2 # -*- coding: utf-8 -*-
3 # This is a port of the original in testprogs/ejs/ldap.js
9 sys.path.insert(0, "bin/python")
11 samba.ensure_external_module("testtools", "testtools")
12 samba.ensure_external_module("subunit", "subunit/python")
14 import samba.getopt as options
16 from samba.auth import system_session
17 from ldb import SCOPE_BASE, LdbError
18 from ldb import ERR_NO_SUCH_OBJECT, ERR_ATTRIBUTE_OR_VALUE_EXISTS
19 from ldb import ERR_ENTRY_ALREADY_EXISTS, ERR_UNWILLING_TO_PERFORM
20 from ldb import ERR_OTHER, ERR_NO_SUCH_ATTRIBUTE
21 from ldb import ERR_OBJECT_CLASS_VIOLATION
22 from ldb import ERR_CONSTRAINT_VIOLATION
23 from ldb import ERR_UNDEFINED_ATTRIBUTE_TYPE
24 from ldb import Message, MessageElement, Dn
25 from ldb import FLAG_MOD_ADD, FLAG_MOD_REPLACE, FLAG_MOD_DELETE
26 from samba.samdb import SamDB
27 from samba.dsdb import (UF_NORMAL_ACCOUNT, UF_ACCOUNTDISABLE,
28 UF_WORKSTATION_TRUST_ACCOUNT, UF_SERVER_TRUST_ACCOUNT,
29 UF_PARTIAL_SECRETS_ACCOUNT, UF_TEMP_DUPLICATE_ACCOUNT,
30 UF_PASSWD_NOTREQD, ATYPE_NORMAL_ACCOUNT,
31 GTYPE_SECURITY_BUILTIN_LOCAL_GROUP, GTYPE_SECURITY_DOMAIN_LOCAL_GROUP,
32 GTYPE_SECURITY_GLOBAL_GROUP, GTYPE_SECURITY_UNIVERSAL_GROUP,
33 GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP, GTYPE_DISTRIBUTION_GLOBAL_GROUP,
34 GTYPE_DISTRIBUTION_UNIVERSAL_GROUP,
35 ATYPE_SECURITY_GLOBAL_GROUP, ATYPE_SECURITY_UNIVERSAL_GROUP,
36 ATYPE_SECURITY_LOCAL_GROUP, ATYPE_DISTRIBUTION_GLOBAL_GROUP,
37 ATYPE_DISTRIBUTION_UNIVERSAL_GROUP, ATYPE_DISTRIBUTION_LOCAL_GROUP,
38 ATYPE_WORKSTATION_TRUST)
39 from samba.dcerpc.security import (DOMAIN_RID_USERS, DOMAIN_RID_ADMINS,
40 DOMAIN_RID_DOMAIN_MEMBERS, DOMAIN_RID_DCS, DOMAIN_RID_READONLY_DCS)
42 from subunit.run import SubunitTestRunner
45 from samba.dcerpc import security
46 from samba.tests import delete_force
48 parser = optparse.OptionParser("sam.py [options] <host>")
49 sambaopts = options.SambaOptions(parser)
50 parser.add_option_group(sambaopts)
51 parser.add_option_group(options.VersionOptions(parser))
52 # use command line creds if available
53 credopts = options.CredentialsOptions(parser)
54 parser.add_option_group(credopts)
55 opts, args = parser.parse_args()
63 lp = sambaopts.get_loadparm()
64 creds = credopts.get_credentials(lp)
66 class SamTests(unittest.TestCase):
69 super(SamTests, self).setUp()
71 self.base_dn = ldb.domain_dn()
73 print "baseDN: %s\n" % self.base_dn
75 delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
76 delete_force(self.ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
77 delete_force(self.ldb, "cn=ldaptest\,specialuser,cn=users," + self.base_dn)
78 delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
79 delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
80 delete_force(self.ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
82 def test_users_groups(self):
83 """This tests the SAM users and groups behaviour"""
84 print "Testing users and groups behaviour\n"
87 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
88 "objectclass": "group"})
91 "dn": "cn=ldaptestgroup2,cn=users," + self.base_dn,
92 "objectclass": "group"})
94 res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
95 scope=SCOPE_BASE, attrs=["objectSID"])
96 self.assertTrue(len(res1) == 1)
97 group_rid_1 = security.dom_sid(ldb.schema_format_value("objectSID",
98 res1[0]["objectSID"][0])).split()[1]
100 res1 = ldb.search("cn=ldaptestgroup2,cn=users," + self.base_dn,
101 scope=SCOPE_BASE, attrs=["objectSID"])
102 self.assertTrue(len(res1) == 1)
103 group_rid_2 = security.dom_sid(ldb.schema_format_value("objectSID",
104 res1[0]["objectSID"][0])).split()[1]
106 # Try to create a user with an invalid account name
109 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
110 "objectclass": "user",
111 "sAMAccountName": "administrator"})
113 except LdbError, (num, _):
114 self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
115 delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
117 # Try to create a user with an invalid account name
120 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
121 "objectclass": "user",
122 "sAMAccountName": []})
124 except LdbError, (num, _):
125 self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
126 delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
128 # Try to create a user with an invalid primary group
131 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
132 "objectclass": "user",
133 "primaryGroupID": "0"})
135 except LdbError, (num, _):
136 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
137 delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
139 # Try to Create a user with a valid primary group
142 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
143 "objectclass": "user",
144 "primaryGroupID": str(group_rid_1)})
146 except LdbError, (num, _):
147 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
148 delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
150 # Test to see how we should behave when the user account doesn't
153 m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
154 m["primaryGroupID"] = MessageElement("0", FLAG_MOD_REPLACE,
159 except LdbError, (num, _):
160 self.assertEquals(num, ERR_NO_SUCH_OBJECT)
162 # Test to see how we should behave when the account isn't a user
164 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
165 m["primaryGroupID"] = MessageElement("0", FLAG_MOD_REPLACE,
170 except LdbError, (num, _):
171 self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
173 # Test default primary groups on add operations
176 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
177 "objectclass": "user"})
179 res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
180 scope=SCOPE_BASE, attrs=["primaryGroupID"])
181 self.assertTrue(len(res1) == 1)
182 self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_USERS))
184 delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
187 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
188 "objectclass": "user",
189 "userAccountControl": str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD) })
191 res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
192 scope=SCOPE_BASE, attrs=["primaryGroupID"])
193 self.assertTrue(len(res1) == 1)
194 self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_USERS))
196 delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
198 # unfortunately the INTERDOMAIN_TRUST_ACCOUNT case cannot be tested
199 # since such accounts aren't directly creatable (ACCESS_DENIED)
202 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
203 "objectclass": "computer",
204 "userAccountControl": str(UF_WORKSTATION_TRUST_ACCOUNT | UF_PASSWD_NOTREQD) })
206 res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
207 scope=SCOPE_BASE, attrs=["primaryGroupID"])
208 self.assertTrue(len(res1) == 1)
209 self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_DOMAIN_MEMBERS))
211 delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
214 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
215 "objectclass": "computer",
216 "userAccountControl": str(UF_SERVER_TRUST_ACCOUNT | UF_PASSWD_NOTREQD) })
218 res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
219 scope=SCOPE_BASE, attrs=["primaryGroupID"])
220 self.assertTrue(len(res1) == 1)
221 self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_DCS))
223 delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
225 # Read-only DC accounts are only creatable by
226 # UF_WORKSTATION_TRUST_ACCOUNT and work only on DCs >= 2008 (therefore
227 # we have a fallback in the assertion)
229 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
230 "objectclass": "computer",
231 "userAccountControl": str(UF_PARTIAL_SECRETS_ACCOUNT | UF_WORKSTATION_TRUST_ACCOUNT | UF_PASSWD_NOTREQD) })
233 res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
234 scope=SCOPE_BASE, attrs=["primaryGroupID"])
235 self.assertTrue(len(res1) == 1)
236 self.assertTrue(res1[0]["primaryGroupID"][0] == str(DOMAIN_RID_READONLY_DCS) or
237 res1[0]["primaryGroupID"][0] == str(DOMAIN_RID_DOMAIN_MEMBERS))
239 delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
241 # Test default primary groups on modify operations
244 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
245 "objectclass": "user"})
248 m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
249 m["userAccountControl"] = MessageElement(str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD), FLAG_MOD_REPLACE,
250 "userAccountControl")
253 res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
254 scope=SCOPE_BASE, attrs=["primaryGroupID"])
255 self.assertTrue(len(res1) == 1)
256 self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_USERS))
258 # unfortunately the INTERDOMAIN_TRUST_ACCOUNT case cannot be tested
259 # since such accounts aren't directly creatable (ACCESS_DENIED)
261 delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
264 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
265 "objectclass": "computer"})
267 res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
268 scope=SCOPE_BASE, attrs=["primaryGroupID"])
269 self.assertTrue(len(res1) == 1)
270 self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_USERS))
273 m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
274 m["userAccountControl"] = MessageElement(str(UF_WORKSTATION_TRUST_ACCOUNT | UF_PASSWD_NOTREQD), FLAG_MOD_REPLACE,
275 "userAccountControl")
278 res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
279 scope=SCOPE_BASE, attrs=["primaryGroupID"])
280 self.assertTrue(len(res1) == 1)
281 self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_DOMAIN_MEMBERS))
284 m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
285 m["userAccountControl"] = MessageElement(str(UF_SERVER_TRUST_ACCOUNT | UF_PASSWD_NOTREQD), FLAG_MOD_REPLACE,
286 "userAccountControl")
