source4/dsdb/tests/python/sam.py

   1 #!/usr/bin/env python
   2 # -*- coding: utf-8 -*-
   3 # This is a port of the original in testprogs/ejs/ldap.js
   4
   5 import optparse
   6 import sys
   7 import os
   8
   9 sys.path.insert(0, "bin/python")
  10 import samba
  11 samba.ensure_external_module("testtools", "testtools")
  12 samba.ensure_external_module("subunit", "subunit/python")
  13
  14 import samba.getopt as options
  15
  16 from samba.auth import system_session
  17 from ldb import SCOPE_BASE, LdbError
  18 from ldb import ERR_NO_SUCH_OBJECT, ERR_ATTRIBUTE_OR_VALUE_EXISTS
  19 from ldb import ERR_ENTRY_ALREADY_EXISTS, ERR_UNWILLING_TO_PERFORM
  20 from ldb import ERR_OTHER, ERR_NO_SUCH_ATTRIBUTE
  21 from ldb import ERR_OBJECT_CLASS_VIOLATION
  22 from ldb import ERR_CONSTRAINT_VIOLATION
  23 from ldb import ERR_UNDEFINED_ATTRIBUTE_TYPE
  24 from ldb import Message, MessageElement, Dn
  25 from ldb import FLAG_MOD_ADD, FLAG_MOD_REPLACE, FLAG_MOD_DELETE
  26 from samba.samdb import SamDB
  27 from samba.dsdb import (UF_NORMAL_ACCOUNT, UF_ACCOUNTDISABLE,
  28     UF_WORKSTATION_TRUST_ACCOUNT, UF_SERVER_TRUST_ACCOUNT,
  29     UF_PARTIAL_SECRETS_ACCOUNT, UF_TEMP_DUPLICATE_ACCOUNT,
  30     UF_PASSWD_NOTREQD, ATYPE_NORMAL_ACCOUNT,
  31     GTYPE_SECURITY_BUILTIN_LOCAL_GROUP, GTYPE_SECURITY_DOMAIN_LOCAL_GROUP,
  32     GTYPE_SECURITY_GLOBAL_GROUP, GTYPE_SECURITY_UNIVERSAL_GROUP,
  33     GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP, GTYPE_DISTRIBUTION_GLOBAL_GROUP,
  34     GTYPE_DISTRIBUTION_UNIVERSAL_GROUP,
  35     ATYPE_SECURITY_GLOBAL_GROUP, ATYPE_SECURITY_UNIVERSAL_GROUP,
  36     ATYPE_SECURITY_LOCAL_GROUP, ATYPE_DISTRIBUTION_GLOBAL_GROUP,
  37     ATYPE_DISTRIBUTION_UNIVERSAL_GROUP, ATYPE_DISTRIBUTION_LOCAL_GROUP,
  38     ATYPE_WORKSTATION_TRUST)
  39 from samba.dcerpc.security import (DOMAIN_RID_USERS, DOMAIN_RID_ADMINS,
  40     DOMAIN_RID_DOMAIN_MEMBERS, DOMAIN_RID_DCS, DOMAIN_RID_READONLY_DCS)
  41
  42 from subunit.run import SubunitTestRunner
  43 import unittest
  44
  45 from samba.dcerpc import security
  46 from samba.tests import delete_force
  47
  48 parser = optparse.OptionParser("sam.py [options] <host>")
  49 sambaopts = options.SambaOptions(parser)
  50 parser.add_option_group(sambaopts)
  51 parser.add_option_group(options.VersionOptions(parser))
  52 # use command line creds if available
  53 credopts = options.CredentialsOptions(parser)
  54 parser.add_option_group(credopts)
  55 opts, args = parser.parse_args()
  56
  57 if len(args) < 1:
  58     parser.print_usage()
  59     sys.exit(1)
  60
  61 host = args[0]
  62
  63 lp = sambaopts.get_loadparm()
  64 creds = credopts.get_credentials(lp)
  65
  66 class SamTests(samba.tests.TestCase):
  67
  68     def setUp(self):
  69         super(SamTests, self).setUp()
  70         self.ldb = ldb
  71         self.base_dn = ldb.domain_dn()
  72
  73         print "baseDN: %s\n" % self.base_dn
  74
  75         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
  76         delete_force(self.ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
  77         delete_force(self.ldb, "cn=ldaptest\,specialuser,cn=users," + self.base_dn)
  78         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
  79         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
  80         delete_force(self.ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
  81
  82     def test_users_groups(self):
  83         """This tests the SAM users and groups behaviour"""
  84         print "Testing users and groups behaviour\n"
  85
  86         ldb.add({
  87             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
  88             "objectclass": "group"})
  89
  90         ldb.add({
  91             "dn": "cn=ldaptestgroup2,cn=users," + self.base_dn,
  92             "objectclass": "group"})
  93
  94         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
  95                           scope=SCOPE_BASE, attrs=["objectSID"])
  96         self.assertTrue(len(res1) == 1)
  97         group_rid_1 = security.dom_sid(ldb.schema_format_value("objectSID",
  98           res1[0]["objectSID"][0])).split()[1]
  99
 100         res1 = ldb.search("cn=ldaptestgroup2,cn=users," + self.base_dn,
 101                           scope=SCOPE_BASE, attrs=["objectSID"])
 102         self.assertTrue(len(res1) == 1)
 103         group_rid_2 = security.dom_sid(ldb.schema_format_value("objectSID",
 104           res1[0]["objectSID"][0])).split()[1]
 105
 106         # Try to create a user with an invalid account name
 107         try:
 108             ldb.add({
 109                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 110                 "objectclass": "user",
 111                 "sAMAccountName": "administrator"})
 112             self.fail()
 113         except LdbError, (num, _):
 114             self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
 115         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 116
 117         # Try to create a user with an invalid account name
 118         try:
 119             ldb.add({
 120                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 121                 "objectclass": "user",
 122                 "sAMAccountName": []})
 123             self.fail()
 124         except LdbError, (num, _):
 125             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 126         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 127
 128         # Try to create a user with an invalid primary group
 129         try:
 130             ldb.add({
 131                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 132                 "objectclass": "user",
 133                 "primaryGroupID": "0"})
 134             self.fail()
 135         except LdbError, (num, _):
 136             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 137         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 138
 139         # Try to Create a user with a valid primary group
 140         try:
 141             ldb.add({
 142                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 143                 "objectclass": "user",
 144                 "primaryGroupID": str(group_rid_1)})
 145             self.fail()
 146         except LdbError, (num, _):
 147             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 148         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 149
 150         # Test to see how we should behave when the user account doesn't
 151         # exist
 152         m = Message()
 153         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 154         m["primaryGroupID"] = MessageElement("0", FLAG_MOD_REPLACE,
 155           "primaryGroupID")
 156         try:
 157             ldb.modify(m)
 158             self.fail()
 159         except LdbError, (num, _):
 160             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
 161
 162         # Test to see how we should behave when the account isn't a user
 163         m = Message()
 164         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 165         m["primaryGroupID"] = MessageElement("0", FLAG_MOD_REPLACE,
 166           "primaryGroupID")
 167         try:
 168             ldb.modify(m)
 169             self.fail()
 170         except LdbError, (num, _):
 171             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 172
 173         # Test default primary groups on add operations
 174
 175         ldb.add({
 176             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 177             "objectclass": "user"})
 178
 179         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 180                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
 181         self.assertTrue(len(res1) == 1)
 182         self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_USERS))
 183
 184         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 185
 186         ldb.add({
 187             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 188             "objectclass": "user",
 189             "userAccountControl": str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD) })
 190
 191         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 192                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
 193         self.assertTrue(len(res1) == 1)
 194         self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_USERS))
 195
 196         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 197
 198         # unfortunately the INTERDOMAIN_TRUST_ACCOUNT case cannot be tested
 199         # since such accounts aren't directly creatable (ACCESS_DENIED)
 200
 201         ldb.add({
 202             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 203             "objectclass": "computer",
 204             "userAccountControl": str(UF_WORKSTATION_TRUST_ACCOUNT | UF_PASSWD_NOTREQD) })
 205
 206         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 207                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
 208         self.assertTrue(len(res1) == 1)
 209         self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_DOMAIN_MEMBERS))
 210
 211         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 212
 213         ldb.add({
 214             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 215             "objectclass": "computer",
 216             "userAccountControl": str(UF_SERVER_TRUST_ACCOUNT | UF_PASSWD_NOTREQD) })
 217
 218         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 219                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
 220         self.assertTrue(len(res1) == 1)
 221         self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_DCS))
 222
 223         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 224
 225         # Read-only DC accounts are only creatable by
 226         # UF_WORKSTATION_TRUST_ACCOUNT and work only on DCs >= 2008 (therefore
 227         # we have a fallback in the assertion)
 228         ldb.add({
 229             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 230             "objectclass": "computer",
 231             "userAccountControl": str(UF_PARTIAL_SECRETS_ACCOUNT | UF_WORKSTATION_TRUST_ACCOUNT | UF_PASSWD_NOTREQD) })
 232
 233         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 234                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
 235         self.assertTrue(len(res1) == 1)
 236         self.assertTrue(res1[0]["primaryGroupID"][0] == str(DOMAIN_RID_READONLY_DCS) or
 237                         res1[0]["primaryGroupID"][0] == str(DOMAIN_RID_DOMAIN_MEMBERS))
 238
 239         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 240
 241         # Test default primary groups on modify operations
 242
 243         ldb.add({
 244             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 245             "objectclass": "user"})
 246
 247         m = Message()
 248         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 249         m["userAccountControl"] = MessageElement(str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD), FLAG_MOD_REPLACE,
 250           "userAccountControl")
 251         ldb.modify(m)
 252
 253         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 254                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
 255         self.assertTrue(len(res1) == 1)
 256         self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_USERS))
 257
 258         # unfortunately the INTERDOMAIN_TRUST_ACCOUNT case cannot be tested
 259         # since such accounts aren't directly creatable (ACCESS_DENIED)
 260
 261         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 262
 263         ldb.add({
 264             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 265             "objectclass": "computer"})
 266
 267         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 268                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
 269         self.assertTrue(len(res1) == 1)
 270         self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_USERS))
 271
 272         m = Message()
 273         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 274         m["userAccountControl"] = MessageElement(str(UF_WORKSTATION_TRUST_ACCOUNT | UF_PASSWD_NOTREQD), FLAG_MOD_REPLACE,
 275           "userAccountControl")
 276         ldb.modify(m)
 277
 278         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 279                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
 280         self.assertTrue(len(res1) == 1)
 281         self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_DOMAIN_MEMBERS))
 282
 283         m = Message()
 284         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 285         m["userAccountControl"] = MessageElement(str(UF_SERVER_TRUST_ACCOUNT | UF_PASSWD_NOTREQD), FLAG_MOD_REPLACE,
 286           "userAccountControl")
 287         ldb.modify(m)
 288
 289         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 290                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
 291         self.assertTrue(len(res1) == 1)
 292         self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_DCS))
 293
 294         # Read-only DC accounts are only creatable by
 295         # UF_WORKSTATION_TRUST_ACCOUNT and work only on DCs >= 2008 (therefore
 296         # we have a fallback in the assertion)
 297         m = Message()
 298         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 299         m["userAccountControl"] = MessageElement(str(UF_PARTIAL_SECRETS_ACCOUNT | UF_WORKSTATION_TRUST_ACCOUNT | UF_PASSWD_NOTREQD), FLAG_MOD_REPLACE,
 300           "userAccountControl")
 301         ldb.modify(m)
 302
 303         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 304                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
 305         self.assertTrue(len(res1) == 1)
 306         self.assertTrue(res1[0]["primaryGroupID"][0] == str(DOMAIN_RID_READONLY_DCS) or
 307                         res1[0]["primaryGroupID"][0] == str(DOMAIN_RID_DOMAIN_MEMBERS))
