source4/dsdb/tests/python/sam.py

   1 #!/usr/bin/env python
   2 # -*- coding: utf-8 -*-
   3 # This is a port of the original in testprogs/ejs/ldap.js
   4
   5 import optparse
   6 import sys
   7 import os
   8
   9 sys.path.insert(0, "bin/python")
  10 import samba
  11 samba.ensure_external_module("testtools", "testtools")
  12 samba.ensure_external_module("subunit", "subunit/python")
  13
  14 import samba.getopt as options
  15
  16 from samba.auth import system_session
  17 from ldb import SCOPE_BASE, LdbError
  18 from ldb import ERR_NO_SUCH_OBJECT, ERR_ATTRIBUTE_OR_VALUE_EXISTS
  19 from ldb import ERR_ENTRY_ALREADY_EXISTS, ERR_UNWILLING_TO_PERFORM
  20 from ldb import ERR_OTHER, ERR_NO_SUCH_ATTRIBUTE
  21 from ldb import ERR_OBJECT_CLASS_VIOLATION
  22 from ldb import ERR_CONSTRAINT_VIOLATION
  23 from ldb import ERR_UNDEFINED_ATTRIBUTE_TYPE
  24 from ldb import Message, MessageElement, Dn
  25 from ldb import FLAG_MOD_ADD, FLAG_MOD_REPLACE, FLAG_MOD_DELETE
  26 from samba.samdb import SamDB
  27 from samba.dsdb import (UF_NORMAL_ACCOUNT, UF_ACCOUNTDISABLE,
  28     UF_WORKSTATION_TRUST_ACCOUNT, UF_SERVER_TRUST_ACCOUNT,
  29     UF_PARTIAL_SECRETS_ACCOUNT, UF_TEMP_DUPLICATE_ACCOUNT,
  30     UF_PASSWD_NOTREQD, ATYPE_NORMAL_ACCOUNT,
  31     GTYPE_SECURITY_BUILTIN_LOCAL_GROUP, GTYPE_SECURITY_DOMAIN_LOCAL_GROUP,
  32     GTYPE_SECURITY_GLOBAL_GROUP, GTYPE_SECURITY_UNIVERSAL_GROUP,
  33     GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP, GTYPE_DISTRIBUTION_GLOBAL_GROUP,
  34     GTYPE_DISTRIBUTION_UNIVERSAL_GROUP,
  35     ATYPE_SECURITY_GLOBAL_GROUP, ATYPE_SECURITY_UNIVERSAL_GROUP,
  36     ATYPE_SECURITY_LOCAL_GROUP, ATYPE_DISTRIBUTION_GLOBAL_GROUP,
  37     ATYPE_DISTRIBUTION_UNIVERSAL_GROUP, ATYPE_DISTRIBUTION_LOCAL_GROUP,
  38     ATYPE_WORKSTATION_TRUST)
  39 from samba.dcerpc.security import (DOMAIN_RID_USERS, DOMAIN_RID_ADMINS,
  40     DOMAIN_RID_DOMAIN_MEMBERS, DOMAIN_RID_DCS, DOMAIN_RID_READONLY_DCS)
  41
  42 from subunit.run import SubunitTestRunner
  43 import unittest
  44
  45 from samba.dcerpc import security
  46 from samba.tests import delete_force
  47
  48 parser = optparse.OptionParser("sam.py [options] <host>")
  49 sambaopts = options.SambaOptions(parser)
  50 parser.add_option_group(sambaopts)
  51 parser.add_option_group(options.VersionOptions(parser))
  52 # use command line creds if available
  53 credopts = options.CredentialsOptions(parser)
  54 parser.add_option_group(credopts)
  55 opts, args = parser.parse_args()
  56
  57 if len(args) < 1:
  58     parser.print_usage()
  59     sys.exit(1)
  60
  61 host = args[0]
  62
  63 lp = sambaopts.get_loadparm()
  64 creds = credopts.get_credentials(lp)
  65
  66 class SamTests(samba.tests.TestCase):
  67
  68     def setUp(self):
  69         super(SamTests, self).setUp()
  70         self.ldb = ldb
  71         self.base_dn = ldb.domain_dn()
  72
  73         print "baseDN: %s\n" % self.base_dn
  74
  75         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
  76         delete_force(self.ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
  77         delete_force(self.ldb, "cn=ldaptest\,specialuser,cn=users," + self.base_dn)
  78         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
  79         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
  80         delete_force(self.ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
  81
  82     def test_users_groups(self):
  83         """This tests the SAM users and groups behaviour"""
  84         print "Testing users and groups behaviour\n"
  85
  86         ldb.add({
  87             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
  88             "objectclass": "group"})
  89
  90         ldb.add({
  91             "dn": "cn=ldaptestgroup2,cn=users," + self.base_dn,
  92             "objectclass": "group"})
  93
  94         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
  95                           scope=SCOPE_BASE, attrs=["objectSID"])
  96         self.assertTrue(len(res1) == 1)
  97         group_rid_1 = security.dom_sid(ldb.schema_format_value("objectSID",
  98           res1[0]["objectSID"][0])).split()[1]
  99
 100         res1 = ldb.search("cn=ldaptestgroup2,cn=users," + self.base_dn,
 101                           scope=SCOPE_BASE, attrs=["objectSID"])
 102         self.assertTrue(len(res1) == 1)
 103         group_rid_2 = security.dom_sid(ldb.schema_format_value("objectSID",
 104           res1[0]["objectSID"][0])).split()[1]
 105
 106         # Try to create a user with an invalid account name
 107         try:
 108             ldb.add({
 109                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 110                 "objectclass": "user",
 111                 "sAMAccountName": "administrator"})
 112             self.fail()
 113         except LdbError, (num, _):
 114             self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
 115         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 116
 117         # Try to create a user with an invalid account name
 118         try:
 119             ldb.add({
 120                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 121                 "objectclass": "user",
 122                 "sAMAccountName": []})
 123             self.fail()
 124         except LdbError, (num, _):
 125             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 126         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 127
 128         # Try to create a user with an invalid primary group
 129         try:
 130             ldb.add({
 131                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 132                 "objectclass": "user",
 133                 "primaryGroupID": "0"})
 134             self.fail()
 135         except LdbError, (num, _):
 136             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 137         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 138
 139         # Try to Create a user with a valid primary group
 140         try:
 141             ldb.add({
 142                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 143                 "objectclass": "user",
 144                 "primaryGroupID": str(group_rid_1)})
 145             self.fail()
 146         except LdbError, (num, _):
 147             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 148         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 149
 150         # Test to see how we should behave when the user account doesn't
 151         # exist
 152         m = Message()
 153         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 154         m["primaryGroupID"] = MessageElement("0", FLAG_MOD_REPLACE,
 155           "primaryGroupID")
 156         try:
 157             ldb.modify(m)
 158             self.fail()
 159         except LdbError, (num, _):
 160             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
 161
 162         # Test to see how we should behave when the account isn't a user
 163         m = Message()
 164         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 165         m["primaryGroupID"] = MessageElement("0", FLAG_MOD_REPLACE,
 166           "primaryGroupID")
 167         try:
 168             ldb.modify(m)
 169             self.fail()
 170         except LdbError, (num, _):
 171             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 172
 173         # Test default primary groups on add operations
 174
 175         ldb.add({
 176             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 177             "objectclass": "user"})
 178
 179         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 180                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
 181         self.assertTrue(len(res1) == 1)
 182         self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_USERS))
 183
 184         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 185
 186         ldb.add({
 187             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 188             "objectclass": "user",
 189             "userAccountControl": str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD) })
 190
 191         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 192                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
 193         self.assertTrue(len(res1) == 1)
 194         self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_USERS))
 195
 196         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 197
 198         # unfortunately the INTERDOMAIN_TRUST_ACCOUNT case cannot be tested
 199         # since such accounts aren't directly creatable (ACCESS_DENIED)
 200
 201         ldb.add({
 202             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 203             "objectclass": "computer",
 204             "userAccountControl": str(UF_WORKSTATION_TRUST_ACCOUNT | UF_PASSWD_NOTREQD) })
 205
 206         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 207                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
 208         self.assertTrue(len(res1) == 1)
 209         self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_DOMAIN_MEMBERS))
 210
 211         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 212
 213         ldb.add({
 214             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 215             "objectclass": "computer",
 216             "userAccountControl": str(UF_SERVER_TRUST_ACCOUNT | UF_PASSWD_NOTREQD) })
 217
 218         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 219                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
 220         self.assertTrue(len(res1) == 1)
 221         self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_DCS))
 222
 223         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 224
 225         # Read-only DC accounts are only creatable by
 226         # UF_WORKSTATION_TRUST_ACCOUNT and work only on DCs >= 2008 (therefore
 227         # we have a fallback in the assertion)
 228         ldb.add({
 229             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 230             "objectclass": "computer",
 231             "userAccountControl": str(UF_PARTIAL_SECRETS_ACCOUNT | UF_WORKSTATION_TRUST_ACCOUNT | UF_PASSWD_NOTREQD) })
 232
 233         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 234                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
 235         self.assertTrue(len(res1) == 1)
 236         self.assertTrue(res1[0]["primaryGroupID"][0] == str(DOMAIN_RID_READONLY_DCS) or
 237                         res1[0]["primaryGroupID"][0] == str(DOMAIN_RID_DOMAIN_MEMBERS))
 238
 239         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 240
 241         # Test default primary groups on modify operations
 242
 243         ldb.add({
 244             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 245             "objectclass": "user"})
 246
 247         m = Message()
 248         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 249         m["userAccountControl"] = MessageElement(str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD), FLAG_MOD_REPLACE,
 250           "userAccountControl")
 251         ldb.modify(m)
 252
 253         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 254                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
 255         self.assertTrue(len(res1) == 1)
 256         self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_USERS))
 257
 258         # unfortunately the INTERDOMAIN_TRUST_ACCOUNT case cannot be tested
 259         # since such accounts aren't directly creatable (ACCESS_DENIED)
 260
 261         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 262
 263         ldb.add({
 264             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 265             "objectclass": "computer"})
 266
 267         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 268                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
 269         self.assertTrue(len(res1) == 1)
 270         self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_USERS))
 271
 272         m = Message()
 273         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 274         m["userAccountControl"] = MessageElement(str(UF_WORKSTATION_TRUST_ACCOUNT | UF_PASSWD_NOTREQD), FLAG_MOD_REPLACE,
 275           "userAccountControl")
 276         ldb.modify(m)
 277
 278         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 279                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
 280         self.assertTrue(len(res1) == 1)
 281         self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_DOMAIN_MEMBERS))
 282
 283         m = Message()
 284         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 285         m["userAccountControl"] = MessageElement(str(UF_SERVER_TRUST_ACCOUNT | UF_PASSWD_NOTREQD), FLAG_MOD_REPLACE,
 286           "userAccountControl")
 287         ldb.modify(m)
 288
 289         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 290                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
 291         self.assertTrue(len(res1) == 1)
 292         self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_DCS))
 293
 294         # Read-only DC accounts are only creatable by
 295         # UF_WORKSTATION_TRUST_ACCOUNT and work only on DCs >= 2008 (therefore
 296         # we have a fallback in the assertion)
 297         m = Message()
 298         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 299         m["userAccountControl"] = MessageElement(str(UF_PARTIAL_SECRETS_ACCOUNT | UF_WORKSTATION_TRUST_ACCOUNT | UF_PASSWD_NOTREQD), FLAG_MOD_REPLACE,
 300           "userAccountControl")
 301         ldb.modify(m)
 302
 303         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 304                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
 305         self.assertTrue(len(res1) == 1)
 306         self.assertTrue(res1[0]["primaryGroupID"][0] == str(DOMAIN_RID_READONLY_DCS) or
 307                         res1[0]["primaryGroupID"][0] == str(DOMAIN_RID_DOMAIN_MEMBERS))
