 524
 525         # mandatory attribute delete trial
 526         m = Message()
 527         m.dn = Dn(ldb, "cn=ldaptestobject," + self.base_dn)
 528         m["ipProtocolNumber"] = MessageElement([], FLAG_MOD_DELETE,
 529           "ipProtocolNumber")
 530         try:
 531             ldb.modify(m)
 532             self.fail()
 533         except LdbError, (num, _):
 534             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 535
 536         # mandatory attribute delete trial
 537         m = Message()
 538         m.dn = Dn(ldb, "cn=ldaptestobject," + self.base_dn)
 539         m["ipProtocolNumber"] = MessageElement([], FLAG_MOD_REPLACE,
 540           "ipProtocolNumber")
 541         try:
 542             ldb.modify(m)
 543             self.fail()
 544         except LdbError, (num, _):
 545             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 546
 547         self.delete_force(self.ldb, "cn=ldaptestobject," + self.base_dn)
 548
 549     def test_single_valued_attributes(self):
 550         """Test single-valued attributes"""
 551         print "Test single-valued attributes"""
 552
 553         try:
 554             self.ldb.add({
 555                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 556                 "objectclass": "group",
 557                 "sAMAccountName": ["nam1", "nam2"]})
 558             self.fail()
 559         except LdbError, (num, _):
 560             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 561
 562         self.ldb.add({
 563              "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 564              "objectclass": "group"})
 565
 566         m = Message()
 567         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 568         m["sAMAccountName"] = MessageElement(["nam1","nam2"], FLAG_MOD_REPLACE,
 569           "sAMAccountName")
 570         try:
 571             ldb.modify(m)
 572             self.fail()
 573         except LdbError, (num, _):
 574             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 575
 576         m = Message()
 577         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 578         m["sAMAccountName"] = MessageElement("testgroupXX", FLAG_MOD_REPLACE,
 579           "sAMAccountName")
 580         ldb.modify(m)
 581
 582         m = Message()
 583         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 584         m["sAMAccountName"] = MessageElement("testgroupXX2", FLAG_MOD_ADD,
 585           "sAMAccountName")
 586         try:
 587             ldb.modify(m)
 588             self.fail()
 589         except LdbError, (num, _):
 590             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 591
 592         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 593
 594     def test_description_attribute(self):
 595         """Test description attribute"""
 596         print "Test description attribute"""
 597
 598         self.ldb.add({
 599             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 600             "description": "desc2",
 601             "objectclass": "group",
 602             "description": "desc1"})
 603
 604         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 605                          scope=SCOPE_BASE, attrs=["description"])
 606         self.assertTrue(len(res) == 1)
 607         self.assertTrue("description" in res[0])
 608         self.assertTrue(len(res[0]["description"]) == 1)
 609         self.assertEquals(res[0]["description"][0], "desc1")
 610
 611         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 612
 613         self.ldb.add({
 614             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 615             "objectclass": "group",
 616             "description": ["desc1", "desc2"]})
 617
 618         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 619                          scope=SCOPE_BASE, attrs=["description"])
 620         self.assertTrue(len(res) == 1)
 621         self.assertTrue("description" in res[0])
 622         self.assertTrue(len(res[0]["description"]) == 2)
 623         self.assertTrue(res[0]["description"][0] == "desc1" or
 624                         res[0]["description"][1] == "desc1")
 625         self.assertTrue(res[0]["description"][0] == "desc2" or
 626                         res[0]["description"][1] == "desc2")
 627
 628         m = Message()
 629         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 630         m["description"] = MessageElement(["desc1","desc2"], FLAG_MOD_REPLACE,
 631           "description")
 632         try:
 633             ldb.modify(m)
 634             self.fail()
 635         except LdbError, (num, _):
 636             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 637
 638         m = Message()
 639         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 640         m["description"] = MessageElement(["desc1","desc2"], FLAG_MOD_DELETE,
 641           "description")
 642         ldb.modify(m)
 643
 644         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 645
 646         self.ldb.add({
 647             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 648             "objectclass": "group" })
 649
 650         m = Message()
 651         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 652         m["description"] = MessageElement("desc1", FLAG_MOD_REPLACE,
 653           "description")
 654         ldb.modify(m)
 655
 656         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 657                          scope=SCOPE_BASE, attrs=["description"])
 658         self.assertTrue(len(res) == 1)
 659         self.assertTrue("description" in res[0])
 660         self.assertTrue(len(res[0]["description"]) == 1)
 661         self.assertEquals(res[0]["description"][0], "desc1")
 662
 663         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 664
 665         self.ldb.add({
 666             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 667             "objectclass": "group",
 668             "description": ["desc1", "desc2"]})
 669
 670         m = Message()
 671         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 672         m["description"] = MessageElement("desc1", FLAG_MOD_REPLACE,
 673           "description")
 674         ldb.modify(m)
 675
 676         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 677                          scope=SCOPE_BASE, attrs=["description"])
 678         self.assertTrue(len(res) == 1)
 679         self.assertTrue("description" in res[0])
 680         self.assertTrue(len(res[0]["description"]) == 1)
 681         self.assertEquals(res[0]["description"][0], "desc1")
 682
 683         m = Message()
 684         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 685         m["description"] = MessageElement("desc3", FLAG_MOD_ADD,
 686           "description")
 687         try:
 688             ldb.modify(m)
 689             self.fail()
 690         except LdbError, (num, _):
 691             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 692
 693         m = Message()
 694         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 695         m["description"] = MessageElement(["desc1","desc2"], FLAG_MOD_DELETE,
 696           "description")
 697         try:
 698             ldb.modify(m)
 699             self.fail()
 700         except LdbError, (num, _):
 701             self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
 702
 703         m = Message()
 704         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 705         m["description"] = MessageElement("desc1", FLAG_MOD_DELETE,
 706           "description")
 707         ldb.modify(m)
 708         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 709                          scope=SCOPE_BASE, attrs=["description"])
 710         self.assertTrue(len(res) == 1)
 711         self.assertFalse("description" in res[0])
 712
 713         m = Message()
 714         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 715         m["description"] = MessageElement(["desc1","desc2"], FLAG_MOD_REPLACE,
 716           "description")
 717         try:
 718             ldb.modify(m)
 719             self.fail()
 720         except LdbError, (num, _):
 721             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 722
 723         m = Message()
 724         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 725         m["description"] = MessageElement(["desc3", "desc4"], FLAG_MOD_ADD,
 726           "description")
 727         try:
 728             ldb.modify(m)
 729             self.fail()
 730         except LdbError, (num, _):
 731             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 732
 733         m = Message()
 734         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 735         m["description"] = MessageElement("desc1", FLAG_MOD_ADD,
 736           "description")
 737         ldb.modify(m)
 738
 739         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 740                          scope=SCOPE_BASE, attrs=["description"])
 741         self.assertTrue(len(res) == 1)
 742         self.assertTrue("description" in res[0])
 743         self.assertTrue(len(res[0]["description"]) == 1)
 744         self.assertEquals(res[0]["description"][0], "desc1")
 745
 746         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 747
 748     def test_empty_messages(self):
 749         """Test empty messages"""
 750         print "Test empty messages"""
 751
 752         m = Message()
 753         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 754
 755         try:
 756             ldb.add(m)
 757             self.fail()
 758         except LdbError, (num, _):
 759             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 760
 761         try:
 762             ldb.modify(m)
 763             self.fail()
 764         except LdbError, (num, _):
 765             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 766
 767         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 768
 769     def test_empty_attributes(self):
 770         """Test empty attributes"""
 771         print "Test empty attributes"""
 772
 773         m = Message()
 774         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 775         m["objectClass"] = MessageElement("group", FLAG_MOD_ADD, "objectClass")
 776         m["description"] = MessageElement([], FLAG_MOD_ADD, "description")
 777
 778         try:
 779             ldb.add(m)
 780             self.fail()
 781         except LdbError, (num, _):
 782             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 783
 784         self.ldb.add({
 785             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 786             "objectclass": "group"})
 787
 788         m = Message()
 789         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 790         m["description"] = MessageElement([], FLAG_MOD_ADD, "description")
 791
 792         try:
 793             ldb.modify(m)
 794             self.fail()
 795         except LdbError, (num, _):
 796             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 797
 798         m = Message()
 799         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 800         m["description"] = MessageElement([], FLAG_MOD_REPLACE, "description")
 801         ldb.modify(m)
 802
 803         m = Message()
 804         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 805         m["description"] = MessageElement([], FLAG_MOD_DELETE, "description")
 806         try:
 807             ldb.modify(m)
 808             self.fail()
 809         except LdbError, (num, _):
 810             self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
 811
 812         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 813
 814     def test_instanceType(self):
 815         """Tests the 'instanceType' attribute"""
 816         print "Tests the 'instanceType' attribute"""
 817
 818         # The instance type is single-valued
 819         try:
 820             self.ldb.add({
 821                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 822                 "objectclass": "group",
 823                 "instanceType": ["0", "1"]})
 824             self.fail()
 825         except LdbError, (num, _):
 826             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 827
 828         # The head NC flag cannot be set without the write flag
 829         try:
 830             self.ldb.add({
 831                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 832                 "objectclass": "group",
 833                 "instanceType": "1" })
 834             self.fail()
 835         except LdbError, (num, _):
 836             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 837
 838         # We cannot manipulate NCs without the head NC flag
 839         try:
 840             self.ldb.add({
 841                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 842                 "objectclass": "group",
 843                 "instanceType": "32" })
 844             self.fail()
 845         except LdbError, (num, _):
 846             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 847
 848         self.ldb.add({
 849              "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 850              "objectclass": "group"})
 851
 852         m = Message()