 308
 309         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 310
 311         # Recreate account for further tests
 312
 313         ldb.add({
 314             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 315             "objectclass": "user"})
 316
 317         # Try to set an invalid account name
 318         m = Message()
 319         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 320         m["sAMAccountName"] = MessageElement("administrator", FLAG_MOD_REPLACE,
 321           "sAMAccountName")
 322         try:
 323             ldb.modify(m)
 324             self.fail()
 325         except LdbError, (num, _):
 326             self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
 327
 328         # But to reset the actual "sAMAccountName" should still be possible
 329         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 330                           scope=SCOPE_BASE, attrs=["sAMAccountName"])
 331         self.assertTrue(len(res1) == 1)
 332         m = Message()
 333         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 334         m["sAMAccountName"] = MessageElement(res1[0]["sAMAccountName"][0], FLAG_MOD_REPLACE,
 335           "sAMAccountName")
 336         ldb.modify(m)
 337
 338         # And another (free) name should be possible as well
 339         m = Message()
 340         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 341         m["sAMAccountName"] = MessageElement("xxx_ldaptestuser_xxx", FLAG_MOD_REPLACE,
 342           "sAMAccountName")
 343         ldb.modify(m)
 344
 345         # We should be able to reset our actual primary group
 346         m = Message()
 347         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 348         m["primaryGroupID"] = MessageElement(str(DOMAIN_RID_USERS), FLAG_MOD_REPLACE,
 349           "primaryGroupID")
 350         ldb.modify(m)
 351
 352         # Try to add invalid primary group
 353         m = Message()
 354         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 355         m["primaryGroupID"] = MessageElement("0", FLAG_MOD_REPLACE,
 356           "primaryGroupID")
 357         try:
 358             ldb.modify(m)
 359             self.fail()
 360         except LdbError, (num, _):
 361             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 362
 363         # Try to make group 1 primary - should be denied since it is not yet
 364         # secondary
 365         m = Message()
 366         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 367         m["primaryGroupID"] = MessageElement(str(group_rid_1),
 368           FLAG_MOD_REPLACE, "primaryGroupID")
 369         try:
 370             ldb.modify(m)
 371             self.fail()
 372         except LdbError, (num, _):
 373             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 374
 375         # Make group 1 secondary
 376         m = Message()
 377         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 378         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
 379                                      FLAG_MOD_REPLACE, "member")
 380         ldb.modify(m)
 381
 382         # Make group 1 primary
 383         m = Message()
 384         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 385         m["primaryGroupID"] = MessageElement(str(group_rid_1),
 386           FLAG_MOD_REPLACE, "primaryGroupID")
 387         ldb.modify(m)
 388
 389         # Try to delete group 1 - should be denied
 390         try:
 391             ldb.delete("cn=ldaptestgroup,cn=users," + self.base_dn)
 392             self.fail()
 393         except LdbError, (num, _):
 394             self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
 395
 396         # Try to add group 1 also as secondary - should be denied
 397         m = Message()
 398         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 399         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
 400                                      FLAG_MOD_ADD, "member")
 401         try:
 402             ldb.modify(m)
 403             self.fail()
 404         except LdbError, (num, _):
 405             self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
 406
 407         # Try to add invalid member to group 1 - should be denied
 408         m = Message()
 409         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 410         m["member"] = MessageElement(
 411           "cn=ldaptestuser3,cn=users," + self.base_dn,
 412           FLAG_MOD_ADD, "member")
 413         try:
 414             ldb.modify(m)
 415             self.fail()
 416         except LdbError, (num, _):
 417             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
 418
 419         # Make group 2 secondary
 420         m = Message()
 421         m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 422         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
 423                                      FLAG_MOD_ADD, "member")
 424         ldb.modify(m)
 425
 426         # Swap the groups
 427         m = Message()
 428         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 429         m["primaryGroupID"] = MessageElement(str(group_rid_2),
 430           FLAG_MOD_REPLACE, "primaryGroupID")
 431         ldb.modify(m)
 432
 433         # Swap the groups (does not really make sense but does the same)
 434         m = Message()
 435         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 436         m["primaryGroupID"] = MessageElement(str(group_rid_1),
 437           FLAG_MOD_REPLACE, "primaryGroupID")
 438         m["primaryGroupID"] = MessageElement(str(group_rid_2),
 439           FLAG_MOD_REPLACE, "primaryGroupID")
 440         ldb.modify(m)
 441
 442         # Old primary group should contain a "member" attribute for the user,
 443         # the new shouldn't contain anymore one
 444         res1 = ldb.search("cn=ldaptestgroup, cn=users," + self.base_dn,
 445                           scope=SCOPE_BASE, attrs=["member"])
 446         self.assertTrue(len(res1) == 1)
 447         self.assertTrue(len(res1[0]["member"]) == 1)
 448         self.assertEquals(res1[0]["member"][0].lower(),
 449           ("cn=ldaptestuser,cn=users," + self.base_dn).lower())
 450
 451         res1 = ldb.search("cn=ldaptestgroup2, cn=users," + self.base_dn,
 452                           scope=SCOPE_BASE, attrs=["member"])
 453         self.assertTrue(len(res1) == 1)
 454         self.assertFalse("member" in res1[0])
 455
 456         # Primary group member
 457         m = Message()
 458         m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 459         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
 460                                      FLAG_MOD_DELETE, "member")
 461         try:
 462             ldb.modify(m)
 463             self.fail()
 464         except LdbError, (num, _):
 465             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 466
 467         # Delete invalid group member
 468         m = Message()
 469         m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 470         m["member"] = MessageElement("cn=ldaptestuser1,cn=users," + self.base_dn,
 471                                      FLAG_MOD_DELETE, "member")
 472         try:
 473             ldb.modify(m)
 474             self.fail()
 475         except LdbError, (num, _):
 476             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 477
 478         # Also this should be denied
 479         try:
 480             ldb.add({
 481               "dn": "cn=ldaptestuser2,cn=users," + self.base_dn,
 482               "objectclass": "user",
 483               "primaryGroupID": "0"})
 484             self.fail()
 485         except LdbError, (num, _):
 486             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 487
 488         # Recreate user accounts
 489
 490         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 491
 492         ldb.add({
 493             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 494             "objectclass": "user"})
 495
 496         ldb.add({
 497             "dn": "cn=ldaptestuser2,cn=users," + self.base_dn,
 498             "objectclass": "user"})
 499
 500         m = Message()
 501         m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 502         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
 503                                      FLAG_MOD_ADD, "member")
 504         ldb.modify(m)
 505
 506         # Already added
 507         m = Message()
 508         m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 509         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
 510                                      FLAG_MOD_ADD, "member")
 511         try:
 512             ldb.modify(m)
 513             self.fail()
 514         except LdbError, (num, _):
 515             self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
 516
 517         # Already added, but as <SID=...>
 518         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 519                           scope=SCOPE_BASE, attrs=["objectSid"])
 520         self.assertTrue(len(res1) == 1)
 521         sid_bin = res1[0]["objectSid"][0]
 522         sid_str = ("<SID=" + ldb.schema_format_value("objectSid", sid_bin) + ">").upper()
 523
 524         m = Message()
 525         m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 526         m["member"] = MessageElement(sid_str, FLAG_MOD_ADD, "member")
 527         try:
 528             ldb.modify(m)
 529             self.fail()
 530         except LdbError, (num, _):
 531             self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
 532
 533         # Invalid member
 534         m = Message()
 535         m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 536         m["member"] = MessageElement("cn=ldaptestuser1,cn=users," + self.base_dn,
 537                                      FLAG_MOD_REPLACE, "member")
 538         try:
 539             ldb.modify(m)
 540             self.fail()
 541         except LdbError, (num, _):
 542             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
 543
 544         # Invalid member
 545         m = Message()
 546         m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 547         m["member"] = MessageElement(["cn=ldaptestuser,cn=users," + self.base_dn,
 548                                       "cn=ldaptestuser1,cn=users," + self.base_dn],
 549                                      FLAG_MOD_REPLACE, "member")
 550         try:
 551             ldb.modify(m)
 552             self.fail()
 553         except LdbError, (num, _):
 554             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
 555
 556         # Invalid member
 557         m = Message()
 558         m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 559         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
 560                                      FLAG_MOD_REPLACE, "member")
 561         m["member"] = MessageElement("cn=ldaptestuser1,cn=users," + self.base_dn,
 562                                      FLAG_MOD_ADD, "member")
 563         try:
 564             ldb.modify(m)
 565             self.fail()
 566         except LdbError, (num, _):
 567             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
 568
 569         m = Message()
 570         m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 571         m["member"] = MessageElement(["cn=ldaptestuser,cn=users," + self.base_dn,
 572                                       "cn=ldaptestuser2,cn=users," + self.base_dn],
 573                                      FLAG_MOD_REPLACE, "member")
 574         ldb.modify(m)
 575
 576         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 577         delete_force(self.ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
 578         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 579         delete_force(self.ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 580
 581         # Make also a small test for accounts with special DNs ("," in this case)
 582         ldb.add({
 583             "dn": "cn=ldaptest\,specialuser,cn=users," + self.base_dn,
 584             "objectclass": "user"})
 585         delete_force(self.ldb, "cn=ldaptest\,specialuser,cn=users," + self.base_dn)
 586
 587     def test_sam_attributes(self):
 588         """Test the behaviour of special attributes of SAM objects"""
 589         print "Testing the behaviour of special attributes of SAM objects\n"""
 590
 591         ldb.add({
 592             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 593             "objectclass": "user"})
 594         ldb.add({
 595             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 596             "objectclass": "group"})
 597
 598         m = Message()
 599         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 600         m["groupType"] = MessageElement(str(GTYPE_SECURITY_GLOBAL_GROUP), FLAG_MOD_ADD,
 601           "groupType")
 602         try:
 603             ldb.modify(m)
 604             self.fail()
 605         except LdbError, (num, _):
 606             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 607
 608         # Delete protection tests
 609
 610         for attr in ["nTSecurityDescriptor", "objectSid", "sAMAccountType",
 611                      "sAMAccountName", "groupType"]:
 612
 613             m = Message()
 614             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 615             m[attr] = MessageElement([], FLAG_MOD_REPLACE, attr)
 616             try:
 617                 ldb.modify(m)
 618                 self.fail()
 619             except LdbError, (num, _):
 620                 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 621
 622             m = Message()
 623             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 624             m[attr] = MessageElement([], FLAG_MOD_DELETE, attr)
 625             try:
 626                 ldb.modify(m)
 627                 self.fail()
 628             except LdbError, (num, _):
 629                 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 630
 631         m = Message()