289 res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
290 scope=SCOPE_BASE, attrs=["primaryGroupID"])
291 self.assertTrue(len(res1) == 1)
292 self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_DCS))
294 # Read-only DC accounts are only creatable by
295 # UF_WORKSTATION_TRUST_ACCOUNT and work only on DCs >= 2008 (therefore
296 # we have a fallback in the assertion)
298 m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
299 m["userAccountControl"] = MessageElement(str(UF_PARTIAL_SECRETS_ACCOUNT | UF_WORKSTATION_TRUST_ACCOUNT | UF_PASSWD_NOTREQD), FLAG_MOD_REPLACE,
300 "userAccountControl")
303 res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
304 scope=SCOPE_BASE, attrs=["primaryGroupID"])
305 self.assertTrue(len(res1) == 1)
306 self.assertTrue(res1[0]["primaryGroupID"][0] == str(DOMAIN_RID_READONLY_DCS) or
307 res1[0]["primaryGroupID"][0] == str(DOMAIN_RID_DOMAIN_MEMBERS))
309 delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
311 # Recreate account for further tests
314 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
315 "objectclass": "user"})
317 # Try to set an invalid account name
319 m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
320 m["sAMAccountName"] = MessageElement("administrator", FLAG_MOD_REPLACE,
325 except LdbError, (num, _):
326 self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
328 # But to reset the actual "sAMAccountName" should still be possible
329 res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
330 scope=SCOPE_BASE, attrs=["sAMAccountName"])
331 self.assertTrue(len(res1) == 1)
333 m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
334 m["sAMAccountName"] = MessageElement(res1[0]["sAMAccountName"][0], FLAG_MOD_REPLACE,
338 # And another (free) name should be possible as well
340 m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
341 m["sAMAccountName"] = MessageElement("xxx_ldaptestuser_xxx", FLAG_MOD_REPLACE,
345 # We should be able to reset our actual primary group
347 m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
348 m["primaryGroupID"] = MessageElement(str(DOMAIN_RID_USERS), FLAG_MOD_REPLACE,
352 # Try to add invalid primary group
354 m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
355 m["primaryGroupID"] = MessageElement("0", FLAG_MOD_REPLACE,
360 except LdbError, (num, _):
361 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
363 # Try to make group 1 primary - should be denied since it is not yet
366 m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
367 m["primaryGroupID"] = MessageElement(str(group_rid_1),
368 FLAG_MOD_REPLACE, "primaryGroupID")
372 except LdbError, (num, _):
373 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
375 # Make group 1 secondary
377 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
378 m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
379 FLAG_MOD_REPLACE, "member")
382 # Make group 1 primary
384 m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
385 m["primaryGroupID"] = MessageElement(str(group_rid_1),
386 FLAG_MOD_REPLACE, "primaryGroupID")
389 # Try to delete group 1 - should be denied
391 ldb.delete("cn=ldaptestgroup,cn=users," + self.base_dn)
393 except LdbError, (num, _):
394 self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
396 # Try to add group 1 also as secondary - should be denied
398 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
399 m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
400 FLAG_MOD_ADD, "member")
404 except LdbError, (num, _):
405 self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
407 # Try to add invalid member to group 1 - should be denied
409 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
410 m["member"] = MessageElement(
411 "cn=ldaptestuser3,cn=users," + self.base_dn,
412 FLAG_MOD_ADD, "member")
416 except LdbError, (num, _):
417 self.assertEquals(num, ERR_NO_SUCH_OBJECT)
419 # Make group 2 secondary
421 m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
422 m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
423 FLAG_MOD_ADD, "member")
428 m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
429 m["primaryGroupID"] = MessageElement(str(group_rid_2),
430 FLAG_MOD_REPLACE, "primaryGroupID")
433 # Swap the groups (does not really make sense but does the same)
435 m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
436 m["primaryGroupID"] = MessageElement(str(group_rid_1),
437 FLAG_MOD_REPLACE, "primaryGroupID")
438 m["primaryGroupID"] = MessageElement(str(group_rid_2),
439 FLAG_MOD_REPLACE, "primaryGroupID")
442 # Old primary group should contain a "member" attribute for the user,
443 # the new shouldn't contain anymore one
444 res1 = ldb.search("cn=ldaptestgroup, cn=users," + self.base_dn,
445 scope=SCOPE_BASE, attrs=["member"])
446 self.assertTrue(len(res1) == 1)
447 self.assertTrue(len(res1[0]["member"]) == 1)
448 self.assertEquals(res1[0]["member"][0].lower(),
449 ("cn=ldaptestuser,cn=users," + self.base_dn).lower())
451 res1 = ldb.search("cn=ldaptestgroup2, cn=users," + self.base_dn,
452 scope=SCOPE_BASE, attrs=["member"])
453 self.assertTrue(len(res1) == 1)
454 self.assertFalse("member" in res1[0])
456 # Primary group member
458 m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
459 m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
460 FLAG_MOD_DELETE, "member")
464 except LdbError, (num, _):
465 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
467 # Delete invalid group member
469 m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
470 m["member"] = MessageElement("cn=ldaptestuser1,cn=users," + self.base_dn,
471 FLAG_MOD_DELETE, "member")
475 except LdbError, (num, _):
476 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
478 # Also this should be denied
481 "dn": "cn=ldaptestuser2,cn=users," + self.base_dn,
482 "objectclass": "user",
483 "primaryGroupID": "0"})
485 except LdbError, (num, _):
486 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
488 # Recreate user accounts
490 delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
493 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
494 "objectclass": "user"})
497 "dn": "cn=ldaptestuser2,cn=users," + self.base_dn,
498 "objectclass": "user"})
501 m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
502 m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
503 FLAG_MOD_ADD, "member")
508 m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
509 m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
510 FLAG_MOD_ADD, "member")
514 except LdbError, (num, _):
515 self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
517 # Already added, but as <SID=...>
518 res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
519 scope=SCOPE_BASE, attrs=["objectSid"])
520 self.assertTrue(len(res1) == 1)
521 sid_bin = res1[0]["objectSid"][0]
522 sid_str = ("<SID=" + ldb.schema_format_value("objectSid", sid_bin) + ">").upper()
525 m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
526 m["member"] = MessageElement(sid_str, FLAG_MOD_ADD, "member")
530 except LdbError, (num, _):
531 self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
535 m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
536 m["member"] = MessageElement("cn=ldaptestuser1,cn=users," + self.base_dn,
537 FLAG_MOD_REPLACE, "member")
541 except LdbError, (num, _):
542 self.assertEquals(num, ERR_NO_SUCH_OBJECT)
546 m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
547 m["member"] = MessageElement(["cn=ldaptestuser,cn=users," + self.base_dn,
548 "cn=ldaptestuser1,cn=users," + self.base_dn],
549 FLAG_MOD_REPLACE, "member")
553 except LdbError, (num, _):
554 self.assertEquals(num, ERR_NO_SUCH_OBJECT)
558 m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
559 m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
560 FLAG_MOD_REPLACE, "member")
561 m["member"] = MessageElement("cn=ldaptestuser1,cn=users," + self.base_dn,
562 FLAG_MOD_ADD, "member")
566 except LdbError, (num, _):
567 self.assertEquals(num, ERR_NO_SUCH_OBJECT)
570 m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
571 m["member"] = MessageElement(["cn=ldaptestuser,cn=users," + self.base_dn,
572 "cn=ldaptestuser2,cn=users," + self.base_dn],
573 FLAG_MOD_REPLACE, "member")
576 delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
577 delete_force(self.ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
578 delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
579 delete_force(self.ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
581 # Make also a small test for accounts with special DNs ("," in this case)
583 "dn": "cn=ldaptest\,specialuser,cn=users," + self.base_dn,
584 "objectclass": "user"})
585 delete_force(self.ldb, "cn=ldaptest\,specialuser,cn=users," + self.base_dn)
587 def test_sam_attributes(self):
588 """Test the behaviour of special attributes of SAM objects"""
589 print "Testing the behaviour of special attributes of SAM objects\n"""
592 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
593 "objectclass": "user"})
595 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
596 "objectclass": "group"})
599 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
600 m["groupType"] = MessageElement(str(GTYPE_SECURITY_GLOBAL_GROUP), FLAG_MOD_ADD,
605 except LdbError, (num, _):
606 self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
608 # Delete protection tests
610 for attr in ["nTSecurityDescriptor", "objectSid", "sAMAccountType",
611 "sAMAccountName", "groupType"]:
614 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
615 m[attr] = MessageElement([], FLAG_MOD_REPLACE, attr)
619 except LdbError, (num, _):
620 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
623 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
624 m[attr] = MessageElement([], FLAG_MOD_DELETE, attr)
628 except LdbError, (num, _):