 308
 309         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 310
 311         # Recreate account for further tests
 312
 313         ldb.add({
 314             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 315             "objectclass": "user"})
 316
 317         # Try to set an invalid account name
 318         m = Message()
 319         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 320         m["sAMAccountName"] = MessageElement("administrator", FLAG_MOD_REPLACE,
 321           "sAMAccountName")
 322         try:
 323             ldb.modify(m)
 324             self.fail()
 325         except LdbError, (num, _):
 326             self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
 327
 328         # But to reset the actual "sAMAccountName" should still be possible
 329         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 330                           scope=SCOPE_BASE, attrs=["sAMAccountName"])
 331         self.assertTrue(len(res1) == 1)
 332         m = Message()
 333         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 334         m["sAMAccountName"] = MessageElement(res1[0]["sAMAccountName"][0], FLAG_MOD_REPLACE,
 335           "sAMAccountName")
 336         ldb.modify(m)
 337
 338         # And another (free) name should be possible as well
 339         m = Message()
 340         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 341         m["sAMAccountName"] = MessageElement("xxx_ldaptestuser_xxx", FLAG_MOD_REPLACE,
 342           "sAMAccountName")
 343         ldb.modify(m)
 344
 345         # We should be able to reset our actual primary group
 346         m = Message()
 347         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 348         m["primaryGroupID"] = MessageElement(str(DOMAIN_RID_USERS), FLAG_MOD_REPLACE,
 349           "primaryGroupID")
 350         ldb.modify(m)
 351
 352         # Try to add invalid primary group
 353         m = Message()
 354         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 355         m["primaryGroupID"] = MessageElement("0", FLAG_MOD_REPLACE,
 356           "primaryGroupID")
 357         try:
 358             ldb.modify(m)
 359             self.fail()
 360         except LdbError, (num, _):
 361             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 362
 363         # Try to make group 1 primary - should be denied since it is not yet
 364         # secondary
 365         m = Message()
 366         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 367         m["primaryGroupID"] = MessageElement(str(group_rid_1),
 368           FLAG_MOD_REPLACE, "primaryGroupID")
 369         try:
 370             ldb.modify(m)
 371             self.fail()
 372         except LdbError, (num, _):
 373             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 374
 375         # Make group 1 secondary
 376         m = Message()
 377         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 378         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
 379                                      FLAG_MOD_REPLACE, "member")
 380         ldb.modify(m)
 381
 382         # Make group 1 primary
 383         m = Message()
 384         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 385         m["primaryGroupID"] = MessageElement(str(group_rid_1),
 386           FLAG_MOD_REPLACE, "primaryGroupID")
 387         ldb.modify(m)
 388
 389         # Try to delete group 1 - should be denied
 390         try:
 391             ldb.delete("cn=ldaptestgroup,cn=users," + self.base_dn)
 392             self.fail()
 393         except LdbError, (num, _):
 394             self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
 395
 396         # Try to add group 1 also as secondary - should be denied
 397         m = Message()
 398         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 399         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
 400                                      FLAG_MOD_ADD, "member")
 401         try:
 402             ldb.modify(m)
 403             self.fail()
 404         except LdbError, (num, _):
 405             self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
 406
 407         # Try to add invalid member to group 1 - should be denied
 408         m = Message()
 409         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 410         m["member"] = MessageElement(
 411           "cn=ldaptestuser3,cn=users," + self.base_dn,
 412           FLAG_MOD_ADD, "member")
 413         try:
 414             ldb.modify(m)
 415             self.fail()
 416         except LdbError, (num, _):
 417             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
 418
 419         # Make group 2 secondary
 420         m = Message()
 421         m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 422         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
 423                                      FLAG_MOD_ADD, "member")
 424         ldb.modify(m)
 425
 426         # Swap the groups
 427         m = Message()
 428         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 429         m["primaryGroupID"] = MessageElement(str(group_rid_2),
 430           FLAG_MOD_REPLACE, "primaryGroupID")
 431         ldb.modify(m)
 432
 433         # Swap the groups (does not really make sense but does the same)
 434         m = Message()
 435         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 436         m["primaryGroupID"] = MessageElement(str(group_rid_1),
 437           FLAG_MOD_REPLACE, "primaryGroupID")
 438         m["primaryGroupID"] = MessageElement(str(group_rid_2),
 439           FLAG_MOD_REPLACE, "primaryGroupID")
 440         ldb.modify(m)
 441
 442         # Old primary group should contain a "member" attribute for the user,
 443         # the new shouldn't contain anymore one
 444         res1 = ldb.search("cn=ldaptestgroup, cn=users," + self.base_dn,
 445                           scope=SCOPE_BASE, attrs=["member"])
 446         self.assertTrue(len(res1) == 1)
 447         self.assertTrue(len(res1[0]["member"]) == 1)
 448         self.assertEquals(res1[0]["member"][0].lower(),
 449           ("cn=ldaptestuser,cn=users," + self.base_dn).lower())
 450
 451         res1 = ldb.search("cn=ldaptestgroup2, cn=users," + self.base_dn,
 452                           scope=SCOPE_BASE, attrs=["member"])
 453         self.assertTrue(len(res1) == 1)
 454         self.assertFalse("member" in res1[0])
 455
 456         # Primary group member
 457         m = Message()
 458         m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 459         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
 460                                      FLAG_MOD_DELETE, "member")
 461         try:
 462             ldb.modify(m)
 463             self.fail()
 464         except LdbError, (num, _):
 465             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 466
 467         # Delete invalid group member
 468         m = Message()
 469         m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 470         m["member"] = MessageElement("cn=ldaptestuser1,cn=users," + self.base_dn,
 471                                      FLAG_MOD_DELETE, "member")
 472         try:
 473             ldb.modify(m)
 474             self.fail()
 475         except LdbError, (num, _):
 476             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 477
 478         # Also this should be denied
 479         try:
 480             ldb.add({
 481               "dn": "cn=ldaptestuser2,cn=users," + self.base_dn,
 482               "objectclass": "user",
 483               "primaryGroupID": "0"})
 484             self.fail()
 485         except LdbError, (num, _):
 486             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 487
 488         # Recreate user accounts
 489
 490         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 491
 492         ldb.add({
 493             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 494             "objectclass": "user"})
 495
 496         ldb.add({
 497             "dn": "cn=ldaptestuser2,cn=users," + self.base_dn,
 498             "objectclass": "user"})
 499
 500         m = Message()
 501         m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 502         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
 503                                      FLAG_MOD_ADD, "member")
 504         ldb.modify(m)
 505
 506         # Already added
 507         m = Message()
 508         m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 509         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
 510                                      FLAG_MOD_ADD, "member")
 511         try:
 512             ldb.modify(m)
 513             self.fail()
 514         except LdbError, (num, _):
 515             self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
 516
 517         # Already added, but as <SID=...>
 518         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 519                           scope=SCOPE_BASE, attrs=["objectSid"])
 520         self.assertTrue(len(res1) == 1)
 521         sid_bin = res1[0]["objectSid"][0]
 522         sid_str = ("<SID=" + ldb.schema_format_value("objectSid", sid_bin) + ">").upper()
 523
 524         m = Message()
 525         m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 526         m["member"] = MessageElement(sid_str, FLAG_MOD_ADD, "member")
 527         try:
 528             ldb.modify(m)
 529             self.fail()
 530         except LdbError, (num, _):
 531             self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
 532
 533         # Invalid member
 534         m = Message()
 535         m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 536         m["member"] = MessageElement("cn=ldaptestuser1,cn=users," + self.base_dn,
 537                                      FLAG_MOD_REPLACE, "member")
 538         try:
 539             ldb.modify(m)
 540             self.fail()
 541         except LdbError, (num, _):
 542             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
 543
 544         # Invalid member
 545         m = Message()
 546         m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 547         m["member"] = MessageElement(["cn=ldaptestuser,cn=users," + self.base_dn,
 548                                       "cn=ldaptestuser1,cn=users," + self.base_dn],
 549                                      FLAG_MOD_REPLACE, "member")
 550         try:
 551             ldb.modify(m)
 552             self.fail()
 553         except LdbError, (num, _):
 554             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
 555
 556         # Invalid member
 557         m = Message()
 558         m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 559         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
 560                                      FLAG_MOD_REPLACE, "member")
 561         m["member"] = MessageElement("cn=ldaptestuser1,cn=users," + self.base_dn,
 562                                      FLAG_MOD_ADD, "member")
 563         try:
 564             ldb.modify(m)
 565             self.fail()
 566         except LdbError, (num, _):
 567             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
 568
 569         m = Message()
 570         m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 571         m["member"] = MessageElement(["cn=ldaptestuser,cn=users," + self.base_dn,
 572                                       "cn=ldaptestuser2,cn=users," + self.base_dn],
 573                                      FLAG_MOD_REPLACE, "member")
 574         ldb.modify(m)
 575
 576         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 577         delete_force(self.ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
 578         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 579         delete_force(self.ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 580
 581         # Make also a small test for accounts with special DNs ("," in this case)
 582         ldb.add({
 583             "dn": "cn=ldaptest\,specialuser,cn=users," + self.base_dn,
 584             "objectclass": "user"})
 585         delete_force(self.ldb, "cn=ldaptest\,specialuser,cn=users," + self.base_dn)
 586
 587     def test_sam_attributes(self):
 588         """Test the behaviour of special attributes of SAM objects"""
 589         print "Testing the behaviour of special attributes of SAM objects\n"""
 590
 591         ldb.add({
 592             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 593             "objectclass": "user"})
 594         ldb.add({
 595             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 596             "objectclass": "group"})
 597
 598         m = Message()
 599         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 600         m["groupType"] = MessageElement(str(GTYPE_SECURITY_GLOBAL_GROUP), FLAG_MOD_ADD,
 601           "groupType")
 602         try:
 603             ldb.modify(m)
 604             self.fail()
 605         except LdbError, (num, _):
 606             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 607
 608         # Delete protection tests
 609
 610         for attr in ["nTSecurityDescriptor", "objectSid", "sAMAccountType",
 611                      "sAMAccountName", "groupType"]:
 612
 613             m = Message()
 614             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 615             m[attr] = MessageElement([], FLAG_MOD_REPLACE, attr)
 616             try:
 617                 ldb.modify(m)
 618                 self.fail()
 619             except LdbError, (num, _):
 620                 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 621
 622             m = Message()
 623             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 624             m[attr] = MessageElement([], FLAG_MOD_DELETE, attr)
 625             try:
 626                 ldb.modify(m)
 627                 self.fail()
 628             except LdbError, (num, _):
 629                 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 630
 631         m = Message()
