summaryrefslogtreecommitdiff
path: root/source4
diff options
context:
space:
mode:
Diffstat (limited to 'source4')
-rwxr-xr-xsource4/dsdb/tests/python/acl.py154
1 files changed, 68 insertions, 86 deletions
diff --git a/source4/dsdb/tests/python/acl.py b/source4/dsdb/tests/python/acl.py
index 0ef7cb6032..34c4e55988 100755
--- a/source4/dsdb/tests/python/acl.py
+++ b/source4/dsdb/tests/python/acl.py
@@ -95,33 +95,6 @@ replace: nTSecurityDescriptor
elif isinstance(desc, security.descriptor):
mod += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
self.ldb_admin.modify_ldif(mod)
-
-
- def create_active_user(self, _ldb, user_dn):
- ldif = """
-dn: """ + user_dn + """
-sAMAccountName: """ + user_dn.split(",")[0][3:] + """
-objectClass: user
-unicodePwd:: """ + base64.b64encode("\"samba123@\"".encode('utf-16-le')) + """
-url: www.example.com
-"""
- _ldb.add_ldif(ldif)
-
- def create_test_user(self, _ldb, user_dn, desc=None):
- ldif = """
-dn: """ + user_dn + """
-sAMAccountName: """ + user_dn.split(",")[0][3:] + """
-objectClass: user
-userPassword: """ + self.user_pass + """
-url: www.example.com
-"""
- if desc:
- assert(isinstance(desc, str) or isinstance(desc, security.descriptor))
- if isinstance(desc, str):
- ldif += "nTSecurityDescriptor: %s" % desc
- elif isinstance(desc, security.descriptor):
- ldif += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
- _ldb.add_ldif(ldif)
def create_group(self, _ldb, group_dn, desc=None):
ldif = """
@@ -202,10 +175,6 @@ url: www.example.com
pass
else:
self.fail()
-
- def create_enable_user(self, username):
- self.create_active_user(self.ldb_admin, self.get_user_dn(username))
- self.ldb_admin.enable_account("(sAMAccountName=" + username + ")")
#tests on ldap add operations
class AclAddTests(AclTests):
@@ -218,9 +187,13 @@ class AclAddTests(AclTests):
self.usr_admin_not_owner = "acl_add_user2"
# Regular user
self.regular_user = "acl_add_user3"
- self.create_enable_user(self.usr_admin_owner)
- self.create_enable_user(self.usr_admin_not_owner)
- self.create_enable_user(self.regular_user)
+ self.test_user1 = "test_add_user1"
+ self.test_group1 = "test_add_group1"
+ self.ou1 = "OU=test_add_ou1"
+ self.ou2 = "OU=test_add_ou2,%s" % self.ou1
+ self.ldb_admin.newuser(self.usr_admin_owner, self.user_pass)
+ self.ldb_admin.newuser(self.usr_admin_not_owner, self.user_pass)
+ self.ldb_admin.newuser(self.regular_user, self.user_pass)
# add admins to the Domain Admins group
self.ldb_admin.add_remove_group_members("Domain Admins", self.usr_admin_owner,
@@ -234,10 +207,12 @@ class AclAddTests(AclTests):
def tearDown(self):
super(AclAddTests, self).tearDown()
- self.delete_force(self.ldb_admin, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
- self.delete_force(self.ldb_admin, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
- self.delete_force(self.ldb_admin, "OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
- self.delete_force(self.ldb_admin, "OU=test_add_ou1," + self.base_dn)
+ self.delete_force(self.ldb_admin, "CN=%s,%s,%s" %
+ (self.test_user1, self.ou2, self.base_dn))
+ self.delete_force(self.ldb_admin, "CN=%s,%s,%s" %
+ (self.test_group1, self.ou2, self.base_dn))
+ self.delete_force(self.ldb_admin, "%s,%s" % (self.ou2, self.base_dn))
+ self.delete_force(self.ldb_admin, "%s,%s" % (self.ou1, self.base_dn))
self.delete_force(self.ldb_admin, self.get_user_dn(self.usr_admin_owner))
self.delete_force(self.ldb_admin, self.get_user_dn(self.usr_admin_not_owner))
self.delete_force(self.ldb_admin, self.get_user_dn(self.regular_user))
@@ -259,7 +234,7 @@ class AclAddTests(AclTests):
mod = "(D;CI;WPCC;;;%s)" % str(user_sid)