629 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
632 m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
633 m["primaryGroupID"] = MessageElement("513", FLAG_MOD_ADD,
638 except LdbError, (num, _):
639 self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
642 m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
643 m["userAccountControl"] = MessageElement(str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD), FLAG_MOD_ADD,
644 "userAccountControl")
648 except LdbError, (num, _):
649 self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
652 m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
653 m["objectSid"] = MessageElement("xxxxxxxxxxxxxxxx", FLAG_MOD_ADD,
658 except LdbError, (num, _):
659 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
662 m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
663 m["sAMAccountType"] = MessageElement("0", FLAG_MOD_ADD,
668 except LdbError, (num, _):
669 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
672 m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
673 m["sAMAccountName"] = MessageElement("test", FLAG_MOD_ADD,
678 except LdbError, (num, _):
679 self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
681 # Delete protection tests
683 for attr in ["nTSecurityDescriptor", "objectSid", "sAMAccountType",
684 "sAMAccountName", "primaryGroupID", "userAccountControl",
685 "accountExpires", "badPasswordTime", "badPwdCount",
686 "codePage", "countryCode", "lastLogoff", "lastLogon",
687 "logonCount", "pwdLastSet"]:
690 m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
691 m[attr] = MessageElement([], FLAG_MOD_REPLACE, attr)
695 except LdbError, (num, _):
696 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
699 m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
700 m[attr] = MessageElement([], FLAG_MOD_DELETE, attr)
704 except LdbError, (num, _):
705 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
707 delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
708 delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
710 def test_primary_group_token_constructed(self):
711 """Test the primary group token behaviour (hidden-generated-readonly attribute on groups) and some other constructed attributes"""
712 print "Testing primary group token behaviour and other constructed attributes\n"
716 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
717 "objectclass": "group",
718 "primaryGroupToken": "100"})
720 except LdbError, (num, _):
721 self.assertEquals(num, ERR_UNDEFINED_ATTRIBUTE_TYPE)
722 delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
725 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
726 "objectclass": "user"})
729 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
730 "objectclass": "group"})
732 # Testing for one invalid, and one valid operational attribute, but also the things they are built from
733 res1 = ldb.search(self.base_dn,
734 scope=SCOPE_BASE, attrs=["primaryGroupToken", "canonicalName", "objectClass", "objectSid"])
735 self.assertTrue(len(res1) == 1)
736 self.assertFalse("primaryGroupToken" in res1[0])
737 self.assertTrue("canonicalName" in res1[0])
738 self.assertTrue("objectClass" in res1[0])
739 self.assertTrue("objectSid" in res1[0])
741 res1 = ldb.search(self.base_dn,
742 scope=SCOPE_BASE, attrs=["primaryGroupToken", "canonicalName"])
743 self.assertTrue(len(res1) == 1)
744 self.assertFalse("primaryGroupToken" in res1[0])
745 self.assertFalse("objectSid" in res1[0])
746 self.assertFalse("objectClass" in res1[0])
747 self.assertTrue("canonicalName" in res1[0])
749 res1 = ldb.search("cn=users," + self.base_dn,
750 scope=SCOPE_BASE, attrs=["primaryGroupToken"])
751 self.assertTrue(len(res1) == 1)
752 self.assertFalse("primaryGroupToken" in res1[0])
754 res1 = ldb.search("cn=ldaptestuser, cn=users," + self.base_dn,
755 scope=SCOPE_BASE, attrs=["primaryGroupToken"])
756 self.assertTrue(len(res1) == 1)
757 self.assertFalse("primaryGroupToken" in res1[0])
759 res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
761 self.assertTrue(len(res1) == 1)
762 self.assertFalse("primaryGroupToken" in res1[0])
764 res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
765 scope=SCOPE_BASE, attrs=["primaryGroupToken", "objectSID"])
766 self.assertTrue(len(res1) == 1)
767 primary_group_token = int(res1[0]["primaryGroupToken"][0])
769 rid = security.dom_sid(ldb.schema_format_value("objectSID", res1[0]["objectSID"][0])).split()[1]
770 self.assertEquals(primary_group_token, rid)
773 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
774 m["primaryGroupToken"] = "100"
778 except LdbError, (num, _):
779 self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
781 delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
782 delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
784 def test_tokenGroups(self):
785 """Test the tokenGroups behaviour (hidden-generated-readonly attribute on SAM objects)"""
786 print "Testing tokenGroups behaviour\n"
788 # The domain object shouldn't contain any "tokenGroups" entry
789 res = ldb.search(self.base_dn, scope=SCOPE_BASE, attrs=["tokenGroups"])
790 self.assertTrue(len(res) == 1)
791 self.assertFalse("tokenGroups" in res[0])
793 # The domain administrator should contain "tokenGroups" entries
794 # (the exact number depends on the domain/forest function level and the
795 # DC software versions)
796 res = ldb.search("cn=Administrator,cn=Users," + self.base_dn,
797 scope=SCOPE_BASE, attrs=["tokenGroups"])
798 self.assertTrue(len(res) == 1)
799 self.assertTrue("tokenGroups" in res[0])
802 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
803 "objectclass": "user"})
805 # This testuser should contain at least two "tokenGroups" entries
806 # (exactly two on an unmodified "Domain Users" and "Users" group)
807 res = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
808 scope=SCOPE_BASE, attrs=["tokenGroups"])
809 self.assertTrue(len(res) == 1)
810 self.assertTrue(len(res[0]["tokenGroups"]) >= 2)
812 # one entry which we need to find should point to domains "Domain Users"
813 # group and another entry should point to the builtin "Users"group
814 domain_users_group_found = False
815 users_group_found = False
816 for sid in res[0]["tokenGroups"]:
817 rid = security.dom_sid(ldb.schema_format_value("objectSID", sid)).split()[1]
819 domain_users_group_found = True
821 users_group_found = True
823 self.assertTrue(domain_users_group_found)
824 self.assertTrue(users_group_found)
826 delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
828 def test_groupType(self):
829 """Test the groupType behaviour"""
830 print "Testing groupType behaviour\n"
832 # You can never create or change to a
833 # "GTYPE_SECURITY_BUILTIN_LOCAL_GROUP"
840 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
841 "objectclass": "group",
844 except LdbError, (num, _):
845 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
846 delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
850 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
851 "objectclass": "group",
852 "groupType": str(GTYPE_SECURITY_BUILTIN_LOCAL_GROUP)})
854 except LdbError, (num, _):
855 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
856 delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
859 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
860 "objectclass": "group",
861 "groupType": str(GTYPE_SECURITY_GLOBAL_GROUP)})
863 res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
864 scope=SCOPE_BASE, attrs=["sAMAccountType"])
865 self.assertTrue(len(res1) == 1)
866 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
867 ATYPE_SECURITY_GLOBAL_GROUP)
868 delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
871 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
872 "objectclass": "group",
873 "groupType": str(GTYPE_SECURITY_UNIVERSAL_GROUP)})
875 res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
876 scope=SCOPE_BASE, attrs=["sAMAccountType"])
877 self.assertTrue(len(res1) == 1)
878 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
879 ATYPE_SECURITY_UNIVERSAL_GROUP)
880 delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
883 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
884 "objectclass": "group",
885 "groupType": str(GTYPE_SECURITY_DOMAIN_LOCAL_GROUP)})
887 res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
888 scope=SCOPE_BASE, attrs=["sAMAccountType"])
889 self.assertTrue(len(res1) == 1)
890 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
891 ATYPE_SECURITY_LOCAL_GROUP)
892 delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
895 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
896 "objectclass": "group",
897 "groupType": str(GTYPE_DISTRIBUTION_GLOBAL_GROUP)})
899 res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
900 scope=SCOPE_BASE, attrs=["sAMAccountType"])
901 self.assertTrue(len(res1) == 1)
902 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
903 ATYPE_DISTRIBUTION_GLOBAL_GROUP)
904 delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
907 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
908 "objectclass": "group",
909 "groupType": str(GTYPE_DISTRIBUTION_UNIVERSAL_GROUP)})
911 res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
912 scope=SCOPE_BASE, attrs=["sAMAccountType"])
913 self.assertTrue(len(res1) == 1)
914 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
915 ATYPE_DISTRIBUTION_UNIVERSAL_GROUP)
916 delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
919 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
920 "objectclass": "group",
921 "groupType": str(GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP)})
923 res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
924 scope=SCOPE_BASE, attrs=["sAMAccountType"])
925 self.assertTrue(len(res1) == 1)
926 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