 632         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 633         m["primaryGroupID"] = MessageElement("513", FLAG_MOD_ADD,
 634           "primaryGroupID")
 635         try:
 636             ldb.modify(m)
 637             self.fail()
 638         except LdbError, (num, _):
 639             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 640
 641         m = Message()
 642         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 643         m["userAccountControl"] = MessageElement(str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD), FLAG_MOD_ADD,
 644           "userAccountControl")
 645         try:
 646             ldb.modify(m)
 647             self.fail()
 648         except LdbError, (num, _):
 649             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 650
 651         m = Message()
 652         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 653         m["objectSid"] = MessageElement("xxxxxxxxxxxxxxxx", FLAG_MOD_ADD,
 654           "objectSid")
 655         try:
 656             ldb.modify(m)
 657             self.fail()
 658         except LdbError, (num, _):
 659             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 660
 661         m = Message()
 662         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 663         m["sAMAccountType"] = MessageElement("0", FLAG_MOD_ADD,
 664           "sAMAccountType")
 665         try:
 666             ldb.modify(m)
 667             self.fail()
 668         except LdbError, (num, _):
 669             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 670
 671         m = Message()
 672         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 673         m["sAMAccountName"] = MessageElement("test", FLAG_MOD_ADD,
 674           "sAMAccountName")
 675         try:
 676             ldb.modify(m)
 677             self.fail()
 678         except LdbError, (num, _):
 679             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 680
 681         # Delete protection tests
 682
 683         for attr in ["nTSecurityDescriptor", "objectSid", "sAMAccountType",
 684                      "sAMAccountName", "primaryGroupID", "userAccountControl",
 685                      "accountExpires", "badPasswordTime", "badPwdCount",
 686                      "codePage", "countryCode", "lastLogoff", "lastLogon",
 687                      "logonCount", "pwdLastSet"]:
 688
 689             m = Message()
 690             m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 691             m[attr] = MessageElement([], FLAG_MOD_REPLACE, attr)
 692             try:
 693                 ldb.modify(m)
 694                 self.fail()
 695             except LdbError, (num, _):
 696                 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 697
 698             m = Message()
 699             m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 700             m[attr] = MessageElement([], FLAG_MOD_DELETE, attr)
 701             try:
 702                 ldb.modify(m)
 703                 self.fail()
 704             except LdbError, (num, _):
 705                 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 706
 707         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 708         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 709
 710     def test_primary_group_token_constructed(self):
 711         """Test the primary group token behaviour (hidden-generated-readonly attribute on groups) and some other constructed attributes"""
 712         print "Testing primary group token behaviour and other constructed attributes\n"
 713
 714         try:
 715             ldb.add({
 716                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 717                 "objectclass": "group",
 718                 "primaryGroupToken": "100"})
 719             self.fail()
 720         except LdbError, (num, _):
 721             self.assertEquals(num, ERR_UNDEFINED_ATTRIBUTE_TYPE)
 722         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 723
 724         ldb.add({
 725             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 726             "objectclass": "user"})
 727
 728         ldb.add({
 729             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 730             "objectclass": "group"})
 731
 732         # Testing for one invalid, and one valid operational attribute, but also the things they are built from
 733         res1 = ldb.search(self.base_dn,
 734                           scope=SCOPE_BASE, attrs=["primaryGroupToken", "canonicalName", "objectClass", "objectSid"])
 735         self.assertTrue(len(res1) == 1)
 736         self.assertFalse("primaryGroupToken" in res1[0])
 737         self.assertTrue("canonicalName" in res1[0])
 738         self.assertTrue("objectClass" in res1[0])
 739         self.assertTrue("objectSid" in res1[0])
 740
 741         res1 = ldb.search(self.base_dn,
 742                           scope=SCOPE_BASE, attrs=["primaryGroupToken", "canonicalName"])
 743         self.assertTrue(len(res1) == 1)
 744         self.assertFalse("primaryGroupToken" in res1[0])
 745         self.assertFalse("objectSid" in res1[0])
 746         self.assertFalse("objectClass" in res1[0])
 747         self.assertTrue("canonicalName" in res1[0])
 748
 749         res1 = ldb.search("cn=users," + self.base_dn,
 750                           scope=SCOPE_BASE, attrs=["primaryGroupToken"])
 751         self.assertTrue(len(res1) == 1)
 752         self.assertFalse("primaryGroupToken" in res1[0])
 753
 754         res1 = ldb.search("cn=ldaptestuser, cn=users," + self.base_dn,
 755                           scope=SCOPE_BASE, attrs=["primaryGroupToken"])
 756         self.assertTrue(len(res1) == 1)
 757         self.assertFalse("primaryGroupToken" in res1[0])
 758
 759         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 760                           scope=SCOPE_BASE)
 761         self.assertTrue(len(res1) == 1)
 762         self.assertFalse("primaryGroupToken" in res1[0])
 763
 764         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 765                           scope=SCOPE_BASE, attrs=["primaryGroupToken", "objectSID"])
 766         self.assertTrue(len(res1) == 1)
 767         primary_group_token = int(res1[0]["primaryGroupToken"][0])
 768
 769         rid = security.dom_sid(ldb.schema_format_value("objectSID", res1[0]["objectSID"][0])).split()[1]
 770         self.assertEquals(primary_group_token, rid)
 771
 772         m = Message()
 773         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 774         m["primaryGroupToken"] = "100"
 775         try:
 776             ldb.modify(m)
 777             self.fail()
 778         except LdbError, (num, _):
 779             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 780
 781         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 782         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 783
 784     def test_tokenGroups(self):
 785         """Test the tokenGroups behaviour (hidden-generated-readonly attribute on SAM objects)"""
 786         print "Testing tokenGroups behaviour\n"
 787
 788         # The domain object shouldn't contain any "tokenGroups" entry
 789         res = ldb.search(self.base_dn, scope=SCOPE_BASE, attrs=["tokenGroups"])
 790         self.assertTrue(len(res) == 1)
 791         self.assertFalse("tokenGroups" in res[0])
 792
 793         # The domain administrator should contain "tokenGroups" entries
 794         # (the exact number depends on the domain/forest function level and the
 795         # DC software versions)
 796         res = ldb.search("cn=Administrator,cn=Users," + self.base_dn,
 797                          scope=SCOPE_BASE, attrs=["tokenGroups"])
 798         self.assertTrue(len(res) == 1)
 799         self.assertTrue("tokenGroups" in res[0])
 800
 801         ldb.add({
 802             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 803             "objectclass": "user"})
 804
 805         # This testuser should contain at least two "tokenGroups" entries
 806         # (exactly two on an unmodified "Domain Users" and "Users" group)
 807         res = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 808                          scope=SCOPE_BASE, attrs=["tokenGroups"])
 809         self.assertTrue(len(res) == 1)
 810         self.assertTrue(len(res[0]["tokenGroups"]) >= 2)
 811
 812         # one entry which we need to find should point to domains "Domain Users"
 813         # group and another entry should point to the builtin "Users"group
 814         domain_users_group_found = False
 815         users_group_found = False
 816         for sid in res[0]["tokenGroups"]:
 817             rid = security.dom_sid(ldb.schema_format_value("objectSID", sid)).split()[1]
 818             if rid == 513:
 819                 domain_users_group_found = True
 820             if rid == 545:
 821                 users_group_found = True
 822
 823         self.assertTrue(domain_users_group_found)
 824         self.assertTrue(users_group_found)
 825
 826         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 827
 828     def test_groupType(self):
 829         """Test the groupType behaviour"""
 830         print "Testing groupType behaviour\n"
 831
 832         # You can never create or change to a
 833         # "GTYPE_SECURITY_BUILTIN_LOCAL_GROUP"
 834
 835         # Add operation
 836
 837         # Invalid attribute
 838         try:
 839             ldb.add({
 840                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 841                 "objectclass": "group",
 842                 "groupType": "0"})
 843             self.fail()
 844         except LdbError, (num, _):
 845             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 846         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 847
 848         try:
 849             ldb.add({
 850                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 851                 "objectclass": "group",
 852                 "groupType": str(GTYPE_SECURITY_BUILTIN_LOCAL_GROUP)})
 853             self.fail()
 854         except LdbError, (num, _):
 855             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 856         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 857
 858         ldb.add({
 859             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 860             "objectclass": "group",
 861             "groupType": str(GTYPE_SECURITY_GLOBAL_GROUP)})
 862
 863         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 864                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
 865         self.assertTrue(len(res1) == 1)
 866         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
 867           ATYPE_SECURITY_GLOBAL_GROUP)
 868         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 869
 870         ldb.add({
 871             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 872             "objectclass": "group",
 873             "groupType": str(GTYPE_SECURITY_UNIVERSAL_GROUP)})
 874
 875         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 876                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
 877         self.assertTrue(len(res1) == 1)
 878         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
 879           ATYPE_SECURITY_UNIVERSAL_GROUP)
 880         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 881
 882         ldb.add({
 883             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 884             "objectclass": "group",
 885             "groupType": str(GTYPE_SECURITY_DOMAIN_LOCAL_GROUP)})
 886
 887         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 888                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
 889         self.assertTrue(len(res1) == 1)
 890         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
 891           ATYPE_SECURITY_LOCAL_GROUP)
 892         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 893
 894         ldb.add({
 895             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 896             "objectclass": "group",
 897             "groupType": str(GTYPE_DISTRIBUTION_GLOBAL_GROUP)})
 898
 899         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 900                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
 901         self.assertTrue(len(res1) == 1)
 902         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
 903           ATYPE_DISTRIBUTION_GLOBAL_GROUP)
 904         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 905
 906         ldb.add({
 907             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 908             "objectclass": "group",
 909             "groupType": str(GTYPE_DISTRIBUTION_UNIVERSAL_GROUP)})
 910
 911         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 912                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
 913         self.assertTrue(len(res1) == 1)
 914         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
 915           ATYPE_DISTRIBUTION_UNIVERSAL_GROUP)
 916         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 917
 918         ldb.add({
 919             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 920             "objectclass": "group",
 921             "groupType": str(GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP)})
 922
 923         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 924                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
 925         self.assertTrue(len(res1) == 1)
 926         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
 927           ATYPE_DISTRIBUTION_LOCAL_GROUP)
 928         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 929
 930         # Modify operation
 931
 932         ldb.add({
 933             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 934             "objectclass": "group"})
 935
 936         # We can change in this direction: global <-> universal <-> local
 937         # On each step also the group type itself (security/distribution) is
 938         # variable.
