source4/dsdb/tests/python/sam.py

   1 #!/usr/bin/env python
   2 # -*- coding: utf-8 -*-
   3 # This is a port of the original in testprogs/ejs/ldap.js
   4
   5 import optparse
   6 import sys
   7 import os
   8
   9 sys.path.insert(0, "bin/python")
  10 import samba
  11 samba.ensure_external_module("testtools", "testtools")
  12 samba.ensure_external_module("subunit", "subunit/python")
  13
  14 import samba.getopt as options
  15
  16 from samba.auth import system_session
  17 from ldb import SCOPE_BASE, LdbError
  18 from ldb import ERR_NO_SUCH_OBJECT, ERR_ATTRIBUTE_OR_VALUE_EXISTS
  19 from ldb import ERR_ENTRY_ALREADY_EXISTS, ERR_UNWILLING_TO_PERFORM
  20 from ldb import ERR_OTHER, ERR_NO_SUCH_ATTRIBUTE
  21 from ldb import ERR_OBJECT_CLASS_VIOLATION
  22 from ldb import ERR_CONSTRAINT_VIOLATION
  23 from ldb import ERR_UNDEFINED_ATTRIBUTE_TYPE
  24 from ldb import Message, MessageElement, Dn
  25 from ldb import FLAG_MOD_ADD, FLAG_MOD_REPLACE, FLAG_MOD_DELETE
  26 from samba.samdb import SamDB
  27 from samba.dsdb import (UF_NORMAL_ACCOUNT, UF_ACCOUNTDISABLE,
  28     UF_WORKSTATION_TRUST_ACCOUNT, UF_SERVER_TRUST_ACCOUNT,
  29     UF_PARTIAL_SECRETS_ACCOUNT, UF_TEMP_DUPLICATE_ACCOUNT,
  30     UF_PASSWD_NOTREQD, ATYPE_NORMAL_ACCOUNT,
  31     GTYPE_SECURITY_BUILTIN_LOCAL_GROUP, GTYPE_SECURITY_DOMAIN_LOCAL_GROUP,
  32     GTYPE_SECURITY_GLOBAL_GROUP, GTYPE_SECURITY_UNIVERSAL_GROUP,
  33     GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP, GTYPE_DISTRIBUTION_GLOBAL_GROUP,
  34     GTYPE_DISTRIBUTION_UNIVERSAL_GROUP,
  35     ATYPE_SECURITY_GLOBAL_GROUP, ATYPE_SECURITY_UNIVERSAL_GROUP,
  36     ATYPE_SECURITY_LOCAL_GROUP, ATYPE_DISTRIBUTION_GLOBAL_GROUP,
  37     ATYPE_DISTRIBUTION_UNIVERSAL_GROUP, ATYPE_DISTRIBUTION_LOCAL_GROUP,
  38     ATYPE_WORKSTATION_TRUST)
  39 from samba.dcerpc.security import (DOMAIN_RID_USERS, DOMAIN_RID_ADMINS,
  40     DOMAIN_RID_DOMAIN_MEMBERS, DOMAIN_RID_DCS, DOMAIN_RID_READONLY_DCS)
  41
  42 from subunit.run import SubunitTestRunner
  43 import unittest
  44
  45 from samba.dcerpc import security
  46 from samba.tests import delete_force
  47
  48 parser = optparse.OptionParser("sam.py [options] <host>")
  49 sambaopts = options.SambaOptions(parser)
  50 parser.add_option_group(sambaopts)
  51 parser.add_option_group(options.VersionOptions(parser))
  52 # use command line creds if available
  53 credopts = options.CredentialsOptions(parser)
  54 parser.add_option_group(credopts)
  55 opts, args = parser.parse_args()
  56
  57 if len(args) < 1:
  58     parser.print_usage()
  59     sys.exit(1)
  60
  61 host = args[0]
  62
  63 lp = sambaopts.get_loadparm()
  64 creds = credopts.get_credentials(lp)
  65
  66 class SamTests(samba.tests.TestCase):
  67
  68     def setUp(self):
  69         super(SamTests, self).setUp()
  70         self.ldb = ldb
  71         self.base_dn = ldb.domain_dn()
  72
  73         print "baseDN: %s\n" % self.base_dn
  74
  75         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
  76         delete_force(self.ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
  77         delete_force(self.ldb, "cn=ldaptest\,specialuser,cn=users," + self.base_dn)
  78         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
  79         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
  80         delete_force(self.ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
  81
  82     def test_users_groups(self):
  83         """This tests the SAM users and groups behaviour"""
  84         print "Testing users and groups behaviour\n"
  85
  86         ldb.add({
  87             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
  88             "objectclass": "group"})
  89
  90         ldb.add({
  91             "dn": "cn=ldaptestgroup2,cn=users," + self.base_dn,
  92             "objectclass": "group"})
  93
  94         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
  95                           scope=SCOPE_BASE, attrs=["objectSID"])
  96         self.assertTrue(len(res1) == 1)
  97         group_rid_1 = security.dom_sid(ldb.schema_format_value("objectSID",
  98           res1[0]["objectSID"][0])).split()[1]
  99
 100         res1 = ldb.search("cn=ldaptestgroup2,cn=users," + self.base_dn,
 101                           scope=SCOPE_BASE, attrs=["objectSID"])
 102         self.assertTrue(len(res1) == 1)
 103         group_rid_2 = security.dom_sid(ldb.schema_format_value("objectSID",
 104           res1[0]["objectSID"][0])).split()[1]
 105
 106         # Try to create a user with an invalid account name
 107         try:
 108             ldb.add({
 109                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 110                 "objectclass": "user",
 111                 "sAMAccountName": "administrator"})
 112             self.fail()
 113         except LdbError, (num, _):
 114             self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
 115         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 116
 117         # Try to create a user with an invalid account name
 118         try:
 119             ldb.add({
 120                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 121                 "objectclass": "user",
 122                 "sAMAccountName": []})
 123             self.fail()
 124         except LdbError, (num, _):
 125             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 126         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 127
 128         # Try to create a user with an invalid primary group
 129         try:
 130             ldb.add({
 131                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 132                 "objectclass": "user",
 133                 "primaryGroupID": "0"})
 134             self.fail()
 135         except LdbError, (num, _):
 136             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 137         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 138
 139         # Try to Create a user with a valid primary group
 140         try:
 141             ldb.add({
 142                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 143                 "objectclass": "user",
 144                 "primaryGroupID": str(group_rid_1)})
 145             self.fail()
 146         except LdbError, (num, _):
 147             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 148         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 149
 150         # Test to see how we should behave when the user account doesn't
 151         # exist
 152         m = Message()
 153         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 154         m["primaryGroupID"] = MessageElement("0", FLAG_MOD_REPLACE,
 155           "primaryGroupID")
 156         try:
 157             ldb.modify(m)
 158             self.fail()
 159         except LdbError, (num, _):
 160             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
 161
 162         # Test to see how we should behave when the account isn't a user
 163         m = Message()
 164         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 165         m["primaryGroupID"] = MessageElement("0", FLAG_MOD_REPLACE,
 166           "primaryGroupID")
 167         try:
 168             ldb.modify(m)
 169             self.fail()
 170         except LdbError, (num, _):
 171             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
 172
 173         # Test default primary groups on add operations
 174
 175         ldb.add({
 176             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 177             "objectclass": "user"})
 178
 179         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 180                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
 181         self.assertTrue(len(res1) == 1)
 182         self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_USERS))
 183
 184         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 185
 186         ldb.add({
 187             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 188             "objectclass": "user",
 189             "userAccountControl": str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD) })
 190
 191         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 192                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
 193         self.assertTrue(len(res1) == 1)
 194         self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_USERS))
 195
 196         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 197
 198         # unfortunately the INTERDOMAIN_TRUST_ACCOUNT case cannot be tested
 199         # since such accounts aren't directly creatable (ACCESS_DENIED)
 200
 201         ldb.add({
 202             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 203             "objectclass": "computer",
 204             "userAccountControl": str(UF_WORKSTATION_TRUST_ACCOUNT | UF_PASSWD_NOTREQD) })
 205
 206         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 207                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
 208         self.assertTrue(len(res1) == 1)
 209         self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_DOMAIN_MEMBERS))
 210
 211         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 212
 213         ldb.add({
 214             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 215             "objectclass": "computer",
 216             "userAccountControl": str(UF_SERVER_TRUST_ACCOUNT | UF_PASSWD_NOTREQD) })
 217
 218         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 219                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
 220         self.assertTrue(len(res1) == 1)
 221         self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_DCS))
 222
 223         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 224
 225         # Read-only DC accounts are only creatable by
 226         # UF_WORKSTATION_TRUST_ACCOUNT and work only on DCs >= 2008 (therefore
 227         # we have a fallback in the assertion)
 228         ldb.add({
 229             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 230             "objectclass": "computer",
 231             "userAccountControl": str(UF_PARTIAL_SECRETS_ACCOUNT | UF_WORKSTATION_TRUST_ACCOUNT | UF_PASSWD_NOTREQD) })
 232
 233         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 234                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
 235         self.assertTrue(len(res1) == 1)
 236         self.assertTrue(res1[0]["primaryGroupID"][0] == str(DOMAIN_RID_READONLY_DCS) or
 237                         res1[0]["primaryGroupID"][0] == str(DOMAIN_RID_DOMAIN_MEMBERS))
 238
 239         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 240
 241         # Test default primary groups on modify operations
 242
 243         ldb.add({
 244             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 245             "objectclass": "user"})
 246
 247         m = Message()
 248         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 249         m["userAccountControl"] = MessageElement(str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD), FLAG_MOD_REPLACE,
 250           "userAccountControl")
 251         ldb.modify(m)
 252
 253         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 254                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
 255         self.assertTrue(len(res1) == 1)
 256         self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_USERS))
 257
 258         # unfortunately the INTERDOMAIN_TRUST_ACCOUNT case cannot be tested
 259         # since such accounts aren't directly creatable (ACCESS_DENIED)
 260
 261         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 262
 263         ldb.add({
 264             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 265             "objectclass": "computer"})
 266
 267         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 268                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
 269         self.assertTrue(len(res1) == 1)
 270         self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_USERS))
 271
 272         m = Message()
 273         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 274         m["userAccountControl"] = MessageElement(str(UF_WORKSTATION_TRUST_ACCOUNT | UF_PASSWD_NOTREQD), FLAG_MOD_REPLACE,
 275           "userAccountControl")
 276         ldb.modify(m)
 277
 278         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 279                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
 280         self.assertTrue(len(res1) == 1)
 281         self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_DOMAIN_MEMBERS))
 282
 283         m = Message()
 284         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 285         m["userAccountControl"] = MessageElement(str(UF_SERVER_TRUST_ACCOUNT | UF_PASSWD_NOTREQD), FLAG_MOD_REPLACE,
 286           "userAccountControl")
 287         ldb.modify(m)
 288
 289         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 290                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
 291         self.assertTrue(len(res1) == 1)
 292         self.assertEquals(res1[0]["primaryGroupID"][0], str(DOMAIN_RID_DCS))
 293
 294         # Read-only DC accounts are only creatable by
 295         # UF_WORKSTATION_TRUST_ACCOUNT and work only on DCs >= 2008 (therefore
 296         # we have a fallback in the assertion)
 297         m = Message()
 298         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 299         m["userAccountControl"] = MessageElement(str(UF_PARTIAL_SECRETS_ACCOUNT | UF_WORKSTATION_TRUST_ACCOUNT | UF_PASSWD_NOTREQD), FLAG_MOD_REPLACE,
 300           "userAccountControl")
 301         ldb.modify(m)
 302
 303         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 304                           scope=SCOPE_BASE, attrs=["primaryGroupID"])
 305         self.assertTrue(len(res1) == 1)
 306         self.assertTrue(res1[0]["primaryGroupID"][0] == str(DOMAIN_RID_READONLY_DCS) or
 307                         res1[0]["primaryGroupID"][0] == str(DOMAIN_RID_DOMAIN_MEMBERS))