 632         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 633         m["primaryGroupID"] = MessageElement("513", FLAG_MOD_ADD,
 634           "primaryGroupID")
 635         try:
 636             ldb.modify(m)
 637             self.fail()
 638         except LdbError, (num, _):
 639             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 640
 641         m = Message()
 642         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 643         m["userAccountControl"] = MessageElement(str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD), FLAG_MOD_ADD,
 644           "userAccountControl")
 645         try:
 646             ldb.modify(m)
 647             self.fail()
 648         except LdbError, (num, _):
 649             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 650
 651         m = Message()
 652         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 653         m["objectSid"] = MessageElement("xxxxxxxxxxxxxxxx", FLAG_MOD_ADD,
 654           "objectSid")
 655         try:
 656             ldb.modify(m)
 657             self.fail()
 658         except LdbError, (num, _):
 659             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 660
 661         m = Message()
 662         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 663         m["sAMAccountType"] = MessageElement("0", FLAG_MOD_ADD,
 664           "sAMAccountType")
 665         try:
 666             ldb.modify(m)
 667             self.fail()
 668         except LdbError, (num, _):
 669             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 670
 671         m = Message()
 672         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 673         m["sAMAccountName"] = MessageElement("test", FLAG_MOD_ADD,
 674           "sAMAccountName")
 675         try:
 676             ldb.modify(m)
 677             self.fail()
 678         except LdbError, (num, _):
 679             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 680
 681         # Delete protection tests
 682
 683         for attr in ["nTSecurityDescriptor", "objectSid", "sAMAccountType",
 684                      "sAMAccountName", "primaryGroupID", "userAccountControl",
 685                      "accountExpires", "badPasswordTime", "badPwdCount",
 686                      "codePage", "countryCode", "lastLogoff", "lastLogon",
 687                      "logonCount", "pwdLastSet"]:
 688
 689             m = Message()
 690             m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 691             m[attr] = MessageElement([], FLAG_MOD_REPLACE, attr)
 692             try:
 693                 ldb.modify(m)
 694                 self.fail()
 695             except LdbError, (num, _):
 696                 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 697
 698             m = Message()
 699             m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 700             m[attr] = MessageElement([], FLAG_MOD_DELETE, attr)
 701             try:
 702                 ldb.modify(m)
 703                 self.fail()
 704             except LdbError, (num, _):
 705                 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 706
 707         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 708         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 709
 710     def test_primary_group_token_constructed(self):
 711         """Test the primary group token behaviour (hidden-generated-readonly attribute on groups) and some other constructed attributes"""
 712         print "Testing primary group token behaviour and other constructed attributes\n"
 713
 714         try:
 715             ldb.add({
 716                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 717                 "objectclass": "group",
 718                 "primaryGroupToken": "100"})
 719             self.fail()
 720         except LdbError, (num, _):
 721             self.assertEquals(num, ERR_UNDEFINED_ATTRIBUTE_TYPE)
 722         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 723
 724         ldb.add({
 725             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 726             "objectclass": "user"})
 727
 728         ldb.add({
 729             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 730             "objectclass": "group"})
 731
 732         # Testing for one invalid, and one valid operational attribute, but also the things they are built from
 733         res1 = ldb.search(self.base_dn,
 734                           scope=SCOPE_BASE, attrs=["primaryGroupToken", "canonicalName", "objectClass", "objectSid"])
 735         self.assertTrue(len(res1) == 1)
 736         self.assertFalse("primaryGroupToken" in res1[0])
 737         self.assertTrue("canonicalName" in res1[0])
 738         self.assertTrue("objectClass" in res1[0])
 739         self.assertTrue("objectSid" in res1[0])
 740
 741         res1 = ldb.search(self.base_dn,
 742                           scope=SCOPE_BASE, attrs=["primaryGroupToken", "canonicalName"])
 743         self.assertTrue(len(res1) == 1)
 744         self.assertFalse("primaryGroupToken" in res1[0])
 745         self.assertFalse("objectSid" in res1[0])
 746         self.assertFalse("objectClass" in res1[0])
 747         self.assertTrue("canonicalName" in res1[0])
 748
 749         res1 = ldb.search("cn=users," + self.base_dn,
 750                           scope=SCOPE_BASE, attrs=["primaryGroupToken"])
 751         self.assertTrue(len(res1) == 1)
 752         self.assertFalse("primaryGroupToken" in res1[0])
 753
 754         res1 = ldb.search("cn=ldaptestuser, cn=users," + self.base_dn,
 755                           scope=SCOPE_BASE, attrs=["primaryGroupToken"])
 756         self.assertTrue(len(res1) == 1)
 757         self.assertFalse("primaryGroupToken" in res1[0])
 758
 759         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 760                           scope=SCOPE_BASE)
 761         self.assertTrue(len(res1) == 1)
 762         self.assertFalse("primaryGroupToken" in res1[0])
 763
 764         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 765                           scope=SCOPE_BASE, attrs=["primaryGroupToken", "objectSID"])
 766         self.assertTrue(len(res1) == 1)
 767         primary_group_token = int(res1[0]["primaryGroupToken"][0])
 768
 769         rid = security.dom_sid(ldb.schema_format_value("objectSID", res1[0]["objectSID"][0])).split()[1]
 770         self.assertEquals(primary_group_token, rid)
 771
 772         m = Message()
 773         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 774         m["primaryGroupToken"] = "100"
 775         try:
 776             ldb.modify(m)
 777             self.fail()
 778         except LdbError, (num, _):
 779             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 780
 781         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 782         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 783
 784     def test_tokenGroups(self):
 785         """Test the tokenGroups behaviour (hidden-generated-readonly attribute on SAM objects)"""
 786         print "Testing tokenGroups behaviour\n"
 787
 788         # The domain object shouldn't contain any "tokenGroups" entry
 789         res = ldb.search(self.base_dn, scope=SCOPE_BASE, attrs=["tokenGroups"])
 790         self.assertTrue(len(res) == 1)
 791         self.assertFalse("tokenGroups" in res[0])
 792
 793         # The domain administrator should contain "tokenGroups" entries
 794         # (the exact number depends on the domain/forest function level and the
 795         # DC software versions)
 796         res = ldb.search("cn=Administrator,cn=Users," + self.base_dn,
 797                          scope=SCOPE_BASE, attrs=["tokenGroups"])
 798         self.assertTrue(len(res) == 1)
 799         self.assertTrue("tokenGroups" in res[0])
 800
 801         ldb.add({
 802             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 803             "objectclass": "user"})
 804
 805         # This testuser should contain at least two "tokenGroups" entries
 806         # (exactly two on an unmodified "Domain Users" and "Users" group)
 807         res = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 808                          scope=SCOPE_BASE, attrs=["tokenGroups"])
 809         self.assertTrue(len(res) == 1)
 810         self.assertTrue(len(res[0]["tokenGroups"]) >= 2)
 811
 812         # one entry which we need to find should point to domains "Domain Users"
 813         # group and another entry should point to the builtin "Users"group
 814         domain_users_group_found = False
 815         users_group_found = False
 816         for sid in res[0]["tokenGroups"]:
 817             rid = security.dom_sid(ldb.schema_format_value("objectSID", sid)).split()[1]
 818             if rid == 513:
 819                 domain_users_group_found = True
 820             if rid == 545:
 821                 users_group_found = True
 822
 823         self.assertTrue(domain_users_group_found)
 824         self.assertTrue(users_group_found)
 825
 826         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 827
 828     def test_groupType(self):
 829         """Test the groupType behaviour"""
 830         print "Testing groupType behaviour\n"
 831
 832         # You can never create or change to a
 833         # "GTYPE_SECURITY_BUILTIN_LOCAL_GROUP"
 834
 835         # Add operation
 836
 837         # Invalid attribute
 838         try:
 839             ldb.add({
 840                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 841                 "objectclass": "group",
 842                 "groupType": "0"})
 843             self.fail()
 844         except LdbError, (num, _):
 845             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 846         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 847
 848         try:
 849             ldb.add({
 850                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 851                 "objectclass": "group",
 852                 "groupType": str(GTYPE_SECURITY_BUILTIN_LOCAL_GROUP)})
 853             self.fail()
 854         except LdbError, (num, _):
 855             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 856         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 857
 858         ldb.add({
 859             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 860             "objectclass": "group",
 861             "groupType": str(GTYPE_SECURITY_GLOBAL_GROUP)})
 862
 863         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 864                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
 865         self.assertTrue(len(res1) == 1)
 866         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
 867           ATYPE_SECURITY_GLOBAL_GROUP)
 868         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 869
 870         ldb.add({
 871             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 872             "objectclass": "group",
 873             "groupType": str(GTYPE_SECURITY_UNIVERSAL_GROUP)})
 874
 875         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 876                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
 877         self.assertTrue(len(res1) == 1)
 878         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
 879           ATYPE_SECURITY_UNIVERSAL_GROUP)
 880         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 881
 882         ldb.add({
 883             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 884             "objectclass": "group",
 885             "groupType": str(GTYPE_SECURITY_DOMAIN_LOCAL_GROUP)})
 886
 887         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 888                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
 889         self.assertTrue(len(res1) == 1)
 890         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
 891           ATYPE_SECURITY_LOCAL_GROUP)
 892         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 893
 894         ldb.add({
 895             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 896             "objectclass": "group",
 897             "groupType": str(GTYPE_DISTRIBUTION_GLOBAL_GROUP)})
 898
 899         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 900                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
 901         self.assertTrue(len(res1) == 1)
 902         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
 903           ATYPE_DISTRIBUTION_GLOBAL_GROUP)
 904         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 905
 906         ldb.add({
 907             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 908             "objectclass": "group",
 909             "groupType": str(GTYPE_DISTRIBUTION_UNIVERSAL_GROUP)})
 910
 911         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 912                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
 913         self.assertTrue(len(res1) == 1)
 914         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
 915           ATYPE_DISTRIBUTION_UNIVERSAL_GROUP)
 916         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 917
 918         ldb.add({
 919             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 920             "objectclass": "group",
 921             "groupType": str(GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP)})
 922
 923         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 924                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
 925         self.assertTrue(len(res1) == 1)
 926         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
 927           ATYPE_DISTRIBUTION_LOCAL_GROUP)
 928         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 929
 930         # Modify operation
 931
 932         ldb.add({
 933             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 934             "objectclass": "group"})
 935
 936         # We can change in this direction: global <-> universal <-> local
 937         # On each step also the group type itself (security/distribution) is
 938         # variable.