self.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
# Test user and group creation with another domain admin's credentials
- self.create_test_user(self.ldb_notowner, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
+ self.ldb_notowner.newuser(self.test_user1, self.user_pass, userou=self.ou2)
self.create_group(self.ldb_notowner, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
# Make sure we HAVE created the two objects -- user and group
# !!! We should not be able to do that, but however beacuse of ACE ordering our inherited Deny ACE
@@ -277,7 +252,7 @@ class AclAddTests(AclTests):
self.ldb_owner.create_ou("OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
# Test user and group creation with regular user credentials
try:
- self.create_test_user(self.ldb_user, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
+ self.ldb_user.newuser(self.test_user1, self.user_pass, userou=self.ou2)
self.create_group(self.ldb_user, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
except LdbError, (num, _):
self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
@@ -299,7 +274,7 @@ class AclAddTests(AclTests):
self.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
self.ldb_owner.create_ou("OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
# Test user and group creation with granted user only to one of the objects
- self.create_test_user(self.ldb_user, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
+ self.ldb_user.newuser(self.test_user1, self.user_pass, userou=self.ou2, setpassword=False)
try:
self.create_group(self.ldb_user, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
except LdbError, (num, _):
@@ -323,7 +298,7 @@ class AclAddTests(AclTests):
self.assert_top_ou_deleted()
self.ldb_owner.create_ou("OU=test_add_ou1," + self.base_dn)
self.ldb_owner.create_ou("OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
- self.create_test_user(self.ldb_owner, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
+ self.ldb_owner.newuser(self.test_user1, self.user_pass, userou=self.ou2)
self.create_group(self.ldb_owner, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
# Make sure we have successfully created the two objects -- user and group
res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s,%s)" % ("CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn))
@@ -340,16 +315,16 @@ class AclModifyTests(AclTests):
self.user_with_wp = "acl_mod_user1"
self.user_with_sm = "acl_mod_user2"
self.user_with_group_sm = "acl_mod_user3"
- self.create_enable_user(self.user_with_wp)
- self.create_enable_user(self.user_with_sm)
- self.create_enable_user(self.user_with_group_sm)
+ self.ldb_admin.newuser(self.user_with_wp, self.user_pass)
+ self.ldb_admin.newuser(self.user_with_sm, self.user_pass)
+ self.ldb_admin.newuser(self.user_with_group_sm, self.user_pass)
self.ldb_user = self.get_ldb_connection(self.user_with_wp, self.user_pass)
self.ldb_user2 = self.get_ldb_connection(self.user_with_sm, self.user_pass)
self.ldb_user3 = self.get_ldb_connection(self.user_with_group_sm, self.user_pass)
self.user_sid = self.get_object_sid( self.get_user_dn(self.user_with_wp))
self.create_group(self.ldb_admin, "CN=test_modify_group2,CN=Users," + self.base_dn)
self.create_group(self.ldb_admin, "CN=test_modify_group3,CN=Users," + self.base_dn)
- self.create_test_user(self.ldb_admin, self.get_user_dn("test_modify_user2"))
+ self.ldb_admin.newuser("test_modify_user2", self.user_pass)
def tearDown(self):
super(AclModifyTests, self).tearDown()
@@ -368,7 +343,7 @@ class AclModifyTests(AclTests):
mod = "(OA;;WP;bf967953-0de6-11d0-a285-00aa003049e2;;%s)" % str(self.user_sid)