 308
 309         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 310
 311         # Recreate account for further tests
 312
 313         ldb.add({
 314             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 315             "objectclass": "user"})
 316
 317         # Try to set an invalid account name
 318         m = Message()
 319         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 320         m["sAMAccountName"] = MessageElement("administrator", FLAG_MOD_REPLACE,
 321           "sAMAccountName")
 322         try:
 323             ldb.modify(m)
 324             self.fail()
 325         except LdbError, (num, _):
 326             self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
 327
 328         # But to reset the actual "sAMAccountName" should still be possible
 329         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 330                           scope=SCOPE_BASE, attrs=["sAMAccountName"])
 331         self.assertTrue(len(res1) == 1)
 332         m = Message()
 333         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 334         m["sAMAccountName"] = MessageElement(res1[0]["sAMAccountName"][0], FLAG_MOD_REPLACE,
 335           "sAMAccountName")
 336         ldb.modify(m)
 337
 338         # And another (free) name should be possible as well
 339         m = Message()
 340         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 341         m["sAMAccountName"] = MessageElement("xxx_ldaptestuser_xxx", FLAG_MOD_REPLACE,
 342           "sAMAccountName")
 343         ldb.modify(m)
 344
 345         # We should be able to reset our actual primary group
 346         m = Message()
 347         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 348         m["primaryGroupID"] = MessageElement(str(DOMAIN_RID_USERS), FLAG_MOD_REPLACE,
 349           "primaryGroupID")
 350         ldb.modify(m)
 351
 352         # Try to add invalid primary group
 353         m = Message()
 354         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 355         m["primaryGroupID"] = MessageElement("0", FLAG_MOD_REPLACE,
 356           "primaryGroupID")
 357         try:
 358             ldb.modify(m)
 359             self.fail()
 360         except LdbError, (num, _):
 361             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 362
 363         # Try to make group 1 primary - should be denied since it is not yet
 364         # secondary
 365         m = Message()
 366         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 367         m["primaryGroupID"] = MessageElement(str(group_rid_1),
 368           FLAG_MOD_REPLACE, "primaryGroupID")
 369         try:
 370             ldb.modify(m)
 371             self.fail()
 372         except LdbError, (num, _):
 373             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 374
 375         # Make group 1 secondary
 376         m = Message()
 377         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 378         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
 379                                      FLAG_MOD_REPLACE, "member")
 380         ldb.modify(m)
 381
 382         # Make group 1 primary
 383         m = Message()
 384         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 385         m["primaryGroupID"] = MessageElement(str(group_rid_1),
 386           FLAG_MOD_REPLACE, "primaryGroupID")
 387         ldb.modify(m)
 388
 389         # Try to delete group 1 - should be denied
 390         try:
 391             ldb.delete("cn=ldaptestgroup,cn=users," + self.base_dn)
 392             self.fail()
 393         except LdbError, (num, _):
 394             self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
 395
 396         # Try to add group 1 also as secondary - should be denied
 397         m = Message()
 398         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 399         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
 400                                      FLAG_MOD_ADD, "member")
 401         try:
 402             ldb.modify(m)
 403             self.fail()
 404         except LdbError, (num, _):
 405             self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
 406
 407         # Try to add invalid member to group 1 - should be denied
 408         m = Message()
 409         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 410         m["member"] = MessageElement(
 411           "cn=ldaptestuser3,cn=users," + self.base_dn,
 412           FLAG_MOD_ADD, "member")
 413         try:
 414             ldb.modify(m)
 415             self.fail()
 416         except LdbError, (num, _):
 417             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
 418
 419         # Make group 2 secondary
 420         m = Message()
 421         m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 422         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
 423                                      FLAG_MOD_ADD, "member")
 424         ldb.modify(m)
 425
 426         # Swap the groups
 427         m = Message()
 428         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 429         m["primaryGroupID"] = MessageElement(str(group_rid_2),
 430           FLAG_MOD_REPLACE, "primaryGroupID")
 431         ldb.modify(m)
 432
 433         # Swap the groups (does not really make sense but does the same)
 434         m = Message()
 435         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 436         m["primaryGroupID"] = MessageElement(str(group_rid_1),
 437           FLAG_MOD_REPLACE, "primaryGroupID")
 438         m["primaryGroupID"] = MessageElement(str(group_rid_2),
 439           FLAG_MOD_REPLACE, "primaryGroupID")
 440         ldb.modify(m)
 441
 442         # Old primary group should contain a "member" attribute for the user,
 443         # the new shouldn't contain anymore one
 444         res1 = ldb.search("cn=ldaptestgroup, cn=users," + self.base_dn,
 445                           scope=SCOPE_BASE, attrs=["member"])
 446         self.assertTrue(len(res1) == 1)
 447         self.assertTrue(len(res1[0]["member"]) == 1)
 448         self.assertEquals(res1[0]["member"][0].lower(),
 449           ("cn=ldaptestuser,cn=users," + self.base_dn).lower())
 450
 451         res1 = ldb.search("cn=ldaptestgroup2, cn=users," + self.base_dn,
 452                           scope=SCOPE_BASE, attrs=["member"])
 453         self.assertTrue(len(res1) == 1)
 454         self.assertFalse("member" in res1[0])
 455
 456         # Primary group member
 457         m = Message()
 458         m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 459         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
 460                                      FLAG_MOD_DELETE, "member")
 461         try:
 462             ldb.modify(m)
 463             self.fail()
 464         except LdbError, (num, _):
 465             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 466
 467         # Delete invalid group member
 468         m = Message()
 469         m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 470         m["member"] = MessageElement("cn=ldaptestuser1,cn=users," + self.base_dn,
 471                                      FLAG_MOD_DELETE, "member")
 472         try:
 473             ldb.modify(m)
 474             self.fail()
 475         except LdbError, (num, _):
 476             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 477
 478         # Also this should be denied
 479         try:
 480             ldb.add({
 481               "dn": "cn=ldaptestuser2,cn=users," + self.base_dn,
 482               "objectclass": "user",
 483               "primaryGroupID": "0"})
 484             self.fail()
 485         except LdbError, (num, _):
 486             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 487
 488         # Recreate user accounts
 489
 490         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 491
 492         ldb.add({
 493             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 494             "objectclass": "user"})
 495
 496         ldb.add({
 497             "dn": "cn=ldaptestuser2,cn=users," + self.base_dn,
 498             "objectclass": "user"})
 499
 500         m = Message()
 501         m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 502         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
 503                                      FLAG_MOD_ADD, "member")
 504         ldb.modify(m)
 505
 506         # Already added
 507         m = Message()
 508         m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 509         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
 510                                      FLAG_MOD_ADD, "member")
 511         try:
 512             ldb.modify(m)
 513             self.fail()
 514         except LdbError, (num, _):
 515             self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
 516
 517         # Already added, but as <SID=...>
 518         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 519                           scope=SCOPE_BASE, attrs=["objectSid"])
 520         self.assertTrue(len(res1) == 1)
 521         sid_bin = res1[0]["objectSid"][0]
 522         sid_str = ("<SID=" + ldb.schema_format_value("objectSid", sid_bin) + ">").upper()
 523
 524         m = Message()
 525         m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 526         m["member"] = MessageElement(sid_str, FLAG_MOD_ADD, "member")
 527         try:
 528             ldb.modify(m)
 529             self.fail()
 530         except LdbError, (num, _):
 531             self.assertEquals(num, ERR_ENTRY_ALREADY_EXISTS)
 532
 533         # Invalid member
 534         m = Message()
 535         m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 536         m["member"] = MessageElement("cn=ldaptestuser1,cn=users," + self.base_dn,
 537                                      FLAG_MOD_REPLACE, "member")
 538         try:
 539             ldb.modify(m)
 540             self.fail()
 541         except LdbError, (num, _):
 542             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
 543
 544         # Invalid member
 545         m = Message()
 546         m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 547         m["member"] = MessageElement(["cn=ldaptestuser,cn=users," + self.base_dn,
 548                                       "cn=ldaptestuser1,cn=users," + self.base_dn],
 549                                      FLAG_MOD_REPLACE, "member")
 550         try:
 551             ldb.modify(m)
 552             self.fail()
 553         except LdbError, (num, _):
 554             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
 555
 556         # Invalid member
 557         m = Message()
 558         m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 559         m["member"] = MessageElement("cn=ldaptestuser,cn=users," + self.base_dn,
 560                                      FLAG_MOD_REPLACE, "member")
 561         m["member"] = MessageElement("cn=ldaptestuser1,cn=users," + self.base_dn,
 562                                      FLAG_MOD_ADD, "member")
 563         try:
 564             ldb.modify(m)
 565             self.fail()
 566         except LdbError, (num, _):
 567             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
 568
 569         m = Message()
 570         m.dn = Dn(ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 571         m["member"] = MessageElement(["cn=ldaptestuser,cn=users," + self.base_dn,
 572                                       "cn=ldaptestuser2,cn=users," + self.base_dn],
 573                                      FLAG_MOD_REPLACE, "member")
 574         ldb.modify(m)
 575
 576         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 577         delete_force(self.ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
 578         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 579         delete_force(self.ldb, "cn=ldaptestgroup2,cn=users," + self.base_dn)
 580
 581         # Make also a small test for accounts with special DNs ("," in this case)
 582         ldb.add({
 583             "dn": "cn=ldaptest\,specialuser,cn=users," + self.base_dn,
 584             "objectclass": "user"})
 585         delete_force(self.ldb, "cn=ldaptest\,specialuser,cn=users," + self.base_dn)
 586
 587     def test_sam_attributes(self):
 588         """Test the behaviour of special attributes of SAM objects"""
 589         print "Testing the behaviour of special attributes of SAM objects\n"""
 590
 591         ldb.add({
 592             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 593             "objectclass": "user"})
 594         ldb.add({
 595             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 596             "objectclass": "group"})
 597
 598         m = Message()
 599         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 600         m["groupType"] = MessageElement(str(GTYPE_SECURITY_GLOBAL_GROUP), FLAG_MOD_ADD,
 601           "groupType")
 602         try:
 603             ldb.modify(m)
 604             self.fail()
 605         except LdbError, (num, _):
 606             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 607
 608         # Delete protection tests
 609
 610         for attr in ["nTSecurityDescriptor", "objectSid", "sAMAccountType",
 611                      "sAMAccountName", "groupType"]:
 612
 613             m = Message()
 614             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 615             m[attr] = MessageElement([], FLAG_MOD_REPLACE, attr)
 616             try:
 617                 ldb.modify(m)
 618                 self.fail()
 619             except LdbError, (num, _):
 620                 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 621
 622             m = Message()
 623             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 624             m[attr] = MessageElement([], FLAG_MOD_DELETE, attr)
 625             try:
 626                 ldb.modify(m)
 627                 self.fail()
 628             except LdbError, (num, _):
 629                 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 630
 631         m = Message()