 853         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 854         m["instanceType"] = MessageElement("0", FLAG_MOD_REPLACE,
 855           "instanceType")
 856         try:
 857             ldb.modify(m)
 858             self.fail()
 859         except LdbError, (num, _):
 860             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 861
 862         m = Message()
 863         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 864         m["instanceType"] = MessageElement([], FLAG_MOD_REPLACE,
 865           "instanceType")
 866         try:
 867             ldb.modify(m)
 868             self.fail()
 869         except LdbError, (num, _):
 870             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 871
 872         m = Message()
 873         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 874         m["instanceType"] = MessageElement([], FLAG_MOD_DELETE, "instanceType")
 875         try:
 876             ldb.modify(m)
 877             self.fail()
 878         except LdbError, (num, _):
 879             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 880
 881         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 882
 883     def test_distinguished_name(self):
 884         """Tests the 'distinguishedName' attribute"""
 885         print "Tests the 'distinguishedName' attribute"""
 886
 887         # a wrong "distinguishedName" attribute is obviously tolerated
 888         self.ldb.add({
 889               "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 890               "objectclass": "group",
 891               "distinguishedName": "cn=ldaptest,cn=users," + self.base_dn})
 892
 893         # proof if the DN has been set correctly
 894         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 895                          scope=SCOPE_BASE, attrs=["distinguishedName"])
 896         self.assertTrue(len(res) == 1)
 897         self.assertTrue("distinguishedName" in res[0])
 898         self.assertTrue(Dn(ldb, res[0]["distinguishedName"][0])
 899            == Dn(ldb, "cn=ldaptestgroup, cn=users," + self.base_dn))
 900
 901         m = Message()
 902         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 903         m["distinguishedName"] = MessageElement(
 904           "cn=ldaptestuser,cn=users," + self.base_dn, FLAG_MOD_ADD,
 905           "distinguishedName")
 906
 907         try:
 908             ldb.modify(m)
 909             self.fail()
 910         except LdbError, (num, _):
 911             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 912
 913         m = Message()
 914         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 915         m["distinguishedName"] = MessageElement(
 916           "cn=ldaptestuser,cn=users," + self.base_dn, FLAG_MOD_REPLACE,
 917           "distinguishedName")
 918
 919         try:
 920             ldb.modify(m)
 921             self.fail()
 922         except LdbError, (num, _):
 923             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 924
 925         m = Message()
 926         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 927         m["distinguishedName"] = MessageElement(
 928           "cn=ldaptestuser,cn=users," + self.base_dn, FLAG_MOD_DELETE,
 929           "distinguishedName")
 930
 931         try:
 932             ldb.modify(m)
 933             self.fail()
 934         except LdbError, (num, _):
 935             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 936
 937         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 938
 939     def test_rdn_name(self):
 940         """Tests the RDN"""
 941         print "Tests the RDN"""
 942
 943         try:
 944             self.ldb.add({
 945                  "dn": "description=xyz,cn=users," + self.base_dn,
 946                  "objectclass": "group"})
 947             self.fail()
 948         except LdbError, (num, _):
 949             self.assertEquals(num, ERR_NAMING_VIOLATION)
 950
 951         self.delete_force(self.ldb, "description=xyz,cn=users," + self.base_dn)
 952
 953         # a wrong "name" attribute is obviously tolerated
 954         self.ldb.add({
 955              "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 956              "objectclass": "group",
 957              "name": "ldaptestgroupx"})
 958
 959         # proof if the name has been set correctly
 960         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 961                          scope=SCOPE_BASE, attrs=["name"])
 962         self.assertTrue(len(res) == 1)
 963         self.assertTrue("name" in res[0])
 964         self.assertTrue(res[0]["name"][0] == "ldaptestgroup")
 965
 966         m = Message()
 967         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 968         m["name"] = MessageElement("cn=ldaptestuser", FLAG_MOD_REPLACE,
 969           "name")
 970         try:
 971             ldb.modify(m)
 972             self.fail()
 973         except LdbError, (num, _):
 974             self.assertEquals(num, ERR_NOT_ALLOWED_ON_RDN)
 975
 976         m = Message()
 977         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 978         m["cn"] = MessageElement("ldaptestuser",
 979           FLAG_MOD_REPLACE, "cn")
 980         try:
 981             ldb.modify(m)
 982             self.fail()
 983         except LdbError, (num, _):
 984             self.assertEquals(num, ERR_NOT_ALLOWED_ON_RDN)
 985
 986         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 987
 988
 989         # this test needs to be disabled until we really understand
 990         # what the rDN length constraints are
 991     def DISABLED_test_largeRDN(self):
 992         """Testing large rDN (limit 64 characters)"""
 993         rdn = "CN=a012345678901234567890123456789012345678901234567890123456789012";
 994         self.delete_force(self.ldb, "%s,%s" % (rdn, self.base_dn))
 995         ldif = """
 996 dn: %s,%s""" % (rdn,self.base_dn) + """
 997 objectClass: container
 998 """
 999         self.ldb.add_ldif(ldif)
1000         self.delete_force(self.ldb, "%s,%s" % (rdn, self.base_dn))
1001
1002         rdn = "CN=a0123456789012345678901234567890123456789012345678901234567890120";
1003         self.delete_force(self.ldb, "%s,%s" % (rdn, self.base_dn))
1004         try:
1005             ldif = """
1006 dn: %s,%s""" % (rdn,self.base_dn) + """
1007 objectClass: container
1008 """
1009             self.ldb.add_ldif(ldif)
1010             self.fail()
1011         except LdbError, (num, _):
1012             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
1013         self.delete_force(self.ldb, "%s,%s" % (rdn, self.base_dn))
1014
1015     def test_rename(self):
1016         """Tests the rename operation"""
1017         print "Tests the rename operations"""
1018
1019         try:
1020             # cannot rename to be a child of itself
1021             ldb.rename(self.base_dn, "dc=test," + self.base_dn)
1022             self.fail()
1023         except LdbError, (num, _):
1024             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1025
1026         try:
1027             # inexistent object
1028             ldb.rename("cn=ldaptestuser2,cn=users," + self.base_dn, "cn=ldaptestuser2,cn=users," + self.base_dn)
1029             self.fail()
1030         except LdbError, (num, _):
1031             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
1032
1033         self.ldb.add({
1034              "dn": "cn=ldaptestuser2,cn=users," + self.base_dn,
1035              "objectclass": ["user", "person"] })
1036
1037         ldb.rename("cn=ldaptestuser2,cn=users," + self.base_dn, "cn=ldaptestuser2,cn=users," + self.base_dn)
1038         ldb.rename("cn=ldaptestuser2,cn=users," + self.base_dn, "cn=ldaptestuser3,cn=users," + self.base_dn)
1039         ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "cn=ldaptestUSER3,cn=users," + self.base_dn)
1040
1041         try:
1042             # containment problem: a user entry cannot contain user entries
1043             ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "cn=ldaptestuser4,cn=ldaptestuser3,cn=users," + self.base_dn)
1044             self.fail()
1045         except LdbError, (num, _):
1046             self.assertEquals(num, ERR_NAMING_VIOLATION)
1047
1048         try:
1049             # invalid parent
1050             ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "cn=ldaptestuser3,cn=people,cn=users," + self.base_dn)
1051             self.fail()
1052         except LdbError, (num, _):
1053             self.assertEquals(num, ERR_OTHER)
1054
1055         try:
1056             # invalid target DN syntax
1057             ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, ",cn=users," + self.base_dn)
1058             self.fail()
1059         except LdbError, (num, _):
1060             self.assertEquals(num, ERR_INVALID_DN_SYNTAX)
1061
1062         try:
1063             # invalid RDN name
1064             ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "ou=ldaptestuser3,cn=users," + self.base_dn)
1065             self.fail()
1066         except LdbError, (num, _):
1067             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1068
1069         self.delete_force(self.ldb, "cn=ldaptestuser3,cn=users," + self.base_dn)
1070
1071         # Performs some "systemFlags" testing
1072
1073         # Move failing since no "SYSTEM_FLAG_CONFIG_ALLOW_MOVE"
1074         try:
1075             ldb.rename("CN=DisplaySpecifiers," + self.configuration_dn, "CN=DisplaySpecifiers,CN=Services," + self.configuration_dn)
1076             self.fail()
1077         except LdbError, (num, _):
1078             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1079
1080         # Limited move failing since no "SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE"
1081         try:
1082             ldb.rename("CN=Directory Service,CN=Windows NT,CN=Services," + self.configuration_dn, "CN=Directory Service,CN=RRAS,CN=Services," + self.configuration_dn)
1083             self.fail()
1084         except LdbError, (num, _):
1085             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1086
1087         # Rename failing since no "SYSTEM_FLAG_CONFIG_ALLOW_RENAME"
1088         try:
1089             ldb.rename("CN=DisplaySpecifiers," + self.configuration_dn, "CN=DisplaySpecifiers2," + self.configuration_dn)
1090             self.fail()
1091         except LdbError, (num, _):
1092             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1093
1094         # It's not really possible to test moves on the schema partition since
1095         # there don't exist subcontainers on it.
1096
1097         # Rename failing since "SYSTEM_FLAG_SCHEMA_BASE_OBJECT"
1098         try:
1099             ldb.rename("CN=Top," + self.schema_dn, "CN=Top2," + self.schema_dn)
1100             self.fail()
1101         except LdbError, (num, _):
1102             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1103
1104         # Move failing since "SYSTEM_FLAG_DOMAIN_DISALLOW_MOVE"
1105         try:
1106             ldb.rename("CN=Users," + self.base_dn, "CN=Users,CN=Computers," + self.base_dn)
1107             self.fail()
1108         except LdbError, (num, _):
1109             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1110
1111         # Rename failing since "SYSTEM_FLAG_DOMAIN_DISALLOW_RENAME"
1112         try:
1113             ldb.rename("CN=Users," + self.base_dn, "CN=Users2," + self.base_dn)
1114             self.fail()
1115         except LdbError, (num, _):
1116             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1117
1118         # Performs some other constraints testing
1119
1120         try:
1121             ldb.rename("CN=Policies,CN=System," + self.base_dn, "CN=Users2," + self.base_dn)
1122             self.fail()
1123         except LdbError, (num, _):
1124             self.assertEquals(num, ERR_OTHER)
1125
1126     def test_rename_twice(self):
1127         """Tests the rename operation twice - this corresponds to a past bug"""
1128         print "Tests the rename twice operation"""
1129
1130         self.ldb.add({
1131              "dn": "cn=ldaptestuser5,cn=users," + self.base_dn,
1132              "objectclass": ["user", "person"] })
1133
1134         ldb.rename("cn=ldaptestuser5,cn=users," + self.base_dn, "cn=ldaptestUSER5,cn=users," + self.base_dn)
1135         self.delete_force(self.ldb, "cn=ldaptestuser5,cn=users," + self.base_dn)
1136         self.ldb.add({
1137              "dn": "cn=ldaptestuser5,cn=users," + self.base_dn,
1138              "objectclass": ["user", "person"] })
1139         ldb.rename("cn=ldaptestuser5,cn=Users," + self.base_dn, "cn=ldaptestUSER5,cn=users," + self.base_dn)
1140         res = ldb.search(expression="cn=ldaptestuser5")
1141         print "Found %u records" % len(res)
1142         self.assertEquals(len(res), 1, "Wrong number of hits for cn=ldaptestuser5")
1143         res = ldb.search(expression="(&(cn=ldaptestuser5)(objectclass=user))")
1144         print "Found %u records" % len(res)
1145         self.assertEquals(len(res), 1, "Wrong number of hits for (&(cn=ldaptestuser5)(objectclass=user))")
1146         self.delete_force(self.ldb, "cn=ldaptestuser5,cn=users," + self.base_dn)
1147
1148     def test_parentGUID(self):
1149         """Test parentGUID behaviour"""
1150         print "Testing parentGUID behaviour\n"
1151
1152         # TODO: This seems to fail on Windows Server. Hidden attribute?