 939
 940         # After creation we should have a "security global group"
 941         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 942                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
 943         self.assertTrue(len(res1) == 1)
 944         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
 945           ATYPE_SECURITY_GLOBAL_GROUP)
 946
 947         # Invalid attribute
 948         try:
 949             m = Message()
 950             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 951             m["groupType"] = MessageElement("0",
 952               FLAG_MOD_REPLACE, "groupType")
 953             ldb.modify(m)
 954             self.fail()
 955         except LdbError, (num, _):
 956             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 957
 958         # Security groups
 959
 960         # Default is "global group"
 961
 962         m = Message()
 963         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 964         m["groupType"] = MessageElement(
 965           str(GTYPE_SECURITY_GLOBAL_GROUP),
 966           FLAG_MOD_REPLACE, "groupType")
 967         ldb.modify(m)
 968
 969         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 970                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
 971         self.assertTrue(len(res1) == 1)
 972         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
 973           ATYPE_SECURITY_GLOBAL_GROUP)
 974
 975         # Change to "local" (shouldn't work)
 976
 977         try:
 978             m = Message()
 979             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 980             m["groupType"] = MessageElement(
 981               str(GTYPE_SECURITY_DOMAIN_LOCAL_GROUP),
 982               FLAG_MOD_REPLACE, "groupType")
 983             ldb.modify(m)
 984             self.fail()
 985         except LdbError, (num, _):
 986             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 987
 988         # Change to "universal"
 989
 990         m = Message()
 991         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 992         m["groupType"] = MessageElement(
 993          str(GTYPE_SECURITY_UNIVERSAL_GROUP),
 994           FLAG_MOD_REPLACE, "groupType")
 995         ldb.modify(m)
 996
 997         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 998                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
 999         self.assertTrue(len(res1) == 1)
1000         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1001           ATYPE_SECURITY_UNIVERSAL_GROUP)
1002
1003         # Change back to "global"
1004
1005         m = Message()
1006         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1007         m["groupType"] = MessageElement(
1008           str(GTYPE_SECURITY_GLOBAL_GROUP),
1009           FLAG_MOD_REPLACE, "groupType")
1010         ldb.modify(m)
1011
1012         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1013                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1014         self.assertTrue(len(res1) == 1)
1015         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1016           ATYPE_SECURITY_GLOBAL_GROUP)
1017
1018         # Change back to "universal"
1019
1020         m = Message()
1021         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1022         m["groupType"] = MessageElement(
1023          str(GTYPE_SECURITY_UNIVERSAL_GROUP),
1024           FLAG_MOD_REPLACE, "groupType")
1025         ldb.modify(m)
1026
1027         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1028                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1029         self.assertTrue(len(res1) == 1)
1030         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1031           ATYPE_SECURITY_UNIVERSAL_GROUP)
1032
1033         # Change to "local"
1034
1035         m = Message()
1036         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1037         m["groupType"] = MessageElement(
1038           str(GTYPE_SECURITY_DOMAIN_LOCAL_GROUP),
1039           FLAG_MOD_REPLACE, "groupType")
1040         ldb.modify(m)
1041
1042         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1043                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1044         self.assertTrue(len(res1) == 1)
1045         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1046           ATYPE_SECURITY_LOCAL_GROUP)
1047
1048         # Change to "global" (shouldn't work)
1049
1050         try:
1051             m = Message()
1052             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1053             m["groupType"] = MessageElement(
1054               str(GTYPE_SECURITY_GLOBAL_GROUP),
1055               FLAG_MOD_REPLACE, "groupType")
1056             ldb.modify(m)
1057             self.fail()
1058         except LdbError, (num, _):
1059             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1060
1061         # Change to "builtin local" (shouldn't work)
1062
1063         try:
1064             m = Message()
1065             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1066             m["groupType"] = MessageElement(
1067               str(GTYPE_SECURITY_BUILTIN_LOCAL_GROUP),
1068               FLAG_MOD_REPLACE, "groupType")
1069             ldb.modify(m)
1070             self.fail()
1071         except LdbError, (num, _):
1072             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1073
1074         m = Message()
1075         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1076
1077         # Change back to "universal"
1078
1079         m = Message()
1080         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1081         m["groupType"] = MessageElement(
1082          str(GTYPE_SECURITY_UNIVERSAL_GROUP),
1083           FLAG_MOD_REPLACE, "groupType")
1084         ldb.modify(m)
1085
1086         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1087                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1088         self.assertTrue(len(res1) == 1)
1089         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1090           ATYPE_SECURITY_UNIVERSAL_GROUP)
1091
1092         # Change to "builtin local" (shouldn't work)
1093
1094         try:
1095             m = Message()
1096             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1097             m["groupType"] = MessageElement(
1098               str(GTYPE_SECURITY_BUILTIN_LOCAL_GROUP),
1099               FLAG_MOD_REPLACE, "groupType")
1100             ldb.modify(m)
1101             self.fail()
1102         except LdbError, (num, _):
1103             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1104
1105         # Change back to "global"
1106
1107         m = Message()
1108         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1109         m["groupType"] = MessageElement(
1110           str(GTYPE_SECURITY_GLOBAL_GROUP),
1111           FLAG_MOD_REPLACE, "groupType")
1112         ldb.modify(m)
1113
1114         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1115                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1116         self.assertTrue(len(res1) == 1)
1117         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1118           ATYPE_SECURITY_GLOBAL_GROUP)
1119
1120         # Change to "builtin local" (shouldn't work)
1121
1122         try:
1123             m = Message()
1124             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1125             m["groupType"] = MessageElement(
1126               str(GTYPE_SECURITY_BUILTIN_LOCAL_GROUP),
1127               FLAG_MOD_REPLACE, "groupType")
1128             ldb.modify(m)
1129             self.fail()
1130         except LdbError, (num, _):
1131             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1132
1133         # Distribution groups
1134
1135         # Default is "global group"
1136
1137         m = Message()
1138         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1139         m["groupType"] = MessageElement(
1140           str(GTYPE_DISTRIBUTION_GLOBAL_GROUP),
1141           FLAG_MOD_REPLACE, "groupType")
1142         ldb.modify(m)
1143
1144         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1145                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1146         self.assertTrue(len(res1) == 1)
1147         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1148           ATYPE_DISTRIBUTION_GLOBAL_GROUP)
1149
1150         # Change to local (shouldn't work)
1151
1152         try:
1153             m = Message()
1154             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1155             m["groupType"] = MessageElement(
1156               str(GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP),
1157               FLAG_MOD_REPLACE, "groupType")
1158             ldb.modify(m)
1159             self.fail()
1160         except LdbError, (num, _):
1161             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1162
1163         # Change to "universal"
1164
1165         m = Message()
1166         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1167         m["groupType"] = MessageElement(
1168          str(GTYPE_DISTRIBUTION_UNIVERSAL_GROUP),
1169           FLAG_MOD_REPLACE, "groupType")
1170         ldb.modify(m)
1171
1172         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1173                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1174         self.assertTrue(len(res1) == 1)
1175         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1176           ATYPE_DISTRIBUTION_UNIVERSAL_GROUP)
1177
1178         # Change back to "global"
1179
1180         m = Message()
1181         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1182         m["groupType"] = MessageElement(
1183           str(GTYPE_DISTRIBUTION_GLOBAL_GROUP),
1184           FLAG_MOD_REPLACE, "groupType")
1185         ldb.modify(m)
1186
1187         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1188                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1189         self.assertTrue(len(res1) == 1)
1190         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1191           ATYPE_DISTRIBUTION_GLOBAL_GROUP)
1192
1193         # Change back to "universal"
1194
1195         m = Message()
1196         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1197         m["groupType"] = MessageElement(
1198          str(GTYPE_DISTRIBUTION_UNIVERSAL_GROUP),
1199           FLAG_MOD_REPLACE, "groupType")
1200         ldb.modify(m)
1201
1202         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1203                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1204         self.assertTrue(len(res1) == 1)
1205         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1206           ATYPE_DISTRIBUTION_UNIVERSAL_GROUP)
1207
1208         # Change to "local"
1209
1210         m = Message()
1211         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1212         m["groupType"] = MessageElement(
1213           str(GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP),
1214           FLAG_MOD_REPLACE, "groupType")
1215         ldb.modify(m)
1216
1217         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1218                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1219         self.assertTrue(len(res1) == 1)
1220         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1221           ATYPE_DISTRIBUTION_LOCAL_GROUP)
1222
1223         # Change to "global" (shouldn't work)
1224
1225         try:
1226             m = Message()
1227             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1228             m["groupType"] = MessageElement(
1229               str(GTYPE_DISTRIBUTION_GLOBAL_GROUP),
1230               FLAG_MOD_REPLACE, "groupType")
1231             ldb.modify(m)
1232             self.fail()
1233         except LdbError, (num, _):
1234             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1235
1236         # Change back to "universal"
1237
1238         # Try to add invalid member to group 1 - should be denied
1239         m = Message()
1240         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1241         m["member"] = MessageElement(
1242           "cn=ldaptestuser3,cn=users," + self.base_dn,
1243           FLAG_MOD_ADD, "member")
1244         try:
1245             ldb.modify(m)
1246             self.fail()
1247         except LdbError, (num, _):
1248             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
1249
1250         # Make group 2 secondary
1251         m = Message()
1252         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1253         m["groupType"] = MessageElement(
1254          str(GTYPE_DISTRIBUTION_UNIVERSAL_GROUP),
1255           FLAG_MOD_REPLACE, "groupType")
1256         ldb.modify(m)
1257
1258         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1259                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1260         self.assertTrue(len(res1) == 1)
1261         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1262           ATYPE_DISTRIBUTION_UNIVERSAL_GROUP)
1263
1264         # Change back to "global"
1265
1266         m = Message()
1267         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1268         m["groupType"] = MessageElement(
1269           str(GTYPE_DISTRIBUTION_GLOBAL_GROUP),
1270           FLAG_MOD_REPLACE, "groupType")
1271         ldb.modify(m)
1272
1273         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1274                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1275         self.assertTrue(len(res1) == 1)
1276         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1277           ATYPE_DISTRIBUTION_GLOBAL_GROUP)
1278
1279         # Both group types: this performs only random checks - all possibilities
1280         # would require too much code.
1281
1282         # Default is "global group"
1283
1284         m = Message()
1285         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1286         m["groupType"] = MessageElement(
1287           str(GTYPE_SECURITY_GLOBAL_GROUP),
1288           FLAG_MOD_REPLACE, "groupType")
1289         ldb.modify(m)
1290
1291         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1292                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1293         self.assertTrue(len(res1) == 1)
1294         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1295           ATYPE_SECURITY_GLOBAL_GROUP)
1296
1297         # Change to "local" (shouldn't work)
1298
1299         try:
1300             m = Message()
1301             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1302             m["groupType"] = MessageElement(
1303               str(GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP),
1304               FLAG_MOD_REPLACE, "groupType")
1305             ldb.modify(m)
1306             self.fail()
1307         except LdbError, (num, _):
1308             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1309
1310         # Change to "universal"
1311
1312         m = Message()
1313         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1314         m["groupType"] = MessageElement(
1315          str(GTYPE_DISTRIBUTION_UNIVERSAL_GROUP),
1316           FLAG_MOD_REPLACE, "groupType")
1317         ldb.modify(m)
1318
1319         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1320                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1321         self.assertTrue(len(res1) == 1)
1322         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1323           ATYPE_DISTRIBUTION_UNIVERSAL_GROUP)
1324
1325         # Change back to "global"
1326
1327         m = Message()
1328         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1329         m["groupType"] = MessageElement(
1330           str(GTYPE_SECURITY_GLOBAL_GROUP),
1331           FLAG_MOD_REPLACE, "groupType")
1332         ldb.modify(m)
1333
1334         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1335                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1336         self.assertTrue(len(res1) == 1)
1337         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1338           ATYPE_SECURITY_GLOBAL_GROUP)
1339
1340         # Change back to "universal"
1341
1342         m = Message()
1343         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1344         m["groupType"] = MessageElement(
1345          str(GTYPE_SECURITY_UNIVERSAL_GROUP),
1346           FLAG_MOD_REPLACE, "groupType")
1347         ldb.modify(m)
1348
1349         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1350                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1351         self.assertTrue(len(res1) == 1)
1352         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1353           ATYPE_SECURITY_UNIVERSAL_GROUP)
1354
1355         # Change to "local"
1356
1357         m = Message()
1358         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1359         m["groupType"] = MessageElement(
1360           str(GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP),
1361           FLAG_MOD_REPLACE, "groupType")
1362         ldb.modify(m)
1363
1364         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1365                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1366         self.assertTrue(len(res1) == 1)
1367         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1368           ATYPE_DISTRIBUTION_LOCAL_GROUP)
1369
1370         # Change to "global" (shouldn't work)
1371
1372         try:
1373             m = Message()
1374             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1375             m["groupType"] = MessageElement(
1376               str(GTYPE_DISTRIBUTION_GLOBAL_GROUP),
1377               FLAG_MOD_REPLACE, "groupType")
1378             ldb.modify(m)
1379             self.fail()
1380         except LdbError, (num, _):
1381             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1382
1383         # Change back to "universal"
1384
1385         m = Message()
1386         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1387         m["groupType"] = MessageElement(
1388          str(GTYPE_SECURITY_UNIVERSAL_GROUP),
1389           FLAG_MOD_REPLACE, "groupType")
1390         ldb.modify(m)
1391
1392         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1393                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1394         self.assertTrue(len(res1) == 1)
1395         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1396           ATYPE_SECURITY_UNIVERSAL_GROUP)
1397
1398         # Change back to "global"
1399
1400         m = Message()
1401         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1402         m["groupType"] = MessageElement(
1403           str(GTYPE_SECURITY_GLOBAL_GROUP),
1404           FLAG_MOD_REPLACE, "groupType")
1405         ldb.modify(m)
1406
1407         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1408                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1409         self.assertTrue(len(res1) == 1)
1410         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1411           ATYPE_SECURITY_GLOBAL_GROUP)
1412
1413         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1414
1415     def test_userAccountControl(self):
1416         """Test the userAccountControl behaviour"""
1417         print "Testing userAccountControl behaviour\n"
1418
1419         # With a user object
1420
1421         # Add operation
1422
1423         # As user you can only set a normal account.