 632         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 633         m["primaryGroupID"] = MessageElement("513", FLAG_MOD_ADD,
 634           "primaryGroupID")
 635         try:
 636             ldb.modify(m)
 637             self.fail()
 638         except LdbError, (num, _):
 639             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 640
 641         m = Message()
 642         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 643         m["userAccountControl"] = MessageElement(str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD), FLAG_MOD_ADD,
 644           "userAccountControl")
 645         try:
 646             ldb.modify(m)
 647             self.fail()
 648         except LdbError, (num, _):
 649             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 650
 651         m = Message()
 652         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 653         m["objectSid"] = MessageElement("xxxxxxxxxxxxxxxx", FLAG_MOD_ADD,
 654           "objectSid")
 655         try:
 656             ldb.modify(m)
 657             self.fail()
 658         except LdbError, (num, _):
 659             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 660
 661         m = Message()
 662         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 663         m["sAMAccountType"] = MessageElement("0", FLAG_MOD_ADD,
 664           "sAMAccountType")
 665         try:
 666             ldb.modify(m)
 667             self.fail()
 668         except LdbError, (num, _):
 669             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 670
 671         m = Message()
 672         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 673         m["sAMAccountName"] = MessageElement("test", FLAG_MOD_ADD,
 674           "sAMAccountName")
 675         try:
 676             ldb.modify(m)
 677             self.fail()
 678         except LdbError, (num, _):
 679             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
 680
 681         # Delete protection tests
 682
 683         for attr in ["nTSecurityDescriptor", "objectSid", "sAMAccountType",
 684                      "sAMAccountName", "primaryGroupID", "userAccountControl",
 685                      "accountExpires", "badPasswordTime", "badPwdCount",
 686                      "codePage", "countryCode", "lastLogoff", "lastLogon",
 687                      "logonCount", "pwdLastSet"]:
 688
 689             m = Message()
 690             m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 691             m[attr] = MessageElement([], FLAG_MOD_REPLACE, attr)
 692             try:
 693                 ldb.modify(m)
 694                 self.fail()
 695             except LdbError, (num, _):
 696                 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 697
 698             m = Message()
 699             m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 700             m[attr] = MessageElement([], FLAG_MOD_DELETE, attr)
 701             try:
 702                 ldb.modify(m)
 703                 self.fail()
 704             except LdbError, (num, _):
 705                 self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 706
 707         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 708         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 709
 710     def test_primary_group_token_constructed(self):
 711         """Test the primary group token behaviour (hidden-generated-readonly attribute on groups) and some other constructed attributes"""
 712         print "Testing primary group token behaviour and other constructed attributes\n"
 713
 714         try:
 715             ldb.add({
 716                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 717                 "objectclass": "group",
 718                 "primaryGroupToken": "100"})
 719             self.fail()
 720         except LdbError, (num, _):
 721             self.assertEquals(num, ERR_UNDEFINED_ATTRIBUTE_TYPE)
 722         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 723
 724         ldb.add({
 725             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 726             "objectclass": "user"})
 727
 728         ldb.add({
 729             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 730             "objectclass": "group"})
 731
 732         # Testing for one invalid, and one valid operational attribute, but also the things they are built from
 733         res1 = ldb.search(self.base_dn,
 734                           scope=SCOPE_BASE, attrs=["primaryGroupToken", "canonicalName", "objectClass", "objectSid"])
 735         self.assertTrue(len(res1) == 1)
 736         self.assertFalse("primaryGroupToken" in res1[0])
 737         self.assertTrue("canonicalName" in res1[0])
 738         self.assertTrue("objectClass" in res1[0])
 739         self.assertTrue("objectSid" in res1[0])
 740
 741         res1 = ldb.search(self.base_dn,
 742                           scope=SCOPE_BASE, attrs=["primaryGroupToken", "canonicalName"])
 743         self.assertTrue(len(res1) == 1)
 744         self.assertFalse("primaryGroupToken" in res1[0])
 745         self.assertFalse("objectSid" in res1[0])
 746         self.assertFalse("objectClass" in res1[0])
 747         self.assertTrue("canonicalName" in res1[0])
 748
 749         res1 = ldb.search("cn=users," + self.base_dn,
 750                           scope=SCOPE_BASE, attrs=["primaryGroupToken"])
 751         self.assertTrue(len(res1) == 1)
 752         self.assertFalse("primaryGroupToken" in res1[0])
 753
 754         res1 = ldb.search("cn=ldaptestuser, cn=users," + self.base_dn,
 755                           scope=SCOPE_BASE, attrs=["primaryGroupToken"])
 756         self.assertTrue(len(res1) == 1)
 757         self.assertFalse("primaryGroupToken" in res1[0])
 758
 759         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 760                           scope=SCOPE_BASE)
 761         self.assertTrue(len(res1) == 1)
 762         self.assertFalse("primaryGroupToken" in res1[0])
 763
 764         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 765                           scope=SCOPE_BASE, attrs=["primaryGroupToken", "objectSID"])
 766         self.assertTrue(len(res1) == 1)
 767         primary_group_token = int(res1[0]["primaryGroupToken"][0])
 768
 769         rid = security.dom_sid(ldb.schema_format_value("objectSID", res1[0]["objectSID"][0])).split()[1]
 770         self.assertEquals(primary_group_token, rid)
 771
 772         m = Message()
 773         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 774         m["primaryGroupToken"] = "100"
 775         try:
 776             ldb.modify(m)
 777             self.fail()
 778         except LdbError, (num, _):
 779             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 780
 781         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 782         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 783
 784     def test_tokenGroups(self):
 785         """Test the tokenGroups behaviour (hidden-generated-readonly attribute on SAM objects)"""
 786         print "Testing tokenGroups behaviour\n"
 787
 788         # The domain object shouldn't contain any "tokenGroups" entry
 789         res = ldb.search(self.base_dn, scope=SCOPE_BASE, attrs=["tokenGroups"])
 790         self.assertTrue(len(res) == 1)
 791         self.assertFalse("tokenGroups" in res[0])
 792
 793         # The domain administrator should contain "tokenGroups" entries
 794         # (the exact number depends on the domain/forest function level and the
 795         # DC software versions)
 796         res = ldb.search("cn=Administrator,cn=Users," + self.base_dn,
 797                          scope=SCOPE_BASE, attrs=["tokenGroups"])
 798         self.assertTrue(len(res) == 1)
 799         self.assertTrue("tokenGroups" in res[0])
 800
 801         ldb.add({
 802             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
 803             "objectclass": "user"})
 804
 805         # This testuser should contain at least two "tokenGroups" entries
 806         # (exactly two on an unmodified "Domain Users" and "Users" group)
 807         res = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
 808                          scope=SCOPE_BASE, attrs=["tokenGroups"])
 809         self.assertTrue(len(res) == 1)
 810         self.assertTrue(len(res[0]["tokenGroups"]) >= 2)
 811
 812         # one entry which we need to find should point to domains "Domain Users"
 813         # group and another entry should point to the builtin "Users"group
 814         domain_users_group_found = False
 815         users_group_found = False
 816         for sid in res[0]["tokenGroups"]:
 817             rid = security.dom_sid(ldb.schema_format_value("objectSID", sid)).split()[1]
 818             if rid == 513:
 819                 domain_users_group_found = True
 820             if rid == 545:
 821                 users_group_found = True
 822
 823         self.assertTrue(domain_users_group_found)
 824         self.assertTrue(users_group_found)
 825
 826         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
 827
 828     def test_groupType(self):
 829         """Test the groupType behaviour"""
 830         print "Testing groupType behaviour\n"
 831
 832         # You can never create or change to a
 833         # "GTYPE_SECURITY_BUILTIN_LOCAL_GROUP"
 834
 835         # Add operation
 836
 837         # Invalid attribute
 838         try:
 839             ldb.add({
 840                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 841                 "objectclass": "group",
 842                 "groupType": "0"})
 843             self.fail()
 844         except LdbError, (num, _):
 845             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 846         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 847
 848         try:
 849             ldb.add({
 850                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 851                 "objectclass": "group",
 852                 "groupType": str(GTYPE_SECURITY_BUILTIN_LOCAL_GROUP)})
 853             self.fail()
 854         except LdbError, (num, _):
 855             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 856         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 857
 858         ldb.add({
 859             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 860             "objectclass": "group",
 861             "groupType": str(GTYPE_SECURITY_GLOBAL_GROUP)})
 862
 863         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 864                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
 865         self.assertTrue(len(res1) == 1)
 866         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
 867           ATYPE_SECURITY_GLOBAL_GROUP)
 868         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 869
 870         ldb.add({
 871             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 872             "objectclass": "group",
 873             "groupType": str(GTYPE_SECURITY_UNIVERSAL_GROUP)})
 874
 875         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 876                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
 877         self.assertTrue(len(res1) == 1)
 878         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
 879           ATYPE_SECURITY_UNIVERSAL_GROUP)
 880         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 881
 882         ldb.add({
 883             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 884             "objectclass": "group",
 885             "groupType": str(GTYPE_SECURITY_DOMAIN_LOCAL_GROUP)})
 886
 887         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 888                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
 889         self.assertTrue(len(res1) == 1)
 890         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
 891           ATYPE_SECURITY_LOCAL_GROUP)
 892         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 893
 894         ldb.add({
 895             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 896             "objectclass": "group",
 897             "groupType": str(GTYPE_DISTRIBUTION_GLOBAL_GROUP)})
 898
 899         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 900                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
 901         self.assertTrue(len(res1) == 1)
 902         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
 903           ATYPE_DISTRIBUTION_GLOBAL_GROUP)
 904         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 905
 906         ldb.add({
 907             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 908             "objectclass": "group",
 909             "groupType": str(GTYPE_DISTRIBUTION_UNIVERSAL_GROUP)})
 910
 911         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 912                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
 913         self.assertTrue(len(res1) == 1)
 914         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
 915           ATYPE_DISTRIBUTION_UNIVERSAL_GROUP)
 916         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 917
 918         ldb.add({
 919             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 920             "objectclass": "group",
 921             "groupType": str(GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP)})
 922
 923         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 924                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
 925         self.assertTrue(len(res1) == 1)
 926         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
 927           ATYPE_DISTRIBUTION_LOCAL_GROUP)
 928         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 929
 930         # Modify operation
 931
 932         ldb.add({
 933             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
 934             "objectclass": "group"})
 935
 936         # We can change in this direction: global <-> universal <-> local
 937         # On each step also the group type itself (security/distribution) is
 938         # variable.