1153
1154         self.ldb.add({
1155             "dn": "cn=parentguidtest,cn=users," + self.base_dn,
1156             "objectclass":"user",
1157             "samaccountname":"parentguidtest"});
1158         res1 = ldb.search(base="cn=parentguidtest,cn=users," + self.base_dn, scope=SCOPE_BASE,
1159                           attrs=["parentGUID", "samaccountname"]);
1160         res2 = ldb.search(base="cn=users," + self.base_dn,scope=SCOPE_BASE,
1161                           attrs=["objectGUID"]);
1162         res3 = ldb.search(base=self.base_dn, scope=SCOPE_BASE,
1163                           attrs=["parentGUID"]);
1164         res4 = ldb.search(base=self.configuration_dn, scope=SCOPE_BASE,
1165                           attrs=["parentGUID"]);
1166         res5 = ldb.search(base=self.schema_dn, scope=SCOPE_BASE,
1167                           attrs=["parentGUID"]);
1168
1169         """Check if the parentGUID is valid """
1170         self.assertEquals(res1[0]["parentGUID"], res2[0]["objectGUID"]);
1171
1172         """Check if it returns nothing when there is no parent object - default NC"""
1173         has_parentGUID = False
1174         for key in res3[0].keys():
1175             if key == "parentGUID":
1176                 has_parentGUID = True
1177                 break
1178         self.assertFalse(has_parentGUID);
1179
1180         """Check if it returns nothing when there is no parent object - configuration NC"""
1181         has_parentGUID = False
1182         for key in res4[0].keys():
1183             if key == "parentGUID":
1184                 has_parentGUID = True
1185                 break
1186         self.assertFalse(has_parentGUID);
1187
1188         """Check if it returns nothing when there is no parent object - schema NC"""
1189         has_parentGUID = False
1190         for key in res5[0].keys():
1191             if key == "parentGUID":
1192                 has_parentGUID = True
1193                 break
1194         self.assertFalse(has_parentGUID);
1195
1196         """Ensures that if you look for another object attribute after the constructed
1197             parentGUID, it will return correctly"""
1198         has_another_attribute = False
1199         for key in res1[0].keys():
1200             if key == "sAMAccountName":
1201                 has_another_attribute = True
1202                 break
1203         self.assertTrue(has_another_attribute)
1204         self.assertTrue(len(res1[0]["samaccountname"]) == 1)
1205         self.assertEquals(res1[0]["samaccountname"][0], "parentguidtest");
1206
1207         print "Testing parentGUID behaviour on rename\n"
1208
1209         self.ldb.add({
1210             "dn": "cn=testotherusers," + self.base_dn,
1211             "objectclass":"container"});
1212         res1 = ldb.search(base="cn=testotherusers," + self.base_dn,scope=SCOPE_BASE,
1213                           attrs=["objectGUID"]);
1214         ldb.rename("cn=parentguidtest,cn=users," + self.base_dn,
1215                    "cn=parentguidtest,cn=testotherusers," + self.base_dn);
1216         res2 = ldb.search(base="cn=parentguidtest,cn=testotherusers," + self.base_dn,
1217                           scope=SCOPE_BASE,
1218                           attrs=["parentGUID"]);
1219         self.assertEquals(res1[0]["objectGUID"], res2[0]["parentGUID"]);
1220
1221         self.delete_force(self.ldb, "cn=parentguidtest,cn=testotherusers," + self.base_dn)
1222         self.delete_force(self.ldb, "cn=testotherusers," + self.base_dn)
1223
1224     def test_groupType_int32(self):
1225         """Test groupType (int32) behaviour (should appear to be casted to a 32 bit signed integer before comparsion)"""
1226         print "Testing groupType (int32) behaviour\n"
1227
1228         res1 = ldb.search(base=self.base_dn, scope=SCOPE_SUBTREE,
1229                           attrs=["groupType"], expression="groupType=2147483653");
1230
1231         res2 = ldb.search(base=self.base_dn, scope=SCOPE_SUBTREE,
1232                           attrs=["groupType"], expression="groupType=-2147483643");
1233
1234         self.assertEquals(len(res1), len(res2))
1235
1236         self.assertTrue(res1.count > 0)
1237
1238         self.assertEquals(res1[0]["groupType"][0], "-2147483643")
1239
1240     def test_linked_attributes(self):
1241         """This tests the linked attribute behaviour"""
1242         print "Testing linked attribute behaviour\n"
1243
1244         ldb.add({
1245             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
1246             "objectclass": "group"})
1247
1248         # This should not work since "memberOf" is linked to "member"
1249         try:
1250             ldb.add({
1251                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1252                 "objectclass": ["user", "person"],
1253                 "memberOf": "cn=ldaptestgroup,cn=users," + self.base_dn})
1254         except LdbError, (num, _):
1255             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1256
1257         ldb.add({
1258             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1259             "objectclass": ["user", "person"]})
1260
1261         m = Message()
1262         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1263         m["memberOf"] = MessageElement("cn=ldaptestgroup,cn=users," + self.base_dn,
1264           FLAG_MOD_ADD, "memberOf")
1265         try:
1266             ldb.modify(m)
1267             self.fail()
1268         except LdbError, (num, _):
1269             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1270
1271         m = Message()
1272         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1273         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
1274           FLAG_MOD_ADD, "member")
1275         ldb.modify(m)
1276
1277         m = Message()
1278         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1279         m["memberOf"] = MessageElement("cn=ldaptestgroup,cn=users," + self.base_dn,
1280           FLAG_MOD_REPLACE, "memberOf")
1281         try:
1282             ldb.modify(m)
1283             self.fail()
1284         except LdbError, (num, _):
1285             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1286
1287         m = Message()
1288         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1289         m["memberOf"] = MessageElement("cn=ldaptestgroup,cn=users," + self.base_dn,
1290           FLAG_MOD_DELETE, "memberOf")
1291         try:
1292             ldb.modify(m)
1293             self.fail()
1294         except LdbError, (num, _):
1295             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1296
1297         m = Message()
1298         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1299         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
1300           FLAG_MOD_DELETE, "member")
1301         ldb.modify(m)
1302
1303         # This should yield no results since the member attribute for
1304         # "ldaptestuser" should have been deleted
1305         res1 = ldb.search("cn=ldaptestgroup, cn=users," + self.base_dn,
1306                           scope=SCOPE_BASE,
1307                           expression="(member=cn=ldaptestuser,cn=users," + self.base_dn + ")",
1308                           attrs=[])
1309         self.assertTrue(len(res1) == 0)
1310
1311         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1312
1313         ldb.add({
1314             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
1315             "objectclass": "group",
1316             "member": "cn=ldaptestuser,cn=users," + self.base_dn})
1317
1318         self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1319
1320         # Make sure that the "member" attribute for "ldaptestuser" has been
1321         # removed
1322         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1323                           scope=SCOPE_BASE, attrs=["member"])
1324         self.assertTrue(len(res) == 1)
1325         self.assertFalse("member" in res[0])
1326
1327         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1328
1329     def test_wkguid(self):
1330         """Test Well known GUID behaviours (including DN+Binary)"""
1331         print "Test Well known GUID behaviours (including DN+Binary)"""
1332
1333         res = self.ldb.search(base=("<WKGUID=ab1d30f3768811d1aded00c04fd8d5cd,%s>" % self.base_dn), scope=SCOPE_BASE, attrs=[])
1334         self.assertEquals(len(res), 1)
1335
1336         res2 = self.ldb.search(scope=SCOPE_BASE, attrs=["wellKnownObjects"], expression=("wellKnownObjects=B:32:ab1d30f3768811d1aded00c04fd8d5cd:%s" % res[0].dn))
1337         self.assertEquals(len(res2), 1)
1338
1339         # Prove that the matching rule is over the whole DN+Binary
1340         res2 = self.ldb.search(scope=SCOPE_BASE, attrs=["wellKnownObjects"], expression=("wellKnownObjects=B:32:ab1d30f3768811d1aded00c04fd8d5cd"))
1341         self.assertEquals(len(res2), 0)
1342         # Prove that the matching rule is over the whole DN+Binary
1343         res2 = self.ldb.search(scope=SCOPE_BASE, attrs=["wellKnownObjects"], expression=("wellKnownObjects=%s") % res[0].dn)
1344         self.assertEquals(len(res2), 0)
1345
1346     def test_subschemasubentry(self):
1347         """Test subSchemaSubEntry appears when requested, but not when not requested"""
1348         print "Test subSchemaSubEntry"""
1349
1350         res = self.ldb.search(base=self.base_dn, scope=SCOPE_BASE, attrs=["subSchemaSubEntry"])
1351         self.assertEquals(len(res), 1)
1352         self.assertEquals(res[0]["subSchemaSubEntry"][0], "CN=Aggregate,"+self.schema_dn)
1353
1354         res = self.ldb.search(base=self.base_dn, scope=SCOPE_BASE, attrs=["*"])
1355         self.assertEquals(len(res), 1)
1356         self.assertTrue("subScheamSubEntry" not in res[0])
1357
1358     def test_all(self):
1359         """Basic tests"""
1360
1361         print "Testing user add"
1362
1363         ldb.add({
1364             "dn": "cn=ldaptestuser,cn=uSers," + self.base_dn,
1365             "objectclass": ["user", "person"],
1366             "cN": "LDAPtestUSER",
1367             "givenname": "ldap",
1368             "sn": "testy"})
1369
1370         ldb.add({
1371             "dn": "cn=ldaptestgroup,cn=uSers," + self.base_dn,
1372             "objectclass": "group",
1373             "member": "cn=ldaptestuser,cn=useRs," + self.base_dn})
1374
1375         ldb.add({
1376             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1377             "objectclass": "computer",
1378             "cN": "LDAPtestCOMPUTER"})
1379
1380         ldb.add({"dn": "cn=ldaptest2computer,cn=computers," + self.base_dn,
1381             "objectClass": "computer",
1382             "cn": "LDAPtest2COMPUTER",
1383             "userAccountControl": str(UF_WORKSTATION_TRUST_ACCOUNT),
1384             "displayname": "ldap testy"})
1385
1386         try:
1387             ldb.add({"dn": "cn=ldaptestcomputer3,cn=computers," + self.base_dn,
1388                      "objectClass": "computer",
1389                      "cn": "LDAPtest2COMPUTER"
1390                      })
1391             self.fail()
1392         except LdbError, (num, _):
1393             self.assertEquals(num, ERR_INVALID_DN_SYNTAX)
1394
1395         try:
1396             ldb.add({"dn": "cn=ldaptestcomputer3,cn=computers," + self.base_dn,
1397                      "objectClass": "computer",
1398                      "cn": "ldaptestcomputer3",
1399                      "sAMAccountType": str(ATYPE_NORMAL_ACCOUNT)
1400                 })
1401             self.fail()
1402         except LdbError, (num, _):
1403             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1404
1405         ldb.add({"dn": "cn=ldaptestcomputer3,cn=computers," + self.base_dn,
1406                  "objectClass": "computer",
1407                  "cn": "LDAPtestCOMPUTER3"
1408                  })
1409
1410         print "Testing ldb.search for (&(cn=ldaptestcomputer3)(objectClass=user))";
1411         res = ldb.search(self.base_dn, expression="(&(cn=ldaptestcomputer3)(objectClass=user))");
1412         self.assertEquals(len(res), 1, "Found only %d for (&(cn=ldaptestcomputer3)(objectClass=user))" % len(res))
1413
1414         self.assertEquals(str(res[0].dn), ("CN=ldaptestcomputer3,CN=Computers," + self.base_dn));
1415         self.assertEquals(res[0]["cn"][0], "ldaptestcomputer3");