 939
 940         # After creation we should have a "security global group"
 941         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 942                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
 943         self.assertTrue(len(res1) == 1)
 944         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
 945           ATYPE_SECURITY_GLOBAL_GROUP)
 946
 947         # Invalid attribute
 948         try:
 949             m = Message()
 950             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 951             m["groupType"] = MessageElement("0",
 952               FLAG_MOD_REPLACE, "groupType")
 953             ldb.modify(m)
 954             self.fail()
 955         except LdbError, (num, _):
 956             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 957
 958         # Security groups
 959
 960         # Default is "global group"
 961
 962         m = Message()
 963         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 964         m["groupType"] = MessageElement(
 965           str(GTYPE_SECURITY_GLOBAL_GROUP),
 966           FLAG_MOD_REPLACE, "groupType")
 967         ldb.modify(m)
 968
 969         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 970                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
 971         self.assertTrue(len(res1) == 1)
 972         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
 973           ATYPE_SECURITY_GLOBAL_GROUP)
 974
 975         # Change to "local" (shouldn't work)
 976
 977         try:
 978             m = Message()
 979             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 980             m["groupType"] = MessageElement(
 981               str(GTYPE_SECURITY_DOMAIN_LOCAL_GROUP),
 982               FLAG_MOD_REPLACE, "groupType")
 983             ldb.modify(m)
 984             self.fail()
 985         except LdbError, (num, _):
 986             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 987
 988         # Change to "universal"
 989
 990         m = Message()
 991         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 992         m["groupType"] = MessageElement(
 993          str(GTYPE_SECURITY_UNIVERSAL_GROUP),
 994           FLAG_MOD_REPLACE, "groupType")
 995         ldb.modify(m)
 996
 997         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 998                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
 999         self.assertTrue(len(res1) == 1)
1000         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1001           ATYPE_SECURITY_UNIVERSAL_GROUP)
1002
1003         # Change back to "global"
1004
1005         m = Message()
1006         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1007         m["groupType"] = MessageElement(
1008           str(GTYPE_SECURITY_GLOBAL_GROUP),
1009           FLAG_MOD_REPLACE, "groupType")
1010         ldb.modify(m)
1011
1012         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1013                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1014         self.assertTrue(len(res1) == 1)
1015         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1016           ATYPE_SECURITY_GLOBAL_GROUP)
1017
1018         # Change back to "universal"
1019
1020         m = Message()
1021         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1022         m["groupType"] = MessageElement(
1023          str(GTYPE_SECURITY_UNIVERSAL_GROUP),
1024           FLAG_MOD_REPLACE, "groupType")
1025         ldb.modify(m)
1026
1027         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1028                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1029         self.assertTrue(len(res1) == 1)
1030         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1031           ATYPE_SECURITY_UNIVERSAL_GROUP)
1032
1033         # Change to "local"
1034
1035         m = Message()
1036         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1037         m["groupType"] = MessageElement(
1038           str(GTYPE_SECURITY_DOMAIN_LOCAL_GROUP),
1039           FLAG_MOD_REPLACE, "groupType")
1040         ldb.modify(m)
1041
1042         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1043                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1044         self.assertTrue(len(res1) == 1)
1045         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1046           ATYPE_SECURITY_LOCAL_GROUP)
1047
1048         # Change to "global" (shouldn't work)
1049
1050         try:
1051             m = Message()
1052             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1053             m["groupType"] = MessageElement(
1054               str(GTYPE_SECURITY_GLOBAL_GROUP),
1055               FLAG_MOD_REPLACE, "groupType")
1056             ldb.modify(m)
1057             self.fail()
1058         except LdbError, (num, _):
1059             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1060
1061         # Change to "builtin local" (shouldn't work)
1062
1063         try:
1064             m = Message()
1065             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1066             m["groupType"] = MessageElement(
1067               str(GTYPE_SECURITY_BUILTIN_LOCAL_GROUP),
1068               FLAG_MOD_REPLACE, "groupType")
1069             ldb.modify(m)
1070             self.fail()
1071         except LdbError, (num, _):
1072             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1073
1074         m = Message()
1075         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1076
1077         # Change back to "universal"
1078
1079         m = Message()
1080         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1081         m["groupType"] = MessageElement(
1082          str(GTYPE_SECURITY_UNIVERSAL_GROUP),
1083           FLAG_MOD_REPLACE, "groupType")
1084         ldb.modify(m)
1085
1086         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1087                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1088         self.assertTrue(len(res1) == 1)
1089         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1090           ATYPE_SECURITY_UNIVERSAL_GROUP)
1091
1092         # Change to "builtin local" (shouldn't work)
1093
1094         try:
1095             m = Message()
1096             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1097             m["groupType"] = MessageElement(
1098               str(GTYPE_SECURITY_BUILTIN_LOCAL_GROUP),
1099               FLAG_MOD_REPLACE, "groupType")
1100             ldb.modify(m)
1101             self.fail()
1102         except LdbError, (num, _):
1103             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1104
1105         # Change back to "global"
1106
1107         m = Message()
1108         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1109         m["groupType"] = MessageElement(
1110           str(GTYPE_SECURITY_GLOBAL_GROUP),
1111           FLAG_MOD_REPLACE, "groupType")
1112         ldb.modify(m)
1113
1114         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1115                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1116         self.assertTrue(len(res1) == 1)
1117         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1118           ATYPE_SECURITY_GLOBAL_GROUP)
1119
1120         # Change to "builtin local" (shouldn't work)
1121
1122         try:
1123             m = Message()
1124             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1125             m["groupType"] = MessageElement(
1126               str(GTYPE_SECURITY_BUILTIN_LOCAL_GROUP),
1127               FLAG_MOD_REPLACE, "groupType")
1128             ldb.modify(m)
1129             self.fail()
1130         except LdbError, (num, _):
1131             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1132
1133         # Distribution groups
1134
1135         # Default is "global group"
1136
1137         m = Message()
1138         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1139         m["groupType"] = MessageElement(
1140           str(GTYPE_DISTRIBUTION_GLOBAL_GROUP),
1141           FLAG_MOD_REPLACE, "groupType")
1142         ldb.modify(m)
1143
1144         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1145                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1146         self.assertTrue(len(res1) == 1)
1147         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1148           ATYPE_DISTRIBUTION_GLOBAL_GROUP)
1149
1150         # Change to local (shouldn't work)
1151
1152         try:
1153             m = Message()
1154             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1155             m["groupType"] = MessageElement(
1156               str(GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP),
1157               FLAG_MOD_REPLACE, "groupType")
1158             ldb.modify(m)
1159             self.fail()
1160         except LdbError, (num, _):
1161             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1162
1163         # Change to "universal"
1164
1165         m = Message()
1166         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1167         m["groupType"] = MessageElement(
1168          str(GTYPE_DISTRIBUTION_UNIVERSAL_GROUP),
1169           FLAG_MOD_REPLACE, "groupType")
1170         ldb.modify(m)
1171
1172         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1173                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1174         self.assertTrue(len(res1) == 1)
1175         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1176           ATYPE_DISTRIBUTION_UNIVERSAL_GROUP)
1177
1178         # Change back to "global"
1179
1180         m = Message()
1181         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1182         m["groupType"] = MessageElement(
1183           str(GTYPE_DISTRIBUTION_GLOBAL_GROUP),
1184           FLAG_MOD_REPLACE, "groupType")
1185         ldb.modify(m)
1186
1187         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1188                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1189         self.assertTrue(len(res1) == 1)
1190         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1191           ATYPE_DISTRIBUTION_GLOBAL_GROUP)
1192
1193         # Change back to "universal"
1194
1195         m = Message()
1196         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1197         m["groupType"] = MessageElement(
1198          str(GTYPE_DISTRIBUTION_UNIVERSAL_GROUP),
1199           FLAG_MOD_REPLACE, "groupType")
1200         ldb.modify(m)
1201
1202         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1203                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1204         self.assertTrue(len(res1) == 1)
1205         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1206           ATYPE_DISTRIBUTION_UNIVERSAL_GROUP)
1207
1208         # Change to "local"
1209
1210         m = Message()
1211         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1212         m["groupType"] = MessageElement(
1213           str(GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP),
1214           FLAG_MOD_REPLACE, "groupType")
1215         ldb.modify(m)
1216
1217         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1218                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1219         self.assertTrue(len(res1) == 1)
1220         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1221           ATYPE_DISTRIBUTION_LOCAL_GROUP)
1222
1223         # Change to "global" (shouldn't work)
1224
1225         try:
1226             m = Message()
1227             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1228             m["groupType"] = MessageElement(
1229               str(GTYPE_DISTRIBUTION_GLOBAL_GROUP),
1230               FLAG_MOD_REPLACE, "groupType")
1231             ldb.modify(m)
1232             self.fail()
1233         except LdbError, (num, _):
1234             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1235
1236         # Change back to "universal"
1237
1238         # Try to add invalid member to group 1 - should be denied
1239         m = Message()
1240         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1241         m["member"] = MessageElement(
1242           "cn=ldaptestuser3,cn=users," + self.base_dn,
1243           FLAG_MOD_ADD, "member")
1244         try:
1245             ldb.modify(m)
1246             self.fail()
1247         except LdbError, (num, _):
1248             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
1249
1250         # Make group 2 secondary
1251         m = Message()
1252         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1253         m["groupType"] = MessageElement(
1254          str(GTYPE_DISTRIBUTION_UNIVERSAL_GROUP),
1255           FLAG_MOD_REPLACE, "groupType")
1256         ldb.modify(m)
1257
1258         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1259                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1260         self.assertTrue(len(res1) == 1)
1261         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1262           ATYPE_DISTRIBUTION_UNIVERSAL_GROUP)
1263
1264         # Change back to "global"
1265
1266         m = Message()
1267         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1268         m["groupType"] = MessageElement(
1269           str(GTYPE_DISTRIBUTION_GLOBAL_GROUP),
1270           FLAG_MOD_REPLACE, "groupType")
1271         ldb.modify(m)
1272
1273         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1274                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1275         self.assertTrue(len(res1) == 1)
1276         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1277           ATYPE_DISTRIBUTION_GLOBAL_GROUP)
1278
1279         # Both group types: this performs only random checks - all possibilities
1280         # would require too much code.
1281
1282         # Default is "global group"
1283
1284         m = Message()
1285         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1286         m["groupType"] = MessageElement(
1287           str(GTYPE_SECURITY_GLOBAL_GROUP),
1288           FLAG_MOD_REPLACE, "groupType")
1289         ldb.modify(m)
1290
1291         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1292                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1293         self.assertTrue(len(res1) == 1)
1294         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1295           ATYPE_SECURITY_GLOBAL_GROUP)
1296
1297         # Change to "local" (shouldn't work)
1298
1299         try:
1300             m = Message()
1301             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1302             m["groupType"] = MessageElement(
1303               str(GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP),
1304               FLAG_MOD_REPLACE, "groupType")
1305             ldb.modify(m)
1306             self.fail()
1307         except LdbError, (num, _):
1308             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1309
1310         # Change to "universal"
1311
1312         m = Message()
1313         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1314         m["groupType"] = MessageElement(
1315          str(GTYPE_DISTRIBUTION_UNIVERSAL_GROUP),
1316           FLAG_MOD_REPLACE, "groupType")
1317         ldb.modify(m)
1318
1319         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1320                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1321         self.assertTrue(len(res1) == 1)
1322         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1323           ATYPE_DISTRIBUTION_UNIVERSAL_GROUP)
1324
1325         # Change back to "global"
1326
1327         m = Message()
1328         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1329         m["groupType"] = MessageElement(
1330           str(GTYPE_SECURITY_GLOBAL_GROUP),
1331           FLAG_MOD_REPLACE, "groupType")
1332         ldb.modify(m)
1333
1334         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1335                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1336         self.assertTrue(len(res1) == 1)
1337         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1338           ATYPE_SECURITY_GLOBAL_GROUP)
1339
1340         # Change back to "universal"
1341
1342         m = Message()
1343         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1344         m["groupType"] = MessageElement(
1345          str(GTYPE_SECURITY_UNIVERSAL_GROUP),
1346           FLAG_MOD_REPLACE, "groupType")
1347         ldb.modify(m)
1348
1349         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1350                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1351         self.assertTrue(len(res1) == 1)
1352         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1353           ATYPE_SECURITY_UNIVERSAL_GROUP)
1354
1355         # Change to "local"
1356
1357         m = Message()
1358         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1359         m["groupType"] = MessageElement(
1360           str(GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP),
1361           FLAG_MOD_REPLACE, "groupType")
1362         ldb.modify(m)
1363
1364         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1365                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1366         self.assertTrue(len(res1) == 1)
1367         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1368           ATYPE_DISTRIBUTION_LOCAL_GROUP)
1369
1370         # Change to "global" (shouldn't work)
1371
1372         try:
1373             m = Message()
1374             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1375             m["groupType"] = MessageElement(
1376               str(GTYPE_DISTRIBUTION_GLOBAL_GROUP),
1377               FLAG_MOD_REPLACE, "groupType")
1378             ldb.modify(m)
1379             self.fail()
1380         except LdbError, (num, _):
1381             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1382
1383         # Change back to "universal"
1384
1385         m = Message()
1386         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1387         m["groupType"] = MessageElement(
1388          str(GTYPE_SECURITY_UNIVERSAL_GROUP),
1389           FLAG_MOD_REPLACE, "groupType")
1390         ldb.modify(m)
1391
1392         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1393                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1394         self.assertTrue(len(res1) == 1)
1395         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1396           ATYPE_SECURITY_UNIVERSAL_GROUP)
1397
1398         # Change back to "global"
1399
1400         m = Message()
1401         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1402         m["groupType"] = MessageElement(
1403           str(GTYPE_SECURITY_GLOBAL_GROUP),
1404           FLAG_MOD_REPLACE, "groupType")
1405         ldb.modify(m)
1406
1407         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1408                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1409         self.assertTrue(len(res1) == 1)
1410         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1411           ATYPE_SECURITY_GLOBAL_GROUP)
1412
1413         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1414
1415     def test_userAccountControl(self):
1416         """Test the userAccountControl behaviour"""
1417         print "Testing userAccountControl behaviour\n"
1418
1419         # With a user object
1420
1421         # Add operation
1422
1423         # As user you can only set a normal account.
1424         # The UF_PASSWD_NOTREQD flag is needed since we haven't requested a
1425         # password yet.
1426         # With SYSTEM rights you can set a interdomain trust account.