 939
 940         # After creation we should have a "security global group"
 941         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 942                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
 943         self.assertTrue(len(res1) == 1)
 944         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
 945           ATYPE_SECURITY_GLOBAL_GROUP)
 946
 947         # Invalid attribute
 948         try:
 949             m = Message()
 950             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 951             m["groupType"] = MessageElement("0",
 952               FLAG_MOD_REPLACE, "groupType")
 953             ldb.modify(m)
 954             self.fail()
 955         except LdbError, (num, _):
 956             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 957
 958         # Security groups
 959
 960         # Default is "global group"
 961
 962         m = Message()
 963         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 964         m["groupType"] = MessageElement(
 965           str(GTYPE_SECURITY_GLOBAL_GROUP),
 966           FLAG_MOD_REPLACE, "groupType")
 967         ldb.modify(m)
 968
 969         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 970                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
 971         self.assertTrue(len(res1) == 1)
 972         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
 973           ATYPE_SECURITY_GLOBAL_GROUP)
 974
 975         # Change to "local" (shouldn't work)
 976
 977         try:
 978             m = Message()
 979             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 980             m["groupType"] = MessageElement(
 981               str(GTYPE_SECURITY_DOMAIN_LOCAL_GROUP),
 982               FLAG_MOD_REPLACE, "groupType")
 983             ldb.modify(m)
 984             self.fail()
 985         except LdbError, (num, _):
 986             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
 987
 988         # Change to "universal"
 989
 990         m = Message()
 991         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
 992         m["groupType"] = MessageElement(
 993          str(GTYPE_SECURITY_UNIVERSAL_GROUP),
 994           FLAG_MOD_REPLACE, "groupType")
 995         ldb.modify(m)
 996
 997         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
 998                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
 999         self.assertTrue(len(res1) == 1)
1000         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1001           ATYPE_SECURITY_UNIVERSAL_GROUP)
1002
1003         # Change back to "global"
1004
1005         m = Message()
1006         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1007         m["groupType"] = MessageElement(
1008           str(GTYPE_SECURITY_GLOBAL_GROUP),
1009           FLAG_MOD_REPLACE, "groupType")
1010         ldb.modify(m)
1011
1012         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1013                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1014         self.assertTrue(len(res1) == 1)
1015         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1016           ATYPE_SECURITY_GLOBAL_GROUP)
1017
1018         # Change back to "universal"
1019
1020         m = Message()
1021         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1022         m["groupType"] = MessageElement(
1023          str(GTYPE_SECURITY_UNIVERSAL_GROUP),
1024           FLAG_MOD_REPLACE, "groupType")
1025         ldb.modify(m)
1026
1027         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1028                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1029         self.assertTrue(len(res1) == 1)
1030         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1031           ATYPE_SECURITY_UNIVERSAL_GROUP)
1032
1033         # Change to "local"
1034
1035         m = Message()
1036         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1037         m["groupType"] = MessageElement(
1038           str(GTYPE_SECURITY_DOMAIN_LOCAL_GROUP),
1039           FLAG_MOD_REPLACE, "groupType")
1040         ldb.modify(m)
1041
1042         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1043                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1044         self.assertTrue(len(res1) == 1)
1045         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1046           ATYPE_SECURITY_LOCAL_GROUP)
1047
1048         # Change to "global" (shouldn't work)
1049
1050         try:
1051             m = Message()
1052             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1053             m["groupType"] = MessageElement(
1054               str(GTYPE_SECURITY_GLOBAL_GROUP),
1055               FLAG_MOD_REPLACE, "groupType")
1056             ldb.modify(m)
1057             self.fail()
1058         except LdbError, (num, _):
1059             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1060
1061         # Change to "builtin local" (shouldn't work)
1062
1063         try:
1064             m = Message()
1065             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1066             m["groupType"] = MessageElement(
1067               str(GTYPE_SECURITY_BUILTIN_LOCAL_GROUP),
1068               FLAG_MOD_REPLACE, "groupType")
1069             ldb.modify(m)
1070             self.fail()
1071         except LdbError, (num, _):
1072             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1073
1074         m = Message()
1075         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1076
1077         # Change back to "universal"
1078
1079         m = Message()
1080         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1081         m["groupType"] = MessageElement(
1082          str(GTYPE_SECURITY_UNIVERSAL_GROUP),
1083           FLAG_MOD_REPLACE, "groupType")
1084         ldb.modify(m)
1085
1086         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1087                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1088         self.assertTrue(len(res1) == 1)
1089         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1090           ATYPE_SECURITY_UNIVERSAL_GROUP)
1091
1092         # Change to "builtin local" (shouldn't work)
1093
1094         try:
1095             m = Message()
1096             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1097             m["groupType"] = MessageElement(
1098               str(GTYPE_SECURITY_BUILTIN_LOCAL_GROUP),
1099               FLAG_MOD_REPLACE, "groupType")
1100             ldb.modify(m)
1101             self.fail()
1102         except LdbError, (num, _):
1103             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1104
1105         # Change back to "global"
1106
1107         m = Message()
1108         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1109         m["groupType"] = MessageElement(
1110           str(GTYPE_SECURITY_GLOBAL_GROUP),
1111           FLAG_MOD_REPLACE, "groupType")
1112         ldb.modify(m)
1113
1114         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1115                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1116         self.assertTrue(len(res1) == 1)
1117         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1118           ATYPE_SECURITY_GLOBAL_GROUP)
1119
1120         # Change to "builtin local" (shouldn't work)
1121
1122         try:
1123             m = Message()
1124             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1125             m["groupType"] = MessageElement(
1126               str(GTYPE_SECURITY_BUILTIN_LOCAL_GROUP),
1127               FLAG_MOD_REPLACE, "groupType")
1128             ldb.modify(m)
1129             self.fail()
1130         except LdbError, (num, _):
1131             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1132
1133         # Distribution groups
1134
1135         # Default is "global group"
1136
1137         m = Message()
1138         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1139         m["groupType"] = MessageElement(
1140           str(GTYPE_DISTRIBUTION_GLOBAL_GROUP),
1141           FLAG_MOD_REPLACE, "groupType")
1142         ldb.modify(m)
1143
1144         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1145                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1146         self.assertTrue(len(res1) == 1)
1147         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1148           ATYPE_DISTRIBUTION_GLOBAL_GROUP)
1149
1150         # Change to local (shouldn't work)
1151
1152         try:
1153             m = Message()
1154             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1155             m["groupType"] = MessageElement(
1156               str(GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP),
1157               FLAG_MOD_REPLACE, "groupType")
1158             ldb.modify(m)
1159             self.fail()
1160         except LdbError, (num, _):
1161             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1162
1163         # Change to "universal"
1164
1165         m = Message()
1166         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1167         m["groupType"] = MessageElement(
1168          str(GTYPE_DISTRIBUTION_UNIVERSAL_GROUP),
1169           FLAG_MOD_REPLACE, "groupType")
1170         ldb.modify(m)
1171
1172         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1173                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1174         self.assertTrue(len(res1) == 1)
1175         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1176           ATYPE_DISTRIBUTION_UNIVERSAL_GROUP)
1177
1178         # Change back to "global"
1179
1180         m = Message()
1181         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1182         m["groupType"] = MessageElement(
1183           str(GTYPE_DISTRIBUTION_GLOBAL_GROUP),
1184           FLAG_MOD_REPLACE, "groupType")
1185         ldb.modify(m)
1186
1187         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1188                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1189         self.assertTrue(len(res1) == 1)
1190         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1191           ATYPE_DISTRIBUTION_GLOBAL_GROUP)
1192
1193         # Change back to "universal"
1194
1195         m = Message()
1196         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1197         m["groupType"] = MessageElement(
1198          str(GTYPE_DISTRIBUTION_UNIVERSAL_GROUP),
1199           FLAG_MOD_REPLACE, "groupType")
1200         ldb.modify(m)
1201
1202         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1203                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1204         self.assertTrue(len(res1) == 1)
1205         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1206           ATYPE_DISTRIBUTION_UNIVERSAL_GROUP)
1207
1208         # Change to "local"
1209
1210         m = Message()
1211         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1212         m["groupType"] = MessageElement(
1213           str(GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP),
1214           FLAG_MOD_REPLACE, "groupType")
1215         ldb.modify(m)
1216
1217         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1218                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1219         self.assertTrue(len(res1) == 1)
1220         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1221           ATYPE_DISTRIBUTION_LOCAL_GROUP)
1222
1223         # Change to "global" (shouldn't work)
1224
1225         try:
1226             m = Message()
1227             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1228             m["groupType"] = MessageElement(
1229               str(GTYPE_DISTRIBUTION_GLOBAL_GROUP),
1230               FLAG_MOD_REPLACE, "groupType")
1231             ldb.modify(m)
1232             self.fail()
1233         except LdbError, (num, _):
1234             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1235
1236         # Change back to "universal"
1237
1238         # Try to add invalid member to group 1 - should be denied
1239         m = Message()
1240         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1241         m["member"] = MessageElement(
1242           "cn=ldaptestuser3,cn=users," + self.base_dn,
1243           FLAG_MOD_ADD, "member")
1244         try:
1245             ldb.modify(m)
1246             self.fail()
1247         except LdbError, (num, _):
1248             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
1249
1250         # Make group 2 secondary
1251         m = Message()
1252         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1253         m["groupType"] = MessageElement(
1254          str(GTYPE_DISTRIBUTION_UNIVERSAL_GROUP),
1255           FLAG_MOD_REPLACE, "groupType")
1256         ldb.modify(m)
1257
1258         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1259                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1260         self.assertTrue(len(res1) == 1)
1261         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1262           ATYPE_DISTRIBUTION_UNIVERSAL_GROUP)
1263
1264         # Change back to "global"
1265
1266         m = Message()
1267         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1268         m["groupType"] = MessageElement(
1269           str(GTYPE_DISTRIBUTION_GLOBAL_GROUP),
1270           FLAG_MOD_REPLACE, "groupType")
1271         ldb.modify(m)
1272
1273         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1274                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1275         self.assertTrue(len(res1) == 1)
1276         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1277           ATYPE_DISTRIBUTION_GLOBAL_GROUP)
1278
1279         # Both group types: this performs only random checks - all possibilities
1280         # would require too much code.
1281
1282         # Default is "global group"
1283
1284         m = Message()
1285         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1286         m["groupType"] = MessageElement(
1287           str(GTYPE_SECURITY_GLOBAL_GROUP),
1288           FLAG_MOD_REPLACE, "groupType")
1289         ldb.modify(m)
1290
1291         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1292                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1293         self.assertTrue(len(res1) == 1)
1294         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1295           ATYPE_SECURITY_GLOBAL_GROUP)
1296
1297         # Change to "local" (shouldn't work)
1298
1299         try:
1300             m = Message()
1301             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1302             m["groupType"] = MessageElement(
1303               str(GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP),
1304               FLAG_MOD_REPLACE, "groupType")
1305             ldb.modify(m)
1306             self.fail()
1307         except LdbError, (num, _):
1308             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1309
1310         # Change to "universal"
1311
1312         m = Message()
1313         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1314         m["groupType"] = MessageElement(
1315          str(GTYPE_DISTRIBUTION_UNIVERSAL_GROUP),
1316           FLAG_MOD_REPLACE, "groupType")
1317         ldb.modify(m)
1318
1319         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1320                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1321         self.assertTrue(len(res1) == 1)
1322         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1323           ATYPE_DISTRIBUTION_UNIVERSAL_GROUP)
1324
1325         # Change back to "global"
1326
1327         m = Message()
1328         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1329         m["groupType"] = MessageElement(
1330           str(GTYPE_SECURITY_GLOBAL_GROUP),
1331           FLAG_MOD_REPLACE, "groupType")
1332         ldb.modify(m)
1333
1334         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1335                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1336         self.assertTrue(len(res1) == 1)
1337         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1338           ATYPE_SECURITY_GLOBAL_GROUP)
1339
1340         # Change back to "universal"
1341
1342         m = Message()
1343         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1344         m["groupType"] = MessageElement(
1345          str(GTYPE_SECURITY_UNIVERSAL_GROUP),
1346           FLAG_MOD_REPLACE, "groupType")
1347         ldb.modify(m)
1348
1349         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1350                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1351         self.assertTrue(len(res1) == 1)
1352         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1353           ATYPE_SECURITY_UNIVERSAL_GROUP)
1354
1355         # Change to "local"
1356
1357         m = Message()
1358         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1359         m["groupType"] = MessageElement(
1360           str(GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP),
1361           FLAG_MOD_REPLACE, "groupType")
1362         ldb.modify(m)
1363
1364         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1365                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1366         self.assertTrue(len(res1) == 1)
1367         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1368           ATYPE_DISTRIBUTION_LOCAL_GROUP)
1369
1370         # Change to "global" (shouldn't work)
1371
1372         try:
1373             m = Message()
1374             m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1375             m["groupType"] = MessageElement(
1376               str(GTYPE_DISTRIBUTION_GLOBAL_GROUP),
1377               FLAG_MOD_REPLACE, "groupType")
1378             ldb.modify(m)
1379             self.fail()
1380         except LdbError, (num, _):
1381             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1382
1383         # Change back to "universal"
1384
1385         m = Message()
1386         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1387         m["groupType"] = MessageElement(
1388          str(GTYPE_SECURITY_UNIVERSAL_GROUP),
1389           FLAG_MOD_REPLACE, "groupType")
1390         ldb.modify(m)
1391
1392         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1393                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1394         self.assertTrue(len(res1) == 1)
1395         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1396           ATYPE_SECURITY_UNIVERSAL_GROUP)
1397
1398         # Change back to "global"
1399
1400         m = Message()
1401         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1402         m["groupType"] = MessageElement(
1403           str(GTYPE_SECURITY_GLOBAL_GROUP),
1404           FLAG_MOD_REPLACE, "groupType")
1405         ldb.modify(m)
1406
1407         res1 = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
1408                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1409         self.assertTrue(len(res1) == 1)
1410         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1411           ATYPE_SECURITY_GLOBAL_GROUP)
1412
1413         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
1414
1415     def test_userAccountControl(self):
1416         """Test the userAccountControl behaviour"""
1417         print "Testing userAccountControl behaviour\n"
1418
1419         # With a user object
1420
1421         # Add operation
1422
1423         # As user you can only set a normal account.
1424         # The UF_PASSWD_NOTREQD flag is needed since we haven't requested a
1425         # password yet.
1426         # With SYSTEM rights you can set a interdomain trust account.