1424         # The UF_PASSWD_NOTREQD flag is needed since we haven't requested a
1425         # password yet.
1426         # With SYSTEM rights you can set a interdomain trust account.
1427
1428         # Invalid attribute
1429         try:
1430             ldb.add({
1431                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1432                 "objectclass": "user",
1433                 "userAccountControl": "0"})
1434             self.fail()
1435         except LdbError, (num, _):
1436             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1437         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1438
1439 # This has to wait until s4 supports it (needs a password module change)
1440 #        try:
1441 #            ldb.add({
1442 #                "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1443 #                "objectclass": "user",
1444 #                "userAccountControl": str(UF_NORMAL_ACCOUNT)})
1445 #            self.fail()
1446 #        except LdbError, (num, _):
1447 #            self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1448 #        delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1449
1450         ldb.add({
1451             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1452             "objectclass": "user",
1453             "userAccountControl": str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD)})
1454
1455         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1456                           scope=SCOPE_BASE,
1457                           attrs=["sAMAccountType", "userAccountControl"])
1458         self.assertTrue(len(res1) == 1)
1459         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1460           ATYPE_NORMAL_ACCOUNT)
1461         self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_ACCOUNTDISABLE == 0)
1462         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1463
1464         try:
1465             ldb.add({
1466                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1467                 "objectclass": "user",
1468                 "userAccountControl": str(UF_TEMP_DUPLICATE_ACCOUNT)})
1469             self.fail()
1470         except LdbError, (num, _):
1471             self.assertEquals(num, ERR_OTHER)
1472         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1473
1474         try:
1475             ldb.add({
1476                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1477                 "objectclass": "user",
1478                 "userAccountControl": str(UF_SERVER_TRUST_ACCOUNT)})
1479             self.fail()
1480         except LdbError, (num, _):
1481             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
1482         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1483
1484         try:
1485             ldb.add({
1486                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1487                 "objectclass": "user",
1488                 "userAccountControl": str(UF_WORKSTATION_TRUST_ACCOUNT)})
1489         except LdbError, (num, _):
1490             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
1491         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1492
1493         try:
1494             ldb.add({
1495                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1496                 "objectclass": "user",
1497                 "userAccountControl": str(UF_WORKSTATION_TRUST_ACCOUNT | UF_PARTIAL_SECRETS_ACCOUNT)})
1498         except LdbError, (num, _):
1499             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
1500         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1501
1502 # This isn't supported yet in s4 - needs ACL module adaption
1503 #        try:
1504 #            ldb.add({
1505 #                "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1506 #                "objectclass": "user",
1507 #                "userAccountControl": str(UF_INTERDOMAIN_TRUST_ACCOUNT)})
1508 #            self.fail()
1509 #        except LdbError, (num, _):
1510 #            self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
1511 #        delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1512
1513         # Modify operation
1514
1515         ldb.add({
1516             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1517             "objectclass": "user"})
1518
1519         # After creation we should have a normal account
1520         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1521                           scope=SCOPE_BASE,
1522                           attrs=["sAMAccountType", "userAccountControl"])
1523         self.assertTrue(len(res1) == 1)
1524         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1525           ATYPE_NORMAL_ACCOUNT)
1526         self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_ACCOUNTDISABLE != 0)
1527
1528         # As user you can only switch from a normal account to a workstation
1529         # trust account and back.
1530         # The UF_PASSWD_NOTREQD flag is needed since we haven't requested a
1531         # password yet.
1532         # With SYSTEM rights you can switch to a interdomain trust account.
1533
1534         # Invalid attribute
1535         try:
1536             m = Message()
1537             m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1538             m["userAccountControl"] = MessageElement("0",
1539               FLAG_MOD_REPLACE, "userAccountControl")
1540             ldb.modify(m)
1541         except LdbError, (num, _):
1542             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1543
1544 # This has to wait until s4 supports it (needs a password module change)
1545 #        try:
1546 #            m = Message()
1547 #            m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1548 #            m["userAccountControl"] = MessageElement(
1549 #              str(UF_NORMAL_ACCOUNT),
1550 #              FLAG_MOD_REPLACE, "userAccountControl")
1551 #            ldb.modify(m)
1552 #        except LdbError, (num, _):
1553 #            self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1554
1555         m = Message()
1556         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1557         m["userAccountControl"] = MessageElement(
1558           str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD),
1559           FLAG_MOD_REPLACE, "userAccountControl")
1560         ldb.modify(m)
1561
1562         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1563                           scope=SCOPE_BASE,
1564                           attrs=["sAMAccountType", "userAccountControl"])
1565         self.assertTrue(len(res1) == 1)
1566         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1567           ATYPE_NORMAL_ACCOUNT)
1568         self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_ACCOUNTDISABLE == 0)
1569
1570         try:
1571             m = Message()
1572             m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1573             m["userAccountControl"] = MessageElement(
1574               str(UF_TEMP_DUPLICATE_ACCOUNT),
1575               FLAG_MOD_REPLACE, "userAccountControl")
1576             ldb.modify(m)
1577             self.fail()
1578         except LdbError, (num, _):
1579             self.assertEquals(num, ERR_OTHER)
1580
1581         try:
1582             m = Message()
1583             m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1584             m["userAccountControl"] = MessageElement(
1585               str(UF_SERVER_TRUST_ACCOUNT),
1586               FLAG_MOD_REPLACE, "userAccountControl")
1587             ldb.modify(m)
1588             self.fail()
1589         except LdbError, (num, _):
1590             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1591
1592         m = Message()
1593         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1594         m["userAccountControl"] = MessageElement(
1595           str(UF_WORKSTATION_TRUST_ACCOUNT),
1596           FLAG_MOD_REPLACE, "userAccountControl")
1597         ldb.modify(m)
1598
1599         try:
1600             m = Message()
1601             m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1602             m["userAccountControl"] = MessageElement(
1603               str(UF_WORKSTATION_TRUST_ACCOUNT | UF_PARTIAL_SECRETS_ACCOUNT),
1604               FLAG_MOD_REPLACE, "userAccountControl")
1605             ldb.modify(m)
1606             self.fail()
1607         except LdbError, (num, _):
1608             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1609
1610         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1611                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1612         self.assertTrue(len(res1) == 1)
1613         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1614           ATYPE_WORKSTATION_TRUST)
1615
1616         m = Message()
1617         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1618         m["userAccountControl"] = MessageElement(
1619           str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD),
1620           FLAG_MOD_REPLACE, "userAccountControl")
1621         ldb.modify(m)
1622
1623         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1624                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1625         self.assertTrue(len(res1) == 1)
1626         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1627           ATYPE_NORMAL_ACCOUNT)
1628
1629 # This isn't supported yet in s4 - needs ACL module adaption
1630 #        try:
1631 #            m = Message()
1632 #            m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1633 #            m["userAccountControl"] = MessageElement(
1634 #              str(UF_INTERDOMAIN_TRUST_ACCOUNT),
1635 #              FLAG_MOD_REPLACE, "userAccountControl")
1636 #            ldb.modify(m)
1637 #            self.fail()
1638 #        except LdbError, (num, _):
1639 #            self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
1640
1641         # With a computer object
1642
1643         # Add operation
1644
1645         # As computer you can set a normal account and a server trust account.
1646         # The UF_PASSWD_NOTREQD flag is needed since we haven't requested a
1647         # password yet.
1648         # With SYSTEM rights you can set a interdomain trust account.
1649
1650         # Invalid attribute
1651         try:
1652             ldb.add({
1653                 "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1654                 "objectclass": "computer",
1655                 "userAccountControl": "0"})
1656             self.fail()
1657         except LdbError, (num, _):
1658             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1659         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1660
1661 # This has to wait until s4 supports it (needs a password module change)
1662 #        try:
1663 #            ldb.add({
1664 #                "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1665 #                "objectclass": "computer",
1666 #                "userAccountControl": str(UF_NORMAL_ACCOUNT)})
1667 #            self.fail()
1668 #        except LdbError, (num, _):
1669 #            self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1670 #        delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1671
1672         ldb.add({
1673             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1674             "objectclass": "computer",
1675             "userAccountControl": str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD)})
1676
1677         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1678                           scope=SCOPE_BASE,
1679                           attrs=["sAMAccountType", "userAccountControl"])
1680         self.assertTrue(len(res1) == 1)
1681         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1682           ATYPE_NORMAL_ACCOUNT)
1683         self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_ACCOUNTDISABLE == 0)
1684         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1685
1686         try:
1687             ldb.add({
1688                 "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1689                 "objectclass": "computer",
1690                 "userAccountControl": str(UF_TEMP_DUPLICATE_ACCOUNT)})
1691             self.fail()
1692         except LdbError, (num, _):
1693             self.assertEquals(num, ERR_OTHER)
1694         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1695
1696         ldb.add({
1697             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1698             "objectclass": "computer",
1699             "userAccountControl": str(UF_SERVER_TRUST_ACCOUNT)})
1700
1701         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1702                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1703         self.assertTrue(len(res1) == 1)
1704         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1705           ATYPE_WORKSTATION_TRUST)
1706         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1707
1708         try:
1709             ldb.add({
1710                 "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1711                 "objectclass": "computer",
1712                 "userAccountControl": str(UF_WORKSTATION_TRUST_ACCOUNT)})
1713         except LdbError, (num, _):
1714             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
1715         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1716
1717 # This isn't supported yet in s4 - needs ACL module adaption
1718 #        try:
1719 #            ldb.add({
1720 #                "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1721 #                "objectclass": "computer",
1722 #                "userAccountControl": str(UF_INTERDOMAIN_TRUST_ACCOUNT)})
1723 #            self.fail()
1724 #        except LdbError, (num, _):
1725 #            self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
1726 #        delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1727
1728         # Modify operation
1729
1730         ldb.add({
1731             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1732             "objectclass": "computer"})
1733
1734         # After creation we should have a normal account
1735         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1736                           scope=SCOPE_BASE,
1737                           attrs=["sAMAccountType", "userAccountControl"])
1738         self.assertTrue(len(res1) == 1)
1739         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1740           ATYPE_NORMAL_ACCOUNT)
1741         self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_ACCOUNTDISABLE != 0)
1742
1743         # As computer you can switch from a normal account to a workstation
1744         # or server trust account and back (also swapping between trust
1745         # accounts is allowed).
1746         # The UF_PASSWD_NOTREQD flag is needed since we haven't requested a
1747         # password yet.
1748         # With SYSTEM rights you can switch to a interdomain trust account.