927 ATYPE_DISTRIBUTION_LOCAL_GROUP)
928 delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
933 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
934 "objectclass": "group"})
936 # We can change in this direction: global <-> universal <-> local
937 # On each step also the group type itself (security/distribution) is
940 # After creation we should have a "security global group"
941 res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
942 scope=SCOPE_BASE, attrs=["sAMAccountType"])
943 self.assertTrue(len(res1) == 1)
944 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
945 ATYPE_SECURITY_GLOBAL_GROUP)
950 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
951 m["groupType"] = MessageElement("0",
952 FLAG_MOD_REPLACE, "groupType")
955 except LdbError, (num, _):
956 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
960 # Default is "global group"
963 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
964 m["groupType"] = MessageElement(
965 str(GTYPE_SECURITY_GLOBAL_GROUP),
966 FLAG_MOD_REPLACE, "groupType")
969 res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
970 scope=SCOPE_BASE, attrs=["sAMAccountType"])
971 self.assertTrue(len(res1) == 1)
972 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
973 ATYPE_SECURITY_GLOBAL_GROUP)
975 # Change to "local" (shouldn't work)
979 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
980 m["groupType"] = MessageElement(
981 str(GTYPE_SECURITY_DOMAIN_LOCAL_GROUP),
982 FLAG_MOD_REPLACE, "groupType")
985 except LdbError, (num, _):
986 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
988 # Change to "universal"
991 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
992 m["groupType"] = MessageElement(
993 str(GTYPE_SECURITY_UNIVERSAL_GROUP),
994 FLAG_MOD_REPLACE, "groupType")
997 res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
998 scope=SCOPE_BASE, attrs=["sAMAccountType"])
999 self.assertTrue(len(res1) == 1)
1000 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1001 ATYPE_SECURITY_UNIVERSAL_GROUP)
1003 # Change back to "global"
1006 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1007 m["groupType"] = MessageElement(
1008 str(GTYPE_SECURITY_GLOBAL_GROUP),
1009 FLAG_MOD_REPLACE, "groupType")
1012 res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1013 scope=SCOPE_BASE, attrs=["sAMAccountType"])
1014 self.assertTrue(len(res1) == 1)
1015 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1016 ATYPE_SECURITY_GLOBAL_GROUP)
1018 # Change back to "universal"
1021 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1022 m["groupType"] = MessageElement(
1023 str(GTYPE_SECURITY_UNIVERSAL_GROUP),
1024 FLAG_MOD_REPLACE, "groupType")
1027 res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1028 scope=SCOPE_BASE, attrs=["sAMAccountType"])
1029 self.assertTrue(len(res1) == 1)
1030 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1031 ATYPE_SECURITY_UNIVERSAL_GROUP)
1036 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1037 m["groupType"] = MessageElement(
1038 str(GTYPE_SECURITY_DOMAIN_LOCAL_GROUP),
1039 FLAG_MOD_REPLACE, "groupType")
1042 res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1043 scope=SCOPE_BASE, attrs=["sAMAccountType"])
1044 self.assertTrue(len(res1) == 1)
1045 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1046 ATYPE_SECURITY_LOCAL_GROUP)
1048 # Change to "global" (shouldn't work)
1052 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1053 m["groupType"] = MessageElement(
1054 str(GTYPE_SECURITY_GLOBAL_GROUP),
1055 FLAG_MOD_REPLACE, "groupType")
1058 except LdbError, (num, _):
1059 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1061 # Change to "builtin local" (shouldn't work)
1065 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1066 m["groupType"] = MessageElement(
1067 str(GTYPE_SECURITY_BUILTIN_LOCAL_GROUP),
1068 FLAG_MOD_REPLACE, "groupType")
1071 except LdbError, (num, _):
1072 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1075 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1077 # Change back to "universal"
1080 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1081 m["groupType"] = MessageElement(
1082 str(GTYPE_SECURITY_UNIVERSAL_GROUP),
1083 FLAG_MOD_REPLACE, "groupType")
1086 res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1087 scope=SCOPE_BASE, attrs=["sAMAccountType"])
1088 self.assertTrue(len(res1) == 1)
1089 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1090 ATYPE_SECURITY_UNIVERSAL_GROUP)
1092 # Change to "builtin local" (shouldn't work)
1096 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1097 m["groupType"] = MessageElement(
1098 str(GTYPE_SECURITY_BUILTIN_LOCAL_GROUP),
1099 FLAG_MOD_REPLACE, "groupType")
1102 except LdbError, (num, _):
1103 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1105 # Change back to "global"
1108 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1109 m["groupType"] = MessageElement(
1110 str(GTYPE_SECURITY_GLOBAL_GROUP),
1111 FLAG_MOD_REPLACE, "groupType")
1114 res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1115 scope=SCOPE_BASE, attrs=["sAMAccountType"])
1116 self.assertTrue(len(res1) == 1)
1117 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1118 ATYPE_SECURITY_GLOBAL_GROUP)
1120 # Change to "builtin local" (shouldn't work)
1124 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1125 m["groupType"] = MessageElement(
1126 str(GTYPE_SECURITY_BUILTIN_LOCAL_GROUP),
1127 FLAG_MOD_REPLACE, "groupType")
1130 except LdbError, (num, _):
1131 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1133 # Distribution groups
1135 # Default is "global group"
1138 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1139 m["groupType"] = MessageElement(
1140 str(GTYPE_DISTRIBUTION_GLOBAL_GROUP),
1141 FLAG_MOD_REPLACE, "groupType")
1144 res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1145 scope=SCOPE_BASE, attrs=["sAMAccountType"])
1146 self.assertTrue(len(res1) == 1)
1147 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1148 ATYPE_DISTRIBUTION_GLOBAL_GROUP)
1150 # Change to local (shouldn't work)
1154 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1155 m["groupType"] = MessageElement(
1156 str(GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP),
1157 FLAG_MOD_REPLACE, "groupType")
1160 except LdbError, (num, _):
1161 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1163 # Change to "universal"
1166 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1167 m["groupType"] = MessageElement(
1168 str(GTYPE_DISTRIBUTION_UNIVERSAL_GROUP),
1169 FLAG_MOD_REPLACE, "groupType")
1172 res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1173 scope=SCOPE_BASE, attrs=["sAMAccountType"])
1174 self.assertTrue(len(res1) == 1)
1175 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1176 ATYPE_DISTRIBUTION_UNIVERSAL_GROUP)
1178 # Change back to "global"
1181 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1182 m["groupType"] = MessageElement(
1183 str(GTYPE_DISTRIBUTION_GLOBAL_GROUP),
1184 FLAG_MOD_REPLACE, "groupType")
1187 res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1188 scope=SCOPE_BASE, attrs=["sAMAccountType"])
1189 self.assertTrue(len(res1) == 1)
1190 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1191 ATYPE_DISTRIBUTION_GLOBAL_GROUP)
1193 # Change back to "universal"
1196 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1197 m["groupType"] = MessageElement(
1198 str(GTYPE_DISTRIBUTION_UNIVERSAL_GROUP),
1199 FLAG_MOD_REPLACE, "groupType")
1202 res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1203 scope=SCOPE_BASE, attrs=["sAMAccountType"])
1204 self.assertTrue(len(res1) == 1)
1205 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1206 ATYPE_DISTRIBUTION_UNIVERSAL_GROUP)
1211 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1212 m["groupType"] = MessageElement(
1213 str(GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP),
1214 FLAG_MOD_REPLACE, "groupType")
1217 res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1218 scope=SCOPE_BASE, attrs=["sAMAccountType"])
1219 self.assertTrue(len(res1) == 1)
1220 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1221 ATYPE_DISTRIBUTION_LOCAL_GROUP)
1223 # Change to "global" (shouldn't work)
1227 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1228 m["groupType"] = MessageElement(
1229 str(GTYPE_DISTRIBUTION_GLOBAL_GROUP),
1230 FLAG_MOD_REPLACE, "groupType")
1233 except LdbError, (num, _):
1234 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1236 # Change back to "universal"
1238 # Try to add invalid member to group 1 - should be denied
1240 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1241 m["member"] = MessageElement(
1242 "cn=ldaptestuser3,cn=users," + self.base_dn,
1243 FLAG_MOD_ADD, "member")
1247 except LdbError, (num, _):
1248 self.assertEquals(num, ERR_NO_SUCH_OBJECT)
1250 # Make group 2 secondary
1252 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1253 m["groupType"] = MessageElement(
1254 str(GTYPE_DISTRIBUTION_UNIVERSAL_GROUP),
1255 FLAG_MOD_REPLACE, "groupType")
1258 res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1259 scope=SCOPE_BASE, attrs=["sAMAccountType"])
1260 self.assertTrue(len(res1) == 1)
1261 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1262 ATYPE_DISTRIBUTION_UNIVERSAL_GROUP)
1264 # Change back to "global"
1267 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1268 m["groupType"] = MessageElement(
1269 str(GTYPE_DISTRIBUTION_GLOBAL_GROUP),
1270 FLAG_MOD_REPLACE, "groupType")
1273 res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1274 scope=SCOPE_BASE, attrs=["sAMAccountType"])
1275 self.assertTrue(len(res1) == 1)
1276 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1277 ATYPE_DISTRIBUTION_GLOBAL_GROUP)
1279 # Both group types: this performs only random checks - all possibilities
1280 # would require too much code.
