s4:acl.py - two password change tests are expected to fails on Windows 2000 function level

1 files changed, 14 insertions, 3 deletions

diff --git a/source4/dsdb/tests/python/acl.py b/source4/dsdb/tests/python/acl.py
index aaf68b5c03..1726c43efc 100755
--- a/source4/dsdb/tests/python/acl.py
+++ b/source4/dsdb/tests/python/acl.py
@@ -1493,11 +1493,14 @@ userPassword: thatsAcomplPASS1
 add: userPassword
 userPassword: thatsAcomplPASS2
 """)
+            # This fails on Windows 2000 domain level with constraint violation
         except LdbError, (num, _):
-            self.assertEquals(num, ERR_UNWILLING_TO_PERFORM)
+            self.assertTrue(num == ERR_CONSTRAINT_VIOLATION or
+                            num == ERR_UNWILLING_TO_PERFORM)
         else:
             self.fail()
 
+
     def test_change_password7(self):
         """Try a password change operation without any CARs given"""
         #users have change password by default - remove for negative testing
@@ -1560,12 +1563,16 @@ userPassword: thatsAcomplPASS1
             self.fail()
         mod = "(OA;;CR;00299570-246d-11d0-a768-00aa006e0529;;PS)"
         self.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
-        self.ldb_user.modify_ldif("""
+        try:
+            self.ldb_user.modify_ldif("""
 dn: """ + self.get_user_dn(self.user_with_wp) + """
 changetype: modify
 replace: userPassword
 userPassword: thatsAcomplPASS1
 """)
+            # This fails on Windows 2000 domain level with constraint violation
+        except LdbError, (num, _):
+            self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 
     def test_reset_password3(self):
         """Grant WP and see what happens (unicodePwd)"""
@@ -1614,12 +1621,16 @@ unicodePwd:: """ + base64.b64encode("\"thatsAcomplPASS1\"".encode('utf-16-le'))
         """Explicitly deny WP but grant CAR (userPassword)"""
         mod = "(D;;WP;;;PS)(OA;;CR;00299570-246d-11d0-a768-00aa006e0529;;PS)"
         self.dacl_add_ace(self.get_user_dn(self.user_with_wp), mod)
-        self.ldb_user.modify_ldif("""
+        try:
+            self.ldb_user.modify_ldif("""
 dn: """ + self.get_user_dn(self.user_with_wp) + """
 changetype: modify
 replace: userPassword
 userPassword: thatsAcomplPASS1
 """)
+            # This fails on Windows 2000 domain level with constraint violation
+        except LdbError, (num, _):
+            self.assertEquals(num, ERR_CONSTRAINT_VIOLATION)
 
 class AclExtendedTests(AclTests):