1749
1750         # Invalid attribute
1751         try:
1752             m = Message()
1753             m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1754             m["userAccountControl"] = MessageElement("0",
1755               FLAG_MOD_REPLACE, "userAccountControl")
1756             ldb.modify(m)
1757         except LdbError, (num, _):
1758             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1759
1760 # This has to wait until s4 supports it (needs a password module change)
1761 #        try:
1762 #            m = Message()
1763 #            m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1764 #            m["userAccountControl"] = MessageElement(
1765 #              str(UF_NORMAL_ACCOUNT),
1766 #              FLAG_MOD_REPLACE, "userAccountControl")
1767 #            ldb.modify(m)
1768 #        except LdbError, (num, _):
1769 #            self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1770
1771         m = Message()
1772         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1773         m["userAccountControl"] = MessageElement(
1774           str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD),
1775           FLAG_MOD_REPLACE, "userAccountControl")
1776         ldb.modify(m)
1777
1778         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1779                           scope=SCOPE_BASE,
1780                           attrs=["sAMAccountType", "userAccountControl"])
1781         self.assertTrue(len(res1) == 1)
1782         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1783           ATYPE_NORMAL_ACCOUNT)
1784         self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_ACCOUNTDISABLE == 0)
1785
1786         try:
1787             m = Message()
1788             m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1789             m["userAccountControl"] = MessageElement(
1790               str(UF_TEMP_DUPLICATE_ACCOUNT),
1791               FLAG_MOD_REPLACE, "userAccountControl")
1792             ldb.modify(m)
1793             self.fail()
1794         except LdbError, (num, _):
1795             self.assertEquals(num, ERR_OTHER)
1796
1797         m = Message()
1798         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1799         m["userAccountControl"] = MessageElement(
1800           str(UF_SERVER_TRUST_ACCOUNT),
1801           FLAG_MOD_REPLACE, "userAccountControl")
1802         ldb.modify(m)
1803
1804         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1805                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1806         self.assertTrue(len(res1) == 1)
1807         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1808           ATYPE_WORKSTATION_TRUST)
1809
1810         m = Message()
1811         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1812         m["userAccountControl"] = MessageElement(
1813           str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD),
1814           FLAG_MOD_REPLACE, "userAccountControl")
1815         ldb.modify(m)
1816
1817         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1818                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1819         self.assertTrue(len(res1) == 1)
1820         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1821           ATYPE_NORMAL_ACCOUNT)
1822
1823         m = Message()
1824         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1825         m["userAccountControl"] = MessageElement(
1826           str(UF_WORKSTATION_TRUST_ACCOUNT),
1827           FLAG_MOD_REPLACE, "userAccountControl")
1828         ldb.modify(m)
1829
1830         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1831                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1832         self.assertTrue(len(res1) == 1)
1833         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1834           ATYPE_WORKSTATION_TRUST)
1835
1836         m = Message()
1837         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1838         m["userAccountControl"] = MessageElement(
1839           str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD),
1840           FLAG_MOD_REPLACE, "userAccountControl")
1841         ldb.modify(m)
1842
1843         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1844                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1845         self.assertTrue(len(res1) == 1)
1846         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1847           ATYPE_NORMAL_ACCOUNT)
1848
1849         m = Message()
1850         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1851         m["userAccountControl"] = MessageElement(
1852           str(UF_SERVER_TRUST_ACCOUNT),
1853           FLAG_MOD_REPLACE, "userAccountControl")
1854         ldb.modify(m)
1855
1856         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1857                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1858         self.assertTrue(len(res1) == 1)
1859         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1860           ATYPE_WORKSTATION_TRUST)
1861
1862         m = Message()
1863         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1864         m["userAccountControl"] = MessageElement(
1865           str(UF_WORKSTATION_TRUST_ACCOUNT),
1866           FLAG_MOD_REPLACE, "userAccountControl")
1867         ldb.modify(m)
1868
1869         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1870                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1871         self.assertTrue(len(res1) == 1)
1872         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1873           ATYPE_WORKSTATION_TRUST)
1874
1875 # This isn't supported yet in s4 - needs ACL module adaption
1876 #        try:
1877 #            m = Message()
1878 #            m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1879 #            m["userAccountControl"] = MessageElement(
1880 #              str(UF_INTERDOMAIN_TRUST_ACCOUNT),
1881 #              FLAG_MOD_REPLACE, "userAccountControl")
1882 #            ldb.modify(m)
1883 #            self.fail()
1884 #        except LdbError, (num, _):
1885 #            self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
1886
1887         # "primaryGroupID" does not change if account type remains the same
1888
1889         # For a user account
1890
1891         ldb.add({
1892             "dn": "cn=ldaptestuser2,cn=users," + self.base_dn,
1893             "objectclass": "user",
1894             "userAccountControl": str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD | UF_ACCOUNTDISABLE)})
1895
1896         res1 = ldb.search("cn=ldaptestuser2,cn=users," + self.base_dn,
1897                           scope=SCOPE_BASE,
1898                           attrs=["userAccountControl"])
1899         self.assertTrue(len(res1) == 1)
1900         self.assertEquals(int(res1[0]["userAccountControl"][0]),
1901            UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD | UF_ACCOUNTDISABLE)
1902
1903         m = Message()
1904         m.dn = Dn(ldb, "<SID=" + ldb.get_domain_sid() + "-" + str(DOMAIN_RID_ADMINS) + ">")
1905         m["member"] = MessageElement(
1906           "cn=ldaptestuser2,cn=users," + self.base_dn, FLAG_MOD_ADD, "member")
1907         ldb.modify(m)
1908
1909         m = Message()
1910         m.dn = Dn(ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
1911         m["primaryGroupID"] = MessageElement(str(DOMAIN_RID_ADMINS),
1912           FLAG_MOD_REPLACE, "primaryGroupID")
1913         ldb.modify(m)
1914
1915         m = Message()
1916         m.dn = Dn(ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
1917         m["userAccountControl"] = MessageElement(
1918           str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD),
1919           FLAG_MOD_REPLACE, "userAccountControl")
1920         ldb.modify(m)
1921
1922         res1 = ldb.search("cn=ldaptestuser2,cn=users," + self.base_dn,
1923                           scope=SCOPE_BASE,
1924                           attrs=["userAccountControl", "primaryGroupID"])
1925         self.assertTrue(len(res1) == 1)
1926         self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_ACCOUNTDISABLE == 0)
1927         self.assertEquals(int(res1[0]["primaryGroupID"][0]), DOMAIN_RID_ADMINS)
1928
1929         # For a workstation account
1930
1931         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1932                           scope=SCOPE_BASE,
1933                           attrs=["primaryGroupID"])
1934         self.assertTrue(len(res1) == 1)
1935         self.assertEquals(int(res1[0]["primaryGroupID"][0]), DOMAIN_RID_DOMAIN_MEMBERS)
1936
1937         m = Message()
1938         m.dn = Dn(ldb, "<SID=" + ldb.get_domain_sid() + "-" + str(DOMAIN_RID_USERS) + ">")
1939         m["member"] = MessageElement(
1940           "cn=ldaptestcomputer,cn=computers," + self.base_dn, FLAG_MOD_ADD, "member")
1941         ldb.modify(m)
1942
1943         m = Message()
1944         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1945         m["primaryGroupID"] = MessageElement(str(DOMAIN_RID_USERS),
1946           FLAG_MOD_REPLACE, "primaryGroupID")
1947         ldb.modify(m)
1948
1949         m = Message()
1950         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1951         m["userAccountControl"] = MessageElement(
1952           str(UF_WORKSTATION_TRUST_ACCOUNT),
1953           FLAG_MOD_REPLACE, "userAccountControl")
1954         ldb.modify(m)
1955
1956         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1957                           scope=SCOPE_BASE,
1958                           attrs=["primaryGroupID"])
1959         self.assertTrue(len(res1) == 1)
1960         self.assertEquals(int(res1[0]["primaryGroupID"][0]), DOMAIN_RID_USERS)
1961
1962         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1963         delete_force(self.ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
1964         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1965
1966     def test_isCriticalSystemObject(self):
1967         """Test the isCriticalSystemObject behaviour"""
1968         print "Testing isCriticalSystemObject behaviour\n"
1969
1970         # Add tests
1971
1972         ldb.add({
1973             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1974             "objectclass": "computer"})
1975
1976         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1977                           scope=SCOPE_BASE,
1978                           attrs=["isCriticalSystemObject"])
1979         self.assertTrue(len(res1) == 1)
1980         self.assertTrue("isCriticalSystemObject" not in res1[0])
1981
1982         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1983
1984         ldb.add({
1985             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1986             "objectclass": "computer",
1987             "userAccountControl": str(UF_WORKSTATION_TRUST_ACCOUNT)})
1988
1989         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1990                           scope=SCOPE_BASE,
1991                           attrs=["isCriticalSystemObject"])
1992         self.assertTrue(len(res1) == 1)
1993         self.assertEquals(res1[0]["isCriticalSystemObject"][0], "FALSE")
1994
1995         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1996
1997         ldb.add({
1998             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1999             "objectclass": "computer",
2000             "userAccountControl": str(UF_WORKSTATION_TRUST_ACCOUNT | UF_PARTIAL_SECRETS_ACCOUNT)})
2001
2002         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2003                           scope=SCOPE_BASE,
2004                           attrs=["isCriticalSystemObject"])
2005         self.assertTrue(len(res1) == 1)
2006         self.assertEquals(res1[0]["isCriticalSystemObject"][0], "TRUE")
2007
2008         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2009
2010         ldb.add({
2011             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2012             "objectclass": "computer",
2013             "userAccountControl": str(UF_SERVER_TRUST_ACCOUNT)})
2014
2015         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2016                           scope=SCOPE_BASE,
2017                           attrs=["isCriticalSystemObject"])
2018         self.assertTrue(len(res1) == 1)
2019         self.assertEquals(res1[0]["isCriticalSystemObject"][0], "TRUE")
2020
2021         # Modification tests
2022
2023         m = Message()
2024         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2025         m["userAccountControl"] = MessageElement(str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD),
2026           FLAG_MOD_REPLACE, "userAccountControl")
2027         ldb.modify(m)
2028
2029         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2030                           scope=SCOPE_BASE,
2031                           attrs=["isCriticalSystemObject"])
2032         self.assertTrue(len(res1) == 1)
2033         self.assertEquals(res1[0]["isCriticalSystemObject"][0], "TRUE")
2034
2035         m = Message()
2036         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2037         m["userAccountControl"] = MessageElement(str(UF_WORKSTATION_TRUST_ACCOUNT),
2038           FLAG_MOD_REPLACE, "userAccountControl")
2039         ldb.modify(m)
2040
2041         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2042                           scope=SCOPE_BASE,
2043                           attrs=["isCriticalSystemObject"])
2044         self.assertTrue(len(res1) == 1)
2045         self.assertEquals(res1[0]["isCriticalSystemObject"][0], "FALSE")
2046
2047         m = Message()
2048         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2049         m["userAccountControl"] = MessageElement(
2050           str(UF_WORKSTATION_TRUST_ACCOUNT | UF_PARTIAL_SECRETS_ACCOUNT),
2051           FLAG_MOD_REPLACE, "userAccountControl")
2052         ldb.modify(m)
2053
2054         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2055                           scope=SCOPE_BASE,
2056                           attrs=["isCriticalSystemObject"])
2057         self.assertTrue(len(res1) == 1)
2058         self.assertEquals(res1[0]["isCriticalSystemObject"][0], "TRUE")
2059
2060         m = Message()
2061         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2062         m["userAccountControl"] = MessageElement(str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD),
2063           FLAG_MOD_REPLACE, "userAccountControl")
2064         ldb.modify(m)
2065
2066         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2067                           scope=SCOPE_BASE,
2068                           attrs=["isCriticalSystemObject"])
2069         self.assertTrue(len(res1) == 1)
2070         self.assertEquals(res1[0]["isCriticalSystemObject"][0], "TRUE")
2071
2072         m = Message()
2073         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2074         m["userAccountControl"] = MessageElement(str(UF_SERVER_TRUST_ACCOUNT),
2075           FLAG_MOD_REPLACE, "userAccountControl")
2076         ldb.modify(m)
2077
2078         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2079                           scope=SCOPE_BASE,
2080                           attrs=["isCriticalSystemObject"])
2081         self.assertTrue(len(res1) == 1)
2082         self.assertEquals(res1[0]["isCriticalSystemObject"][0], "TRUE")
2083
2084         m = Message()