# First test object -- User
print "Testing modify on User object"
- self.create_test_user(self.ldb_admin, self.get_user_dn("test_modify_user1"))
+ self.ldb_admin.newuser("test_modify_user1", self.user_pass)
self.dacl_add_ace(self.get_user_dn("test_modify_user1"), mod)
ldif = """
dn: """ + self.get_user_dn("test_modify_user1") + """
@@ -411,7 +386,7 @@ displayName: test_changed"""
# First test object -- User
print "Testing modify on User object"
#self.delete_force(self.ldb_admin, self.get_user_dn("test_modify_user1"))
- self.create_test_user(self.ldb_admin, self.get_user_dn("test_modify_user1"))
+ self.ldb_admin.newuser("test_modify_user1", self.user_pass)
self.dacl_add_ace(self.get_user_dn("test_modify_user1"), mod)
# Modify on attribute you have rights for
ldif = """
@@ -496,7 +471,7 @@ url: www.samba.org"""
"""7 Modify one attribute as you have no what so ever rights granted"""
# First test object -- User
print "Testing modify on User object"
- self.create_test_user(self.ldb_admin, self.get_user_dn("test_modify_user1"))
+ self.ldb_admin.newuser("test_modify_user1", self.user_pass)
# Modify on attribute you do not have rights for granted
ldif = """
dn: """ + self.get_user_dn("test_modify_user1") + """
@@ -674,9 +649,9 @@ class AclSearchTests(AclTests):
self.creds_tmp.set_workstation(creds.get_workstation())
self.anonymous = SamDB(url=host, credentials=self.creds_tmp, lp=lp)
self.dsheuristics = self.ldb_admin.get_dsheuristics()
- self.create_enable_user(self.u1)
- self.create_enable_user(self.u2)
- self.create_enable_user(self.u3)
+ self.ldb_admin.newuser(self.u1, self.user_pass)
+ self.ldb_admin.newuser(self.u2, self.user_pass)
+ self.ldb_admin.newuser(self.u3, self.user_pass)
self.create_security_group(self.ldb_admin, self.get_user_dn(self.group1))
self.ldb_admin.add_remove_group_members(self.group1, self.u2,
add_members_operation=True)
@@ -1029,8 +1004,8 @@ class AclDeleteTests(AclTests):
def setUp(self):
super(AclDeleteTests, self).setUp()
self.regular_user = "acl_delete_user1"
- # Create regular user
- self.create_enable_user(self.regular_user)
+ # Create regular user
+ self.ldb_admin.newuser(self.regular_user, self.user_pass)
self.ldb_user = self.get_ldb_connection(self.regular_user, self.user_pass)
def tearDown(self):
@@ -1041,7 +1016,7 @@ class AclDeleteTests(AclTests):
def test_delete_u1(self):
"""User is prohibited by default to delete another User object"""
# Create user that we try to delete
- self.create_test_user(self.ldb_admin, self.get_user_dn("test_delete_user1"))
+ self.ldb_admin.newuser("test_delete_user1", self.user_pass)
# Here delete User object should ALWAYS through exception
try:
self.ldb_user.delete(self.get_user_dn("test_delete_user1"))
@@ -1054,7 +1029,7 @@ class AclDeleteTests(AclTests):
"""User's group has RIGHT_DELETE to another User object"""
user_dn = self.get_user_dn("test_delete_user1")
# Create user that we try to delete
- self.create_test_user(self.ldb_admin, user_dn)
+ self.ldb_admin.newuser("test_delete_user1", self.user_pass)
mod = "(A;;SD;;;AU)"
self.dacl_add_ace(user_dn, mod)
# Try to delete User object
@@ -1067,7 +1042,7 @@ class AclDeleteTests(AclTests):
"""User indentified by SID has RIGHT_DELETE to another User object"""
user_dn = self.get_user_dn("test_delete_user1")
# Create user that we try to delete
- self.create_test_user(self.ldb_admin, user_dn)
+ self.ldb_admin.newuser("test_delete_user1", self.user_pass)
mod = "(A;;SD;;;%s)" % self.get_object_sid(self.get_user_dn(self.regular_user))
self.dacl_add_ace(user_dn, mod)
# Try to delete User object
@@ -1082,39 +1057,46 @@ class AclRenameTests(AclTests):