1427
1428         ldb.add({
1429             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1430             "objectclass": "user",
1431             "userAccountControl": "0"})
1432
1433         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1434                           scope=SCOPE_BASE,
1435                           attrs=["sAMAccountType", "userAccountControl"])
1436         self.assertTrue(len(res1) == 1)
1437         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1438           ATYPE_NORMAL_ACCOUNT)
1439         self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_ACCOUNTDISABLE == 0)
1440         self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_PASSWD_NOTREQD == 0)
1441         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1442
1443 # This has to wait until s4 supports it (needs a password module change)
1444 #        try:
1445 #            ldb.add({
1446 #                "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1447 #                "objectclass": "user",
1448 #                "userAccountControl": str(UF_NORMAL_ACCOUNT)})
1449 #            self.fail()
1450 #        except LdbError, (num, _):
1451 #            self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1452 #        delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1453
1454         ldb.add({
1455             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1456             "objectclass": "user",
1457             "userAccountControl": str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD)})
1458
1459         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1460                           scope=SCOPE_BASE,
1461                           attrs=["sAMAccountType", "userAccountControl"])
1462         self.assertTrue(len(res1) == 1)
1463         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1464           ATYPE_NORMAL_ACCOUNT)
1465         self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_ACCOUNTDISABLE == 0)
1466         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1467
1468         try:
1469             ldb.add({
1470                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1471                 "objectclass": "user",
1472                 "userAccountControl": str(UF_TEMP_DUPLICATE_ACCOUNT)})
1473             self.fail()
1474         except LdbError, (num, _):
1475             self.assertEquals(num, ERR_OTHER)
1476         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1477
1478         try:
1479             ldb.add({
1480                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1481                 "objectclass": "user",
1482                 "userAccountControl": str(UF_SERVER_TRUST_ACCOUNT)})
1483             self.fail()
1484         except LdbError, (num, _):
1485             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
1486         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1487
1488         try:
1489             ldb.add({
1490                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1491                 "objectclass": "user",
1492                 "userAccountControl": str(UF_WORKSTATION_TRUST_ACCOUNT)})
1493         except LdbError, (num, _):
1494             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
1495         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1496
1497         try:
1498             ldb.add({
1499                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1500                 "objectclass": "user",
1501                 "userAccountControl": str(UF_WORKSTATION_TRUST_ACCOUNT | UF_PARTIAL_SECRETS_ACCOUNT)})
1502         except LdbError, (num, _):
1503             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
1504         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1505
1506 # This isn't supported yet in s4 - needs ACL module adaption
1507 #        try:
1508 #            ldb.add({
1509 #                "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1510 #                "objectclass": "user",
1511 #                "userAccountControl": str(UF_INTERDOMAIN_TRUST_ACCOUNT)})
1512 #            self.fail()
1513 #        except LdbError, (num, _):
1514 #            self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
1515 #        delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1516
1517         # Modify operation
1518
1519         ldb.add({
1520             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1521             "objectclass": "user"})
1522
1523         # After creation we should have a normal account
1524         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1525                           scope=SCOPE_BASE,
1526                           attrs=["sAMAccountType", "userAccountControl"])
1527         self.assertTrue(len(res1) == 1)
1528         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1529           ATYPE_NORMAL_ACCOUNT)
1530         self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_ACCOUNTDISABLE != 0)
1531
1532         # As user you can only switch from a normal account to a workstation
1533         # trust account and back.
1534         # The UF_PASSWD_NOTREQD flag is needed since we haven't requested a
1535         # password yet.
1536         # With SYSTEM rights you can switch to a interdomain trust account.
1537
1538         # Invalid attribute
1539         try:
1540             m = Message()
1541             m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1542             m["userAccountControl"] = MessageElement("0",
1543               FLAG_MOD_REPLACE, "userAccountControl")
1544             ldb.modify(m)
1545         except LdbError, (num, _):
1546             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1547
1548 # This has to wait until s4 supports it (needs a password module change)
1549 #        try:
1550 #            m = Message()
1551 #            m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1552 #            m["userAccountControl"] = MessageElement(
1553 #              str(UF_NORMAL_ACCOUNT),
1554 #              FLAG_MOD_REPLACE, "userAccountControl")
1555 #            ldb.modify(m)
1556 #        except LdbError, (num, _):
1557 #            self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1558
1559         m = Message()
1560         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1561         m["userAccountControl"] = MessageElement(
1562           str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD),
1563           FLAG_MOD_REPLACE, "userAccountControl")
1564         ldb.modify(m)
1565
1566         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1567                           scope=SCOPE_BASE,
1568                           attrs=["sAMAccountType", "userAccountControl"])
1569         self.assertTrue(len(res1) == 1)
1570         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1571           ATYPE_NORMAL_ACCOUNT)
1572         self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_ACCOUNTDISABLE == 0)
1573
1574         m = Message()
1575         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1576         m["userAccountControl"] = MessageElement(
1577           str(UF_ACCOUNTDISABLE),
1578           FLAG_MOD_REPLACE, "userAccountControl")
1579         ldb.modify(m)
1580
1581         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1582                           scope=SCOPE_BASE,
1583                           attrs=["sAMAccountType", "userAccountControl"])
1584         self.assertTrue(len(res1) == 1)
1585         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1586           ATYPE_NORMAL_ACCOUNT)
1587         self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_NORMAL_ACCOUNT != 0)
1588         self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_ACCOUNTDISABLE != 0)
1589
1590         try:
1591             m = Message()
1592             m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1593             m["userAccountControl"] = MessageElement(
1594               str(UF_TEMP_DUPLICATE_ACCOUNT),
1595               FLAG_MOD_REPLACE, "userAccountControl")
1596             ldb.modify(m)
1597             self.fail()
1598         except LdbError, (num, _):
1599             self.assertEquals(num, ERR_OTHER)
1600
1601         try:
1602             m = Message()
1603             m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1604             m["userAccountControl"] = MessageElement(
1605               str(UF_SERVER_TRUST_ACCOUNT),
1606               FLAG_MOD_REPLACE, "userAccountControl")
1607             ldb.modify(m)
1608             self.fail()
1609         except LdbError, (num, _):
1610             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1611
1612         m = Message()
1613         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1614         m["userAccountControl"] = MessageElement(
1615           str(UF_WORKSTATION_TRUST_ACCOUNT),
1616           FLAG_MOD_REPLACE, "userAccountControl")
1617         ldb.modify(m)
1618
1619         try:
1620             m = Message()
1621             m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1622             m["userAccountControl"] = MessageElement(
1623               str(UF_WORKSTATION_TRUST_ACCOUNT | UF_PARTIAL_SECRETS_ACCOUNT),
1624               FLAG_MOD_REPLACE, "userAccountControl")
1625             ldb.modify(m)
1626             self.fail()
1627         except LdbError, (num, _):
1628             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1629
1630         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1631                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1632         self.assertTrue(len(res1) == 1)
1633         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1634           ATYPE_WORKSTATION_TRUST)
1635
1636         m = Message()
1637         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1638         m["userAccountControl"] = MessageElement(
1639           str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD),
1640           FLAG_MOD_REPLACE, "userAccountControl")
1641         ldb.modify(m)
1642
1643         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1644                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1645         self.assertTrue(len(res1) == 1)
1646         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1647           ATYPE_NORMAL_ACCOUNT)
1648
1649 # This isn't supported yet in s4 - needs ACL module adaption
1650 #        try:
1651 #            m = Message()
1652 #            m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1653 #            m["userAccountControl"] = MessageElement(
1654 #              str(UF_INTERDOMAIN_TRUST_ACCOUNT),
1655 #              FLAG_MOD_REPLACE, "userAccountControl")
1656 #            ldb.modify(m)
1657 #            self.fail()
1658 #        except LdbError, (num, _):
1659 #            self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
1660
1661         # With a computer object
1662
1663         # Add operation
1664
1665         # As computer you can set a normal account and a server trust account.
1666         # The UF_PASSWD_NOTREQD flag is needed since we haven't requested a
1667         # password yet.
1668         # With SYSTEM rights you can set a interdomain trust account.
1669
1670         ldb.add({
1671             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1672             "objectclass": "computer",
1673             "userAccountControl": "0"})
1674
1675         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1676                           scope=SCOPE_BASE,
1677                           attrs=["sAMAccountType", "userAccountControl"])
1678         self.assertTrue(len(res1) == 1)
1679         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1680           ATYPE_NORMAL_ACCOUNT)
1681         self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_ACCOUNTDISABLE == 0)
1682         self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_PASSWD_NOTREQD == 0)
1683         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1684
1685 # This has to wait until s4 supports it (needs a password module change)
1686 #        try:
1687 #            ldb.add({
1688 #                "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1689 #                "objectclass": "computer",
1690 #                "userAccountControl": str(UF_NORMAL_ACCOUNT)})
1691 #            self.fail()
1692 #        except LdbError, (num, _):
1693 #            self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1694 #        delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1695
1696         ldb.add({
1697             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1698             "objectclass": "computer",
1699             "userAccountControl": str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD)})
1700
1701         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1702                           scope=SCOPE_BASE,
1703                           attrs=["sAMAccountType", "userAccountControl"])
1704         self.assertTrue(len(res1) == 1)
1705         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1706           ATYPE_NORMAL_ACCOUNT)
1707         self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_ACCOUNTDISABLE == 0)
1708         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1709
1710         try:
1711             ldb.add({
1712                 "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1713                 "objectclass": "computer",
1714                 "userAccountControl": str(UF_TEMP_DUPLICATE_ACCOUNT)})
1715             self.fail()
1716         except LdbError, (num, _):
1717             self.assertEquals(num, ERR_OTHER)
1718         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1719
1720         ldb.add({
1721             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1722             "objectclass": "computer",
1723             "userAccountControl": str(UF_SERVER_TRUST_ACCOUNT)})
1724
1725         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1726                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1727         self.assertTrue(len(res1) == 1)
1728         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1729           ATYPE_WORKSTATION_TRUST)
1730         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1731
1732         try:
1733             ldb.add({
1734                 "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1735                 "objectclass": "computer",
1736                 "userAccountControl": str(UF_WORKSTATION_TRUST_ACCOUNT)})
1737         except LdbError, (num, _):
1738             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
1739         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1740
1741 # This isn't supported yet in s4 - needs ACL module adaption
1742 #        try:
1743 #            ldb.add({
1744 #                "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1745 #                "objectclass": "computer",
1746 #                "userAccountControl": str(UF_INTERDOMAIN_TRUST_ACCOUNT)})
1747 #            self.fail()
1748 #        except LdbError, (num, _):
1749 #            self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
1750 #        delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1751
1752         # Modify operation
1753
1754         ldb.add({
1755             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1756             "objectclass": "computer"})
1757
1758         # After creation we should have a normal account
1759         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1760                           scope=SCOPE_BASE,
1761                           attrs=["sAMAccountType", "userAccountControl"])
1762         self.assertTrue(len(res1) == 1)
1763         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1764           ATYPE_NORMAL_ACCOUNT)
1765         self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_ACCOUNTDISABLE != 0)
1766
1767         # As computer you can switch from a normal account to a workstation
1768         # or server trust account and back (also swapping between trust
1769         # accounts is allowed).
1770         # The UF_PASSWD_NOTREQD flag is needed since we haven't requested a
1771         # password yet.
1772         # With SYSTEM rights you can switch to a interdomain trust account.