2085         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2086         m["userAccountControl"] = MessageElement(str(UF_WORKSTATION_TRUST_ACCOUNT),
2087           FLAG_MOD_REPLACE, "userAccountControl")
2088         ldb.modify(m)
2089
2090         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2091                           scope=SCOPE_BASE,
2092                           attrs=["isCriticalSystemObject"])
2093         self.assertTrue(len(res1) == 1)
2094         self.assertEquals(res1[0]["isCriticalSystemObject"][0], "FALSE")
2095
2096         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2097
2098     def test_service_principal_name_updates(self):
2099         """Test the servicePrincipalNames update behaviour"""
2100         print "Testing servicePrincipalNames update behaviour\n"
2101
2102         ldb.add({
2103             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2104             "objectclass": "computer",
2105             "dNSHostName": "testname.testdom"})
2106
2107         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2108                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2109         self.assertTrue(len(res) == 1)
2110         self.assertFalse("servicePrincipalName" in res[0])
2111
2112         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2113
2114         ldb.add({
2115             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2116             "objectclass": "computer",
2117             "servicePrincipalName": "HOST/testname.testdom"})
2118
2119         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2120                           scope=SCOPE_BASE, attrs=["dNSHostName"])
2121         self.assertTrue(len(res) == 1)
2122         self.assertFalse("dNSHostName" in res[0])
2123
2124         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2125
2126         ldb.add({
2127             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2128             "objectclass": "computer",
2129             "dNSHostName": "testname2.testdom",
2130             "servicePrincipalName": "HOST/testname.testdom"})
2131
2132         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2133                          scope=SCOPE_BASE, attrs=["dNSHostName"])
2134         self.assertTrue(len(res) == 1)
2135         self.assertEquals(res[0]["dNSHostName"][0], "testname2.testdom")
2136
2137         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2138                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2139         self.assertTrue(len(res) == 1)
2140         self.assertEquals(res[0]["servicePrincipalName"][0],
2141                           "HOST/testname.testdom")
2142
2143         m = Message()
2144         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2145         m["dNSHostName"] = MessageElement("testname.testdoM",
2146                                           FLAG_MOD_REPLACE, "dNSHostName")
2147         ldb.modify(m)
2148
2149         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2150                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2151         self.assertTrue(len(res) == 1)
2152         self.assertEquals(res[0]["servicePrincipalName"][0],
2153                           "HOST/testname.testdom")
2154
2155         m = Message()
2156         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2157         m["dNSHostName"] = MessageElement("testname2.testdom2",
2158                                           FLAG_MOD_REPLACE, "dNSHostName")
2159         ldb.modify(m)
2160
2161         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2162                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2163         self.assertTrue(len(res) == 1)
2164         self.assertEquals(res[0]["servicePrincipalName"][0],
2165                           "HOST/testname2.testdom2")
2166
2167         m = Message()
2168         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2169         m["dNSHostName"] = MessageElement([],
2170                                           FLAG_MOD_DELETE, "dNSHostName")
2171         ldb.modify(m)
2172
2173         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2174                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2175         self.assertTrue(len(res) == 1)
2176         self.assertEquals(res[0]["servicePrincipalName"][0],
2177                           "HOST/testname2.testdom2")
2178
2179         m = Message()
2180         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2181         m["dNSHostName"] = MessageElement("testname.testdom3",
2182                                           FLAG_MOD_REPLACE, "dNSHostName")
2183         ldb.modify(m)
2184
2185         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2186                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2187         self.assertTrue(len(res) == 1)
2188         self.assertEquals(res[0]["servicePrincipalName"][0],
2189                           "HOST/testname2.testdom2")
2190
2191         m = Message()
2192         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2193         m["dNSHostName"] = MessageElement("testname2.testdom2",
2194                                           FLAG_MOD_REPLACE, "dNSHostName")
2195         ldb.modify(m)
2196
2197         m = Message()
2198         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2199         m["dNSHostName"] = MessageElement("testname3.testdom3",
2200                                           FLAG_MOD_REPLACE, "dNSHostName")
2201         m["servicePrincipalName"] = MessageElement("HOST/testname2.testdom2",
2202                                                    FLAG_MOD_REPLACE,
2203                                                    "servicePrincipalName")
2204         ldb.modify(m)
2205
2206         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2207                           scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2208         self.assertTrue(len(res) == 1)
2209         self.assertEquals(res[0]["servicePrincipalName"][0],
2210                           "HOST/testname3.testdom3")
2211
2212         m = Message()
2213         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2214         m["servicePrincipalName"] = MessageElement("HOST/testname2.testdom2",
2215                                                    FLAG_MOD_REPLACE,
2216                                                    "servicePrincipalName")
2217         m["dNSHostName"] = MessageElement("testname4.testdom4",
2218                                           FLAG_MOD_REPLACE, "dNSHostName")
2219         ldb.modify(m)
2220
2221         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2222                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2223         self.assertTrue(len(res) == 1)
2224         self.assertEquals(res[0]["servicePrincipalName"][0],
2225                           "HOST/testname2.testdom2")
2226
2227         m = Message()
2228         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2229         m["servicePrincipalName"] = MessageElement([],
2230                                                    FLAG_MOD_DELETE,
2231                                                    "servicePrincipalName")
2232         ldb.modify(m)
2233
2234         m = Message()
2235         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2236         m["dNSHostName"] = MessageElement("testname2.testdom2",
2237                                           FLAG_MOD_REPLACE, "dNSHostName")
2238         ldb.modify(m)
2239
2240         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2241                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2242         self.assertTrue(len(res) == 1)
2243         self.assertFalse("servicePrincipalName" in res[0])
2244
2245         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2246
2247         ldb.add({
2248             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2249             "objectclass": "computer",
2250             "sAMAccountName": "testname$"})
2251
2252         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2253                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2254         self.assertTrue(len(res) == 1)
2255         self.assertFalse("servicePrincipalName" in res[0])
2256
2257         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2258
2259         ldb.add({
2260             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2261             "objectclass": "computer",
2262             "servicePrincipalName": "HOST/testname"})
2263
2264         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2265                          scope=SCOPE_BASE, attrs=["sAMAccountName"])
2266         self.assertTrue(len(res) == 1)
2267         self.assertTrue("sAMAccountName" in res[0])
2268
2269         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2270
2271         ldb.add({
2272             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2273             "objectclass": "computer",
2274             "sAMAccountName": "testname$",
2275             "servicePrincipalName": "HOST/testname"})
2276
2277         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2278                          scope=SCOPE_BASE, attrs=["sAMAccountName"])
2279         self.assertTrue(len(res) == 1)
2280         self.assertEquals(res[0]["sAMAccountName"][0], "testname$")
2281
2282         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2283                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2284         self.assertTrue(len(res) == 1)
2285         self.assertEquals(res[0]["servicePrincipalName"][0],
2286                           "HOST/testname")
2287
2288         m = Message()
2289         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2290         m["sAMAccountName"] = MessageElement("testnamE$",
2291                                              FLAG_MOD_REPLACE, "sAMAccountName")
2292         ldb.modify(m)
2293
2294         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2295                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2296         self.assertTrue(len(res) == 1)
2297         self.assertEquals(res[0]["servicePrincipalName"][0],
2298                           "HOST/testname")
2299
2300         m = Message()
2301         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2302         m["sAMAccountName"] = MessageElement("testname",
2303                                              FLAG_MOD_REPLACE, "sAMAccountName")
2304         ldb.modify(m)
2305
2306         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2307                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2308         self.assertTrue(len(res) == 1)
2309         self.assertEquals(res[0]["servicePrincipalName"][0],
2310                           "HOST/testname")
2311
2312         m = Message()
2313         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2314         m["sAMAccountName"] = MessageElement("test$name$",
2315                                              FLAG_MOD_REPLACE, "sAMAccountName")
2316         ldb.modify(m)
2317
2318         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2319                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2320         self.assertTrue(len(res) == 1)
2321         self.assertEquals(res[0]["servicePrincipalName"][0],
2322                           "HOST/test$name")
2323
2324         m = Message()
2325         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2326         m["sAMAccountName"] = MessageElement("testname2",
2327                                              FLAG_MOD_REPLACE, "sAMAccountName")
2328         ldb.modify(m)
2329
2330         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2331                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2332         self.assertTrue(len(res) == 1)
2333         self.assertEquals(res[0]["servicePrincipalName"][0],
2334                           "HOST/testname2")
2335
2336         m = Message()
2337         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2338         m["sAMAccountName"] = MessageElement("testname3",
2339                                              FLAG_MOD_REPLACE, "sAMAccountName")
2340         m["servicePrincipalName"] = MessageElement("HOST/testname2",
2341                                                    FLAG_MOD_REPLACE,
2342                                                    "servicePrincipalName")
2343         ldb.modify(m)
2344
2345         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2346                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2347         self.assertTrue(len(res) == 1)
2348         self.assertEquals(res[0]["servicePrincipalName"][0],
2349                           "HOST/testname3")
2350
2351         m = Message()
2352         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2353         m["servicePrincipalName"] = MessageElement("HOST/testname2",
2354                                                    FLAG_MOD_REPLACE,
2355                                                    "servicePrincipalName")
2356         m["sAMAccountName"] = MessageElement("testname4",
2357                                              FLAG_MOD_REPLACE, "sAMAccountName")
2358         ldb.modify(m)
2359
2360         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2361                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2362         self.assertTrue(len(res) == 1)
2363         self.assertEquals(res[0]["servicePrincipalName"][0],
2364                           "HOST/testname2")
2365
2366         m = Message()
2367         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2368         m["servicePrincipalName"] = MessageElement([],
2369                                                    FLAG_MOD_DELETE,
2370                                                    "servicePrincipalName")
2371         ldb.modify(m)
2372
2373         m = Message()
2374         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2375         m["sAMAccountName"] = MessageElement("testname2",
2376                                              FLAG_MOD_REPLACE, "sAMAccountName")
2377         ldb.modify(m)
2378
2379         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2380                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2381         self.assertTrue(len(res) == 1)
2382         self.assertFalse("servicePrincipalName" in res[0])
2383
2384         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2385
2386         ldb.add({
2387             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2388             "objectclass": "computer",
2389             "dNSHostName": "testname.testdom",
2390             "sAMAccountName": "testname$",
2391             "servicePrincipalName": [ "HOST/testname.testdom", "HOST/testname" ]
2392         })
2393
2394         m = Message()
2395         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2396         m["dNSHostName"] = MessageElement("testname2.testdom",
2397                                           FLAG_MOD_REPLACE, "dNSHostName")
2398         m["sAMAccountName"] = MessageElement("testname2$",
2399                                              FLAG_MOD_REPLACE, "sAMAccountName")
2400         ldb.modify(m)
2401
2402         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2403                          scope=SCOPE_BASE, attrs=["dNSHostName", "sAMAccountName", "servicePrincipalName"])