1416         self.assertEquals(res[0]["name"][0], "ldaptestcomputer3");
1417         self.assertEquals(res[0]["objectClass"][0], "top");
1418         self.assertEquals(res[0]["objectClass"][1], "person");
1419         self.assertEquals(res[0]["objectClass"][2], "organizationalPerson");
1420         self.assertEquals(res[0]["objectClass"][3], "user");
1421         self.assertEquals(res[0]["objectClass"][4], "computer");
1422         self.assertTrue("objectGUID" in res[0])
1423         self.assertTrue("whenCreated" in res[0])
1424         self.assertEquals(res[0]["objectCategory"][0], ("CN=Computer,CN=Schema,CN=Configuration," + self.base_dn));
1425         self.assertEquals(int(res[0]["primaryGroupID"][0]), 513);
1426         self.assertEquals(int(res[0]["sAMAccountType"][0]), ATYPE_NORMAL_ACCOUNT);
1427         self.assertEquals(int(res[0]["userAccountControl"][0]), UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD | UF_ACCOUNTDISABLE);
1428
1429         self.delete_force(self.ldb, "cn=ldaptestcomputer3,cn=computers," + self.base_dn)
1430
1431         print "Testing attribute or value exists behaviour"
1432         try:
1433             ldb.modify_ldif("""
1434 dn: cn=ldaptest2computer,cn=computers,""" + self.base_dn + """
1435 changetype: modify
1436 replace: servicePrincipalName
1437 servicePrincipalName: host/ldaptest2computer
1438 servicePrincipalName: host/ldaptest2computer
1439 servicePrincipalName: cifs/ldaptest2computer
1440 """)
1441             self.fail()
1442         except LdbError, (num, msg):
1443             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
1444
1445         ldb.modify_ldif("""
1446 dn: cn=ldaptest2computer,cn=computers,""" + self.base_dn + """
1447 changetype: modify
1448 replace: servicePrincipalName
1449 servicePrincipalName: host/ldaptest2computer
1450 servicePrincipalName: cifs/ldaptest2computer
1451 """)
1452         try:
1453             ldb.modify_ldif("""
1454 dn: cn=ldaptest2computer,cn=computers,""" + self.base_dn + """
1455 changetype: modify
1456 add: servicePrincipalName
1457 servicePrincipalName: host/ldaptest2computer
1458 """)
1459             self.fail()
1460         except LdbError, (num, msg):
1461             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
1462
1463         print "Testing ranged results"
1464         ldb.modify_ldif("""
1465 dn: cn=ldaptest2computer,cn=computers,""" + self.base_dn + """
1466 changetype: modify
1467 replace: servicePrincipalName
1468 """)
1469
1470         ldb.modify_ldif("""
1471 dn: cn=ldaptest2computer,cn=computers,""" + self.base_dn + """
1472 changetype: modify
1473 add: servicePrincipalName
1474 servicePrincipalName: host/ldaptest2computer0
1475 servicePrincipalName: host/ldaptest2computer1
1476 servicePrincipalName: host/ldaptest2computer2
1477 servicePrincipalName: host/ldaptest2computer3
1478 servicePrincipalName: host/ldaptest2computer4
1479 servicePrincipalName: host/ldaptest2computer5
1480 servicePrincipalName: host/ldaptest2computer6
1481 servicePrincipalName: host/ldaptest2computer7
1482 servicePrincipalName: host/ldaptest2computer8
1483 servicePrincipalName: host/ldaptest2computer9
1484 servicePrincipalName: host/ldaptest2computer10
1485 servicePrincipalName: host/ldaptest2computer11
1486 servicePrincipalName: host/ldaptest2computer12
1487 servicePrincipalName: host/ldaptest2computer13
1488 servicePrincipalName: host/ldaptest2computer14
1489 servicePrincipalName: host/ldaptest2computer15
1490 servicePrincipalName: host/ldaptest2computer16
1491 servicePrincipalName: host/ldaptest2computer17
1492 servicePrincipalName: host/ldaptest2computer18
1493 servicePrincipalName: host/ldaptest2computer19
1494 servicePrincipalName: host/ldaptest2computer20
1495 servicePrincipalName: host/ldaptest2computer21
1496 servicePrincipalName: host/ldaptest2computer22
1497 servicePrincipalName: host/ldaptest2computer23
1498 servicePrincipalName: host/ldaptest2computer24
1499 servicePrincipalName: host/ldaptest2computer25
1500 servicePrincipalName: host/ldaptest2computer26
1501 servicePrincipalName: host/ldaptest2computer27
1502 servicePrincipalName: host/ldaptest2computer28
1503 servicePrincipalName: host/ldaptest2computer29
1504 """)
1505
1506         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE,
1507                          attrs=["servicePrincipalName;range=0-*"])
1508         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
1509         #print len(res[0]["servicePrincipalName;range=0-*"])
1510         self.assertEquals(len(res[0]["servicePrincipalName;range=0-*"]), 30)
1511
1512         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=0-19"])
1513         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
1514             # print res[0]["servicePrincipalName;range=0-19"].length
1515         self.assertEquals(len(res[0]["servicePrincipalName;range=0-19"]), 20)
1516
1517
1518         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=0-30"])
1519         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
1520         self.assertEquals(len(res[0]["servicePrincipalName;range=0-*"]), 30)
1521
1522         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=0-40"])
1523         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
1524         self.assertEquals(len(res[0]["servicePrincipalName;range=0-*"]), 30)
1525
1526         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=30-40"])
1527         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
1528         self.assertEquals(len(res[0]["servicePrincipalName;range=30-*"]), 0)
1529
1530
1531         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=10-40"])
1532         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
1533         self.assertEquals(len(res[0]["servicePrincipalName;range=10-*"]), 20)
1534         # pos_11 = res[0]["servicePrincipalName;range=10-*"][18]
1535
1536         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=11-40"])
1537         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
1538         self.assertEquals(len(res[0]["servicePrincipalName;range=11-*"]), 19)
1539             # print res[0]["servicePrincipalName;range=11-*"][18]
1540             # print pos_11
1541             # self.assertEquals((res[0]["servicePrincipalName;range=11-*"][18]), pos_11)
1542
1543         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName;range=11-15"])
1544         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
1545         self.assertEquals(len(res[0]["servicePrincipalName;range=11-15"]), 5)
1546             # self.assertEquals(res[0]["servicePrincipalName;range=11-15"][4], pos_11)
1547
1548         res = ldb.search(self.base_dn, expression="(cn=ldaptest2computer))", scope=SCOPE_SUBTREE, attrs=["servicePrincipalName"])
1549         self.assertEquals(len(res), 1, "Could not find (cn=ldaptest2computer)")
1550             # print res[0]["servicePrincipalName"][18]
1551             # print pos_11
1552         self.assertEquals(len(res[0]["servicePrincipalName"]), 30)
1553             # self.assertEquals(res[0]["servicePrincipalName"][18], pos_11)
1554
1555         self.delete_force(self.ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
1556         ldb.add({
1557             "dn": "cn=ldaptestuser2,cn=useRs," + self.base_dn,
1558             "objectClass": ["person", "user"],
1559             "cn": "LDAPtestUSER2",
1560             "givenname": "testy",
1561             "sn": "ldap user2"})
1562
1563         print "Testing Ambigious Name Resolution"
1564         # Testing ldb.search for (&(anr=ldap testy)(objectClass=user))
1565         res = ldb.search(expression="(&(anr=ldap testy)(objectClass=user))")
1566         self.assertEquals(len(res), 3, "Found only %d of 3 for (&(anr=ldap testy)(objectClass=user))" % len(res))
1567
1568         # Testing ldb.search for (&(anr=testy ldap)(objectClass=user))
1569         res = ldb.search(expression="(&(anr=testy ldap)(objectClass=user))")
1570         self.assertEquals(len(res), 2, "Found only %d of 2 for (&(anr=testy ldap)(objectClass=user))" % len(res))
1571
1572         # Testing ldb.search for (&(anr=ldap)(objectClass=user))
1573         res = ldb.search(expression="(&(anr=ldap)(objectClass=user))")
1574         self.assertEquals(len(res), 4, "Found only %d of 4 for (&(anr=ldap)(objectClass=user))" % len(res))
1575
1576         # Testing ldb.search for (&(anr==ldap)(objectClass=user))
1577         res = ldb.search(expression="(&(anr==ldap)(objectClass=user))")
1578         self.assertEquals(len(res), 1, "Could not find (&(anr==ldap)(objectClass=user)). Found only %d for (&(anr=ldap)(objectClass=user))" % len(res))
1579
1580         self.assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + self.base_dn))
1581         self.assertEquals(res[0]["cn"][0], "ldaptestuser")
1582         self.assertEquals(str(res[0]["name"]), "ldaptestuser")
1583
1584         # Testing ldb.search for (&(anr=testy)(objectClass=user))
1585         res = ldb.search(expression="(&(anr=testy)(objectClass=user))")
1586         self.assertEquals(len(res), 2, "Found only %d for (&(anr=testy)(objectClass=user))" % len(res))
1587
1588         # Testing ldb.search for (&(anr=testy ldap)(objectClass=user))
1589         res = ldb.search(expression="(&(anr=testy ldap)(objectClass=user))")
1590         self.assertEquals(len(res), 2, "Found only %d for (&(anr=testy ldap)(objectClass=user))" % len(res))
1591
1592         # Testing ldb.search for (&(anr==testy ldap)(objectClass=user))
1593 # this test disabled for the moment, as anr with == tests are not understood
1594 #        res = ldb.search(expression="(&(anr==testy ldap)(objectClass=user))")
1595 #        self.assertEquals(len(res), 1, "Found only %d for (&(anr==testy ldap)(objectClass=user))" % len(res))
1596
1597 #        self.assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + self.base_dn))
1598 #        self.assertEquals(res[0]["cn"][0], "ldaptestuser")
1599 #        self.assertEquals(res[0]["name"][0], "ldaptestuser")
1600
1601         # Testing ldb.search for (&(anr==testy ldap)(objectClass=user))
1602 #        res = ldb.search(expression="(&(anr==testy ldap)(objectClass=user))")
1603 #        self.assertEquals(len(res), 1, "Could not find (&(anr==testy ldap)(objectClass=user))")
1604
1605 #        self.assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + self.base_dn))
1606 #        self.assertEquals(res[0]["cn"][0], "ldaptestuser")
1607 #        self.assertEquals(res[0]["name"][0], "ldaptestuser")
1608
1609         # Testing ldb.search for (&(anr=testy ldap user)(objectClass=user))
1610         res = ldb.search(expression="(&(anr=testy ldap user)(objectClass=user))")
1611         self.assertEquals(len(res), 1, "Could not find (&(anr=testy ldap user)(objectClass=user))")
1612
1613         self.assertEquals(str(res[0].dn), ("CN=ldaptestuser2,CN=Users," + self.base_dn))
1614         self.assertEquals(str(res[0]["cn"]), "ldaptestuser2")
1615         self.assertEquals(str(res[0]["name"]), "ldaptestuser2")
1616
1617         # Testing ldb.search for (&(anr==testy ldap user2)(objectClass=user))
1618 #        res = ldb.search(expression="(&(anr==testy ldap user2)(objectClass=user))")
1619 #        self.assertEquals(len(res), 1, "Could not find (&(anr==testy ldap user2)(objectClass=user))")
1620
1621         self.assertEquals(str(res[0].dn), ("CN=ldaptestuser2,CN=Users," + self.base_dn))
1622         self.assertEquals(str(res[0]["cn"]), "ldaptestuser2")
1623         self.assertEquals(str(res[0]["name"]), "ldaptestuser2")
1624
1625         # Testing ldb.search for (&(anr==ldap user2)(objectClass=user))
1626 #        res = ldb.search(expression="(&(anr==ldap user2)(objectClass=user))")
1627 #        self.assertEquals(len(res), 1, "Could not find (&(anr==ldap user2)(objectClass=user))")
1628
1629         self.assertEquals(str(res[0].dn), ("CN=ldaptestuser2,CN=Users," + self.base_dn))
1630         self.assertEquals(str(res[0]["cn"]), "ldaptestuser2")
1631         self.assertEquals(str(res[0]["name"]), "ldaptestuser2")
1632
1633         # Testing ldb.search for (&(anr==not ldap user2)(objectClass=user))
1634 #        res = ldb.search(expression="(&(anr==not ldap user2)(objectClass=user))")
1635 #        self.assertEquals(len(res), 0, "Must not find (&(anr==not ldap user2)(objectClass=user))")
1636
1637         # Testing ldb.search for (&(anr=not ldap user2)(objectClass=user))