def setUp(self):
super(AclRenameTests, self).setUp()
self.regular_user = "acl_rename_user1"
-
+ self.ou1 = "OU=test_rename_ou1"
+ self.ou2 = "OU=test_rename_ou2"
+ self.ou3 = "OU=test_rename_ou3,%s" % self.ou2
+ self.testuser1 = "test_rename_user1"
+ self.testuser2 = "test_rename_user2"
+ self.testuser3 = "test_rename_user3"
+ self.testuser4 = "test_rename_user4"
+ self.testuser5 = "test_rename_user5"
# Create regular user
- self.create_enable_user(self.regular_user)
+ self.ldb_admin.newuser(self.regular_user, self.user_pass)
self.ldb_user = self.get_ldb_connection(self.regular_user, self.user_pass)
def tearDown(self):
super(AclRenameTests, self).tearDown()
# Rename OU3
- self.delete_force(self.ldb_admin, "CN=test_rename_user1,OU=test_rename_ou3,OU=test_rename_ou2," + self.base_dn)
- self.delete_force(self.ldb_admin, "CN=test_rename_user2,OU=test_rename_ou3,OU=test_rename_ou2," + self.base_dn)
- self.delete_force(self.ldb_admin, "CN=test_rename_user5,OU=test_rename_ou3,OU=test_rename_ou2," + self.base_dn)
- self.delete_force(self.ldb_admin, "OU=test_rename_ou3,OU=test_rename_ou2," + self.base_dn)
+ self.delete_force(self.ldb_admin, "CN=%s,%s,%s" % (self.testuser1, self.ou3, self.base_dn))
+ self.delete_force(self.ldb_admin, "CN=%s,%s,%s" % (self.testuser2, self.ou3, self.base_dn))
+ self.delete_force(self.ldb_admin, "CN=%s,%s,%s" % (self.testuser5, self.ou3, self.base_dn))
+ self.delete_force(self.ldb_admin, "%s,%s" % (self.ou3, self.base_dn))
# Rename OU2
- self.delete_force(self.ldb_admin, "CN=test_rename_user1,OU=test_rename_ou2," + self.base_dn)
- self.delete_force(self.ldb_admin, "CN=test_rename_user2,OU=test_rename_ou2," + self.base_dn)
- self.delete_force(self.ldb_admin, "CN=test_rename_user5,OU=test_rename_ou2," + self.base_dn)
- self.delete_force(self.ldb_admin, "OU=test_rename_ou2," + self.base_dn)
+ self.delete_force(self.ldb_admin, "CN=%s,%s,%s" % (self.testuser1, self.ou2, self.base_dn))
+ self.delete_force(self.ldb_admin, "CN=%s,%s,%s" % (self.testuser2, self.ou2, self.base_dn))
+ self.delete_force(self.ldb_admin, "CN=%s,%s,%s" % (self.testuser5, self.ou2, self.base_dn))
+ self.delete_force(self.ldb_admin, "%s,%s" % (self.ou2, self.base_dn))
# Rename OU1
- self.delete_force(self.ldb_admin, "CN=test_rename_user1,OU=test_rename_ou1," + self.base_dn)
- self.delete_force(self.ldb_admin, "CN=test_rename_user2,OU=test_rename_ou1," + self.base_dn)
- self.delete_force(self.ldb_admin, "CN=test_rename_user5,OU=test_rename_ou1," + self.base_dn)
- self.delete_force(self.ldb_admin, "OU=test_rename_ou3,OU=test_rename_ou1," + self.base_dn)
- self.delete_force(self.ldb_admin, "OU=test_rename_ou1," + self.base_dn)
+ self.delete_force(self.ldb_admin, "CN=%s,%s,%s" % (self.testuser1, self.ou1, self.base_dn))
+ self.delete_force(self.ldb_admin, "CN=%s,%s,%s" % (self.testuser2, self.ou1, self.base_dn))
+ self.delete_force(self.ldb_admin, "CN=%s,%s,%s" % (self.testuser5, self.ou1, self.base_dn))
+ self.delete_force(self.ldb_admin, "OU=test_rename_ou3,%s,%s" % (self.ou1, self.base_dn))
+ self.delete_force(self.ldb_admin, "%s,%s" % (self.ou1, self.base_dn))
self.delete_force(self.ldb_admin, self.get_user_dn(self.regular_user))
def test_rename_u1(self):
"""Regular user fails to rename 'User object' within single OU"""
# Create OU structure
self.ldb_admin.create_ou("OU=test_rename_ou1," + self.base_dn)
- self.create_test_user(self.ldb_admin, "CN=test_rename_user1,OU=test_rename_ou1," + self.base_dn)
+ self.ldb_admin.newuser(self.testuser1, self.user_pass, userou=self.ou1)
try:
- self.ldb_user.rename("CN=test_rename_user1,OU=test_rename_ou1," + self.base_dn, \