1773
1774         # Invalid attribute
1775         try:
1776             m = Message()
1777             m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1778             m["userAccountControl"] = MessageElement("0",
1779               FLAG_MOD_REPLACE, "userAccountControl")
1780             ldb.modify(m)
1781         except LdbError, (num, _):
1782             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1783
1784 # This has to wait until s4 supports it (needs a password module change)
1785 #        try:
1786 #            m = Message()
1787 #            m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1788 #            m["userAccountControl"] = MessageElement(
1789 #              str(UF_NORMAL_ACCOUNT),
1790 #              FLAG_MOD_REPLACE, "userAccountControl")
1791 #            ldb.modify(m)
1792 #        except LdbError, (num, _):
1793 #            self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1794
1795         m = Message()
1796         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1797         m["userAccountControl"] = MessageElement(
1798           str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD),
1799           FLAG_MOD_REPLACE, "userAccountControl")
1800         ldb.modify(m)
1801
1802         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1803                           scope=SCOPE_BASE,
1804                           attrs=["sAMAccountType", "userAccountControl"])
1805         self.assertTrue(len(res1) == 1)
1806         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1807           ATYPE_NORMAL_ACCOUNT)
1808         self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_ACCOUNTDISABLE == 0)
1809
1810         m = Message()
1811         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1812         m["userAccountControl"] = MessageElement(
1813           str(UF_ACCOUNTDISABLE),
1814           FLAG_MOD_REPLACE, "userAccountControl")
1815         ldb.modify(m)
1816
1817         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1818                           scope=SCOPE_BASE,
1819                           attrs=["sAMAccountType", "userAccountControl"])
1820         self.assertTrue(len(res1) == 1)
1821         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1822           ATYPE_NORMAL_ACCOUNT)
1823         self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_NORMAL_ACCOUNT != 0)
1824         self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_ACCOUNTDISABLE != 0)
1825
1826         try:
1827             m = Message()
1828             m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1829             m["userAccountControl"] = MessageElement(
1830               str(UF_TEMP_DUPLICATE_ACCOUNT),
1831               FLAG_MOD_REPLACE, "userAccountControl")
1832             ldb.modify(m)
1833             self.fail()
1834         except LdbError, (num, _):
1835             self.assertEquals(num, ERR_OTHER)
1836
1837         m = Message()
1838         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1839         m["userAccountControl"] = MessageElement(
1840           str(UF_SERVER_TRUST_ACCOUNT),
1841           FLAG_MOD_REPLACE, "userAccountControl")
1842         ldb.modify(m)
1843
1844         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1845                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1846         self.assertTrue(len(res1) == 1)
1847         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1848           ATYPE_WORKSTATION_TRUST)
1849
1850         m = Message()
1851         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1852         m["userAccountControl"] = MessageElement(
1853           str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD),
1854           FLAG_MOD_REPLACE, "userAccountControl")
1855         ldb.modify(m)
1856
1857         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1858                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1859         self.assertTrue(len(res1) == 1)
1860         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1861           ATYPE_NORMAL_ACCOUNT)
1862
1863         m = Message()
1864         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1865         m["userAccountControl"] = MessageElement(
1866           str(UF_WORKSTATION_TRUST_ACCOUNT),
1867           FLAG_MOD_REPLACE, "userAccountControl")
1868         ldb.modify(m)
1869
1870         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1871                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1872         self.assertTrue(len(res1) == 1)
1873         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1874           ATYPE_WORKSTATION_TRUST)
1875
1876         m = Message()
1877         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1878         m["userAccountControl"] = MessageElement(
1879           str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD),
1880           FLAG_MOD_REPLACE, "userAccountControl")
1881         ldb.modify(m)
1882
1883         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1884                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1885         self.assertTrue(len(res1) == 1)
1886         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1887           ATYPE_NORMAL_ACCOUNT)
1888
1889         m = Message()
1890         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1891         m["userAccountControl"] = MessageElement(
1892           str(UF_SERVER_TRUST_ACCOUNT),
1893           FLAG_MOD_REPLACE, "userAccountControl")
1894         ldb.modify(m)
1895
1896         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1897                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1898         self.assertTrue(len(res1) == 1)
1899         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1900           ATYPE_WORKSTATION_TRUST)
1901
1902         m = Message()
1903         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1904         m["userAccountControl"] = MessageElement(
1905           str(UF_WORKSTATION_TRUST_ACCOUNT),
1906           FLAG_MOD_REPLACE, "userAccountControl")
1907         ldb.modify(m)
1908
1909         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1910                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1911         self.assertTrue(len(res1) == 1)
1912         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1913           ATYPE_WORKSTATION_TRUST)
1914
1915 # This isn't supported yet in s4 - needs ACL module adaption
1916 #        try:
1917 #            m = Message()
1918 #            m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1919 #            m["userAccountControl"] = MessageElement(
1920 #              str(UF_INTERDOMAIN_TRUST_ACCOUNT),
1921 #              FLAG_MOD_REPLACE, "userAccountControl")
1922 #            ldb.modify(m)
1923 #            self.fail()
1924 #        except LdbError, (num, _):
1925 #            self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
1926
1927         # "primaryGroupID" does not change if account type remains the same
1928
1929         # For a user account
1930
1931         ldb.add({
1932             "dn": "cn=ldaptestuser2,cn=users," + self.base_dn,
1933             "objectclass": "user",
1934             "userAccountControl": str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD | UF_ACCOUNTDISABLE)})
1935
1936         res1 = ldb.search("cn=ldaptestuser2,cn=users," + self.base_dn,
1937                           scope=SCOPE_BASE,
1938                           attrs=["userAccountControl"])
1939         self.assertTrue(len(res1) == 1)
1940         self.assertEquals(int(res1[0]["userAccountControl"][0]),
1941            UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD | UF_ACCOUNTDISABLE)
1942
1943         m = Message()
1944         m.dn = Dn(ldb, "<SID=" + ldb.get_domain_sid() + "-" + str(DOMAIN_RID_ADMINS) + ">")
1945         m["member"] = MessageElement(
1946           "cn=ldaptestuser2,cn=users," + self.base_dn, FLAG_MOD_ADD, "member")
1947         ldb.modify(m)
1948
1949         m = Message()
1950         m.dn = Dn(ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
1951         m["primaryGroupID"] = MessageElement(str(DOMAIN_RID_ADMINS),
1952           FLAG_MOD_REPLACE, "primaryGroupID")
1953         ldb.modify(m)
1954
1955         m = Message()
1956         m.dn = Dn(ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
1957         m["userAccountControl"] = MessageElement(
1958           str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD),
1959           FLAG_MOD_REPLACE, "userAccountControl")
1960         ldb.modify(m)
1961
1962         res1 = ldb.search("cn=ldaptestuser2,cn=users," + self.base_dn,
1963                           scope=SCOPE_BASE,
1964                           attrs=["userAccountControl", "primaryGroupID"])
1965         self.assertTrue(len(res1) == 1)
1966         self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_ACCOUNTDISABLE == 0)
1967         self.assertEquals(int(res1[0]["primaryGroupID"][0]), DOMAIN_RID_ADMINS)
1968
1969         # For a workstation account
1970
1971         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1972                           scope=SCOPE_BASE,
1973                           attrs=["primaryGroupID"])
1974         self.assertTrue(len(res1) == 1)
1975         self.assertEquals(int(res1[0]["primaryGroupID"][0]), DOMAIN_RID_DOMAIN_MEMBERS)
1976
1977         m = Message()
1978         m.dn = Dn(ldb, "<SID=" + ldb.get_domain_sid() + "-" + str(DOMAIN_RID_USERS) + ">")
1979         m["member"] = MessageElement(
1980           "cn=ldaptestcomputer,cn=computers," + self.base_dn, FLAG_MOD_ADD, "member")
1981         ldb.modify(m)
1982
1983         m = Message()
1984         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1985         m["primaryGroupID"] = MessageElement(str(DOMAIN_RID_USERS),
1986           FLAG_MOD_REPLACE, "primaryGroupID")
1987         ldb.modify(m)
1988
1989         m = Message()
1990         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1991         m["userAccountControl"] = MessageElement(
1992           str(UF_WORKSTATION_TRUST_ACCOUNT),
1993           FLAG_MOD_REPLACE, "userAccountControl")
1994         ldb.modify(m)
1995
1996         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1997                           scope=SCOPE_BASE,
1998                           attrs=["primaryGroupID"])
1999         self.assertTrue(len(res1) == 1)
2000         self.assertEquals(int(res1[0]["primaryGroupID"][0]), DOMAIN_RID_USERS)
2001
2002         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
2003         delete_force(self.ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
2004         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2005
2006     def test_isCriticalSystemObject(self):
2007         """Test the isCriticalSystemObject behaviour"""
2008         print "Testing isCriticalSystemObject behaviour\n"
2009
2010         # Add tests
2011
2012         ldb.add({
2013             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2014             "objectclass": "computer"})
2015
2016         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2017                           scope=SCOPE_BASE,
2018                           attrs=["isCriticalSystemObject"])
2019         self.assertTrue(len(res1) == 1)
2020         self.assertTrue("isCriticalSystemObject" not in res1[0])
2021
2022         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2023
2024         ldb.add({
2025             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2026             "objectclass": "computer",
2027             "userAccountControl": str(UF_WORKSTATION_TRUST_ACCOUNT)})
2028
2029         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2030                           scope=SCOPE_BASE,
2031                           attrs=["isCriticalSystemObject"])
2032         self.assertTrue(len(res1) == 1)
2033         self.assertEquals(res1[0]["isCriticalSystemObject"][0], "FALSE")
2034
2035         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2036
2037         ldb.add({
2038             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2039             "objectclass": "computer",
2040             "userAccountControl": str(UF_WORKSTATION_TRUST_ACCOUNT | UF_PARTIAL_SECRETS_ACCOUNT)})
2041
2042         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2043                           scope=SCOPE_BASE,
2044                           attrs=["isCriticalSystemObject"])
2045         self.assertTrue(len(res1) == 1)
2046         self.assertEquals(res1[0]["isCriticalSystemObject"][0], "TRUE")
2047
2048         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2049
2050         ldb.add({
2051             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2052             "objectclass": "computer",
2053             "userAccountControl": str(UF_SERVER_TRUST_ACCOUNT)})
2054
2055         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2056                           scope=SCOPE_BASE,
2057                           attrs=["isCriticalSystemObject"])
2058         self.assertTrue(len(res1) == 1)
2059         self.assertEquals(res1[0]["isCriticalSystemObject"][0], "TRUE")
2060
2061         # Modification tests
2062
2063         m = Message()
2064         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2065         m["userAccountControl"] = MessageElement(str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD),
2066           FLAG_MOD_REPLACE, "userAccountControl")
2067         ldb.modify(m)
2068
2069         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2070                           scope=SCOPE_BASE,
2071                           attrs=["isCriticalSystemObject"])
2072         self.assertTrue(len(res1) == 1)
2073         self.assertEquals(res1[0]["isCriticalSystemObject"][0], "TRUE")
2074
2075         m = Message()
2076         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2077         m["userAccountControl"] = MessageElement(str(UF_WORKSTATION_TRUST_ACCOUNT),
2078           FLAG_MOD_REPLACE, "userAccountControl")
2079         ldb.modify(m)
2080
2081         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2082                           scope=SCOPE_BASE,
2083                           attrs=["isCriticalSystemObject"])
2084         self.assertTrue(len(res1) == 1)
2085         self.assertEquals(res1[0]["isCriticalSystemObject"][0], "FALSE")
2086
2087         m = Message()
2088         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2089         m["userAccountControl"] = MessageElement(
2090           str(UF_WORKSTATION_TRUST_ACCOUNT | UF_PARTIAL_SECRETS_ACCOUNT),
2091           FLAG_MOD_REPLACE, "userAccountControl")
2092         ldb.modify(m)
2093
2094         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2095                           scope=SCOPE_BASE,
2096                           attrs=["isCriticalSystemObject"])
2097         self.assertTrue(len(res1) == 1)
2098         self.assertEquals(res1[0]["isCriticalSystemObject"][0], "TRUE")
2099
2100         m = Message()
2101         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2102         m["userAccountControl"] = MessageElement(str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD),
2103           FLAG_MOD_REPLACE, "userAccountControl")
2104         ldb.modify(m)
2105
2106         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2107                           scope=SCOPE_BASE,
2108                           attrs=["isCriticalSystemObject"])
2109         self.assertTrue(len(res1) == 1)
2110         self.assertEquals(res1[0]["isCriticalSystemObject"][0], "TRUE")
2111
2112         m = Message()