1638         res = ldb.search(expression="(&(anr=not ldap user2)(objectClass=user))")
1639         self.assertEquals(len(res), 0, "Must not find (&(anr=not ldap user2)(objectClass=user))")
1640
1641         # Testing ldb.search for (&(anr="testy ldap")(objectClass=user)) (ie, with quotes)
1642 #        res = ldb.search(expression="(&(anr==\"testy ldap\")(objectClass=user))")
1643 #        self.assertEquals(len(res), 0, "Found (&(anr==\"testy ldap\")(objectClass=user))")
1644
1645         print "Testing Renames"
1646
1647         attrs = ["objectGUID", "objectSid"]
1648         print "Testing ldb.search for (&(cn=ldaptestUSer2)(objectClass=user))"
1649         res_user = ldb.search(self.base_dn, expression="(&(cn=ldaptestUSer2)(objectClass=user))", scope=SCOPE_SUBTREE, attrs=attrs)
1650         self.assertEquals(len(res_user), 1, "Could not find (&(cn=ldaptestUSer2)(objectClass=user))")
1651
1652         # Check rename works with extended/alternate DN forms
1653         ldb.rename("<SID=" + ldb.schema_format_value("objectSID", res_user[0]["objectSID"][0]) + ">" , "cn=ldaptestUSER3,cn=users," + self.base_dn)
1654
1655         print "Testing ldb.search for (&(cn=ldaptestuser3)(objectClass=user))"
1656         res = ldb.search(expression="(&(cn=ldaptestuser3)(objectClass=user))")
1657         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestuser3)(objectClass=user))")
1658
1659         self.assertEquals(str(res[0].dn), ("CN=ldaptestUSER3,CN=Users," + self.base_dn))
1660         self.assertEquals(str(res[0]["cn"]), "ldaptestUSER3")
1661         self.assertEquals(str(res[0]["name"]), "ldaptestUSER3")
1662
1663          #"Testing ldb.search for (&(&(cn=ldaptestuser3)(userAccountControl=*))(objectClass=user))"
1664         res = ldb.search(expression="(&(&(cn=ldaptestuser3)(userAccountControl=*))(objectClass=user))")
1665         self.assertEquals(len(res), 1, "(&(&(cn=ldaptestuser3)(userAccountControl=*))(objectClass=user))")
1666
1667         self.assertEquals(str(res[0].dn), ("CN=ldaptestUSER3,CN=Users," + self.base_dn))
1668         self.assertEquals(str(res[0]["cn"]), "ldaptestUSER3")
1669         self.assertEquals(str(res[0]["name"]), "ldaptestUSER3")
1670
1671          #"Testing ldb.search for (&(&(cn=ldaptestuser3)(userAccountControl=546))(objectClass=user))"
1672         res = ldb.search(expression="(&(&(cn=ldaptestuser3)(userAccountControl=546))(objectClass=user))")
1673         self.assertEquals(len(res), 1, "(&(&(cn=ldaptestuser3)(userAccountControl=546))(objectClass=user))")
1674
1675         self.assertEquals(str(res[0].dn), ("CN=ldaptestUSER3,CN=Users," + self.base_dn))
1676         self.assertEquals(str(res[0]["cn"]), "ldaptestUSER3")
1677         self.assertEquals(str(res[0]["name"]), "ldaptestUSER3")
1678
1679          #"Testing ldb.search for (&(&(cn=ldaptestuser3)(userAccountControl=547))(objectClass=user))"
1680         res = ldb.search(expression="(&(&(cn=ldaptestuser3)(userAccountControl=547))(objectClass=user))")
1681         self.assertEquals(len(res), 0, "(&(&(cn=ldaptestuser3)(userAccountControl=547))(objectClass=user))")
1682
1683         # This is a Samba special, and does not exist in real AD
1684         #    print "Testing ldb.search for (dn=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")"
1685         #    res = ldb.search("(dn=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")")
1686         #    if (res.error != 0 || len(res) != 1) {
1687         #        print "Could not find (dn=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")"
1688         #        self.assertEquals(len(res), 1)
1689         #    }
1690         #    self.assertEquals(res[0].dn, ("CN=ldaptestUSER3,CN=Users," + self.base_dn))
1691         #    self.assertEquals(res[0].cn, "ldaptestUSER3")
1692         #    self.assertEquals(res[0].name, "ldaptestUSER3")
1693
1694         print "Testing ldb.search for (distinguishedName=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")"
1695         res = ldb.search(expression="(distinguishedName=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")")
1696         self.assertEquals(len(res), 1, "Could not find (dn=CN=ldaptestUSER3,CN=Users," + self.base_dn + ")")
1697         self.assertEquals(str(res[0].dn), ("CN=ldaptestUSER3,CN=Users," + self.base_dn))
1698         self.assertEquals(str(res[0]["cn"]), "ldaptestUSER3")
1699         self.assertEquals(str(res[0]["name"]), "ldaptestUSER3")
1700
1701         # ensure we cannot add it again
1702         try:
1703             ldb.add({"dn": "cn=ldaptestuser3,cn=userS," + self.base_dn,
1704                       "objectClass": ["person", "user"],
1705                       "cn": "LDAPtestUSER3"})
1706             self.fail()
1707         except LdbError, (num, _):
1708             self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
1709
1710         # rename back
1711         ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "cn=ldaptestuser2,cn=users," + self.base_dn)
1712
1713         # ensure we cannot rename it twice
1714         try:
1715             ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn,
1716                        "cn=ldaptestuser2,cn=users," + self.base_dn)
1717             self.fail()
1718         except LdbError, (num, _):
1719             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
1720
1721         # ensure can now use that name
1722         ldb.add({"dn": "cn=ldaptestuser3,cn=users," + self.base_dn,
1723                       "objectClass": ["person", "user"],
1724                       "cn": "LDAPtestUSER3"})
1725
1726         # ensure we now cannot rename
1727         try:
1728             ldb.rename("cn=ldaptestuser2,cn=users," + self.base_dn, "cn=ldaptestuser3,cn=users," + self.base_dn)
1729             self.fail()
1730         except LdbError, (num, _):
1731             self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
1732         try:
1733             ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "cn=ldaptestuser3,cn=configuration," + self.base_dn)
1734             self.fail()
1735         except LdbError, (num, _):
1736             self.assertTrue(num in (71, 64))
1737
1738         ldb.rename("cn=ldaptestuser3,cn=users," + self.base_dn, "cn=ldaptestuser5,cn=users," + self.base_dn)
1739
1740         ldb.delete("cn=ldaptestuser5,cn=users," + self.base_dn)
1741
1742         self.delete_force(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
1743
1744         ldb.rename("cn=ldaptestgroup,cn=users," + self.base_dn, "cn=ldaptestgroup2,cn=users," + self.base_dn)
1745
1746         print "Testing subtree renames"
1747
1748         ldb.add({"dn": "cn=ldaptestcontainer," + self.base_dn,
1749                  "objectClass": "container"})
1750
1751         ldb.add({"dn": "CN=ldaptestuser4,CN=ldaptestcontainer," + self.base_dn,
1752                  "objectClass": ["person", "user"],
1753                  "cn": "LDAPtestUSER4"})
1754
1755         ldb.modify_ldif("""
1756 dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
1757 changetype: modify
1758 add: member
1759 member: cn=ldaptestuser4,cn=ldaptestcontainer,""" + self.base_dn + """
1760 member: cn=ldaptestcomputer,cn=computers,""" + self.base_dn + """
1761 member: cn=ldaptestuser2,cn=users,""" + self.base_dn + """
1762 """)
1763
1764         print "Testing ldb.rename of cn=ldaptestcontainer," + self.base_dn + " to cn=ldaptestcontainer2," + self.base_dn
1765         ldb.rename("CN=ldaptestcontainer," + self.base_dn, "CN=ldaptestcontainer2," + self.base_dn)
1766
1767         print "Testing ldb.search for (&(cn=ldaptestuser4)(objectClass=user))"
1768         res = ldb.search(expression="(&(cn=ldaptestuser4)(objectClass=user))")
1769         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestuser4)(objectClass=user))")
1770
1771         print "Testing subtree ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in (just renamed from) cn=ldaptestcontainer," + self.base_dn
1772         try:
1773             res = ldb.search("cn=ldaptestcontainer," + self.base_dn,
1774                     expression="(&(cn=ldaptestuser4)(objectClass=user))",
1775                     scope=SCOPE_SUBTREE)
1776             self.fail(res)
1777         except LdbError, (num, _):
1778             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
1779
1780         print "Testing one-level ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in (just renamed from) cn=ldaptestcontainer," + self.base_dn
1781         try:
1782             res = ldb.search("cn=ldaptestcontainer," + self.base_dn,
1783                     expression="(&(cn=ldaptestuser4)(objectClass=user))", scope=SCOPE_ONELEVEL)
1784             self.fail()
1785         except LdbError, (num, _):
1786             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
1787
1788         print "Testing ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in renamed container"
1789         res = ldb.search("cn=ldaptestcontainer2," + self.base_dn, expression="(&(cn=ldaptestuser4)(objectClass=user))", scope=SCOPE_SUBTREE)
1790         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestuser4)(objectClass=user)) under cn=ldaptestcontainer2," + self.base_dn)
1791
1792         self.assertEquals(str(res[0].dn), ("CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn))
1793         self.assertEquals(res[0]["memberOf"][0].upper(), ("CN=ldaptestgroup2,CN=Users," + self.base_dn).upper())
1794
1795         time.sleep(4)
1796
1797         print "Testing ldb.search for (&(member=CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn + ")(objectclass=group)) to check subtree renames and linked attributes"
1798         res = ldb.search(self.base_dn, expression="(&(member=CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn + ")(objectclass=group))", scope=SCOPE_SUBTREE)
1799         self.assertEquals(len(res), 1, "Could not find (&(member=CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn + ")(objectclass=group)), perhaps linked attributes are not consistant with subtree renames?")
1800
1801         print "Testing ldb.rename (into itself) of cn=ldaptestcontainer2," + self.base_dn + " to cn=ldaptestcontainer,cn=ldaptestcontainer2," + self.base_dn
1802         try:
1803             ldb.rename("cn=ldaptestcontainer2," + self.base_dn, "cn=ldaptestcontainer,cn=ldaptestcontainer2," + self.base_dn)
1804             self.fail()
1805         except LdbError, (num, _):
1806             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1807
1808         print "Testing ldb.rename (into non-existent container) of cn=ldaptestcontainer2," + self.base_dn + " to cn=ldaptestcontainer,cn=ldaptestcontainer3," + self.base_dn
1809         try:
1810             ldb.rename("cn=ldaptestcontainer2," + self.base_dn, "cn=ldaptestcontainer,cn=ldaptestcontainer3," + self.base_dn)
1811             self.fail()
1812         except LdbError, (num, _):
1813             self.assertTrue(num in (ERR_UNWILLING_TO_PERFORM, ERR_OTHER))
1814
1815         print "Testing delete (should fail, not a leaf node) of renamed cn=ldaptestcontainer2," + self.base_dn
1816         try:
1817             ldb.delete("cn=ldaptestcontainer2," + self.base_dn)
1818             self.fail()
1819         except LdbError, (num, _):
1820             self.assertEquals(num, ERR_NOT_ALLOWED_ON_NON_LEAF)
1821
1822         print "Testing base ldb.search for CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn
1823         res = ldb.search(expression="(objectclass=*)", base=("CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn), scope=SCOPE_BASE)
1824         self.assertEquals(len(res), 1)
1825         res = ldb.search(expression="(cn=ldaptestuser40)", base=("CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn), scope=SCOPE_BASE)
1826         self.assertEquals(len(res), 0)
1827
1828         print "Testing one-level ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in cn=ldaptestcontainer2," + self.base_dn
1829         res = ldb.search(expression="(&(cn=ldaptestuser4)(objectClass=user))", base=("cn=ldaptestcontainer2," + self.base_dn), scope=SCOPE_ONELEVEL)
1830         # FIXME: self.assertEquals(len(res), 0)
1831
1832         print "Testing one-level ldb.search for (&(cn=ldaptestuser4)(objectClass=user)) in cn=ldaptestcontainer2," + self.base_dn
1833         res = ldb.search(expression="(&(cn=ldaptestuser4)(objectClass=user))", base=("cn=ldaptestcontainer2," + self.base_dn), scope=SCOPE_SUBTREE)