1282 # Default is "global group"
1285 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1286 m["groupType"] = MessageElement(
1287 str(GTYPE_SECURITY_GLOBAL_GROUP),
1288 FLAG_MOD_REPLACE, "groupType")
1291 res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1292 scope=SCOPE_BASE, attrs=["sAMAccountType"])
1293 self.assertTrue(len(res1) == 1)
1294 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1295 ATYPE_SECURITY_GLOBAL_GROUP)
1297 # Change to "local" (shouldn't work)
1301 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1302 m["groupType"] = MessageElement(
1303 str(GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP),
1304 FLAG_MOD_REPLACE, "groupType")
1307 except LdbError, (num, _):
1308 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1310 # Change to "universal"
1313 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1314 m["groupType"] = MessageElement(
1315 str(GTYPE_DISTRIBUTION_UNIVERSAL_GROUP),
1316 FLAG_MOD_REPLACE, "groupType")
1319 res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1320 scope=SCOPE_BASE, attrs=["sAMAccountType"])
1321 self.assertTrue(len(res1) == 1)
1322 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1323 ATYPE_DISTRIBUTION_UNIVERSAL_GROUP)
1325 # Change back to "global"
1328 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1329 m["groupType"] = MessageElement(
1330 str(GTYPE_SECURITY_GLOBAL_GROUP),
1331 FLAG_MOD_REPLACE, "groupType")
1334 res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1335 scope=SCOPE_BASE, attrs=["sAMAccountType"])
1336 self.assertTrue(len(res1) == 1)
1337 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1338 ATYPE_SECURITY_GLOBAL_GROUP)
1340 # Change back to "universal"
1343 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1344 m["groupType"] = MessageElement(
1345 str(GTYPE_SECURITY_UNIVERSAL_GROUP),
1346 FLAG_MOD_REPLACE, "groupType")
1349 res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1350 scope=SCOPE_BASE, attrs=["sAMAccountType"])
1351 self.assertTrue(len(res1) == 1)
1352 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1353 ATYPE_SECURITY_UNIVERSAL_GROUP)
1358 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1359 m["groupType"] = MessageElement(
1360 str(GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP),
1361 FLAG_MOD_REPLACE, "groupType")
1364 res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1365 scope=SCOPE_BASE, attrs=["sAMAccountType"])
1366 self.assertTrue(len(res1) == 1)
1367 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1368 ATYPE_DISTRIBUTION_LOCAL_GROUP)
1370 # Change to "global" (shouldn't work)
1374 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1375 m["groupType"] = MessageElement(
1376 str(GTYPE_DISTRIBUTION_GLOBAL_GROUP),
1377 FLAG_MOD_REPLACE, "groupType")
1380 except LdbError, (num, _):
1381 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1383 # Change back to "universal"
1386 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1387 m["groupType"] = MessageElement(
1388 str(GTYPE_SECURITY_UNIVERSAL_GROUP),
1389 FLAG_MOD_REPLACE, "groupType")
1392 res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1393 scope=SCOPE_BASE, attrs=["sAMAccountType"])
1394 self.assertTrue(len(res1) == 1)
1395 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1396 ATYPE_SECURITY_UNIVERSAL_GROUP)
1398 # Change back to "global"
1401 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1402 m["groupType"] = MessageElement(
1403 str(GTYPE_SECURITY_GLOBAL_GROUP),
1404 FLAG_MOD_REPLACE, "groupType")
1407 res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1408 scope=SCOPE_BASE, attrs=["sAMAccountType"])
1409 self.assertTrue(len(res1) == 1)
1410 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1411 ATYPE_SECURITY_GLOBAL_GROUP)
1413 delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1415 def test_userAccountControl(self):
1416 """Test the userAccountControl behaviour"""
1417 print "Testing userAccountControl behaviour\n"
1419 # With a user object
1423 # As user you can only set a normal account.
1424 # The UF_PASSWD_NOTREQD flag is needed since we haven't requested a
1426 # With SYSTEM rights you can set a interdomain trust account.
1431 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1432 "objectclass": "user",
1433 "userAccountControl": "0"})
1435 except LdbError, (num, _):
1436 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1437 delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1439 # This has to wait until s4 supports it (needs a password module change)
1442 # "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1443 # "objectclass": "user",
1444 # "userAccountControl": str(UF_NORMAL_ACCOUNT)})
1446 # except LdbError, (num, _):
1447 # self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1448 # delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1451 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1452 "objectclass": "user",
1453 "userAccountControl": str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD)})
1455 res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1457 attrs=["sAMAccountType", "userAccountControl"])
1458 self.assertTrue(len(res1) == 1)
1459 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1460 ATYPE_NORMAL_ACCOUNT)
1461 self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_ACCOUNTDISABLE == 0)
1462 delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1466 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1467 "objectclass": "user",
1468 "userAccountControl": str(UF_TEMP_DUPLICATE_ACCOUNT)})
1470 except LdbError, (num, _):
1471 self.assertEquals(num, ERR_OTHER)
1472 delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1476 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1477 "objectclass": "user",
1478 "userAccountControl": str(UF_SERVER_TRUST_ACCOUNT)})
1480 except LdbError, (num, _):
1481 self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
1482 delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1486 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1487 "objectclass": "user",
1488 "userAccountControl": str(UF_WORKSTATION_TRUST_ACCOUNT)})
1489 except LdbError, (num, _):
1490 self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
1491 delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1495 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1496 "objectclass": "user",
1497 "userAccountControl": str(UF_WORKSTATION_TRUST_ACCOUNT | UF_PARTIAL_SECRETS_ACCOUNT)})
1498 except LdbError, (num, _):
1499 self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
1500 delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1502 # This isn't supported yet in s4 - needs ACL module adaption
1505 # "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1506 # "objectclass": "user",
1507 # "userAccountControl": str(UF_INTERDOMAIN_TRUST_ACCOUNT)})
1509 # except LdbError, (num, _):
1510 # self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
1511 # delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1516 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1517 "objectclass": "user"})
1519 # After creation we should have a normal account
1520 res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1522 attrs=["sAMAccountType", "userAccountControl"])
1523 self.assertTrue(len(res1) == 1)
1524 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1525 ATYPE_NORMAL_ACCOUNT)
1526 self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_ACCOUNTDISABLE != 0)
1528 # As user you can only switch from a normal account to a workstation
1529 # trust account and back.
1530 # The UF_PASSWD_NOTREQD flag is needed since we haven't requested a
1532 # With SYSTEM rights you can switch to a interdomain trust account.
1537 m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1538 m["userAccountControl"] = MessageElement("0",
1539 FLAG_MOD_REPLACE, "userAccountControl")
1541 except LdbError, (num, _):
1542 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1544 # This has to wait until s4 supports it (needs a password module change)
1547 # m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1548 # m["userAccountControl"] = MessageElement(
1549 # str(UF_NORMAL_ACCOUNT),
1550 # FLAG_MOD_REPLACE, "userAccountControl")
1552 # except LdbError, (num, _):
1553 # self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1556 m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1557 m["userAccountControl"] = MessageElement(
1558 str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD),
1559 FLAG_MOD_REPLACE, "userAccountControl")
1562 res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1564 attrs=["sAMAccountType", "userAccountControl"])
1565 self.assertTrue(len(res1) == 1)
1566 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1567 ATYPE_NORMAL_ACCOUNT)
1568 self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_ACCOUNTDISABLE == 0)
1572 m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1573 m["userAccountControl"] = MessageElement(
1574 str(UF_TEMP_DUPLICATE_ACCOUNT),
1575 FLAG_MOD_REPLACE, "userAccountControl")
1578 except LdbError, (num, _):
1579 self.assertEquals(num, ERR_OTHER)
1583 m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1584 m["userAccountControl"] = MessageElement(
1585 str(UF_SERVER_TRUST_ACCOUNT),
1586 FLAG_MOD_REPLACE, "userAccountControl")
1589 except LdbError, (num, _):
1590 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1593 m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1594 m["userAccountControl"] = MessageElement(
1595 str(UF_WORKSTATION_TRUST_ACCOUNT),
1596 FLAG_MOD_REPLACE, "userAccountControl")
1601 m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1602 m["userAccountControl"] = MessageElement(
1603 str(UF_WORKSTATION_TRUST_ACCOUNT | UF_PARTIAL_SECRETS_ACCOUNT),
1604 FLAG_MOD_REPLACE, "userAccountControl")
1607 except LdbError, (num, _):
1608 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1610 res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1611 scope=SCOPE_BASE, attrs=["sAMAccountType"])
1612 self.assertTrue(len(res1) == 1)
1613 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1614 ATYPE_WORKSTATION_TRUST)
1617 m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1618 m["userAccountControl"] = MessageElement(
1619 str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD),
1620 FLAG_MOD_REPLACE, "userAccountControl")
1623 res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1624 scope=SCOPE_BASE, attrs=["sAMAccountType"])
1625 self.assertTrue(len(res1) == 1)
1626 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1627 ATYPE_NORMAL_ACCOUNT)
1629 # This isn't supported yet in s4 - needs ACL module adaption
1632 # m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1633 # m["userAccountControl"] = MessageElement(
1634 # str(UF_INTERDOMAIN_TRUST_ACCOUNT),
1635 # FLAG_MOD_REPLACE, "userAccountControl")
1638 # except LdbError, (num, _):
1639 # self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
1641 # With a computer object
1645 # As computer you can set a normal account and a server trust account.
1646 # The UF_PASSWD_NOTREQD flag is needed since we haven't requested a
1648 # With SYSTEM rights you can set a interdomain trust account.