1427
1428         ldb.add({
1429             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1430             "objectclass": "user",
1431             "userAccountControl": "0"})
1432
1433         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1434                           scope=SCOPE_BASE,
1435                           attrs=["sAMAccountType", "userAccountControl"])
1436         self.assertTrue(len(res1) == 1)
1437         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1438           ATYPE_NORMAL_ACCOUNT)
1439         self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_ACCOUNTDISABLE == 0)
1440         self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_PASSWD_NOTREQD == 0)
1441         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1442
1443 # This has to wait until s4 supports it (needs a password module change)
1444 #        try:
1445 #            ldb.add({
1446 #                "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1447 #                "objectclass": "user",
1448 #                "userAccountControl": str(UF_NORMAL_ACCOUNT)})
1449 #            self.fail()
1450 #        except LdbError, (num, _):
1451 #            self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1452 #        delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1453
1454         ldb.add({
1455             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1456             "objectclass": "user",
1457             "userAccountControl": str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD)})
1458
1459         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1460                           scope=SCOPE_BASE,
1461                           attrs=["sAMAccountType", "userAccountControl"])
1462         self.assertTrue(len(res1) == 1)
1463         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1464           ATYPE_NORMAL_ACCOUNT)
1465         self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_ACCOUNTDISABLE == 0)
1466         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1467
1468         try:
1469             ldb.add({
1470                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1471                 "objectclass": "user",
1472                 "userAccountControl": str(UF_TEMP_DUPLICATE_ACCOUNT)})
1473             self.fail()
1474         except LdbError, (num, _):
1475             self.assertEquals(num, ERR_OTHER)
1476         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1477
1478         try:
1479             ldb.add({
1480                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1481                 "objectclass": "user",
1482                 "userAccountControl": str(UF_SERVER_TRUST_ACCOUNT)})
1483             self.fail()
1484         except LdbError, (num, _):
1485             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
1486         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1487
1488         try:
1489             ldb.add({
1490                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1491                 "objectclass": "user",
1492                 "userAccountControl": str(UF_WORKSTATION_TRUST_ACCOUNT)})
1493         except LdbError, (num, _):
1494             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
1495         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1496
1497         try:
1498             ldb.add({
1499                 "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1500                 "objectclass": "user",
1501                 "userAccountControl": str(UF_WORKSTATION_TRUST_ACCOUNT | UF_PARTIAL_SECRETS_ACCOUNT)})
1502         except LdbError, (num, _):
1503             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
1504         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1505
1506 # This isn't supported yet in s4 - needs ACL module adaption
1507 #        try:
1508 #            ldb.add({
1509 #                "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1510 #                "objectclass": "user",
1511 #                "userAccountControl": str(UF_INTERDOMAIN_TRUST_ACCOUNT)})
1512 #            self.fail()
1513 #        except LdbError, (num, _):
1514 #            self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
1515 #        delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1516
1517         # Modify operation
1518
1519         ldb.add({
1520             "dn": "cn=ldaptestuser,cn=users," + self.base_dn,
1521             "objectclass": "user"})
1522
1523         # After creation we should have a normal account
1524         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1525                           scope=SCOPE_BASE,
1526                           attrs=["sAMAccountType", "userAccountControl"])
1527         self.assertTrue(len(res1) == 1)
1528         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1529           ATYPE_NORMAL_ACCOUNT)
1530         self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_ACCOUNTDISABLE != 0)
1531
1532         # As user you can only switch from a normal account to a workstation
1533         # trust account and back.
1534         # The UF_PASSWD_NOTREQD flag is needed since we haven't requested a
1535         # password yet.
1536         # With SYSTEM rights you can switch to a interdomain trust account.
1537
1538         # Invalid attribute
1539         try:
1540             m = Message()
1541             m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1542             m["userAccountControl"] = MessageElement("0",
1543               FLAG_MOD_REPLACE, "userAccountControl")
1544             ldb.modify(m)
1545         except LdbError, (num, _):
1546             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1547
1548 # This has to wait until s4 supports it (needs a password module change)
1549 #        try:
1550 #            m = Message()
1551 #            m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1552 #            m["userAccountControl"] = MessageElement(
1553 #              str(UF_NORMAL_ACCOUNT),
1554 #              FLAG_MOD_REPLACE, "userAccountControl")
1555 #            ldb.modify(m)
1556 #        except LdbError, (num, _):
1557 #            self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1558
1559         m = Message()
1560         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1561         m["userAccountControl"] = MessageElement(
1562           str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD),
1563           FLAG_MOD_REPLACE, "userAccountControl")
1564         ldb.modify(m)
1565
1566         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1567                           scope=SCOPE_BASE,
1568                           attrs=["sAMAccountType", "userAccountControl"])
1569         self.assertTrue(len(res1) == 1)
1570         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1571           ATYPE_NORMAL_ACCOUNT)
1572         self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_ACCOUNTDISABLE == 0)
1573
1574         try:
1575             m = Message()
1576             m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1577             m["userAccountControl"] = MessageElement(
1578               str(UF_TEMP_DUPLICATE_ACCOUNT),
1579               FLAG_MOD_REPLACE, "userAccountControl")
1580             ldb.modify(m)
1581             self.fail()
1582         except LdbError, (num, _):
1583             self.assertEquals(num, ERR_OTHER)
1584
1585         try:
1586             m = Message()
1587             m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1588             m["userAccountControl"] = MessageElement(
1589               str(UF_SERVER_TRUST_ACCOUNT),
1590               FLAG_MOD_REPLACE, "userAccountControl")
1591             ldb.modify(m)
1592             self.fail()
1593         except LdbError, (num, _):
1594             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1595
1596         m = Message()
1597         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1598         m["userAccountControl"] = MessageElement(
1599           str(UF_WORKSTATION_TRUST_ACCOUNT),
1600           FLAG_MOD_REPLACE, "userAccountControl")
1601         ldb.modify(m)
1602
1603         try:
1604             m = Message()
1605             m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1606             m["userAccountControl"] = MessageElement(
1607               str(UF_WORKSTATION_TRUST_ACCOUNT | UF_PARTIAL_SECRETS_ACCOUNT),
1608               FLAG_MOD_REPLACE, "userAccountControl")
1609             ldb.modify(m)
1610             self.fail()
1611         except LdbError, (num, _):
1612             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1613
1614         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1615                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1616         self.assertTrue(len(res1) == 1)
1617         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1618           ATYPE_WORKSTATION_TRUST)
1619
1620         m = Message()
1621         m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1622         m["userAccountControl"] = MessageElement(
1623           str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD),
1624           FLAG_MOD_REPLACE, "userAccountControl")
1625         ldb.modify(m)
1626
1627         res1 = ldb.search("cn=ldaptestuser,cn=users," + self.base_dn,
1628                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1629         self.assertTrue(len(res1) == 1)
1630         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1631           ATYPE_NORMAL_ACCOUNT)
1632
1633 # This isn't supported yet in s4 - needs ACL module adaption
1634 #        try:
1635 #            m = Message()
1636 #            m.dn = Dn(ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1637 #            m["userAccountControl"] = MessageElement(
1638 #              str(UF_INTERDOMAIN_TRUST_ACCOUNT),
1639 #              FLAG_MOD_REPLACE, "userAccountControl")
1640 #            ldb.modify(m)
1641 #            self.fail()
1642 #        except LdbError, (num, _):
1643 #            self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
1644
1645         # With a computer object
1646
1647         # Add operation
1648
1649         # As computer you can set a normal account and a server trust account.
1650         # The UF_PASSWD_NOTREQD flag is needed since we haven't requested a
1651         # password yet.
1652         # With SYSTEM rights you can set a interdomain trust account.
1653
1654         ldb.add({
1655             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1656             "objectclass": "computer",
1657             "userAccountControl": "0"})
1658
1659         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1660                           scope=SCOPE_BASE,
1661                           attrs=["sAMAccountType", "userAccountControl"])
1662         self.assertTrue(len(res1) == 1)
1663         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1664           ATYPE_NORMAL_ACCOUNT)
1665         self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_ACCOUNTDISABLE == 0)
1666         self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_PASSWD_NOTREQD == 0)
1667         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1668
1669 # This has to wait until s4 supports it (needs a password module change)
1670 #        try:
1671 #            ldb.add({
1672 #                "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1673 #                "objectclass": "computer",
1674 #                "userAccountControl": str(UF_NORMAL_ACCOUNT)})
1675 #            self.fail()
1676 #        except LdbError, (num, _):
1677 #            self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1678 #        delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1679
1680         ldb.add({
1681             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1682             "objectclass": "computer",
1683             "userAccountControl": str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD)})
1684
1685         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1686                           scope=SCOPE_BASE,
1687                           attrs=["sAMAccountType", "userAccountControl"])
1688         self.assertTrue(len(res1) == 1)
1689         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1690           ATYPE_NORMAL_ACCOUNT)
1691         self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_ACCOUNTDISABLE == 0)
1692         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1693
1694         try:
1695             ldb.add({
1696                 "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1697                 "objectclass": "computer",
1698                 "userAccountControl": str(UF_TEMP_DUPLICATE_ACCOUNT)})
1699             self.fail()
1700         except LdbError, (num, _):
1701             self.assertEquals(num, ERR_OTHER)
1702         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1703
1704         ldb.add({
1705             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1706             "objectclass": "computer",
1707             "userAccountControl": str(UF_SERVER_TRUST_ACCOUNT)})
1708
1709         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1710                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1711         self.assertTrue(len(res1) == 1)
1712         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1713           ATYPE_WORKSTATION_TRUST)
1714         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1715
1716         try:
1717             ldb.add({
1718                 "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1719                 "objectclass": "computer",
1720                 "userAccountControl": str(UF_WORKSTATION_TRUST_ACCOUNT)})
1721         except LdbError, (num, _):
1722             self.assertEquals(num, ERR_OBJECT_CLASS_VIOLATION)
1723         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1724
1725 # This isn't supported yet in s4 - needs ACL module adaption
1726 #        try:
1727 #            ldb.add({
1728 #                "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1729 #                "objectclass": "computer",
1730 #                "userAccountControl": str(UF_INTERDOMAIN_TRUST_ACCOUNT)})
1731 #            self.fail()
1732 #        except LdbError, (num, _):
1733 #            self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
1734 #        delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1735
1736         # Modify operation
1737
1738         ldb.add({
1739             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1740             "objectclass": "computer"})
1741
1742         # After creation we should have a normal account
1743         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1744                           scope=SCOPE_BASE,
1745                           attrs=["sAMAccountType", "userAccountControl"])
1746         self.assertTrue(len(res1) == 1)
1747         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1748           ATYPE_NORMAL_ACCOUNT)
1749         self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_ACCOUNTDISABLE != 0)
1750
1751         # As computer you can switch from a normal account to a workstation
1752         # or server trust account and back (also swapping between trust
1753         # accounts is allowed).
1754         # The UF_PASSWD_NOTREQD flag is needed since we haven't requested a
1755         # password yet.
1756         # With SYSTEM rights you can switch to a interdomain trust account.