2113         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2114         m["userAccountControl"] = MessageElement(str(UF_SERVER_TRUST_ACCOUNT),
2115           FLAG_MOD_REPLACE, "userAccountControl")
2116         ldb.modify(m)
2117
2118         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2119                           scope=SCOPE_BASE,
2120                           attrs=["isCriticalSystemObject"])
2121         self.assertTrue(len(res1) == 1)
2122         self.assertEquals(res1[0]["isCriticalSystemObject"][0], "TRUE")
2123
2124         m = Message()
2125         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2126         m["userAccountControl"] = MessageElement(str(UF_WORKSTATION_TRUST_ACCOUNT),
2127           FLAG_MOD_REPLACE, "userAccountControl")
2128         ldb.modify(m)
2129
2130         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2131                           scope=SCOPE_BASE,
2132                           attrs=["isCriticalSystemObject"])
2133         self.assertTrue(len(res1) == 1)
2134         self.assertEquals(res1[0]["isCriticalSystemObject"][0], "FALSE")
2135
2136         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2137
2138     def test_service_principal_name_updates(self):
2139         """Test the servicePrincipalNames update behaviour"""
2140         print "Testing servicePrincipalNames update behaviour\n"
2141
2142         ldb.add({
2143             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2144             "objectclass": "computer",
2145             "dNSHostName": "testname.testdom"})
2146
2147         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2148                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2149         self.assertTrue(len(res) == 1)
2150         self.assertFalse("servicePrincipalName" in res[0])
2151
2152         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2153
2154         ldb.add({
2155             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2156             "objectclass": "computer",
2157             "servicePrincipalName": "HOST/testname.testdom"})
2158
2159         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2160                           scope=SCOPE_BASE, attrs=["dNSHostName"])
2161         self.assertTrue(len(res) == 1)
2162         self.assertFalse("dNSHostName" in res[0])
2163
2164         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2165
2166         ldb.add({
2167             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2168             "objectclass": "computer",
2169             "dNSHostName": "testname2.testdom",
2170             "servicePrincipalName": "HOST/testname.testdom"})
2171
2172         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2173                          scope=SCOPE_BASE, attrs=["dNSHostName"])
2174         self.assertTrue(len(res) == 1)
2175         self.assertEquals(res[0]["dNSHostName"][0], "testname2.testdom")
2176
2177         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2178                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2179         self.assertTrue(len(res) == 1)
2180         self.assertEquals(res[0]["servicePrincipalName"][0],
2181                           "HOST/testname.testdom")
2182
2183         m = Message()
2184         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2185         m["dNSHostName"] = MessageElement("testname.testdoM",
2186                                           FLAG_MOD_REPLACE, "dNSHostName")
2187         ldb.modify(m)
2188
2189         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2190                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2191         self.assertTrue(len(res) == 1)
2192         self.assertEquals(res[0]["servicePrincipalName"][0],
2193                           "HOST/testname.testdom")
2194
2195         m = Message()
2196         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2197         m["dNSHostName"] = MessageElement("testname2.testdom2",
2198                                           FLAG_MOD_REPLACE, "dNSHostName")
2199         ldb.modify(m)
2200
2201         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2202                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2203         self.assertTrue(len(res) == 1)
2204         self.assertEquals(res[0]["servicePrincipalName"][0],
2205                           "HOST/testname2.testdom2")
2206
2207         m = Message()
2208         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2209         m["dNSHostName"] = MessageElement([],
2210                                           FLAG_MOD_DELETE, "dNSHostName")
2211         ldb.modify(m)
2212
2213         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2214                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2215         self.assertTrue(len(res) == 1)
2216         self.assertEquals(res[0]["servicePrincipalName"][0],
2217                           "HOST/testname2.testdom2")
2218
2219         m = Message()
2220         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2221         m["dNSHostName"] = MessageElement("testname.testdom3",
2222                                           FLAG_MOD_REPLACE, "dNSHostName")
2223         ldb.modify(m)
2224
2225         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2226                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2227         self.assertTrue(len(res) == 1)
2228         self.assertEquals(res[0]["servicePrincipalName"][0],
2229                           "HOST/testname2.testdom2")
2230
2231         m = Message()
2232         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2233         m["dNSHostName"] = MessageElement("testname2.testdom2",
2234                                           FLAG_MOD_REPLACE, "dNSHostName")
2235         ldb.modify(m)
2236
2237         m = Message()
2238         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2239         m["dNSHostName"] = MessageElement("testname3.testdom3",
2240                                           FLAG_MOD_REPLACE, "dNSHostName")
2241         m["servicePrincipalName"] = MessageElement("HOST/testname2.testdom2",
2242                                                    FLAG_MOD_REPLACE,
2243                                                    "servicePrincipalName")
2244         ldb.modify(m)
2245
2246         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2247                           scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2248         self.assertTrue(len(res) == 1)
2249         self.assertEquals(res[0]["servicePrincipalName"][0],
2250                           "HOST/testname3.testdom3")
2251
2252         m = Message()
2253         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2254         m["servicePrincipalName"] = MessageElement("HOST/testname2.testdom2",
2255                                                    FLAG_MOD_REPLACE,
2256                                                    "servicePrincipalName")
2257         m["dNSHostName"] = MessageElement("testname4.testdom4",
2258                                           FLAG_MOD_REPLACE, "dNSHostName")
2259         ldb.modify(m)
2260
2261         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2262                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2263         self.assertTrue(len(res) == 1)
2264         self.assertEquals(res[0]["servicePrincipalName"][0],
2265                           "HOST/testname2.testdom2")
2266
2267         m = Message()
2268         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2269         m["servicePrincipalName"] = MessageElement([],
2270                                                    FLAG_MOD_DELETE,
2271                                                    "servicePrincipalName")
2272         ldb.modify(m)
2273
2274         m = Message()
2275         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2276         m["dNSHostName"] = MessageElement("testname2.testdom2",
2277                                           FLAG_MOD_REPLACE, "dNSHostName")
2278         ldb.modify(m)
2279
2280         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2281                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2282         self.assertTrue(len(res) == 1)
2283         self.assertFalse("servicePrincipalName" in res[0])
2284
2285         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2286
2287         ldb.add({
2288             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2289             "objectclass": "computer",
2290             "sAMAccountName": "testname$"})
2291
2292         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2293                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2294         self.assertTrue(len(res) == 1)
2295         self.assertFalse("servicePrincipalName" in res[0])
2296
2297         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2298
2299         ldb.add({
2300             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2301             "objectclass": "computer",
2302             "servicePrincipalName": "HOST/testname"})
2303
2304         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2305                          scope=SCOPE_BASE, attrs=["sAMAccountName"])
2306         self.assertTrue(len(res) == 1)
2307         self.assertTrue("sAMAccountName" in res[0])
2308
2309         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2310
2311         ldb.add({
2312             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2313             "objectclass": "computer",
2314             "sAMAccountName": "testname$",
2315             "servicePrincipalName": "HOST/testname"})
2316
2317         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2318                          scope=SCOPE_BASE, attrs=["sAMAccountName"])
2319         self.assertTrue(len(res) == 1)
2320         self.assertEquals(res[0]["sAMAccountName"][0], "testname$")
2321
2322         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2323                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2324         self.assertTrue(len(res) == 1)
2325         self.assertEquals(res[0]["servicePrincipalName"][0],
2326                           "HOST/testname")
2327
2328         m = Message()
2329         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2330         m["sAMAccountName"] = MessageElement("testnamE$",
2331                                              FLAG_MOD_REPLACE, "sAMAccountName")
2332         ldb.modify(m)
2333
2334         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2335                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2336         self.assertTrue(len(res) == 1)
2337         self.assertEquals(res[0]["servicePrincipalName"][0],
2338                           "HOST/testname")
2339
2340         m = Message()
2341         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2342         m["sAMAccountName"] = MessageElement("testname",
2343                                              FLAG_MOD_REPLACE, "sAMAccountName")
2344         ldb.modify(m)
2345
2346         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2347                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2348         self.assertTrue(len(res) == 1)
2349         self.assertEquals(res[0]["servicePrincipalName"][0],
2350                           "HOST/testname")
2351
2352         m = Message()
2353         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2354         m["sAMAccountName"] = MessageElement("test$name$",
2355                                              FLAG_MOD_REPLACE, "sAMAccountName")
2356         ldb.modify(m)
2357
2358         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2359                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2360         self.assertTrue(len(res) == 1)
2361         self.assertEquals(res[0]["servicePrincipalName"][0],
2362                           "HOST/test$name")
2363
2364         m = Message()
2365         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2366         m["sAMAccountName"] = MessageElement("testname2",
2367                                              FLAG_MOD_REPLACE, "sAMAccountName")
2368         ldb.modify(m)
2369
2370         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2371                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2372         self.assertTrue(len(res) == 1)
2373         self.assertEquals(res[0]["servicePrincipalName"][0],
2374                           "HOST/testname2")
2375
2376         m = Message()
2377         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2378         m["sAMAccountName"] = MessageElement("testname3",
2379                                              FLAG_MOD_REPLACE, "sAMAccountName")
2380         m["servicePrincipalName"] = MessageElement("HOST/testname2",
2381                                                    FLAG_MOD_REPLACE,
2382                                                    "servicePrincipalName")
2383         ldb.modify(m)
2384
2385         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2386                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2387         self.assertTrue(len(res) == 1)
2388         self.assertEquals(res[0]["servicePrincipalName"][0],
2389                           "HOST/testname3")
2390
2391         m = Message()
2392         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2393         m["servicePrincipalName"] = MessageElement("HOST/testname2",
2394                                                    FLAG_MOD_REPLACE,
2395                                                    "servicePrincipalName")
2396         m["sAMAccountName"] = MessageElement("testname4",
2397                                              FLAG_MOD_REPLACE, "sAMAccountName")
2398         ldb.modify(m)
2399
2400         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2401                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2402         self.assertTrue(len(res) == 1)
2403         self.assertEquals(res[0]["servicePrincipalName"][0],
2404                           "HOST/testname2")
2405
2406         m = Message()
2407         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2408         m["servicePrincipalName"] = MessageElement([],
2409                                                    FLAG_MOD_DELETE,
2410                                                    "servicePrincipalName")
2411         ldb.modify(m)
2412
2413         m = Message()
2414         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2415         m["sAMAccountName"] = MessageElement("testname2",
2416                                              FLAG_MOD_REPLACE, "sAMAccountName")
2417         ldb.modify(m)
2418
2419         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2420                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2421         self.assertTrue(len(res) == 1)
2422         self.assertFalse("servicePrincipalName" in res[0])
2423
2424         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2425
2426         ldb.add({
2427             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2428             "objectclass": "computer",
2429             "dNSHostName": "testname.testdom",
2430             "sAMAccountName": "testname$",
2431             "servicePrincipalName": [ "HOST/testname.testdom", "HOST/testname" ]
2432         })
2433
2434         m = Message()
2435         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2436         m["dNSHostName"] = MessageElement("testname2.testdom",
2437                                           FLAG_MOD_REPLACE, "dNSHostName")
2438         m["sAMAccountName"] = MessageElement("testname2$",