1653 "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1654 "objectclass": "computer",
1655 "userAccountControl": "0"})
1657 except LdbError, (num, _):
1658 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1659 delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1661 # This has to wait until s4 supports it (needs a password module change)
1664 # "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1665 # "objectclass": "computer",
1666 # "userAccountControl": str(UF_NORMAL_ACCOUNT)})
1668 # except LdbError, (num, _):
1669 # self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1670 # delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1673 "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1674 "objectclass": "computer",
1675 "userAccountControl": str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD)})
1677 res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1679 attrs=["sAMAccountType", "userAccountControl"])
1680 self.assertTrue(len(res1) == 1)
1681 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1682 ATYPE_NORMAL_ACCOUNT)
1683 self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_ACCOUNTDISABLE == 0)
1684 delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1688 "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1689 "objectclass": "computer",
1690 "userAccountControl": str(UF_TEMP_DUPLICATE_ACCOUNT)})
1692 except LdbError, (num, _):
1693 self.assertEquals(num, ERR_OTHER)
1694 delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1697 "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1698 "objectclass": "computer",
1699 "userAccountControl": str(UF_SERVER_TRUST_ACCOUNT)})
1701 res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1702 scope=SCOPE_BASE, attrs=["sAMAccountType"])
1703 self.assertTrue(len(res1) == 1)
1704 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1705 ATYPE_WORKSTATION_TRUST)
1706 delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1710 "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1711 "objectclass": "computer",
1712 "userAccountControl": str(UF_WORKSTATION_TRUST_ACCOUNT)})
1713 except LdbError, (num, _):
1714 self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
1715 delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1717 # This isn't supported yet in s4 - needs ACL module adaption
1720 # "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1721 # "objectclass": "computer",
1722 # "userAccountControl": str(UF_INTERDOMAIN_TRUST_ACCOUNT)})
1724 # except LdbError, (num, _):
1725 # self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
1726 # delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1731 "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1732 "objectclass": "computer"})
1734 # After creation we should have a normal account
1735 res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1737 attrs=["sAMAccountType", "userAccountControl"])
1738 self.assertTrue(len(res1) == 1)
1739 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1740 ATYPE_NORMAL_ACCOUNT)
1741 self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_ACCOUNTDISABLE != 0)
1743 # As computer you can switch from a normal account to a workstation
1744 # or server trust account and back (also swapping between trust
1745 # accounts is allowed).
1746 # The UF_PASSWD_NOTREQD flag is needed since we haven't requested a
1748 # With SYSTEM rights you can switch to a interdomain trust account.
1753 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1754 m["userAccountControl"] = MessageElement("0",
1755 FLAG_MOD_REPLACE, "userAccountControl")
1757 except LdbError, (num, _):
1758 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1760 # This has to wait until s4 supports it (needs a password module change)
1763 # m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1764 # m["userAccountControl"] = MessageElement(
1765 # str(UF_NORMAL_ACCOUNT),
1766 # FLAG_MOD_REPLACE, "userAccountControl")
1768 # except LdbError, (num, _):
1769 # self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1772 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1773 m["userAccountControl"] = MessageElement(
1774 str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD),
1775 FLAG_MOD_REPLACE, "userAccountControl")
1778 res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1780 attrs=["sAMAccountType", "userAccountControl"])
1781 self.assertTrue(len(res1) == 1)
1782 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1783 ATYPE_NORMAL_ACCOUNT)
1784 self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_ACCOUNTDISABLE == 0)
1788 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1789 m["userAccountControl"] = MessageElement(
1790 str(UF_TEMP_DUPLICATE_ACCOUNT),
1791 FLAG_MOD_REPLACE, "userAccountControl")
1794 except LdbError, (num, _):
1795 self.assertEquals(num, ERR_OTHER)
1798 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1799 m["userAccountControl"] = MessageElement(
1800 str(UF_SERVER_TRUST_ACCOUNT),
1801 FLAG_MOD_REPLACE, "userAccountControl")
1804 res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1805 scope=SCOPE_BASE, attrs=["sAMAccountType"])
1806 self.assertTrue(len(res1) == 1)
1807 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1808 ATYPE_WORKSTATION_TRUST)
1811 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1812 m["userAccountControl"] = MessageElement(
1813 str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD),
1814 FLAG_MOD_REPLACE, "userAccountControl")
1817 res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1818 scope=SCOPE_BASE, attrs=["sAMAccountType"])
1819 self.assertTrue(len(res1) == 1)
1820 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1821 ATYPE_NORMAL_ACCOUNT)
1824 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1825 m["userAccountControl"] = MessageElement(
1826 str(UF_WORKSTATION_TRUST_ACCOUNT),
1827 FLAG_MOD_REPLACE, "userAccountControl")
1830 res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1831 scope=SCOPE_BASE, attrs=["sAMAccountType"])
1832 self.assertTrue(len(res1) == 1)
1833 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1834 ATYPE_WORKSTATION_TRUST)
1837 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1838 m["userAccountControl"] = MessageElement(
1839 str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD),
1840 FLAG_MOD_REPLACE, "userAccountControl")
1843 res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1844 scope=SCOPE_BASE, attrs=["sAMAccountType"])
1845 self.assertTrue(len(res1) == 1)
1846 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1847 ATYPE_NORMAL_ACCOUNT)
1850 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1851 m["userAccountControl"] = MessageElement(
1852 str(UF_SERVER_TRUST_ACCOUNT),
1853 FLAG_MOD_REPLACE, "userAccountControl")
1856 res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1857 scope=SCOPE_BASE, attrs=["sAMAccountType"])
1858 self.assertTrue(len(res1) == 1)
1859 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1860 ATYPE_WORKSTATION_TRUST)
1863 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1864 m["userAccountControl"] = MessageElement(
1865 str(UF_WORKSTATION_TRUST_ACCOUNT),
1866 FLAG_MOD_REPLACE, "userAccountControl")
1869 res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1870 scope=SCOPE_BASE, attrs=["sAMAccountType"])
1871 self.assertTrue(len(res1) == 1)
1872 self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1873 ATYPE_WORKSTATION_TRUST)
1875 # This isn't supported yet in s4 - needs ACL module adaption
1878 # m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1879 # m["userAccountControl"] = MessageElement(
1880 # str(UF_INTERDOMAIN_TRUST_ACCOUNT),
1881 # FLAG_MOD_REPLACE, "userAccountControl")
1884 # except LdbError, (num, _):
1885 # self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
1887 # "primaryGroupID" does not change if account type remains the same
1889 # For a user account
1892 "dn": "cn=ldaptestuser2,cn=users," + self.base_dn,
1893 "objectclass": "user",
1894 "userAccountControl": str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD | UF_ACCOUNTDISABLE)})
1896 res1 = ldb.search("cn=ldaptestuser2,cn=users," + self.base_dn,
1898 attrs=["userAccountControl"])
1899 self.assertTrue(len(res1) == 1)
1900 self.assertEquals(int(res1[0]["userAccountControl"][0]),
1901 UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD | UF_ACCOUNTDISABLE)
1904 m.dn = Dn(ldb, "<SID=" + ldb.get_domain_sid() + "-" + str(DOMAIN_RID_ADMINS) + ">")
1905 m["member"] = MessageElement(
1906 "cn=ldaptestuser2,cn=users," + self.base_dn, FLAG_MOD_ADD, "member")
1910 m.dn = Dn(ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
1911 m["primaryGroupID"] = MessageElement(str(DOMAIN_RID_ADMINS),
1912 FLAG_MOD_REPLACE, "primaryGroupID")
1916 m.dn = Dn(ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
1917 m["userAccountControl"] = MessageElement(
1918 str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD),
1919 FLAG_MOD_REPLACE, "userAccountControl")
1922 res1 = ldb.search("cn=ldaptestuser2,cn=users," + self.base_dn,
1924 attrs=["userAccountControl", "primaryGroupID"])
1925 self.assertTrue(len(res1) == 1)
1926 self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_ACCOUNTDISABLE == 0)
1927 self.assertEquals(int(res1[0]["primaryGroupID"][0]), DOMAIN_RID_ADMINS)
1929 # For a workstation account
1931 res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1933 attrs=["primaryGroupID"])
1934 self.assertTrue(len(res1) == 1)
1935 self.assertEquals(int(res1[0]["primaryGroupID"][0]), DOMAIN_RID_DOMAIN_MEMBERS)
1938 m.dn = Dn(ldb, "<SID=" + ldb.get_domain_sid() + "-" + str(DOMAIN_RID_USERS) + ">")
1939 m["member"] = MessageElement(
1940 "cn=ldaptestcomputer,cn=computers," + self.base_dn, FLAG_MOD_ADD, "member")
1944 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1945 m["primaryGroupID"] = MessageElement(str(DOMAIN_RID_USERS),
1946 FLAG_MOD_REPLACE, "primaryGroupID")
1950 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1951 m["userAccountControl"] = MessageElement(
1952 str(UF_WORKSTATION_TRUST_ACCOUNT),
1953 FLAG_MOD_REPLACE, "userAccountControl")
1956 res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1958 attrs=["primaryGroupID"])
1959 self.assertTrue(len(res1) == 1)
1960 self.assertEquals(int(res1[0]["primaryGroupID"][0]), DOMAIN_RID_USERS)
1962 delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1963 delete_force(self.ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
1964 delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1966 def test_isCriticalSystemObject(self):