1757
1758         # Invalid attribute
1759         try:
1760             m = Message()
1761             m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1762             m["userAccountControl"] = MessageElement("0",
1763               FLAG_MOD_REPLACE, "userAccountControl")
1764             ldb.modify(m)
1765         except LdbError, (num, _):
1766             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1767
1768 # This has to wait until s4 supports it (needs a password module change)
1769 #        try:
1770 #            m = Message()
1771 #            m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1772 #            m["userAccountControl"] = MessageElement(
1773 #              str(UF_NORMAL_ACCOUNT),
1774 #              FLAG_MOD_REPLACE, "userAccountControl")
1775 #            ldb.modify(m)
1776 #        except LdbError, (num, _):
1777 #            self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
1778
1779         m = Message()
1780         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1781         m["userAccountControl"] = MessageElement(
1782           str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD),
1783           FLAG_MOD_REPLACE, "userAccountControl")
1784         ldb.modify(m)
1785
1786         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1787                           scope=SCOPE_BASE,
1788                           attrs=["sAMAccountType", "userAccountControl"])
1789         self.assertTrue(len(res1) == 1)
1790         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1791           ATYPE_NORMAL_ACCOUNT)
1792         self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_ACCOUNTDISABLE == 0)
1793
1794         try:
1795             m = Message()
1796             m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1797             m["userAccountControl"] = MessageElement(
1798               str(UF_TEMP_DUPLICATE_ACCOUNT),
1799               FLAG_MOD_REPLACE, "userAccountControl")
1800             ldb.modify(m)
1801             self.fail()
1802         except LdbError, (num, _):
1803             self.assertEquals(num, ERR_OTHER)
1804
1805         m = Message()
1806         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1807         m["userAccountControl"] = MessageElement(
1808           str(UF_SERVER_TRUST_ACCOUNT),
1809           FLAG_MOD_REPLACE, "userAccountControl")
1810         ldb.modify(m)
1811
1812         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1813                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1814         self.assertTrue(len(res1) == 1)
1815         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1816           ATYPE_WORKSTATION_TRUST)
1817
1818         m = Message()
1819         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1820         m["userAccountControl"] = MessageElement(
1821           str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD),
1822           FLAG_MOD_REPLACE, "userAccountControl")
1823         ldb.modify(m)
1824
1825         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1826                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1827         self.assertTrue(len(res1) == 1)
1828         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1829           ATYPE_NORMAL_ACCOUNT)
1830
1831         m = Message()
1832         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1833         m["userAccountControl"] = MessageElement(
1834           str(UF_WORKSTATION_TRUST_ACCOUNT),
1835           FLAG_MOD_REPLACE, "userAccountControl")
1836         ldb.modify(m)
1837
1838         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1839                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1840         self.assertTrue(len(res1) == 1)
1841         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1842           ATYPE_WORKSTATION_TRUST)
1843
1844         m = Message()
1845         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1846         m["userAccountControl"] = MessageElement(
1847           str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD),
1848           FLAG_MOD_REPLACE, "userAccountControl")
1849         ldb.modify(m)
1850
1851         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1852                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1853         self.assertTrue(len(res1) == 1)
1854         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1855           ATYPE_NORMAL_ACCOUNT)
1856
1857         m = Message()
1858         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1859         m["userAccountControl"] = MessageElement(
1860           str(UF_SERVER_TRUST_ACCOUNT),
1861           FLAG_MOD_REPLACE, "userAccountControl")
1862         ldb.modify(m)
1863
1864         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1865                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1866         self.assertTrue(len(res1) == 1)
1867         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1868           ATYPE_WORKSTATION_TRUST)
1869
1870         m = Message()
1871         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1872         m["userAccountControl"] = MessageElement(
1873           str(UF_WORKSTATION_TRUST_ACCOUNT),
1874           FLAG_MOD_REPLACE, "userAccountControl")
1875         ldb.modify(m)
1876
1877         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1878                           scope=SCOPE_BASE, attrs=["sAMAccountType"])
1879         self.assertTrue(len(res1) == 1)
1880         self.assertEquals(int(res1[0]["sAMAccountType"][0]),
1881           ATYPE_WORKSTATION_TRUST)
1882
1883 # This isn't supported yet in s4 - needs ACL module adaption
1884 #        try:
1885 #            m = Message()
1886 #            m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1887 #            m["userAccountControl"] = MessageElement(
1888 #              str(UF_INTERDOMAIN_TRUST_ACCOUNT),
1889 #              FLAG_MOD_REPLACE, "userAccountControl")
1890 #            ldb.modify(m)
1891 #            self.fail()
1892 #        except LdbError, (num, _):
1893 #            self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
1894
1895         # "primaryGroupID" does not change if account type remains the same
1896
1897         # For a user account
1898
1899         ldb.add({
1900             "dn": "cn=ldaptestuser2,cn=users," + self.base_dn,
1901             "objectclass": "user",
1902             "userAccountControl": str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD | UF_ACCOUNTDISABLE)})
1903
1904         res1 = ldb.search("cn=ldaptestuser2,cn=users," + self.base_dn,
1905                           scope=SCOPE_BASE,
1906                           attrs=["userAccountControl"])
1907         self.assertTrue(len(res1) == 1)
1908         self.assertEquals(int(res1[0]["userAccountControl"][0]),
1909            UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD | UF_ACCOUNTDISABLE)
1910
1911         m = Message()
1912         m.dn = Dn(ldb, "<SID=" + ldb.get_domain_sid() + "-" + str(DOMAIN_RID_ADMINS) + ">")
1913         m["member"] = MessageElement(
1914           "cn=ldaptestuser2,cn=users," + self.base_dn, FLAG_MOD_ADD, "member")
1915         ldb.modify(m)
1916
1917         m = Message()
1918         m.dn = Dn(ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
1919         m["primaryGroupID"] = MessageElement(str(DOMAIN_RID_ADMINS),
1920           FLAG_MOD_REPLACE, "primaryGroupID")
1921         ldb.modify(m)
1922
1923         m = Message()
1924         m.dn = Dn(ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
1925         m["userAccountControl"] = MessageElement(
1926           str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD),
1927           FLAG_MOD_REPLACE, "userAccountControl")
1928         ldb.modify(m)
1929
1930         res1 = ldb.search("cn=ldaptestuser2,cn=users," + self.base_dn,
1931                           scope=SCOPE_BASE,
1932                           attrs=["userAccountControl", "primaryGroupID"])
1933         self.assertTrue(len(res1) == 1)
1934         self.assertTrue(int(res1[0]["userAccountControl"][0]) & UF_ACCOUNTDISABLE == 0)
1935         self.assertEquals(int(res1[0]["primaryGroupID"][0]), DOMAIN_RID_ADMINS)
1936
1937         # For a workstation account
1938
1939         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1940                           scope=SCOPE_BASE,
1941                           attrs=["primaryGroupID"])
1942         self.assertTrue(len(res1) == 1)
1943         self.assertEquals(int(res1[0]["primaryGroupID"][0]), DOMAIN_RID_DOMAIN_MEMBERS)
1944
1945         m = Message()
1946         m.dn = Dn(ldb, "<SID=" + ldb.get_domain_sid() + "-" + str(DOMAIN_RID_USERS) + ">")
1947         m["member"] = MessageElement(
1948           "cn=ldaptestcomputer,cn=computers," + self.base_dn, FLAG_MOD_ADD, "member")
1949         ldb.modify(m)
1950
1951         m = Message()
1952         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1953         m["primaryGroupID"] = MessageElement(str(DOMAIN_RID_USERS),
1954           FLAG_MOD_REPLACE, "primaryGroupID")
1955         ldb.modify(m)
1956
1957         m = Message()
1958         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1959         m["userAccountControl"] = MessageElement(
1960           str(UF_WORKSTATION_TRUST_ACCOUNT),
1961           FLAG_MOD_REPLACE, "userAccountControl")
1962         ldb.modify(m)
1963
1964         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1965                           scope=SCOPE_BASE,
1966                           attrs=["primaryGroupID"])
1967         self.assertTrue(len(res1) == 1)
1968         self.assertEquals(int(res1[0]["primaryGroupID"][0]), DOMAIN_RID_USERS)
1969
1970         delete_force(self.ldb, "cn=ldaptestuser,cn=users," + self.base_dn)
1971         delete_force(self.ldb, "cn=ldaptestuser2,cn=users," + self.base_dn)
1972         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1973
1974     def test_isCriticalSystemObject(self):
1975         """Test the isCriticalSystemObject behaviour"""
1976         print "Testing isCriticalSystemObject behaviour\n"
1977
1978         # Add tests
1979
1980         ldb.add({
1981             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1982             "objectclass": "computer"})
1983
1984         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1985                           scope=SCOPE_BASE,
1986                           attrs=["isCriticalSystemObject"])
1987         self.assertTrue(len(res1) == 1)
1988         self.assertTrue("isCriticalSystemObject" not in res1[0])
1989
1990         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
1991
1992         ldb.add({
1993             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
1994             "objectclass": "computer",
1995             "userAccountControl": str(UF_WORKSTATION_TRUST_ACCOUNT)})
1996
1997         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
1998                           scope=SCOPE_BASE,
1999                           attrs=["isCriticalSystemObject"])
2000         self.assertTrue(len(res1) == 1)
2001         self.assertEquals(res1[0]["isCriticalSystemObject"][0], "FALSE")
2002
2003         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2004
2005         ldb.add({
2006             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2007             "objectclass": "computer",
2008             "userAccountControl": str(UF_WORKSTATION_TRUST_ACCOUNT | UF_PARTIAL_SECRETS_ACCOUNT)})
2009
2010         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2011                           scope=SCOPE_BASE,
2012                           attrs=["isCriticalSystemObject"])
2013         self.assertTrue(len(res1) == 1)
2014         self.assertEquals(res1[0]["isCriticalSystemObject"][0], "TRUE")
2015
2016         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2017
2018         ldb.add({
2019             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2020             "objectclass": "computer",
2021             "userAccountControl": str(UF_SERVER_TRUST_ACCOUNT)})
2022
2023         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2024                           scope=SCOPE_BASE,
2025                           attrs=["isCriticalSystemObject"])
2026         self.assertTrue(len(res1) == 1)
2027         self.assertEquals(res1[0]["isCriticalSystemObject"][0], "TRUE")
2028
2029         # Modification tests
2030
2031         m = Message()
2032         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2033         m["userAccountControl"] = MessageElement(str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD),
2034           FLAG_MOD_REPLACE, "userAccountControl")
2035         ldb.modify(m)
2036
2037         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2038                           scope=SCOPE_BASE,
2039                           attrs=["isCriticalSystemObject"])
2040         self.assertTrue(len(res1) == 1)
2041         self.assertEquals(res1[0]["isCriticalSystemObject"][0], "TRUE")
2042
2043         m = Message()
2044         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2045         m["userAccountControl"] = MessageElement(str(UF_WORKSTATION_TRUST_ACCOUNT),
2046           FLAG_MOD_REPLACE, "userAccountControl")
2047         ldb.modify(m)
2048
2049         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2050                           scope=SCOPE_BASE,
2051                           attrs=["isCriticalSystemObject"])
2052         self.assertTrue(len(res1) == 1)
2053         self.assertEquals(res1[0]["isCriticalSystemObject"][0], "FALSE")
2054
2055         m = Message()
2056         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2057         m["userAccountControl"] = MessageElement(
2058           str(UF_WORKSTATION_TRUST_ACCOUNT | UF_PARTIAL_SECRETS_ACCOUNT),
2059           FLAG_MOD_REPLACE, "userAccountControl")
2060         ldb.modify(m)
2061
2062         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2063                           scope=SCOPE_BASE,
2064                           attrs=["isCriticalSystemObject"])
2065         self.assertTrue(len(res1) == 1)
2066         self.assertEquals(res1[0]["isCriticalSystemObject"][0], "TRUE")
2067
2068         m = Message()
2069         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2070         m["userAccountControl"] = MessageElement(str(UF_NORMAL_ACCOUNT | UF_PASSWD_NOTREQD),
2071           FLAG_MOD_REPLACE, "userAccountControl")
2072         ldb.modify(m)
2073
2074         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2075                           scope=SCOPE_BASE,
2076                           attrs=["isCriticalSystemObject"])
2077         self.assertTrue(len(res1) == 1)
2078         self.assertEquals(res1[0]["isCriticalSystemObject"][0], "TRUE")
2079
2080         m = Message()
2081         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2082         m["userAccountControl"] = MessageElement(str(UF_SERVER_TRUST_ACCOUNT),
2083           FLAG_MOD_REPLACE, "userAccountControl")
2084         ldb.modify(m)
2085
2086         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2087                           scope=SCOPE_BASE,
2088                           attrs=["isCriticalSystemObject"])
2089         self.assertTrue(len(res1) == 1)
2090         self.assertEquals(res1[0]["isCriticalSystemObject"][0], "TRUE")
2091
2092         m = Message()