1834         # FIXME: self.assertEquals(len(res), 0)
1835
1836         print "Testing delete of subtree renamed "+("CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn)
1837         ldb.delete(("CN=ldaptestuser4,CN=ldaptestcontainer2," + self.base_dn))
1838         print "Testing delete of renamed cn=ldaptestcontainer2," + self.base_dn
1839         ldb.delete("cn=ldaptestcontainer2," + self.base_dn)
1840
1841         ldb.add({"dn": "cn=ldaptestutf8user èùéìòà,cn=users," + self.base_dn, "objectClass": "user"})
1842
1843         ldb.add({"dn": "cn=ldaptestutf8user2  èùéìòà,cn=users," + self.base_dn, "objectClass": "user"})
1844
1845         print "Testing ldb.search for (&(cn=ldaptestuser)(objectClass=user))"
1846         res = ldb.search(expression="(&(cn=ldaptestuser)(objectClass=user))")
1847         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestuser)(objectClass=user))")
1848
1849         self.assertEquals(str(res[0].dn), ("CN=ldaptestuser,CN=Users," + self.base_dn))
1850         self.assertEquals(str(res[0]["cn"]), "ldaptestuser")
1851         self.assertEquals(str(res[0]["name"]), "ldaptestuser")
1852         self.assertEquals(set(res[0]["objectClass"]), set(["top", "person", "organizationalPerson", "user"]))
1853         self.assertTrue("objectGUID" in res[0])
1854         self.assertTrue("whenCreated" in res[0])
1855         self.assertEquals(str(res[0]["objectCategory"]), ("CN=Person,CN=Schema,CN=Configuration," + self.base_dn))
1856         self.assertEquals(int(res[0]["sAMAccountType"][0]), ATYPE_NORMAL_ACCOUNT)
1857         self.assertEquals(int(res[0]["userAccountControl"][0]), UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD | UF_ACCOUNTDISABLE)
1858         self.assertEquals(res[0]["memberOf"][0].upper(), ("CN=ldaptestgroup2,CN=Users," + self.base_dn).upper())
1859         self.assertEquals(len(res[0]["memberOf"]), 1)
1860
1861         print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=cn=person,cn=schema,cn=configuration," + self.base_dn + "))"
1862         res2 = ldb.search(expression="(&(cn=ldaptestuser)(objectCategory=cn=person,cn=schema,cn=configuration," + self.base_dn + "))")
1863         self.assertEquals(len(res2), 1, "Could not find (&(cn=ldaptestuser)(objectCategory=cn=person,cn=schema,cn=configuration," + self.base_dn + "))")
1864
1865         self.assertEquals(res[0].dn, res2[0].dn)
1866
1867         print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=PerSon))"
1868         res3 = ldb.search(expression="(&(cn=ldaptestuser)(objectCategory=PerSon))")
1869         self.assertEquals(len(res3), 1, "Could not find (&(cn=ldaptestuser)(objectCategory=PerSon)): matched %d" % len(res3))
1870
1871         self.assertEquals(res[0].dn, res3[0].dn)
1872
1873         if gc_ldb is not None:
1874             print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=PerSon)) in Global Catalog"
1875             res3gc = gc_ldb.search(expression="(&(cn=ldaptestuser)(objectCategory=PerSon))")
1876             self.assertEquals(len(res3gc), 1)
1877
1878             self.assertEquals(res[0].dn, res3gc[0].dn)
1879
1880         print "Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=PerSon)) in with 'phantom root' control"
1881
1882         if gc_ldb is not None:
1883             res3control = gc_ldb.search(self.base_dn, expression="(&(cn=ldaptestuser)(objectCategory=PerSon))", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["search_options:1:2"])
1884             self.assertEquals(len(res3control), 1, "Could not find (&(cn=ldaptestuser)(objectCategory=PerSon)) in Global Catalog")
1885
1886             self.assertEquals(res[0].dn, res3control[0].dn)
1887
1888         ldb.delete(res[0].dn)
1889
1890         print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectClass=user))"
1891         res = ldb.search(expression="(&(cn=ldaptestcomputer)(objectClass=user))")
1892         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestuser)(objectClass=user))")
1893
1894         self.assertEquals(str(res[0].dn), ("CN=ldaptestcomputer,CN=Computers," + self.base_dn))
1895         self.assertEquals(str(res[0]["cn"]), "ldaptestcomputer")
1896         self.assertEquals(str(res[0]["name"]), "ldaptestcomputer")
1897         self.assertEquals(set(res[0]["objectClass"]), set(["top", "person", "organizationalPerson", "user", "computer"]))
1898         self.assertTrue("objectGUID" in res[0])
1899         self.assertTrue("whenCreated" in res[0])
1900         self.assertEquals(str(res[0]["objectCategory"]), ("CN=Computer,CN=Schema,CN=Configuration," + self.base_dn))
1901         self.assertEquals(int(res[0]["primaryGroupID"][0]), 513)
1902         self.assertEquals(int(res[0]["sAMAccountType"][0]), ATYPE_NORMAL_ACCOUNT)
1903         self.assertEquals(int(res[0]["userAccountControl"][0]), UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD | UF_ACCOUNTDISABLE)
1904         self.assertEquals(res[0]["memberOf"][0].upper(), ("CN=ldaptestgroup2,CN=Users," + self.base_dn).upper())
1905         self.assertEquals(len(res[0]["memberOf"]), 1)
1906
1907         print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + "))"
1908         res2 = ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + "))")
1909         self.assertEquals(len(res2), 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + "))")
1910
1911         self.assertEquals(res[0].dn, res2[0].dn)
1912
1913         if gc_ldb is not None:
1914             print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + ")) in Global Catlog"
1915             res2gc = gc_ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + "))")
1916             self.assertEquals(len(res2gc), 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=cn=computer,cn=schema,cn=configuration," + self.base_dn + ")) in Global Catlog")
1917
1918             self.assertEquals(res[0].dn, res2gc[0].dn)
1919
1920         print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=compuTER))"
1921         res3 = ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=compuTER))")
1922         self.assertEquals(len(res3), 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=compuTER))")
1923
1924         self.assertEquals(res[0].dn, res3[0].dn)
1925
1926         if gc_ldb is not None:
1927             print "Testing ldb.search for (&(cn=ldaptestcomputer)(objectCategory=compuTER)) in Global Catalog"
1928             res3gc = gc_ldb.search(expression="(&(cn=ldaptestcomputer)(objectCategory=compuTER))")
1929             self.assertEquals(len(res3gc), 1, "Could not find (&(cn=ldaptestcomputer)(objectCategory=compuTER)) in Global Catalog")
1930
1931             self.assertEquals(res[0].dn, res3gc[0].dn)
1932
1933         print "Testing ldb.search for (&(cn=ldaptestcomp*r)(objectCategory=compuTER))"
1934         res4 = ldb.search(expression="(&(cn=ldaptestcomp*r)(objectCategory=compuTER))")
1935         self.assertEquals(len(res4), 1, "Could not find (&(cn=ldaptestcomp*r)(objectCategory=compuTER))")
1936
1937         self.assertEquals(res[0].dn, res4[0].dn)
1938
1939         print "Testing ldb.search for (&(cn=ldaptestcomput*)(objectCategory=compuTER))"
1940         res5 = ldb.search(expression="(&(cn=ldaptestcomput*)(objectCategory=compuTER))")
1941         self.assertEquals(len(res5), 1, "Could not find (&(cn=ldaptestcomput*)(objectCategory=compuTER))")
1942
1943         self.assertEquals(res[0].dn, res5[0].dn)
1944
1945         print "Testing ldb.search for (&(cn=*daptestcomputer)(objectCategory=compuTER))"
1946         res6 = ldb.search(expression="(&(cn=*daptestcomputer)(objectCategory=compuTER))")
1947         self.assertEquals(len(res6), 1, "Could not find (&(cn=*daptestcomputer)(objectCategory=compuTER))")
1948
1949         self.assertEquals(res[0].dn, res6[0].dn)
1950
1951         ldb.delete("<GUID=" + ldb.schema_format_value("objectGUID", res[0]["objectGUID"][0]) + ">")
1952
1953         print "Testing ldb.search for (&(cn=ldaptest2computer)(objectClass=user))"
1954         res = ldb.search(expression="(&(cn=ldaptest2computer)(objectClass=user))")
1955         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptest2computer)(objectClass=user))")
1956
1957         self.assertEquals(str(res[0].dn), "CN=ldaptest2computer,CN=Computers," + self.base_dn)
1958         self.assertEquals(str(res[0]["cn"]), "ldaptest2computer")
1959         self.assertEquals(str(res[0]["name"]), "ldaptest2computer")
1960         self.assertEquals(list(res[0]["objectClass"]), ["top", "person", "organizationalPerson", "user", "computer"])
1961         self.assertTrue("objectGUID" in res[0])
1962         self.assertTrue("whenCreated" in res[0])
1963         self.assertEquals(res[0]["objectCategory"][0], "CN=Computer,CN=Schema,CN=Configuration," + self.base_dn)
1964         self.assertEquals(int(res[0]["sAMAccountType"][0]), ATYPE_WORKSTATION_TRUST)
1965         self.assertEquals(int(res[0]["userAccountControl"][0]), UF_WORKSTATION_TRUST_ACCOUNT)
1966
1967         ldb.delete("<SID=" + ldb.schema_format_value("objectSID", res[0]["objectSID"][0]) + ">")
1968
1969         attrs = ["cn", "name", "objectClass", "objectGUID", "objectSID", "whenCreated", "nTSecurityDescriptor", "memberOf", "allowedAttributes", "allowedAttributesEffective"]
1970         print "Testing ldb.search for (&(cn=ldaptestUSer2)(objectClass=user))"
1971         res_user = ldb.search(self.base_dn, expression="(&(cn=ldaptestUSer2)(objectClass=user))", scope=SCOPE_SUBTREE, attrs=attrs)
1972         self.assertEquals(len(res_user), 1, "Could not find (&(cn=ldaptestUSer2)(objectClass=user))")
1973
1974         self.assertEquals(str(res_user[0].dn), ("CN=ldaptestuser2,CN=Users," + self.base_dn))
1975         self.assertEquals(str(res_user[0]["cn"]), "ldaptestuser2")
1976         self.assertEquals(str(res_user[0]["name"]), "ldaptestuser2")
1977         self.assertEquals(list(res_user[0]["objectClass"]), ["top", "person", "organizationalPerson", "user"])
1978         self.assertTrue("objectSid" in res_user[0])
1979         self.assertTrue("objectGUID" in res_user[0])
1980         self.assertTrue("whenCreated" in res_user[0])
1981         self.assertTrue("nTSecurityDescriptor" in res_user[0])
1982         self.assertTrue("allowedAttributes" in res_user[0])
1983         self.assertTrue("allowedAttributesEffective" in res_user[0])
1984         self.assertEquals(res_user[0]["memberOf"][0].upper(), ("CN=ldaptestgroup2,CN=Users," + self.base_dn).upper())
1985
1986         ldaptestuser2_sid = res_user[0]["objectSid"][0]
1987         ldaptestuser2_guid = res_user[0]["objectGUID"][0]
1988
1989         attrs = ["cn", "name", "objectClass", "objectGUID", "objectSID", "whenCreated", "nTSecurityDescriptor", "member", "allowedAttributes", "allowedAttributesEffective"]
1990         print "Testing ldb.search for (&(cn=ldaptestgroup2)(objectClass=group))"
1991         res = ldb.search(self.base_dn, expression="(&(cn=ldaptestgroup2)(objectClass=group))", scope=SCOPE_SUBTREE, attrs=attrs)
1992         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group))")
1993
1994         self.assertEquals(str(res[0].dn), ("CN=ldaptestgroup2,CN=Users," + self.base_dn))
1995         self.assertEquals(str(res[0]["cn"]), "ldaptestgroup2")
1996         self.assertEquals(str(res[0]["name"]), "ldaptestgroup2")
1997         self.assertEquals(list(res[0]["objectClass"]), ["top", "group"])
1998         self.assertTrue("objectGUID" in res[0])
1999         self.assertTrue("objectSid" in res[0])
2000         self.assertTrue("whenCreated" in res[0])
2001         self.assertTrue("nTSecurityDescriptor" in res[0])
2002         self.assertTrue("allowedAttributes" in res[0])
2003         self.assertTrue("allowedAttributesEffective" in res[0])
2004         memberUP = []
2005         for m in res[0]["member"]:
2006             memberUP.append(m.upper())
2007         self.assertTrue(("CN=ldaptestuser2,CN=Users," + self.base_dn).upper() in memberUP)
2008
2009         res = ldb.search(self.base_dn, expression="(&(cn=ldaptestgroup2)(objectClass=group))", scope=SCOPE_SUBTREE, attrs=attrs, controls=["extended_dn:1:1"])
2010         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group))")
2011
2012         print res[0]["member"]
2013         memberUP = []
2014         for m in res[0]["member"]:
2015             memberUP.append(m.upper())