1967 """Test the isCriticalSystemObject behaviour"""
1968 print "Testing isCriticalSystemObject behaviour\n"
1973 "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1974 "objectclass": "computer"})
1976 res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1978 attrs=["isCriticalSystemObject"])
1979 self.assertTrue(len(res1) == 1)
1980 self.assertTrue("isCriticalSystemObject" not in res1[0])
1982 delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1985 "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1986 "objectclass": "computer",
1987 "userAccountControl": str(UF_WORKSTATION_TRUST_ACCOUNT)})
1989 res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1991 attrs=["isCriticalSystemObject"])
1992 self.assertTrue(len(res1) == 1)
1993 self.assertEquals(res1[0]["isCriticalSystemObject"][0], "FALSE")
1995 delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1998 "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1999 "objectclass": "computer",
2000 "userAccountControl": str(UF_WORKSTATION_TRUST_ACCOUNT | UF_PARTIAL_SECRETS_ACCOUNT)})
2002 res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2004 attrs=["isCriticalSystemObject"])
2005 self.assertTrue(len(res1) == 1)
2006 self.assertEquals(res1[0]["isCriticalSystemObject"][0], "TRUE")
2008 delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2011 "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2012 "objectclass": "computer",
2013 "userAccountControl": str(UF_SERVER_TRUST_ACCOUNT)})
2015 res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2017 attrs=["isCriticalSystemObject"])
2018 self.assertTrue(len(res1) == 1)
2019 self.assertEquals(res1[0]["isCriticalSystemObject"][0], "TRUE")
2021 # Modification tests
2024 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2025 m["userAccountControl"] = MessageElement(str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD),
2026 FLAG_MOD_REPLACE, "userAccountControl")
2029 res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2031 attrs=["isCriticalSystemObject"])
2032 self.assertTrue(len(res1) == 1)
2033 self.assertEquals(res1[0]["isCriticalSystemObject"][0], "TRUE")
2036 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2037 m["userAccountControl"] = MessageElement(str(UF_WORKSTATION_TRUST_ACCOUNT),
2038 FLAG_MOD_REPLACE, "userAccountControl")
2041 res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2043 attrs=["isCriticalSystemObject"])
2044 self.assertTrue(len(res1) == 1)
2045 self.assertEquals(res1[0]["isCriticalSystemObject"][0], "FALSE")
2048 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2049 m["userAccountControl"] = MessageElement(
2050 str(UF_WORKSTATION_TRUST_ACCOUNT | UF_PARTIAL_SECRETS_ACCOUNT),
2051 FLAG_MOD_REPLACE, "userAccountControl")
2054 res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2056 attrs=["isCriticalSystemObject"])
2057 self.assertTrue(len(res1) == 1)
2058 self.assertEquals(res1[0]["isCriticalSystemObject"][0], "TRUE")
2061 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2062 m["userAccountControl"] = MessageElement(str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD),
2063 FLAG_MOD_REPLACE, "userAccountControl")
2066 res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2068 attrs=["isCriticalSystemObject"])
2069 self.assertTrue(len(res1) == 1)
2070 self.assertEquals(res1[0]["isCriticalSystemObject"][0], "TRUE")
2073 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2074 m["userAccountControl"] = MessageElement(str(UF_SERVER_TRUST_ACCOUNT),
2075 FLAG_MOD_REPLACE, "userAccountControl")
2078 res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2080 attrs=["isCriticalSystemObject"])
2081 self.assertTrue(len(res1) == 1)
2082 self.assertEquals(res1[0]["isCriticalSystemObject"][0], "TRUE")
2085 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2086 m["userAccountControl"] = MessageElement(str(UF_WORKSTATION_TRUST_ACCOUNT),
2087 FLAG_MOD_REPLACE, "userAccountControl")
2090 res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2092 attrs=["isCriticalSystemObject"])
2093 self.assertTrue(len(res1) == 1)
2094 self.assertEquals(res1[0]["isCriticalSystemObject"][0], "FALSE")
2096 delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2098 def test_service_principal_name_updates(self):
2099 """Test the servicePrincipalNames update behaviour"""
2100 print "Testing servicePrincipalNames update behaviour\n"
2103 "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2104 "objectclass": "computer",
2105 "dNSHostName": "testname.testdom"})
2107 res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2108 scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2109 self.assertTrue(len(res) == 1)
2110 self.assertFalse("servicePrincipalName" in res[0])
2112 delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2115 "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2116 "objectclass": "computer",
2117 "servicePrincipalName": "HOST/testname.testdom"})
2119 res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2120 scope=SCOPE_BASE, attrs=["dNSHostName"])
2121 self.assertTrue(len(res) == 1)
2122 self.assertFalse("dNSHostName" in res[0])
2124 delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2127 "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2128 "objectclass": "computer",
2129 "dNSHostName": "testname2.testdom",
2130 "servicePrincipalName": "HOST/testname.testdom"})
2132 res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2133 scope=SCOPE_BASE, attrs=["dNSHostName"])
2134 self.assertTrue(len(res) == 1)
2135 self.assertEquals(res[0]["dNSHostName"][0], "testname2.testdom")
2137 res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2138 scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2139 self.assertTrue(len(res) == 1)
2140 self.assertEquals(res[0]["servicePrincipalName"][0],
2141 "HOST/testname.testdom")
2144 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2145 m["dNSHostName"] = MessageElement("testname.testdoM",
2146 FLAG_MOD_REPLACE, "dNSHostName")
2149 res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2150 scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2151 self.assertTrue(len(res) == 1)
2152 self.assertEquals(res[0]["servicePrincipalName"][0],
2153 "HOST/testname.testdom")
2156 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2157 m["dNSHostName"] = MessageElement("testname2.testdom2",
2158 FLAG_MOD_REPLACE, "dNSHostName")
2161 res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2162 scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2163 self.assertTrue(len(res) == 1)
2164 self.assertEquals(res[0]["servicePrincipalName"][0],
2165 "HOST/testname2.testdom2")
2168 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2169 m["dNSHostName"] = MessageElement([],
2170 FLAG_MOD_DELETE, "dNSHostName")
2173 res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2174 scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2175 self.assertTrue(len(res) == 1)
2176 self.assertEquals(res[0]["servicePrincipalName"][0],
2177 "HOST/testname2.testdom2")
2180 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2181 m["dNSHostName"] = MessageElement("testname.testdom3",
2182 FLAG_MOD_REPLACE, "dNSHostName")
2185 res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2186 scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2187 self.assertTrue(len(res) == 1)
2188 self.assertEquals(res[0]["servicePrincipalName"][0],
2189 "HOST/testname2.testdom2")
2192 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2193 m["dNSHostName"] = MessageElement("testname2.testdom2",
2194 FLAG_MOD_REPLACE, "dNSHostName")
2198 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2199 m["dNSHostName"] = MessageElement("testname3.testdom3",
2200 FLAG_MOD_REPLACE, "dNSHostName")
2201 m["servicePrincipalName"] = MessageElement("HOST/testname2.testdom2",
2203 "servicePrincipalName")
2206 res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2207 scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2208 self.assertTrue(len(res) == 1)
2209 self.assertEquals(res[0]["servicePrincipalName"][0],
2210 "HOST/testname3.testdom3")
2213 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2214 m["servicePrincipalName"] = MessageElement("HOST/testname2.testdom2",
2216 "servicePrincipalName")
2217 m["dNSHostName"] = MessageElement("testname4.testdom4",
2218 FLAG_MOD_REPLACE, "dNSHostName")
2221 res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2222 scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2223 self.assertTrue(len(res) == 1)
2224 self.assertEquals(res[0]["servicePrincipalName"][0],
2225 "HOST/testname2.testdom2")
2228 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2229 m["servicePrincipalName"] = MessageElement([],
2231 "servicePrincipalName")
2235 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2236 m["dNSHostName"] = MessageElement("testname2.testdom2",
2237 FLAG_MOD_REPLACE, "dNSHostName")
2240 res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2241 scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2242 self.assertTrue(len(res) == 1)
2243 self.assertFalse("servicePrincipalName" in res[0])
2245 delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2248 "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2249 "objectclass": "computer",
2250 "sAMAccountName": "testname$"})
2252 res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2253 scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2254 self.assertTrue(len(res) == 1)
2255 self.assertFalse("servicePrincipalName" in res[0])
2257 delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2260 "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2261 "objectclass": "computer",
2262 "servicePrincipalName": "HOST/testname"})
2264 res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2265 scope=SCOPE_BASE, attrs=["sAMAccountName"])
2266 self.assertTrue(len(res) == 1)
2267 self.assertTrue("sAMAccountName" in res[0])
2269 delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2272 "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2273 "objectclass": "computer",
2274 "sAMAccountName": "testname$",
2275 "servicePrincipalName": "HOST/testname"})
2277 res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2278 scope=SCOPE_BASE, attrs=["sAMAccountName"])
2279 self.assertTrue(len(res) == 1)
2280 self.assertEquals(res[0]["sAMAccountName"][0], "testname$")
2282 res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2283 scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2284 self.assertTrue(len(res) == 1)
2285 self.assertEquals(res[0]["servicePrincipalName"][0],