- "CN=test_rename_user5,OU=test_rename_ou1," + self.base_dn)
+ self.ldb_user.rename("CN=%s,%s,%s" % (self.testuser1, self.ou1, self.base_dn), \
+ "CN=%s,%s,%s" % (self.testuser5, self.ou1, self.base_dn))
except LdbError, (num, _):
self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
else:
@@ -1127,7 +1109,7 @@ class AclRenameTests(AclTests):
rename_user_dn = "CN=test_rename_user5," + ou_dn
# Create OU structure
self.ldb_admin.create_ou(ou_dn)
- self.create_test_user(self.ldb_admin, user_dn)
+ self.ldb_admin.newuser(self.testuser1, self.user_pass, userou=self.ou1)
mod = "(A;;WP;;;AU)"
self.dacl_add_ace(user_dn, mod)
# Rename 'User object' having WP to AU
@@ -1146,7 +1128,7 @@ class AclRenameTests(AclTests):
rename_user_dn = "CN=test_rename_user5," + ou_dn
# Create OU structure
self.ldb_admin.create_ou(ou_dn)
- self.create_test_user(self.ldb_admin, user_dn)
+ self.ldb_admin.newuser(self.testuser1, self.user_pass, userou=self.ou1)
sid = self.get_object_sid(self.get_user_dn(self.regular_user))
mod = "(A;;WP;;;%s)" % str(sid)
self.dacl_add_ace(user_dn, mod)
@@ -1168,7 +1150,7 @@ class AclRenameTests(AclTests):
# Create OU structure
self.ldb_admin.create_ou(ou1_dn)
self.ldb_admin.create_ou(ou2_dn)
- self.create_test_user(self.ldb_admin, user_dn)
+ self.ldb_admin.newuser(self.testuser2, self.user_pass, userou=self.ou1)
mod = "(A;;WPSD;;;AU)"
self.dacl_add_ace(user_dn, mod)
mod = "(A;;CC;;;AU)"
@@ -1191,7 +1173,7 @@ class AclRenameTests(AclTests):
# Create OU structure
self.ldb_admin.create_ou(ou1_dn)
self.ldb_admin.create_ou(ou2_dn)
- self.create_test_user(self.ldb_admin, user_dn)
+ self.ldb_admin.newuser(self.testuser2, self.user_pass, userou=self.ou1)
sid = self.get_object_sid(self.get_user_dn(self.regular_user))
mod = "(A;;WPSD;;;%s)" % str(sid)
self.dacl_add_ace(user_dn, mod)
@@ -1220,7 +1202,7 @@ class AclRenameTests(AclTests):
self.dacl_add_ace(ou1_dn, mod)
mod = "(A;;CC;;;AU)"
self.dacl_add_ace(ou2_dn, mod)
- self.create_test_user(self.ldb_admin, user_dn)
+ self.ldb_admin.newuser(self.testuser2, self.user_pass, userou=self.ou1)
mod = "(A;;WP;;;AU)"
self.dacl_add_ace(user_dn, mod)
# Rename 'User object' having SD and CC to AU
@@ -1247,7 +1229,7 @@ class AclRenameTests(AclTests):
self.dacl_add_ace(ou1_dn, mod)
mod = "(A;;CC;;;AU)"
self.dacl_add_ace(ou3_dn, mod)
- self.create_test_user(self.ldb_admin, user_dn)
+ self.ldb_admin.newuser(self.testuser2, self.user_pass, userou=self.ou1)
# Rename 'User object' having SD and CC to AU
self.ldb_user.rename(user_dn, rename_user_dn)
res = self.ldb_admin.search(self.base_dn,
@@ -1293,8 +1275,8 @@ class AclCARTests(AclTests):
super(AclCARTests, self).setUp()
self.user_with_wp = "acl_car_user1"
self.user_with_pc = "acl_car_user2"
- self.create_enable_user(self.user_with_wp)
- self.create_enable_user(self.user_with_pc)
+ self.ldb_admin.newuser(self.user_with_wp, self.user_pass)
+ self.ldb_admin.newuser(self.user_with_pc, self.user_pass)
self.ldb_user = self.get_ldb_connection(self.user_with_wp, self.user_pass)
self.ldb_user2 = self.get_ldb_connection(self.user_with_pc, self.user_pass)
@@ -1586,9 +1568,9 @@ class AclExtendedTests(AclTests):
self.u2 = "ext_u2"
#admin user
self.u3 = "ext_u3"
- self.create_enable_user(self.u1)
- self.create_enable_user(self.u2)
- self.create_enable_user(self.u3)
+ self.ldb_admin.newuser(self.u1, self.user_pass)
+ self.ldb_admin.newuser(self.u2, self.user_pass)
+ self.ldb_admin.newuser(self.u3, self.user_pass)
self.ldb_admin.add_remove_group_members("Domain Admins", self.u3,
add_members_operation=True)
self.ldb_user1 = self.get_ldb_connection(self.u1, self.user_pass)