2093         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2094         m["userAccountControl"] = MessageElement(str(UF_WORKSTATION_TRUST_ACCOUNT),
2095           FLAG_MOD_REPLACE, "userAccountControl")
2096         ldb.modify(m)
2097
2098         res1 = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2099                           scope=SCOPE_BASE,
2100                           attrs=["isCriticalSystemObject"])
2101         self.assertTrue(len(res1) == 1)
2102         self.assertEquals(res1[0]["isCriticalSystemObject"][0], "FALSE")
2103
2104         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2105
2106     def test_service_principal_name_updates(self):
2107         """Test the servicePrincipalNames update behaviour"""
2108         print "Testing servicePrincipalNames update behaviour\n"
2109
2110         ldb.add({
2111             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2112             "objectclass": "computer",
2113             "dNSHostName": "testname.testdom"})
2114
2115         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2116                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2117         self.assertTrue(len(res) == 1)
2118         self.assertFalse("servicePrincipalName" in res[0])
2119
2120         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2121
2122         ldb.add({
2123             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2124             "objectclass": "computer",
2125             "servicePrincipalName": "HOST/testname.testdom"})
2126
2127         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2128                           scope=SCOPE_BASE, attrs=["dNSHostName"])
2129         self.assertTrue(len(res) == 1)
2130         self.assertFalse("dNSHostName" in res[0])
2131
2132         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2133
2134         ldb.add({
2135             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2136             "objectclass": "computer",
2137             "dNSHostName": "testname2.testdom",
2138             "servicePrincipalName": "HOST/testname.testdom"})
2139
2140         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2141                          scope=SCOPE_BASE, attrs=["dNSHostName"])
2142         self.assertTrue(len(res) == 1)
2143         self.assertEquals(res[0]["dNSHostName"][0], "testname2.testdom")
2144
2145         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2146                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2147         self.assertTrue(len(res) == 1)
2148         self.assertEquals(res[0]["servicePrincipalName"][0],
2149                           "HOST/testname.testdom")
2150
2151         m = Message()
2152         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2153         m["dNSHostName"] = MessageElement("testname.testdoM",
2154                                           FLAG_MOD_REPLACE, "dNSHostName")
2155         ldb.modify(m)
2156
2157         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2158                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2159         self.assertTrue(len(res) == 1)
2160         self.assertEquals(res[0]["servicePrincipalName"][0],
2161                           "HOST/testname.testdom")
2162
2163         m = Message()
2164         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2165         m["dNSHostName"] = MessageElement("testname2.testdom2",
2166                                           FLAG_MOD_REPLACE, "dNSHostName")
2167         ldb.modify(m)
2168
2169         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2170                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2171         self.assertTrue(len(res) == 1)
2172         self.assertEquals(res[0]["servicePrincipalName"][0],
2173                           "HOST/testname2.testdom2")
2174
2175         m = Message()
2176         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2177         m["dNSHostName"] = MessageElement([],
2178                                           FLAG_MOD_DELETE, "dNSHostName")
2179         ldb.modify(m)
2180
2181         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2182                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2183         self.assertTrue(len(res) == 1)
2184         self.assertEquals(res[0]["servicePrincipalName"][0],
2185                           "HOST/testname2.testdom2")
2186
2187         m = Message()
2188         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2189         m["dNSHostName"] = MessageElement("testname.testdom3",
2190                                           FLAG_MOD_REPLACE, "dNSHostName")
2191         ldb.modify(m)
2192
2193         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2194                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2195         self.assertTrue(len(res) == 1)
2196         self.assertEquals(res[0]["servicePrincipalName"][0],
2197                           "HOST/testname2.testdom2")
2198
2199         m = Message()
2200         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2201         m["dNSHostName"] = MessageElement("testname2.testdom2",
2202                                           FLAG_MOD_REPLACE, "dNSHostName")
2203         ldb.modify(m)
2204
2205         m = Message()
2206         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2207         m["dNSHostName"] = MessageElement("testname3.testdom3",
2208                                           FLAG_MOD_REPLACE, "dNSHostName")
2209         m["servicePrincipalName"] = MessageElement("HOST/testname2.testdom2",
2210                                                    FLAG_MOD_REPLACE,
2211                                                    "servicePrincipalName")
2212         ldb.modify(m)
2213
2214         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2215                           scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2216         self.assertTrue(len(res) == 1)
2217         self.assertEquals(res[0]["servicePrincipalName"][0],
2218                           "HOST/testname3.testdom3")
2219
2220         m = Message()
2221         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2222         m["servicePrincipalName"] = MessageElement("HOST/testname2.testdom2",
2223                                                    FLAG_MOD_REPLACE,
2224                                                    "servicePrincipalName")
2225         m["dNSHostName"] = MessageElement("testname4.testdom4",
2226                                           FLAG_MOD_REPLACE, "dNSHostName")
2227         ldb.modify(m)
2228
2229         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2230                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2231         self.assertTrue(len(res) == 1)
2232         self.assertEquals(res[0]["servicePrincipalName"][0],
2233                           "HOST/testname2.testdom2")
2234
2235         m = Message()
2236         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2237         m["servicePrincipalName"] = MessageElement([],
2238                                                    FLAG_MOD_DELETE,
2239                                                    "servicePrincipalName")
2240         ldb.modify(m)
2241
2242         m = Message()
2243         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2244         m["dNSHostName"] = MessageElement("testname2.testdom2",
2245                                           FLAG_MOD_REPLACE, "dNSHostName")
2246         ldb.modify(m)
2247
2248         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2249                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2250         self.assertTrue(len(res) == 1)
2251         self.assertFalse("servicePrincipalName" in res[0])
2252
2253         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2254
2255         ldb.add({
2256             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2257             "objectclass": "computer",
2258             "sAMAccountName": "testname$"})
2259
2260         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2261                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2262         self.assertTrue(len(res) == 1)
2263         self.assertFalse("servicePrincipalName" in res[0])
2264
2265         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2266
2267         ldb.add({
2268             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2269             "objectclass": "computer",
2270             "servicePrincipalName": "HOST/testname"})
2271
2272         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2273                          scope=SCOPE_BASE, attrs=["sAMAccountName"])
2274         self.assertTrue(len(res) == 1)
2275         self.assertTrue("sAMAccountName" in res[0])
2276
2277         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2278
2279         ldb.add({
2280             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2281             "objectclass": "computer",
2282             "sAMAccountName": "testname$",
2283             "servicePrincipalName": "HOST/testname"})
2284
2285         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2286                          scope=SCOPE_BASE, attrs=["sAMAccountName"])
2287         self.assertTrue(len(res) == 1)
2288         self.assertEquals(res[0]["sAMAccountName"][0], "testname$")
2289
2290         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2291                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2292         self.assertTrue(len(res) == 1)
2293         self.assertEquals(res[0]["servicePrincipalName"][0],
2294                           "HOST/testname")
2295
2296         m = Message()
2297         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2298         m["sAMAccountName"] = MessageElement("testnamE$",
2299                                              FLAG_MOD_REPLACE, "sAMAccountName")
2300         ldb.modify(m)
2301
2302         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2303                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2304         self.assertTrue(len(res) == 1)
2305         self.assertEquals(res[0]["servicePrincipalName"][0],
2306                           "HOST/testname")
2307
2308         m = Message()
2309         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2310         m["sAMAccountName"] = MessageElement("testname",
2311                                              FLAG_MOD_REPLACE, "sAMAccountName")
2312         ldb.modify(m)
2313
2314         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2315                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2316         self.assertTrue(len(res) == 1)
2317         self.assertEquals(res[0]["servicePrincipalName"][0],
2318                           "HOST/testname")
2319
2320         m = Message()
2321         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2322         m["sAMAccountName"] = MessageElement("test$name$",
2323                                              FLAG_MOD_REPLACE, "sAMAccountName")
2324         ldb.modify(m)
2325
2326         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2327                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2328         self.assertTrue(len(res) == 1)
2329         self.assertEquals(res[0]["servicePrincipalName"][0],
2330                           "HOST/test$name")
2331
2332         m = Message()
2333         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2334         m["sAMAccountName"] = MessageElement("testname2",
2335                                              FLAG_MOD_REPLACE, "sAMAccountName")
2336         ldb.modify(m)
2337
2338         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2339                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2340         self.assertTrue(len(res) == 1)
2341         self.assertEquals(res[0]["servicePrincipalName"][0],
2342                           "HOST/testname2")
2343
2344         m = Message()
2345         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2346         m["sAMAccountName"] = MessageElement("testname3",
2347                                              FLAG_MOD_REPLACE, "sAMAccountName")
2348         m["servicePrincipalName"] = MessageElement("HOST/testname2",
2349                                                    FLAG_MOD_REPLACE,
2350                                                    "servicePrincipalName")
2351         ldb.modify(m)
2352
2353         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2354                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2355         self.assertTrue(len(res) == 1)
2356         self.assertEquals(res[0]["servicePrincipalName"][0],
2357                           "HOST/testname3")
2358
2359         m = Message()
2360         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2361         m["servicePrincipalName"] = MessageElement("HOST/testname2",
2362                                                    FLAG_MOD_REPLACE,
2363                                                    "servicePrincipalName")
2364         m["sAMAccountName"] = MessageElement("testname4",
2365                                              FLAG_MOD_REPLACE, "sAMAccountName")
2366         ldb.modify(m)
2367
2368         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2369                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2370         self.assertTrue(len(res) == 1)
2371         self.assertEquals(res[0]["servicePrincipalName"][0],
2372                           "HOST/testname2")
2373
2374         m = Message()
2375         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2376         m["servicePrincipalName"] = MessageElement([],
2377                                                    FLAG_MOD_DELETE,
2378                                                    "servicePrincipalName")
2379         ldb.modify(m)
2380
2381         m = Message()
2382         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2383         m["sAMAccountName"] = MessageElement("testname2",
2384                                              FLAG_MOD_REPLACE, "sAMAccountName")
2385         ldb.modify(m)
2386
2387         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2388                          scope=SCOPE_BASE, attrs=["servicePrincipalName"])
2389         self.assertTrue(len(res) == 1)
2390         self.assertFalse("servicePrincipalName" in res[0])
2391
2392         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2393
2394         ldb.add({
2395             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2396             "objectclass": "computer",
2397             "dNSHostName": "testname.testdom",
2398             "sAMAccountName": "testname$",
2399             "servicePrincipalName": [ "HOST/testname.testdom", "HOST/testname" ]
2400         })
2401
2402         m = Message()
2403         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2404         m["dNSHostName"] = MessageElement("testname2.testdom",
2405                                           FLAG_MOD_REPLACE, "dNSHostName")
2406         m["sAMAccountName"] = MessageElement("testname2$",
2407                                              FLAG_MOD_REPLACE, "sAMAccountName")
2408         ldb.modify(m)
2409
2410         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2411                          scope=SCOPE_BASE, attrs=["dNSHostName", "sAMAccountName", "servicePrincipalName"])