2439                                              FLAG_MOD_REPLACE, "sAMAccountName")
2440         ldb.modify(m)
2441
2442         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2443                          scope=SCOPE_BASE, attrs=["dNSHostName", "sAMAccountName", "servicePrincipalName"])
2444         self.assertTrue(len(res) == 1)
2445         self.assertEquals(res[0]["dNSHostName"][0], "testname2.testdom")
2446         self.assertEquals(res[0]["sAMAccountName"][0], "testname2$")
2447         self.assertTrue(res[0]["servicePrincipalName"][0] == "HOST/testname2" or
2448                         res[0]["servicePrincipalName"][1] == "HOST/testname2")
2449         self.assertTrue(res[0]["servicePrincipalName"][0] == "HOST/testname2.testdom" or
2450                         res[0]["servicePrincipalName"][1] == "HOST/testname2.testdom")
2451
2452         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2453
2454         ldb.add({
2455             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2456             "objectclass": "computer",
2457             "dNSHostName": "testname.testdom",
2458             "sAMAccountName": "testname$",
2459             "servicePrincipalName": [ "HOST/testname.testdom", "HOST/testname" ]
2460         })
2461
2462         m = Message()
2463         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2464         m["sAMAccountName"] = MessageElement("testname2$",
2465                                              FLAG_MOD_REPLACE, "sAMAccountName")
2466         m["dNSHostName"] = MessageElement("testname2.testdom",
2467                                           FLAG_MOD_REPLACE, "dNSHostName")
2468         ldb.modify(m)
2469
2470         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2471                          scope=SCOPE_BASE, attrs=["dNSHostName", "sAMAccountName", "servicePrincipalName"])
2472         self.assertTrue(len(res) == 1)
2473         self.assertEquals(res[0]["dNSHostName"][0], "testname2.testdom")
2474         self.assertEquals(res[0]["sAMAccountName"][0], "testname2$")
2475         self.assertTrue(len(res[0]["servicePrincipalName"]) == 2)
2476         self.assertTrue("HOST/testname2" in res[0]["servicePrincipalName"])
2477         self.assertTrue("HOST/testname2.testdom" in res[0]["servicePrincipalName"])
2478
2479         m = Message()
2480         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2481         m["servicePrincipalName"] = MessageElement("HOST/testname2.testdom",
2482                                                    FLAG_MOD_ADD, "servicePrincipalName")
2483         try:
2484             ldb.modify(m)
2485             self.fail()
2486         except LdbError, (num, _):
2487             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
2488
2489         m = Message()
2490         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2491         m["servicePrincipalName"] = MessageElement("HOST/testname3",
2492                                                    FLAG_MOD_ADD, "servicePrincipalName")
2493         ldb.modify(m)
2494
2495         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2496                          scope=SCOPE_BASE, attrs=["dNSHostName", "sAMAccountName", "servicePrincipalName"])
2497         self.assertTrue(len(res) == 1)
2498         self.assertEquals(res[0]["dNSHostName"][0], "testname2.testdom")
2499         self.assertEquals(res[0]["sAMAccountName"][0], "testname2$")
2500         self.assertTrue(len(res[0]["servicePrincipalName"]) == 3)
2501         self.assertTrue("HOST/testname2" in res[0]["servicePrincipalName"])
2502         self.assertTrue("HOST/testname3" in res[0]["servicePrincipalName"])
2503         self.assertTrue("HOST/testname2.testdom" in res[0]["servicePrincipalName"])
2504
2505         m = Message()
2506         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2507         m["dNSHostName"] = MessageElement("testname3.testdom",
2508                                           FLAG_MOD_REPLACE, "dNSHostName")
2509         m["servicePrincipalName"] = MessageElement("HOST/testname3.testdom",
2510                                                    FLAG_MOD_ADD, "servicePrincipalName")
2511         ldb.modify(m)
2512
2513         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2514                          scope=SCOPE_BASE, attrs=["dNSHostName", "sAMAccountName", "servicePrincipalName"])
2515         self.assertTrue(len(res) == 1)
2516         self.assertEquals(res[0]["dNSHostName"][0], "testname3.testdom")
2517         self.assertEquals(res[0]["sAMAccountName"][0], "testname2$")
2518         self.assertTrue(len(res[0]["servicePrincipalName"]) == 3)
2519         self.assertTrue("HOST/testname2" in res[0]["servicePrincipalName"])
2520         self.assertTrue("HOST/testname3" in res[0]["servicePrincipalName"])
2521         self.assertTrue("HOST/testname3.testdom" in res[0]["servicePrincipalName"])
2522
2523         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2524
2525     def test_sam_description_attribute(self):
2526         """Test SAM description attribute"""
2527         print "Test SAM description attribute"""
2528
2529         self.ldb.add({
2530             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
2531             "description": "desc2",
2532             "objectclass": "group",
2533             "description": "desc1"})
2534
2535         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
2536                          scope=SCOPE_BASE, attrs=["description"])
2537         self.assertTrue(len(res) == 1)
2538         self.assertTrue("description" in res[0])
2539         self.assertTrue(len(res[0]["description"]) == 1)
2540         self.assertEquals(res[0]["description"][0], "desc1")
2541
2542         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2543
2544         self.ldb.add({
2545             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
2546             "objectclass": "group",
2547             "description": ["desc1", "desc2"]})
2548
2549         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
2550                          scope=SCOPE_BASE, attrs=["description"])
2551         self.assertTrue(len(res) == 1)
2552         self.assertTrue("description" in res[0])
2553         self.assertTrue(len(res[0]["description"]) == 2)
2554         self.assertTrue(res[0]["description"][0] == "desc1" or
2555                         res[0]["description"][1] == "desc1")
2556         self.assertTrue(res[0]["description"][0] == "desc2" or
2557                         res[0]["description"][1] == "desc2")
2558
2559         m = Message()
2560         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2561         m["description"] = MessageElement(["desc1","desc2"], FLAG_MOD_REPLACE,
2562           "description")
2563         try:
2564             ldb.modify(m)
2565             self.fail()
2566         except LdbError, (num, _):
2567             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
2568
2569         m = Message()
2570         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2571         m["description"] = MessageElement(["desc1","desc2"], FLAG_MOD_DELETE,
2572           "description")
2573         ldb.modify(m)
2574
2575         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2576
2577         self.ldb.add({
2578             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
2579             "objectclass": "group" })
2580
2581         m = Message()
2582         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2583         m["description"] = MessageElement("desc1", FLAG_MOD_REPLACE,
2584           "description")
2585         ldb.modify(m)
2586
2587         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
2588                          scope=SCOPE_BASE, attrs=["description"])
2589         self.assertTrue(len(res) == 1)
2590         self.assertTrue("description" in res[0])
2591         self.assertTrue(len(res[0]["description"]) == 1)
2592         self.assertEquals(res[0]["description"][0], "desc1")
2593
2594         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2595
2596         self.ldb.add({
2597             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
2598             "objectclass": "group",
2599             "description": ["desc1", "desc2"]})
2600
2601         m = Message()
2602         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2603         m["description"] = MessageElement("desc1", FLAG_MOD_REPLACE,
2604           "description")
2605         ldb.modify(m)
2606
2607         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
2608                          scope=SCOPE_BASE, attrs=["description"])
2609         self.assertTrue(len(res) == 1)
2610         self.assertTrue("description" in res[0])
2611         self.assertTrue(len(res[0]["description"]) == 1)
2612         self.assertEquals(res[0]["description"][0], "desc1")
2613
2614         m = Message()
2615         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2616         m["description"] = MessageElement("desc3", FLAG_MOD_ADD,
2617           "description")
2618         try:
2619             ldb.modify(m)
2620             self.fail()
2621         except LdbError, (num, _):
2622             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
2623
2624         m = Message()
2625         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2626         m["description"] = MessageElement(["desc1","desc2"], FLAG_MOD_DELETE,
2627           "description")
2628         try:
2629             ldb.modify(m)
2630             self.fail()
2631         except LdbError, (num, _):
2632             self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
2633
2634         m = Message()
2635         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2636         m["description"] = MessageElement("desc1", FLAG_MOD_DELETE,
2637           "description")
2638         ldb.modify(m)
2639         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
2640                          scope=SCOPE_BASE, attrs=["description"])
2641         self.assertTrue(len(res) == 1)
2642         self.assertFalse("description" in res[0])
2643
2644         m = Message()
2645         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2646         m["description"] = MessageElement(["desc1","desc2"], FLAG_MOD_REPLACE,
2647           "description")
2648         try:
2649             ldb.modify(m)
2650             self.fail()
2651         except LdbError, (num, _):
2652             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
2653
2654         m = Message()
2655         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2656         m["description"] = MessageElement(["desc3", "desc4"], FLAG_MOD_ADD,
2657           "description")
2658         try:
2659             ldb.modify(m)
2660             self.fail()
2661         except LdbError, (num, _):
2662             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
2663
2664         m = Message()
2665         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2666         m["description"] = MessageElement("desc1", FLAG_MOD_ADD,
2667           "description")
2668         ldb.modify(m)
2669
2670         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
2671                          scope=SCOPE_BASE, attrs=["description"])
2672         self.assertTrue(len(res) == 1)
2673         self.assertTrue("description" in res[0])
2674         self.assertTrue(len(res[0]["description"]) == 1)
2675         self.assertEquals(res[0]["description"][0], "desc1")
2676
2677         m = Message()
2678         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2679         m.add(MessageElement("desc1", FLAG_MOD_DELETE, "description"))
2680         m.add(MessageElement("desc2", FLAG_MOD_ADD, "description"))
2681         ldb.modify(m)
2682
2683         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
2684                          scope=SCOPE_BASE, attrs=["description"])
2685         self.assertTrue(len(res) == 1)
2686         self.assertTrue("description" in res[0])
2687         self.assertTrue(len(res[0]["description"]) == 1)
2688         self.assertEquals(res[0]["description"][0], "desc2")
2689
2690         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2691
2692
2693     def test_fSMORoleOwner_attribute(self):
2694         """Test fSMORoleOwner attribute"""
2695         print "Test fSMORoleOwner attribute"""
2696
2697         ds_service_name = self.ldb.get_dsServiceName()
2698
2699         # The "fSMORoleOwner" attribute can only be set to "nTDSDSA" entries,
2700         # invalid DNs return ERR_UNWILLING_TO_PERFORM
2701
2702         try:
2703             self.ldb.add({
2704                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
2705                 "objectclass": "group",
2706                 "fSMORoleOwner": self.base_dn})
2707             self.fail()
2708         except LdbError, (num, _):
2709             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
2710
2711         try:
2712             self.ldb.add({
2713                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
2714                 "objectclass": "group",
2715                 "fSMORoleOwner": [] })
2716             self.fail()
2717         except LdbError, (num, _):
2718             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
2719
2720         # We are able to set it to a valid "nTDSDSA" entry if the server is
2721         # capable of handling the role
2722
2723         self.ldb.add({
2724             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
2725             "objectclass": "group",
2726             "fSMORoleOwner": ds_service_name })
2727
2728         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2729
2730         self.ldb.add({
2731             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
2732             "objectclass": "group" })
2733
2734         m = Message()
2735         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2736         m.add(MessageElement(self.base_dn, FLAG_MOD_REPLACE, "fSMORoleOwner"))
2737         try:
2738             ldb.modify(m)
2739             self.fail()
2740         except LdbError, (num, _):
2741             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
2742
2743         m = Message()
2744         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2745         m.add(MessageElement([], FLAG_MOD_REPLACE, "fSMORoleOwner"))
2746         try:
2747             ldb.modify(m)
2748             self.fail()
2749         except LdbError, (num, _):
2750             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
2751
2752         # We are able to set it to a valid "nTDSDSA" entry if the server is
2753         # capable of handling the role
2754
2755         m = Message()
2756         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2757         m.add(MessageElement(ds_service_name, FLAG_MOD_REPLACE, "fSMORoleOwner"))
2758         ldb.modify(m)
2759
2760         # A clean-out works on plain entries, not master (schema, PDC...) DNs
2761
2762         m = Message()
2763         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2764         m.add(MessageElement([], FLAG_MOD_DELETE, "fSMORoleOwner"))
2765         ldb.modify(m)
2766
2767         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2768
2769
2770 if not "://" in host:
2771     if os.path.isfile(host):
2772         host = "tdb://%s" % host
2773     else:
2774         host = "ldap://%s" % host
2775
2776 ldb = SamDB(host, credentials=creds, session_info=system_session(lp), lp=lp)
2777
2778 runner = SubunitTestRunner()
2779 rc = 0
2780 if not runner.run(unittest.makeSuite(SamTests)).wasSuccessful():
2781     rc = 1
2782 sys.exit(rc)