2016         print ("<GUID=" + ldb.schema_format_value("objectGUID", ldaptestuser2_guid) + ">;<SID=" + ldb.schema_format_value("objectSid", ldaptestuser2_sid) + ">;CN=ldaptestuser2,CN=Users," + self.base_dn).upper()
2017
2018         self.assertTrue(("<GUID=" + ldb.schema_format_value("objectGUID", ldaptestuser2_guid) + ">;<SID=" + ldb.schema_format_value("objectSid", ldaptestuser2_sid) + ">;CN=ldaptestuser2,CN=Users," + self.base_dn).upper() in memberUP)
2019
2020         print "Quicktest for linked attributes"
2021         ldb.modify_ldif("""
2022 dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
2023 changetype: modify
2024 replace: member
2025 member: CN=ldaptestuser2,CN=Users,""" + self.base_dn + """
2026 member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + self.base_dn + """
2027 """)
2028
2029         ldb.modify_ldif("""
2030 dn: <GUID=""" + ldb.schema_format_value("objectGUID", res[0]["objectGUID"][0]) + """>
2031 changetype: modify
2032 replace: member
2033 member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + self.base_dn + """
2034 """)
2035
2036         ldb.modify_ldif("""
2037 dn: <SID=""" + ldb.schema_format_value("objectSid", res[0]["objectSid"][0]) + """>
2038 changetype: modify
2039 delete: member
2040 """)
2041
2042         ldb.modify_ldif("""
2043 dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
2044 changetype: modify
2045 add: member
2046 member: <GUID=""" + ldb.schema_format_value("objectGUID", res[0]["objectGUID"][0]) + """>
2047 member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + self.base_dn + """
2048 """)
2049
2050         ldb.modify_ldif("""
2051 dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
2052 changetype: modify
2053 replace: member
2054 """)
2055
2056         ldb.modify_ldif("""
2057 dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
2058 changetype: modify
2059 add: member
2060 member: <SID=""" + ldb.schema_format_value("objectSid", res_user[0]["objectSid"][0]) + """>
2061 member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + self.base_dn + """
2062 """)
2063
2064         ldb.modify_ldif("""
2065 dn: cn=ldaptestgroup2,cn=users,""" + self.base_dn + """
2066 changetype: modify
2067 delete: member
2068 member: CN=ldaptestutf8user èùéìòà,CN=Users,""" + self.base_dn + """
2069 """)
2070
2071         res = ldb.search(self.base_dn, expression="(&(cn=ldaptestgroup2)(objectClass=group))", scope=SCOPE_SUBTREE, attrs=attrs)
2072         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group))")
2073
2074         self.assertEquals(str(res[0].dn), ("CN=ldaptestgroup2,CN=Users," + self.base_dn))
2075         self.assertEquals(res[0]["member"][0], ("CN=ldaptestuser2,CN=Users," + self.base_dn))
2076         self.assertEquals(len(res[0]["member"]), 1)
2077
2078         ldb.delete(("CN=ldaptestuser2,CN=Users," + self.base_dn))
2079
2080         time.sleep(4)
2081
2082         attrs = ["cn", "name", "objectClass", "objectGUID", "whenCreated", "nTSecurityDescriptor", "member"]
2083         print "Testing ldb.search for (&(cn=ldaptestgroup2)(objectClass=group)) to check linked delete"
2084         res = ldb.search(self.base_dn, expression="(&(cn=ldaptestgroup2)(objectClass=group))", scope=SCOPE_SUBTREE, attrs=attrs)
2085         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestgroup2)(objectClass=group)) to check linked delete")
2086
2087         self.assertEquals(str(res[0].dn), ("CN=ldaptestgroup2,CN=Users," + self.base_dn))
2088         self.assertTrue("member" not in res[0])
2089
2090         print "Testing ldb.search for (&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))"
2091 # TODO UTF8 users don't seem to work fully anymore
2092 #        res = ldb.search(expression="(&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))")
2093         res = ldb.search(expression="(&(cn=ldaptestutf8user èùéìòà)(objectclass=user))")
2094         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))")
2095
2096         self.assertEquals(str(res[0].dn), ("CN=ldaptestutf8user èùéìòà,CN=Users," + self.base_dn))
2097         self.assertEquals(str(res[0]["cn"]), "ldaptestutf8user èùéìòà")
2098         self.assertEquals(str(res[0]["name"]), "ldaptestutf8user èùéìòà")
2099         self.assertEquals(list(res[0]["objectClass"]), ["top", "person", "organizationalPerson", "user"])
2100         self.assertTrue("objectGUID" in res[0])
2101         self.assertTrue("whenCreated" in res[0])
2102
2103         ldb.delete(res[0].dn)
2104
2105         print "Testing ldb.search for (&(cn=ldaptestutf8user2*)(objectClass=user))"
2106         res = ldb.search(expression="(&(cn=ldaptestutf8user2*)(objectClass=user))")
2107         self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestutf8user2*)(objectClass=user))")
2108
2109         ldb.delete(res[0].dn)
2110
2111         ldb.delete(("CN=ldaptestgroup2,CN=Users," + self.base_dn))
2112
2113         print "Testing ldb.search for (&(cn=ldaptestutf8user2 ÈÙÉÌÒÀ)(objectClass=user))"
2114 # TODO UTF8 users don't seem to work fully anymore
2115 #        res = ldb.search(expression="(&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))")
2116 #        self.assertEquals(len(res), 1, "Could not find (&(cn=ldaptestutf8user ÈÙÉÌÒÀ)(objectClass=user))")
2117
2118         print "Testing that we can't get at the configuration DN from the main search base"
2119         res = ldb.search(self.base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
2120         self.assertEquals(len(res), 0)
2121
2122         print "Testing that we can get at the configuration DN from the main search base on the LDAP port with the 'phantom root' search_options control"
2123         res = ldb.search(self.base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["search_options:1:2"])
2124         self.assertTrue(len(res) > 0)
2125
2126         if gc_ldb is not None:
2127             print "Testing that we can get at the configuration DN from the main search base on the GC port with the search_options control == 0"
2128
2129             res = gc_ldb.search(self.base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["search_options:1:0"])
2130             self.assertTrue(len(res) > 0)
2131
2132             print "Testing that we do find configuration elements in the global catlog"
2133             res = gc_ldb.search(self.base_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
2134             self.assertTrue(len(res) > 0)
2135
2136             print "Testing that we do find configuration elements and user elements at the same time"
2137             res = gc_ldb.search(self.base_dn, expression="(|(objectClass=crossRef)(objectClass=person))", scope=SCOPE_SUBTREE, attrs=["cn"])
2138             self.assertTrue(len(res) > 0)
2139
2140             print "Testing that we do find configuration elements in the global catlog, with the configuration basedn"
2141             res = gc_ldb.search(self.configuration_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
2142             self.assertTrue(len(res) > 0)
2143
2144         print "Testing that we can get at the configuration DN on the main LDAP port"
2145         res = ldb.search(self.configuration_dn, expression="objectClass=crossRef", scope=SCOPE_SUBTREE, attrs=["cn"])
2146         self.assertTrue(len(res) > 0)
2147
2148         print "Testing objectCategory canonacolisation"
2149         res = ldb.search(self.configuration_dn, expression="objectCategory=ntDsDSA", scope=SCOPE_SUBTREE, attrs=["cn"])
2150         self.assertTrue(len(res) > 0, "Didn't find any records with objectCategory=ntDsDSA")
2151         self.assertTrue(len(res) != 0)
2152
2153         res = ldb.search(self.configuration_dn, expression="objectCategory=CN=ntDs-DSA," + self.schema_dn, scope=SCOPE_SUBTREE, attrs=["cn"])
2154         self.assertTrue(len(res) > 0, "Didn't find any records with objectCategory=CN=ntDs-DSA," + self.schema_dn)
2155         self.assertTrue(len(res) != 0)
2156
2157         print "Testing objectClass attribute order on "+ self.base_dn
2158         res = ldb.search(expression="objectClass=domain", base=self.base_dn,
2159                          scope=SCOPE_BASE, attrs=["objectClass"])
2160         self.assertEquals(len(res), 1)
2161
2162         self.assertEquals(list(res[0]["objectClass"]), ["top", "domain", "domainDNS"])
2163
2164     #  check enumeration
2165
2166         print "Testing ldb.search for objectCategory=person"
2167         res = ldb.search(self.base_dn, expression="objectCategory=person", scope=SCOPE_SUBTREE, attrs=["cn"])
2168         self.assertTrue(len(res) > 0)
2169
2170         print "Testing ldb.search for objectCategory=person with domain scope control"
2171         res = ldb.search(self.base_dn, expression="objectCategory=person", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["domain_scope:1"])
2172         self.assertTrue(len(res) > 0)
2173
2174         print "Testing ldb.search for objectCategory=user"
2175         res = ldb.search(self.base_dn, expression="objectCategory=user", scope=SCOPE_SUBTREE, attrs=["cn"])
2176         self.assertTrue(len(res) > 0)
2177
2178         print "Testing ldb.search for objectCategory=user with domain scope control"
2179         res = ldb.search(self.base_dn, expression="objectCategory=user", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["domain_scope:1"])
2180         self.assertTrue(len(res) > 0)
2181
2182         print "Testing ldb.search for objectCategory=group"
2183         res = ldb.search(self.base_dn, expression="objectCategory=group", scope=SCOPE_SUBTREE, attrs=["cn"])
2184         self.assertTrue(len(res) > 0)
2185
2186         print "Testing ldb.search for objectCategory=group with domain scope control"
2187         res = ldb.search(self.base_dn, expression="objectCategory=group", scope=SCOPE_SUBTREE, attrs=["cn"], controls=["domain_scope:1"])
2188         self.assertTrue(len(res) > 0)
2189
2190         print "Testing creating a user with the posixAccount objectClass"
2191         self.ldb.add_ldif("""dn: cn=posixuser,CN=Users,%s
2192 objectClass: top
2193 objectClass: person
2194 objectClass: posixAccount
2195 objectClass: user
2196 objectClass: organizationalPerson
2197 cn: posixuser
2198 uid: posixuser
2199 sn: posixuser
2200 uidNumber: 10126
2201 gidNumber: 10126
2202 homeDirectory: /home/posixuser
2203 loginShell: /bin/bash
2204 gecos: Posix User;;;
2205 description: A POSIX user"""% (self.base_dn))
2206
2207         print "Testing removing the posixAccount objectClass from an existing user"
2208         self.ldb.modify_ldif("""dn: cn=posixuser,CN=Users,%s
2209 changetype: modify
2210 delete: objectClass
2211 objectClass: posixAccount"""% (self.base_dn))
2212
2213         print "Testing adding the posixAccount objectClass to an existing user"
2214         self.ldb.modify_ldif("""dn: cn=posixuser,CN=Users,%s
2215 changetype: modify
2216 add: objectClass
2217 objectClass: posixAccount"""% (self.base_dn))
2218
2219         self.delete_force(self.ldb, "cn=posixuser,cn=users," + self.base_dn)
2220         self.delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
2221         self.delete_force(self.ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
2222         self.delete_force(self.ldb, "cn=ldaptestuser3,cn=users," + self.base_dn)
2223         self.delete_force(self.ldb, "cn=ldaptestuser4,cn=ldaptestcontainer," + self.base_dn)
2224         self.delete_force(self.ldb, "cn=ldaptestuser4,cn=ldaptestcontainer2," + self.base_dn)
2225         self.delete_force(self.ldb, "cn=ldaptestuser5,cn=users," + self.base_dn)
2226         self.delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2227         self.delete_force(self.ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
2228         self.delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2229         self.delete_force(self.ldb, "cn=ldaptest2computer,cn=computers," + self.base_dn)
2230         self.delete_force(self.ldb, "cn=ldaptestcomputer3,cn=computers," + self.base_dn)
2231         self.delete_force(self.ldb, "cn=ldaptestutf8user èùéìòà,cn=users," + self.base_dn)
2232         self.delete_force(self.ldb, "cn=ldaptestutf8user2  èùéìòà,cn=users," + self.base_dn)
2233         self.delete_force(self.ldb, "cn=ldaptestcontainer," + self.base_dn)
2234         self.delete_force(self.ldb, "cn=ldaptestcontainer2," + self.base_dn)
2235
2236     def test_security_descriptor_add(self):
2237         """ Testing ldb.add_ldif() for nTSecurityDescriptor """
2238         user_name = "testdescriptoruser1"