2404         self.assertTrue(len(res) == 1)
2405         self.assertEquals(res[0]["dNSHostName"][0], "testname2.testdom")
2406         self.assertEquals(res[0]["sAMAccountName"][0], "testname2$")
2407         self.assertTrue(res[0]["servicePrincipalName"][0] == "HOST/testname2" or
2408                         res[0]["servicePrincipalName"][1] == "HOST/testname2")
2409         self.assertTrue(res[0]["servicePrincipalName"][0] == "HOST/testname2.testdom" or
2410                         res[0]["servicePrincipalName"][1] == "HOST/testname2.testdom")
2411
2412         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2413
2414         ldb.add({
2415             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2416             "objectclass": "computer",
2417             "dNSHostName": "testname.testdom",
2418             "sAMAccountName": "testname$",
2419             "servicePrincipalName": [ "HOST/testname.testdom", "HOST/testname" ]
2420         })
2421
2422         m = Message()
2423         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2424         m["sAMAccountName"] = MessageElement("testname2$",
2425                                              FLAG_MOD_REPLACE, "sAMAccountName")
2426         m["dNSHostName"] = MessageElement("testname2.testdom",
2427                                           FLAG_MOD_REPLACE, "dNSHostName")
2428         ldb.modify(m)
2429
2430         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2431                          scope=SCOPE_BASE, attrs=["dNSHostName", "sAMAccountName", "servicePrincipalName"])
2432         self.assertTrue(len(res) == 1)
2433         self.assertEquals(res[0]["dNSHostName"][0], "testname2.testdom")
2434         self.assertEquals(res[0]["sAMAccountName"][0], "testname2$")
2435         self.assertTrue(len(res[0]["servicePrincipalName"]) == 2)
2436         self.assertTrue("HOST/testname2" in res[0]["servicePrincipalName"])
2437         self.assertTrue("HOST/testname2.testdom" in res[0]["servicePrincipalName"])
2438
2439         m = Message()
2440         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2441         m["servicePrincipalName"] = MessageElement("HOST/testname2.testdom",
2442                                                    FLAG_MOD_ADD, "servicePrincipalName")
2443         try:
2444             ldb.modify(m)
2445             self.fail()
2446         except LdbError, (num, _):
2447             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
2448
2449         m = Message()
2450         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2451         m["servicePrincipalName"] = MessageElement("HOST/testname3",
2452                                                    FLAG_MOD_ADD, "servicePrincipalName")
2453         ldb.modify(m)
2454
2455         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2456                          scope=SCOPE_BASE, attrs=["dNSHostName", "sAMAccountName", "servicePrincipalName"])
2457         self.assertTrue(len(res) == 1)
2458         self.assertEquals(res[0]["dNSHostName"][0], "testname2.testdom")
2459         self.assertEquals(res[0]["sAMAccountName"][0], "testname2$")
2460         self.assertTrue(len(res[0]["servicePrincipalName"]) == 3)
2461         self.assertTrue("HOST/testname2" in res[0]["servicePrincipalName"])
2462         self.assertTrue("HOST/testname3" in res[0]["servicePrincipalName"])
2463         self.assertTrue("HOST/testname2.testdom" in res[0]["servicePrincipalName"])
2464
2465         m = Message()
2466         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2467         m["dNSHostName"] = MessageElement("testname3.testdom",
2468                                           FLAG_MOD_REPLACE, "dNSHostName")
2469         m["servicePrincipalName"] = MessageElement("HOST/testname3.testdom",
2470                                                    FLAG_MOD_ADD, "servicePrincipalName")
2471         ldb.modify(m)
2472
2473         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2474                          scope=SCOPE_BASE, attrs=["dNSHostName", "sAMAccountName", "servicePrincipalName"])
2475         self.assertTrue(len(res) == 1)
2476         self.assertEquals(res[0]["dNSHostName"][0], "testname3.testdom")
2477         self.assertEquals(res[0]["sAMAccountName"][0], "testname2$")
2478         self.assertTrue(len(res[0]["servicePrincipalName"]) == 3)
2479         self.assertTrue("HOST/testname2" in res[0]["servicePrincipalName"])
2480         self.assertTrue("HOST/testname3" in res[0]["servicePrincipalName"])
2481         self.assertTrue("HOST/testname3.testdom" in res[0]["servicePrincipalName"])
2482
2483         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2484
2485     def test_sam_description_attribute(self):
2486         """Test SAM description attribute"""
2487         print "Test SAM description attribute"""
2488
2489         self.ldb.add({
2490             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
2491             "description": "desc2",
2492             "objectclass": "group",
2493             "description": "desc1"})
2494
2495         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
2496                          scope=SCOPE_BASE, attrs=["description"])
2497         self.assertTrue(len(res) == 1)
2498         self.assertTrue("description" in res[0])
2499         self.assertTrue(len(res[0]["description"]) == 1)
2500         self.assertEquals(res[0]["description"][0], "desc1")
2501
2502         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2503
2504         self.ldb.add({
2505             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
2506             "objectclass": "group",
2507             "description": ["desc1", "desc2"]})
2508
2509         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
2510                          scope=SCOPE_BASE, attrs=["description"])
2511         self.assertTrue(len(res) == 1)
2512         self.assertTrue("description" in res[0])
2513         self.assertTrue(len(res[0]["description"]) == 2)
2514         self.assertTrue(res[0]["description"][0] == "desc1" or
2515                         res[0]["description"][1] == "desc1")
2516         self.assertTrue(res[0]["description"][0] == "desc2" or
2517                         res[0]["description"][1] == "desc2")
2518
2519         m = Message()
2520         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2521         m["description"] = MessageElement(["desc1","desc2"], FLAG_MOD_REPLACE,
2522           "description")
2523         try:
2524             ldb.modify(m)
2525             self.fail()
2526         except LdbError, (num, _):
2527             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
2528
2529         m = Message()
2530         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2531         m["description"] = MessageElement(["desc1","desc2"], FLAG_MOD_DELETE,
2532           "description")
2533         ldb.modify(m)
2534
2535         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2536
2537         self.ldb.add({
2538             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
2539             "objectclass": "group" })
2540
2541         m = Message()
2542         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2543         m["description"] = MessageElement("desc1", FLAG_MOD_REPLACE,
2544           "description")
2545         ldb.modify(m)
2546
2547         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
2548                          scope=SCOPE_BASE, attrs=["description"])
2549         self.assertTrue(len(res) == 1)
2550         self.assertTrue("description" in res[0])
2551         self.assertTrue(len(res[0]["description"]) == 1)
2552         self.assertEquals(res[0]["description"][0], "desc1")
2553
2554         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2555
2556         self.ldb.add({
2557             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
2558             "objectclass": "group",
2559             "description": ["desc1", "desc2"]})
2560
2561         m = Message()
2562         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2563         m["description"] = MessageElement("desc1", FLAG_MOD_REPLACE,
2564           "description")
2565         ldb.modify(m)
2566
2567         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
2568                          scope=SCOPE_BASE, attrs=["description"])
2569         self.assertTrue(len(res) == 1)
2570         self.assertTrue("description" in res[0])
2571         self.assertTrue(len(res[0]["description"]) == 1)
2572         self.assertEquals(res[0]["description"][0], "desc1")
2573
2574         m = Message()
2575         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2576         m["description"] = MessageElement("desc3", FLAG_MOD_ADD,
2577           "description")
2578         try:
2579             ldb.modify(m)
2580             self.fail()
2581         except LdbError, (num, _):
2582             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
2583
2584         m = Message()
2585         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2586         m["description"] = MessageElement(["desc1","desc2"], FLAG_MOD_DELETE,
2587           "description")
2588         try:
2589             ldb.modify(m)
2590             self.fail()
2591         except LdbError, (num, _):
2592             self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
2593
2594         m = Message()
2595         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2596         m["description"] = MessageElement("desc1", FLAG_MOD_DELETE,
2597           "description")
2598         ldb.modify(m)
2599         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
2600                          scope=SCOPE_BASE, attrs=["description"])
2601         self.assertTrue(len(res) == 1)
2602         self.assertFalse("description" in res[0])
2603
2604         m = Message()
2605         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2606         m["description"] = MessageElement(["desc1","desc2"], FLAG_MOD_REPLACE,
2607           "description")
2608         try:
2609             ldb.modify(m)
2610             self.fail()
2611         except LdbError, (num, _):
2612             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
2613
2614         m = Message()
2615         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2616         m["description"] = MessageElement(["desc3", "desc4"], FLAG_MOD_ADD,
2617           "description")
2618         try:
2619             ldb.modify(m)
2620             self.fail()
2621         except LdbError, (num, _):
2622             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
2623
2624         m = Message()
2625         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2626         m["description"] = MessageElement("desc1", FLAG_MOD_ADD,
2627           "description")
2628         ldb.modify(m)
2629
2630         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
2631                          scope=SCOPE_BASE, attrs=["description"])
2632         self.assertTrue(len(res) == 1)
2633         self.assertTrue("description" in res[0])
2634         self.assertTrue(len(res[0]["description"]) == 1)
2635         self.assertEquals(res[0]["description"][0], "desc1")
2636
2637         m = Message()
2638         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2639         m.add(MessageElement("desc1", FLAG_MOD_DELETE, "description"))
2640         m.add(MessageElement("desc2", FLAG_MOD_ADD, "description"))
2641         ldb.modify(m)
2642
2643         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
2644                          scope=SCOPE_BASE, attrs=["description"])
2645         self.assertTrue(len(res) == 1)
2646         self.assertTrue("description" in res[0])
2647         self.assertTrue(len(res[0]["description"]) == 1)
2648         self.assertEquals(res[0]["description"][0], "desc2")
2649
2650         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2651
2652
2653     def test_fSMORoleOwner_attribute(self):
2654         """Test fSMORoleOwner attribute"""
2655         print "Test fSMORoleOwner attribute"""
2656
2657         ds_service_name = self.ldb.get_dsServiceName()
2658
2659         # The "fSMORoleOwner" attribute can only be set to "nTDSDSA" entries,
2660         # invalid DNs return ERR_UNWILLING_TO_PERFORM
2661
2662         try:
2663             self.ldb.add({
2664                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
2665                 "objectclass": "group",
2666                 "fSMORoleOwner": self.base_dn})
2667             self.fail()
2668         except LdbError, (num, _):
2669             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
2670
2671         try:
2672             self.ldb.add({
2673                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
2674                 "objectclass": "group",
2675                 "fSMORoleOwner": [] })
2676             self.fail()
2677         except LdbError, (num, _):
2678             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
2679
2680         # We are able to set it to a valid "nTDSDSA" entry if the server is
2681         # capable of handling the role
2682
2683         self.ldb.add({
2684             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
2685             "objectclass": "group",
2686             "fSMORoleOwner": ds_service_name })
2687
2688         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2689
2690         self.ldb.add({
2691             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
2692             "objectclass": "group" })
2693
2694         m = Message()
2695         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2696         m.add(MessageElement(self.base_dn, FLAG_MOD_REPLACE, "fSMORoleOwner"))
2697         try:
2698             ldb.modify(m)
2699             self.fail()
2700         except LdbError, (num, _):
2701             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
2702
2703         m = Message()
2704         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2705         m.add(MessageElement([], FLAG_MOD_REPLACE, "fSMORoleOwner"))
2706         try:
2707             ldb.modify(m)
2708             self.fail()
2709         except LdbError, (num, _):
2710             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
2711
2712         # We are able to set it to a valid "nTDSDSA" entry if the server is
2713         # capable of handling the role
2714
2715         m = Message()
2716         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2717         m.add(MessageElement(ds_service_name, FLAG_MOD_REPLACE, "fSMORoleOwner"))
2718         ldb.modify(m)
2719
2720         # A clean-out works on plain entries, not master (schema, PDC...) DNs
2721
2722         m = Message()
2723         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2724         m.add(MessageElement([], FLAG_MOD_DELETE, "fSMORoleOwner"))
2725         ldb.modify(m)
2726
2727         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2728
2729
2730 if not "://" in host:
2731     if os.path.isfile(host):
2732         host = "tdb://%s" % host
2733     else:
2734         host = "ldap://%s" % host
2735
2736 ldb = SamDB(host, credentials=creds, session_info=system_session(lp), lp=lp)
2737
2738 runner = SubunitTestRunner()
2739 rc = 0
2740 if not runner.run(unittest.makeSuite(SamTests)).wasSuccessful():
2741     rc = 1
2742 sys.exit(rc)