2289 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2290 m["sAMAccountName"] = MessageElement("testnamE$",
2291 FLAG_MOD_REPLACE, "sAMAccountName")
2294 res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2295 scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2296 self.assertTrue(len(res) == 1)
2297 self.assertEquals(res[0]["servicePrincipalName"][0],
2301 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2302 m["sAMAccountName"] = MessageElement("testname",
2303 FLAG_MOD_REPLACE, "sAMAccountName")
2306 res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2307 scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2308 self.assertTrue(len(res) == 1)
2309 self.assertEquals(res[0]["servicePrincipalName"][0],
2313 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2314 m["sAMAccountName"] = MessageElement("test$name$",
2315 FLAG_MOD_REPLACE, "sAMAccountName")
2318 res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2319 scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2320 self.assertTrue(len(res) == 1)
2321 self.assertEquals(res[0]["servicePrincipalName"][0],
2325 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2326 m["sAMAccountName"] = MessageElement("testname2",
2327 FLAG_MOD_REPLACE, "sAMAccountName")
2330 res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2331 scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2332 self.assertTrue(len(res) == 1)
2333 self.assertEquals(res[0]["servicePrincipalName"][0],
2337 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2338 m["sAMAccountName"] = MessageElement("testname3",
2339 FLAG_MOD_REPLACE, "sAMAccountName")
2340 m["servicePrincipalName"] = MessageElement("HOST/testname2",
2342 "servicePrincipalName")
2345 res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2346 scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2347 self.assertTrue(len(res) == 1)
2348 self.assertEquals(res[0]["servicePrincipalName"][0],
2352 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2353 m["servicePrincipalName"] = MessageElement("HOST/testname2",
2355 "servicePrincipalName")
2356 m["sAMAccountName"] = MessageElement("testname4",
2357 FLAG_MOD_REPLACE, "sAMAccountName")
2360 res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2361 scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2362 self.assertTrue(len(res) == 1)
2363 self.assertEquals(res[0]["servicePrincipalName"][0],
2367 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2368 m["servicePrincipalName"] = MessageElement([],
2370 "servicePrincipalName")
2374 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2375 m["sAMAccountName"] = MessageElement("testname2",
2376 FLAG_MOD_REPLACE, "sAMAccountName")
2379 res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2380 scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2381 self.assertTrue(len(res) == 1)
2382 self.assertFalse("servicePrincipalName" in res[0])
2384 delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2387 "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2388 "objectclass": "computer",
2389 "dNSHostName": "testname.testdom",
2390 "sAMAccountName": "testname$",
2391 "servicePrincipalName": [ "HOST/testname.testdom", "HOST/testname" ]
2395 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2396 m["dNSHostName"] = MessageElement("testname2.testdom",
2397 FLAG_MOD_REPLACE, "dNSHostName")
2398 m["sAMAccountName"] = MessageElement("testname2$",
2399 FLAG_MOD_REPLACE, "sAMAccountName")
2402 res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2403 scope=SCOPE_BASE, attrs=["dNSHostName", "sAMAccountName", "servicePrincipalName"])
2404 self.assertTrue(len(res) == 1)
2405 self.assertEquals(res[0]["dNSHostName"][0], "testname2.testdom")
2406 self.assertEquals(res[0]["sAMAccountName"][0], "testname2$")
2407 self.assertTrue(res[0]["servicePrincipalName"][0] == "HOST/testname2" or
2408 res[0]["servicePrincipalName"][1] == "HOST/testname2")
2409 self.assertTrue(res[0]["servicePrincipalName"][0] == "HOST/testname2.testdom" or
2410 res[0]["servicePrincipalName"][1] == "HOST/testname2.testdom")
2412 delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2415 "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2416 "objectclass": "computer",
2417 "dNSHostName": "testname.testdom",
2418 "sAMAccountName": "testname$",
2419 "servicePrincipalName": [ "HOST/testname.testdom", "HOST/testname" ]
2423 m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2424 m["sAMAccountName"] = MessageElement("testname2$",
2425 FLAG_MOD_REPLACE, "sAMAccountName")
2426 m["dNSHostName"] = MessageElement("testname2.testdom",
2427 FLAG_MOD_REPLACE, "dNSHostName")
2430 res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2431 scope=SCOPE_BASE, attrs=["dNSHostName", "sAMAccountName", "servicePrincipalName"])
2432 self.assertTrue(len(res) == 1)
2433 self.assertEquals(res[0]["dNSHostName"][0], "testname2.testdom")
2434 self.assertEquals(res[0]["sAMAccountName"][0], "testname2$")
2435 self.assertTrue(res[0]["servicePrincipalName"][0] == "HOST/testname2" or
2436 res[0]["servicePrincipalName"][1] == "HOST/testname2")
2437 self.assertTrue(res[0]["servicePrincipalName"][0] == "HOST/testname2.testdom" or
2438 res[0]["servicePrincipalName"][1] == "HOST/testname2.testdom")
2440 delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2442 def test_sam_description_attribute(self):
2443 """Test SAM description attribute"""
2444 print "Test SAM description attribute"""
2447 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
2448 "description": "desc2",
2449 "objectclass": "group",
2450 "description": "desc1"})
2452 res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
2453 scope=SCOPE_BASE, attrs=["description"])
2454 self.assertTrue(len(res) == 1)
2455 self.assertTrue("description" in res[0])
2456 self.assertTrue(len(res[0]["description"]) == 1)
2457 self.assertEquals(res[0]["description"][0], "desc1")
2459 delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2462 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
2463 "objectclass": "group",
2464 "description": ["desc1", "desc2"]})
2466 res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
2467 scope=SCOPE_BASE, attrs=["description"])
2468 self.assertTrue(len(res) == 1)
2469 self.assertTrue("description" in res[0])
2470 self.assertTrue(len(res[0]["description"]) == 2)
2471 self.assertTrue(res[0]["description"][0] == "desc1" or
2472 res[0]["description"][1] == "desc1")
2473 self.assertTrue(res[0]["description"][0] == "desc2" or
2474 res[0]["description"][1] == "desc2")
2477 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2478 m["description"] = MessageElement(["desc1","desc2"], FLAG_MOD_REPLACE,
2483 except LdbError, (num, _):
2484 self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
2487 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2488 m["description"] = MessageElement(["desc1","desc2"], FLAG_MOD_DELETE,
2492 delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2495 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
2496 "objectclass": "group" })
2499 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2500 m["description"] = MessageElement("desc1", FLAG_MOD_REPLACE,
2504 res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
2505 scope=SCOPE_BASE, attrs=["description"])
2506 self.assertTrue(len(res) == 1)
2507 self.assertTrue("description" in res[0])
2508 self.assertTrue(len(res[0]["description"]) == 1)
2509 self.assertEquals(res[0]["description"][0], "desc1")
2511 delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2514 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
2515 "objectclass": "group",
2516 "description": ["desc1", "desc2"]})
2519 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2520 m["description"] = MessageElement("desc1", FLAG_MOD_REPLACE,
2524 res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
2525 scope=SCOPE_BASE, attrs=["description"])
2526 self.assertTrue(len(res) == 1)
2527 self.assertTrue("description" in res[0])
2528 self.assertTrue(len(res[0]["description"]) == 1)
2529 self.assertEquals(res[0]["description"][0], "desc1")
2532 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2533 m["description"] = MessageElement("desc3", FLAG_MOD_ADD,
2538 except LdbError, (num, _):
2539 self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
2542 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2543 m["description"] = MessageElement(["desc1","desc2"], FLAG_MOD_DELETE,
2548 except LdbError, (num, _):
2549 self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
2552 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2553 m["description"] = MessageElement("desc1", FLAG_MOD_DELETE,
2556 res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
2557 scope=SCOPE_BASE, attrs=["description"])
2558 self.assertTrue(len(res) == 1)
2559 self.assertFalse("description" in res[0])
2562 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2563 m["description"] = MessageElement(["desc1","desc2"], FLAG_MOD_REPLACE,
2568 except LdbError, (num, _):
2569 self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
2572 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2573 m["description"] = MessageElement(["desc3", "desc4"], FLAG_MOD_ADD,
2578 except LdbError, (num, _):
2579 self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
2582 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2583 m["description"] = MessageElement("desc1", FLAG_MOD_ADD,
2587 res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
2588 scope=SCOPE_BASE, attrs=["description"])
2589 self.assertTrue(len(res) == 1)
2590 self.assertTrue("description" in res[0])
2591 self.assertTrue(len(res[0]["description"]) == 1)
2592 self.assertEquals(res[0]["description"][0], "desc1")
2595 m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2596 m.add(MessageElement("desc1", FLAG_MOD_DELETE, "description"))
2597 m.add(MessageElement("desc2", FLAG_MOD_ADD, "description"))
2600 res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
2601 scope=SCOPE_BASE, attrs=["description"])
2602 self.assertTrue(len(res) == 1)
2603 self.assertTrue("description" in res[0])
2604 self.assertTrue(len(res[0]["description"]) == 1)
2605 self.assertEquals(res[0]["description"][0], "desc2")
2607 delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2610 if not "://" in host:
2611 if os.path.isfile(host):
2612 host = "tdb://%s" % host
2614 host = "ldap://%s" % host
2616 ldb = SamDB(host, credentials=creds, session_info=system_session(lp), lp=lp)
2618 runner = SubunitTestRunner()
2620 if not runner.run(unittest.makeSuite(SamTests)).wasSuccessful():