2412         self.assertTrue(len(res) == 1)
2413         self.assertEquals(res[0]["dNSHostName"][0], "testname2.testdom")
2414         self.assertEquals(res[0]["sAMAccountName"][0], "testname2$")
2415         self.assertTrue(res[0]["servicePrincipalName"][0] == "HOST/testname2" or
2416                         res[0]["servicePrincipalName"][1] == "HOST/testname2")
2417         self.assertTrue(res[0]["servicePrincipalName"][0] == "HOST/testname2.testdom" or
2418                         res[0]["servicePrincipalName"][1] == "HOST/testname2.testdom")
2419
2420         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2421
2422         ldb.add({
2423             "dn": "cn=ldaptestcomputer,cn=computers," + self.base_dn,
2424             "objectclass": "computer",
2425             "dNSHostName": "testname.testdom",
2426             "sAMAccountName": "testname$",
2427             "servicePrincipalName": [ "HOST/testname.testdom", "HOST/testname" ]
2428         })
2429
2430         m = Message()
2431         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2432         m["sAMAccountName"] = MessageElement("testname2$",
2433                                              FLAG_MOD_REPLACE, "sAMAccountName")
2434         m["dNSHostName"] = MessageElement("testname2.testdom",
2435                                           FLAG_MOD_REPLACE, "dNSHostName")
2436         ldb.modify(m)
2437
2438         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2439                          scope=SCOPE_BASE, attrs=["dNSHostName", "sAMAccountName", "servicePrincipalName"])
2440         self.assertTrue(len(res) == 1)
2441         self.assertEquals(res[0]["dNSHostName"][0], "testname2.testdom")
2442         self.assertEquals(res[0]["sAMAccountName"][0], "testname2$")
2443         self.assertTrue(len(res[0]["servicePrincipalName"]) == 2)
2444         self.assertTrue("HOST/testname2" in res[0]["servicePrincipalName"])
2445         self.assertTrue("HOST/testname2.testdom" in res[0]["servicePrincipalName"])
2446
2447         m = Message()
2448         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2449         m["servicePrincipalName"] = MessageElement("HOST/testname2.testdom",
2450                                                    FLAG_MOD_ADD, "servicePrincipalName")
2451         try:
2452             ldb.modify(m)
2453             self.fail()
2454         except LdbError, (num, _):
2455             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
2456
2457         m = Message()
2458         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2459         m["servicePrincipalName"] = MessageElement("HOST/testname3",
2460                                                    FLAG_MOD_ADD, "servicePrincipalName")
2461         ldb.modify(m)
2462
2463         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2464                          scope=SCOPE_BASE, attrs=["dNSHostName", "sAMAccountName", "servicePrincipalName"])
2465         self.assertTrue(len(res) == 1)
2466         self.assertEquals(res[0]["dNSHostName"][0], "testname2.testdom")
2467         self.assertEquals(res[0]["sAMAccountName"][0], "testname2$")
2468         self.assertTrue(len(res[0]["servicePrincipalName"]) == 3)
2469         self.assertTrue("HOST/testname2" in res[0]["servicePrincipalName"])
2470         self.assertTrue("HOST/testname3" in res[0]["servicePrincipalName"])
2471         self.assertTrue("HOST/testname2.testdom" in res[0]["servicePrincipalName"])
2472
2473         m = Message()
2474         m.dn = Dn(ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2475         m["dNSHostName"] = MessageElement("testname3.testdom",
2476                                           FLAG_MOD_REPLACE, "dNSHostName")
2477         m["servicePrincipalName"] = MessageElement("HOST/testname3.testdom",
2478                                                    FLAG_MOD_ADD, "servicePrincipalName")
2479         ldb.modify(m)
2480
2481         res = ldb.search("cn=ldaptestcomputer,cn=computers," + self.base_dn,
2482                          scope=SCOPE_BASE, attrs=["dNSHostName", "sAMAccountName", "servicePrincipalName"])
2483         self.assertTrue(len(res) == 1)
2484         self.assertEquals(res[0]["dNSHostName"][0], "testname3.testdom")
2485         self.assertEquals(res[0]["sAMAccountName"][0], "testname2$")
2486         self.assertTrue(len(res[0]["servicePrincipalName"]) == 3)
2487         self.assertTrue("HOST/testname2" in res[0]["servicePrincipalName"])
2488         self.assertTrue("HOST/testname3" in res[0]["servicePrincipalName"])
2489         self.assertTrue("HOST/testname3.testdom" in res[0]["servicePrincipalName"])
2490
2491         delete_force(self.ldb, "cn=ldaptestcomputer,cn=computers," + self.base_dn)
2492
2493     def test_sam_description_attribute(self):
2494         """Test SAM description attribute"""
2495         print "Test SAM description attribute"""
2496
2497         self.ldb.add({
2498             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
2499             "description": "desc2",
2500             "objectclass": "group",
2501             "description": "desc1"})
2502
2503         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
2504                          scope=SCOPE_BASE, attrs=["description"])
2505         self.assertTrue(len(res) == 1)
2506         self.assertTrue("description" in res[0])
2507         self.assertTrue(len(res[0]["description"]) == 1)
2508         self.assertEquals(res[0]["description"][0], "desc1")
2509
2510         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2511
2512         self.ldb.add({
2513             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
2514             "objectclass": "group",
2515             "description": ["desc1", "desc2"]})
2516
2517         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
2518                          scope=SCOPE_BASE, attrs=["description"])
2519         self.assertTrue(len(res) == 1)
2520         self.assertTrue("description" in res[0])
2521         self.assertTrue(len(res[0]["description"]) == 2)
2522         self.assertTrue(res[0]["description"][0] == "desc1" or
2523                         res[0]["description"][1] == "desc1")
2524         self.assertTrue(res[0]["description"][0] == "desc2" or
2525                         res[0]["description"][1] == "desc2")
2526
2527         m = Message()
2528         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2529         m["description"] = MessageElement(["desc1","desc2"], FLAG_MOD_REPLACE,
2530           "description")
2531         try:
2532             ldb.modify(m)
2533             self.fail()
2534         except LdbError, (num, _):
2535             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
2536
2537         m = Message()
2538         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2539         m["description"] = MessageElement(["desc1","desc2"], FLAG_MOD_DELETE,
2540           "description")
2541         ldb.modify(m)
2542
2543         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2544
2545         self.ldb.add({
2546             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
2547             "objectclass": "group" })
2548
2549         m = Message()
2550         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2551         m["description"] = MessageElement("desc1", FLAG_MOD_REPLACE,
2552           "description")
2553         ldb.modify(m)
2554
2555         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
2556                          scope=SCOPE_BASE, attrs=["description"])
2557         self.assertTrue(len(res) == 1)
2558         self.assertTrue("description" in res[0])
2559         self.assertTrue(len(res[0]["description"]) == 1)
2560         self.assertEquals(res[0]["description"][0], "desc1")
2561
2562         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2563
2564         self.ldb.add({
2565             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
2566             "objectclass": "group",
2567             "description": ["desc1", "desc2"]})
2568
2569         m = Message()
2570         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2571         m["description"] = MessageElement("desc1", FLAG_MOD_REPLACE,
2572           "description")
2573         ldb.modify(m)
2574
2575         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
2576                          scope=SCOPE_BASE, attrs=["description"])
2577         self.assertTrue(len(res) == 1)
2578         self.assertTrue("description" in res[0])
2579         self.assertTrue(len(res[0]["description"]) == 1)
2580         self.assertEquals(res[0]["description"][0], "desc1")
2581
2582         m = Message()
2583         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2584         m["description"] = MessageElement("desc3", FLAG_MOD_ADD,
2585           "description")
2586         try:
2587             ldb.modify(m)
2588             self.fail()
2589         except LdbError, (num, _):
2590             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
2591
2592         m = Message()
2593         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2594         m["description"] = MessageElement(["desc1","desc2"], FLAG_MOD_DELETE,
2595           "description")
2596         try:
2597             ldb.modify(m)
2598             self.fail()
2599         except LdbError, (num, _):
2600             self.assertEquals(num, ERR_NO_SUCH_ATTRIBUTE)
2601
2602         m = Message()
2603         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2604         m["description"] = MessageElement("desc1", FLAG_MOD_DELETE,
2605           "description")
2606         ldb.modify(m)
2607         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
2608                          scope=SCOPE_BASE, attrs=["description"])
2609         self.assertTrue(len(res) == 1)
2610         self.assertFalse("description" in res[0])
2611
2612         m = Message()
2613         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2614         m["description"] = MessageElement(["desc1","desc2"], FLAG_MOD_REPLACE,
2615           "description")
2616         try:
2617             ldb.modify(m)
2618             self.fail()
2619         except LdbError, (num, _):
2620             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
2621
2622         m = Message()
2623         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2624         m["description"] = MessageElement(["desc3", "desc4"], FLAG_MOD_ADD,
2625           "description")
2626         try:
2627             ldb.modify(m)
2628             self.fail()
2629         except LdbError, (num, _):
2630             self.assertEquals(num, ERR_ATTRIBUTE_OR_VALUE_EXISTS)
2631
2632         m = Message()
2633         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2634         m["description"] = MessageElement("desc1", FLAG_MOD_ADD,
2635           "description")
2636         ldb.modify(m)
2637
2638         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
2639                          scope=SCOPE_BASE, attrs=["description"])
2640         self.assertTrue(len(res) == 1)
2641         self.assertTrue("description" in res[0])
2642         self.assertTrue(len(res[0]["description"]) == 1)
2643         self.assertEquals(res[0]["description"][0], "desc1")
2644
2645         m = Message()
2646         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2647         m.add(MessageElement("desc1", FLAG_MOD_DELETE, "description"))
2648         m.add(MessageElement("desc2", FLAG_MOD_ADD, "description"))
2649         ldb.modify(m)
2650
2651         res = ldb.search("cn=ldaptestgroup,cn=users," + self.base_dn,
2652                          scope=SCOPE_BASE, attrs=["description"])
2653         self.assertTrue(len(res) == 1)
2654         self.assertTrue("description" in res[0])
2655         self.assertTrue(len(res[0]["description"]) == 1)
2656         self.assertEquals(res[0]["description"][0], "desc2")
2657
2658         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2659
2660
2661     def test_fSMORoleOwner_attribute(self):
2662         """Test fSMORoleOwner attribute"""
2663         print "Test fSMORoleOwner attribute"""
2664
2665         ds_service_name = self.ldb.get_dsServiceName()
2666
2667         # The "fSMORoleOwner" attribute can only be set to "nTDSDSA" entries,
2668         # invalid DNs return ERR_UNWILLING_TO_PERFORM
2669
2670         try:
2671             self.ldb.add({
2672                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
2673                 "objectclass": "group",
2674                 "fSMORoleOwner": self.base_dn})
2675             self.fail()
2676         except LdbError, (num, _):
2677             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
2678
2679         try:
2680             self.ldb.add({
2681                 "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
2682                 "objectclass": "group",
2683                 "fSMORoleOwner": [] })
2684             self.fail()
2685         except LdbError, (num, _):
2686             self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
2687
2688         # We are able to set it to a valid "nTDSDSA" entry if the server is
2689         # capable of handling the role
2690
2691         self.ldb.add({
2692             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
2693             "objectclass": "group",
2694             "fSMORoleOwner": ds_service_name })
2695
2696         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2697
2698         self.ldb.add({
2699             "dn": "cn=ldaptestgroup,cn=users," + self.base_dn,
2700             "objectclass": "group" })
2701
2702         m = Message()
2703         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2704         m.add(MessageElement(self.base_dn, FLAG_MOD_REPLACE, "fSMORoleOwner"))
2705         try:
2706             ldb.modify(m)
2707             self.fail()
2708         except LdbError, (num, _):
2709             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
2710
2711         m = Message()
2712         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2713         m.add(MessageElement([], FLAG_MOD_REPLACE, "fSMORoleOwner"))
2714         try:
2715             ldb.modify(m)
2716             self.fail()
2717         except LdbError, (num, _):
2718             self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
2719
2720         # We are able to set it to a valid "nTDSDSA" entry if the server is
2721         # capable of handling the role
2722
2723         m = Message()
2724         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2725         m.add(MessageElement(ds_service_name, FLAG_MOD_REPLACE, "fSMORoleOwner"))
2726         ldb.modify(m)
2727
2728         # A clean-out works on plain entries, not master (schema, PDC...) DNs
2729
2730         m = Message()
2731         m.dn = Dn(ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2732         m.add(MessageElement([], FLAG_MOD_DELETE, "fSMORoleOwner"))
2733         ldb.modify(m)
2734
2735         delete_force(self.ldb, "cn=ldaptestgroup,cn=users," + self.base_dn)
2736
2737
2738 if not "://" in host:
2739     if os.path.isfile(host):
2740         host = "tdb://%s" % host
2741     else:
2742         host = "ldap://%s" % host
2743
2744 ldb = SamDB(host, credentials=creds, session_info=system_session(lp), lp=lp)
2745
2746 runner = SubunitTestRunner()
2747 rc = 0
2748 if not runner.run(unittest.makeSuite(SamTests)).wasSuccessful():
2749     rc = 1
2750 sys.exit(rc)