2239         user_dn = "CN=%s,CN=Users,%s" % (user_name, self.base_dn)
2240         #
2241         # Test add_ldif() with SDDL security descriptor input
2242         #
2243         self.delete_force(self.ldb, user_dn)
2244         try:
2245             sddl = "O:DUG:DUD:PAI(A;;RPWP;;;AU)S:PAI"
2246             self.ldb.add_ldif("""
2247 dn: """ + user_dn + """
2248 objectclass: user
2249 sAMAccountName: """ + user_name + """
2250 nTSecurityDescriptor: """ + sddl)
2251             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2252             desc = res[0]["nTSecurityDescriptor"][0]
2253             desc = ndr_unpack( security.descriptor, desc )
2254             desc_sddl = desc.as_sddl( self.domain_sid )
2255             self.assertEqual(desc_sddl, sddl)
2256         finally:
2257             self.delete_force(self.ldb, user_dn)
2258         #
2259         # Test add_ldif() with BASE64 security descriptor
2260         #
2261         try:
2262             sddl = "O:DUG:DUD:PAI(A;;RPWP;;;AU)S:PAI"
2263             desc = security.descriptor.from_sddl(sddl, self.domain_sid)
2264             desc_binary = ndr_pack(desc)
2265             desc_base64 = base64.b64encode(desc_binary)
2266             self.ldb.add_ldif("""
2267 dn: """ + user_dn + """
2268 objectclass: user
2269 sAMAccountName: """ + user_name + """
2270 nTSecurityDescriptor:: """ + desc_base64)
2271             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2272             desc = res[0]["nTSecurityDescriptor"][0]
2273             desc = ndr_unpack(security.descriptor, desc)
2274             desc_sddl = desc.as_sddl(self.domain_sid)
2275             self.assertEqual(desc_sddl, sddl)
2276         finally:
2277             self.delete_force(self.ldb, user_dn)
2278
2279     def test_security_descriptor_add_neg(self):
2280         """Test add_ldif() with BASE64 security descriptor input using WRONG domain SID
2281             Negative test
2282         """
2283         user_name = "testdescriptoruser1"
2284         user_dn = "CN=%s,CN=Users,%s" % (user_name, self.base_dn)
2285         self.delete_force(self.ldb, user_dn)
2286         try:
2287             sddl = "O:DUG:DUD:PAI(A;;RPWP;;;AU)S:PAI"
2288             desc = security.descriptor.from_sddl(sddl, security.dom_sid('S-1-5-21'))
2289             desc_base64 = base64.b64encode( ndr_pack(desc) )
2290             self.ldb.add_ldif("""
2291 dn: """ + user_dn + """
2292 objectclass: user
2293 sAMAccountName: """ + user_name + """
2294 nTSecurityDescriptor:: """ + desc_base64)
2295             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2296             self.assertTrue("nTSecurityDescriptor" in res[0])
2297         finally:
2298             self.delete_force(self.ldb, user_dn)
2299
2300     def test_security_descriptor_modify(self):
2301         """ Testing ldb.modify_ldif() for nTSecurityDescriptor """
2302         user_name = "testdescriptoruser2"
2303         user_dn = "CN=%s,CN=Users,%s" % (user_name, self.base_dn)
2304         #
2305         # Delete user object and test modify_ldif() with SDDL security descriptor input
2306         # Add ACE to the original descriptor test
2307         #
2308         try:
2309             self.delete_force(self.ldb, user_dn)
2310             self.ldb.add_ldif("""
2311 dn: """ + user_dn + """
2312 objectclass: user
2313 sAMAccountName: """ + user_name)
2314             # Modify descriptor
2315             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2316             desc = res[0]["nTSecurityDescriptor"][0]
2317             desc = ndr_unpack(security.descriptor, desc)
2318             desc_sddl = desc.as_sddl(self.domain_sid)
2319             sddl = desc_sddl[:desc_sddl.find("(")] + "(A;;RPWP;;;AU)" + desc_sddl[desc_sddl.find("("):]
2320             mod = """
2321 dn: """ + user_dn + """
2322 changetype: modify
2323 replace: nTSecurityDescriptor
2324 nTSecurityDescriptor: """ + sddl
2325             self.ldb.modify_ldif(mod)
2326             # Read modified descriptor
2327             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2328             desc = res[0]["nTSecurityDescriptor"][0]
2329             desc = ndr_unpack(security.descriptor, desc)
2330             desc_sddl = desc.as_sddl(self.domain_sid)
2331             self.assertEqual(desc_sddl, sddl)
2332         finally:
2333             self.delete_force(self.ldb, user_dn)
2334         #
2335         # Test modify_ldif() with SDDL security descriptor input
2336         # New desctiptor test
2337         #
2338         try:
2339             self.ldb.add_ldif("""
2340 dn: """ + user_dn + """
2341 objectclass: user
2342 sAMAccountName: """ + user_name)
2343             # Modify descriptor
2344             sddl = "O:DUG:DUD:PAI(A;;RPWP;;;AU)S:PAI"
2345             mod = """
2346 dn: """ + user_dn + """
2347 changetype: modify
2348 replace: nTSecurityDescriptor
2349 nTSecurityDescriptor: """ + sddl
2350             self.ldb.modify_ldif(mod)
2351             # Read modified descriptor
2352             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2353             desc = res[0]["nTSecurityDescriptor"][0]
2354             desc = ndr_unpack(security.descriptor, desc)
2355             desc_sddl = desc.as_sddl(self.domain_sid)
2356             self.assertEqual(desc_sddl, sddl)
2357         finally:
2358             self.delete_force(self.ldb, user_dn)
2359         #
2360         # Test modify_ldif() with BASE64 security descriptor input
2361         # Add ACE to the original descriptor test
2362         #
2363         try:
2364             self.ldb.add_ldif("""
2365 dn: """ + user_dn + """
2366 objectclass: user
2367 sAMAccountName: """ + user_name)
2368             # Modify descriptor
2369             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2370             desc = res[0]["nTSecurityDescriptor"][0]
2371             desc = ndr_unpack(security.descriptor, desc)
2372             desc_sddl = desc.as_sddl(self.domain_sid)
2373             sddl = desc_sddl[:desc_sddl.find("(")] + "(A;;RPWP;;;AU)" + desc_sddl[desc_sddl.find("("):]
2374             desc = security.descriptor.from_sddl(sddl, self.domain_sid)
2375             desc_base64 = base64.b64encode(ndr_pack(desc))
2376             mod = """
2377 dn: """ + user_dn + """
2378 changetype: modify
2379 replace: nTSecurityDescriptor
2380 nTSecurityDescriptor:: """ + desc_base64
2381             self.ldb.modify_ldif(mod)
2382             # Read modified descriptor
2383             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2384             desc = res[0]["nTSecurityDescriptor"][0]
2385             desc = ndr_unpack(security.descriptor, desc)
2386             desc_sddl = desc.as_sddl(self.domain_sid)
2387             self.assertEqual(desc_sddl, sddl)
2388         finally:
2389             self.delete_force(self.ldb, user_dn)
2390         #
2391         # Test modify_ldif() with BASE64 security descriptor input
2392         # New descriptor test
2393         #
2394         try:
2395             self.delete_force(self.ldb, user_dn)
2396             self.ldb.add_ldif("""
2397 dn: """ + user_dn + """
2398 objectclass: user
2399 sAMAccountName: """ + user_name)
2400             # Modify descriptor
2401             sddl = "O:DUG:DUD:PAI(A;;RPWP;;;AU)S:PAI"
2402             desc = security.descriptor.from_sddl(sddl, self.domain_sid)
2403             desc_base64 = base64.b64encode(ndr_pack(desc))
2404             mod = """
2405 dn: """ + user_dn + """
2406 changetype: modify
2407 replace: nTSecurityDescriptor
2408 nTSecurityDescriptor:: """ + desc_base64
2409             self.ldb.modify_ldif(mod)
2410             # Read modified descriptor
2411             res = self.ldb.search(base=user_dn, attrs=["nTSecurityDescriptor"])
2412             desc = res[0]["nTSecurityDescriptor"][0]
2413             desc = ndr_unpack(security.descriptor, desc)
2414             desc_sddl = desc.as_sddl(self.domain_sid)
2415             self.assertEqual(desc_sddl, sddl)
2416         finally:
2417             self.delete_force(self.ldb, user_dn)
2418
2419
2420 class BaseDnTests(unittest.TestCase):
2421
2422     def setUp(self):
2423         super(BaseDnTests, self).setUp()
2424         self.ldb = ldb
2425
2426     def test_rootdse_attrs(self):
2427         """Testing for all rootDSE attributes"""
2428         res = self.ldb.search(scope=SCOPE_BASE, attrs=[])
2429         self.assertEquals(len(res), 1)
2430
2431     def test_highestcommittedusn(self):
2432         """Testing for highestCommittedUSN"""
2433         res = self.ldb.search("", scope=SCOPE_BASE, attrs=["highestCommittedUSN"])
2434         self.assertEquals(len(res), 1)
2435         self.assertTrue(int(res[0]["highestCommittedUSN"][0]) != 0)
2436
2437     def test_netlogon(self):
2438         """Testing for netlogon via LDAP"""
2439         res = self.ldb.search("", scope=SCOPE_BASE, attrs=["netlogon"])
2440         self.assertEquals(len(res), 0)
2441
2442     def test_netlogon_highestcommitted_usn(self):
2443         """Testing for netlogon and highestCommittedUSN via LDAP"""
2444         res = self.ldb.search("", scope=SCOPE_BASE,
2445                 attrs=["netlogon", "highestCommittedUSN"])
2446         self.assertEquals(len(res), 0)
2447
2448     def test_namingContexts(self):
2449         """Testing for namingContexts in rootDSE"""
2450         res = self.ldb.search("", scope=SCOPE_BASE,
2451                 attrs=["namingContexts", "defaultNamingContext", "schemaNamingContext", "configurationNamingContext"])
2452         self.assertEquals(len(res), 1)
2453
2454         ncs = set([])
2455         for nc in res[0]["namingContexts"]:
2456             self.assertTrue(nc not in ncs)
2457             ncs.add(nc)
2458
2459         self.assertTrue(res[0]["defaultNamingContext"][0] in ncs)
2460         self.assertTrue(res[0]["configurationNamingContext"][0] in ncs)
2461         self.assertTrue(res[0]["schemaNamingContext"][0] in ncs)
2462
2463     def test_serverPath(self):
2464         """Testing the server paths in rootDSE"""
2465         res = self.ldb.search("", scope=SCOPE_BASE,
2466                               attrs=["dsServiceName", "serverName"])
2467         self.assertEquals(len(res), 1)
2468
2469         self.assertTrue("CN=Servers" in res[0]["dsServiceName"][0])
2470         self.assertTrue("CN=Sites" in res[0]["dsServiceName"][0])
2471         self.assertTrue("CN=NTDS Settings" in res[0]["dsServiceName"][0])
2472         self.assertTrue("CN=Servers" in res[0]["serverName"][0])
2473         self.assertTrue("CN=Sites" in res[0]["serverName"][0])
2474         self.assertFalse("CN=NTDS Settings" in res[0]["serverName"][0])
2475
2476     def test_dnsHostname(self):
2477         """Testing the DNS hostname in rootDSE"""
2478         res = self.ldb.search("", scope=SCOPE_BASE,
2479                               attrs=["dnsHostName", "serverName"])
2480         self.assertEquals(len(res), 1)
2481
2482         res2 = self.ldb.search(res[0]["serverName"][0], scope=SCOPE_BASE,
2483                                attrs=["dNSHostName"])
2484         self.assertEquals(len(res2), 1)
2485
2486         self.assertEquals(res[0]["dnsHostName"][0], res2[0]["dNSHostName"][0])
2487
2488     def test_ldapServiceName(self):
2489         """Testing the ldap service name in rootDSE"""
2490         res = self.ldb.search("", scope=SCOPE_BASE,
2491                               attrs=["ldapServiceName", "dNSHostName"])
2492         self.assertEquals(len(res), 1)
2493
2494         (hostname, _, dns_domainname) = res[0]["dNSHostName"][0].partition(".")
2495         self.assertTrue(":%s$@%s" % (hostname, dns_domainname.upper())
2496                         in res[0]["ldapServiceName"][0])
2497
2498 if not "://" in host:
2499     if os.path.isfile(host):
2500         host = "tdb://%s" % host
2501     else:
2502         host = "ldap://%s" % host
2503
2504 ldb = Ldb(host, credentials=creds, session_info=system_session(), lp=lp)
2505 if not "tdb://" in host:
2506     gc_ldb = Ldb("%s:3268" % host, credentials=creds,
2507                  session_info=system_session(), lp=lp)
2508 else:
2509     gc_ldb = None
2510
2511 runner = SubunitTestRunner()
2512 rc = 0
2513 if not runner.run(unittest.makeSuite(BaseDnTests)).wasSuccessful():
2514     rc = 1
2515 if not runner.run(unittest.makeSuite(BasicTests)).wasSuccessful():
2516     rc = 1
2517 sys.exit(rc)