[SCM] Samba Shared Repository - branch master updated

Nadezhda Ivanova nivanova at samba.org
Thu Nov 5 08:42:34 MST 2009


The branch, master has been updated
       via  5fb9d06... Python tests for the acl module.
      from  1fc47e12.. Version 1.0 of the directory service acls module.

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 5fb9d06607c46eae7e1ec4599ad59246f84bb4ee
Author: Zahari Zahariev <zahari.zahariev at postpath.com>
Date:   Thu Nov 5 17:40:54 2009 +0200

    Python tests for the acl module.
    
    Signed-off-by: Nadezhda Ivanova <nadezhda.ivanova at postpath.com>
    
    Author:    Zahari Zahariev <zahari.zahariev at postpath.com>

-----------------------------------------------------------------------

Summary of changes:
 source4/lib/ldb/tests/python/acl.py | 1104 +++++++++++++++++++++++++++++++++++
 source4/selftest/tests.sh           |    1 +
 2 files changed, 1105 insertions(+), 0 deletions(-)
 create mode 100755 source4/lib/ldb/tests/python/acl.py


Changeset truncated at 500 lines:

diff --git a/source4/lib/ldb/tests/python/acl.py b/source4/lib/ldb/tests/python/acl.py
new file mode 100755
index 0000000..ae35ddf
--- /dev/null
+++ b/source4/lib/ldb/tests/python/acl.py
@@ -0,0 +1,1104 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+# This is unit with PPD tests
+
+import getopt
+import optparse
+import sys
+import os
+import base64
+import re
+
+sys.path.append("bin/python")
+sys.path.append("../lib/subunit/python")
+
+import samba.getopt as options
+
+# Some error messages that are being tested
+from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError
+from ldb import ERR_NO_SUCH_OBJECT, ERR_INVALID_DN_SYNTAX, ERR_UNWILLING_TO_PERFORM
+from ldb import ERR_INSUFFICIENT_ACCESS_RIGHTS
+
+# For running the test unit
+from samba.ndr import ndr_pack, ndr_unpack
+from samba.dcerpc import security
+
+from samba.auth import system_session
+from samba import Ldb
+from subunit import SubunitTestRunner
+import unittest
+
+parser = optparse.OptionParser("ldap [options] <host>")
+sambaopts = options.SambaOptions(parser)
+parser.add_option_group(sambaopts)
+parser.add_option_group(options.VersionOptions(parser))
+
+# use command line creds if available
+credopts = options.CredentialsOptions(parser)
+parser.add_option_group(credopts)
+opts, args = parser.parse_args()
+
+if len(args) < 1:
+    parser.print_usage()
+    sys.exit(1)
+
+host = args[0]
+
+lp = sambaopts.get_loadparm()
+creds = credopts.get_credentials(lp)
+
+#
+# Tests start here
+#
+
+class AclTests(unittest.TestCase):
+
+    def delete_force(self, ldb, dn):
+        try:
+            ldb.delete(dn)
+        except LdbError, (num, _):
+            self.assertEquals(num, ERR_NO_SUCH_OBJECT)
+
+    def find_basedn(self, ldb):
+        res = ldb.search(base="", expression="", scope=SCOPE_BASE,
+                         attrs=["defaultNamingContext"])
+        self.assertEquals(len(res), 1)
+        return res[0]["defaultNamingContext"][0]
+
+    def find_domain_sid(self, ldb):
+        res = ldb.search(base=self.base_dn, expression="(objectClass=*)", scope=SCOPE_BASE)
+        return ndr_unpack( security.dom_sid,res[0]["objectSid"][0])
+
+    def setUp(self):
+        self.ldb_admin = ldb
+        self.base_dn = self.find_basedn(self.ldb_admin)
+        self.domain_sid = self.find_domain_sid(self.ldb_admin)
+        print "baseDN: %s" % self.base_dn
+        self.SAMBA = False; self.WIN = False
+        res = self.ldb_admin.search(base="",expression="", scope=SCOPE_BASE,
+                                    attrs=["vendorName"])
+        if res and "vendorName" in res[0].keys() and res[0]["vendorName"][0].find("Samba Team") != -1:
+            self.SAMBA = True
+        else:
+            self.WIN = True
+        if self.WIN:
+            # Modify acluser1 & acluser2 to be excluded from 'Doamin Admin' group
+            try:
+                ldif = """
+dn: CN=Domain Admins,CN=Users,""" + self.base_dn + """
+changetype: modify
+delete: member
+member: """ + self.get_user_dn("acluser1")
+                self.ldb_admin.modify_ldif(ldif)
+                ldif = """
+dn: CN=Domain Admins,CN=Users,""" + self.base_dn + """
+changetype: modify
+delete: member
+member: """ + self.get_user_dn("acluser2")
+                self.ldb_admin.modify_ldif(ldif)
+            except LdbError, (num, _):
+                self.assertEquals(num, ERR_UNWILLING_TO_PERFORM) # LDAP_ENTRY_ALREADY_EXISTS
+
+    def tearDown(self):
+        # Add
+        self.delete_force(self.ldb_admin, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
+        self.delete_force(self.ldb_admin, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
+        self.delete_force(self.ldb_admin, "OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
+        self.delete_force(self.ldb_admin, "OU=test_add_ou1," + self.base_dn)
+        # Modify
+        self.delete_force(self.ldb_admin, self.get_user_dn("test_modify_user1"))
+        self.delete_force(self.ldb_admin, "CN=test_modify_group1,CN=Users," + self.base_dn)
+        self.delete_force(self.ldb_admin, "OU=test_modify_ou1," + self.base_dn)
+        # Search
+        self.delete_force(self.ldb_admin, "CN=test_search_user1,OU=test_search_ou1," + self.base_dn)
+        self.delete_force(self.ldb_admin, "OU=test_search_ou1," + self.base_dn)
+        # Delete
+        self.delete_force(self.ldb_admin, self.get_user_dn("test_delete_user1"))
+        # Rename OU3
+        self.delete_force(self.ldb_admin, "CN=test_rename_user1,OU=test_rename_ou3,OU=test_rename_ou2," + self.base_dn)
+        self.delete_force(self.ldb_admin, "CN=test_rename_user2,OU=test_rename_ou3,OU=test_rename_ou2," + self.base_dn)
+        self.delete_force(self.ldb_admin, "CN=test_rename_user5,OU=test_rename_ou3,OU=test_rename_ou2," + self.base_dn)
+        self.delete_force(self.ldb_admin, "OU=test_rename_ou3,OU=test_rename_ou2," + self.base_dn)
+        # Rename OU2
+        self.delete_force(self.ldb_admin, "CN=test_rename_user1,OU=test_rename_ou2," + self.base_dn)
+        self.delete_force(self.ldb_admin, "CN=test_rename_user2,OU=test_rename_ou2," + self.base_dn)
+        self.delete_force(self.ldb_admin, "CN=test_rename_user5,OU=test_rename_ou2," + self.base_dn)
+        self.delete_force(self.ldb_admin, "OU=test_rename_ou2," + self.base_dn)
+        # Rename OU1
+        self.delete_force(self.ldb_admin, "CN=test_rename_user1,OU=test_rename_ou1," + self.base_dn)
+        self.delete_force(self.ldb_admin, "CN=test_rename_user2,OU=test_rename_ou1," + self.base_dn)
+        self.delete_force(self.ldb_admin, "CN=test_rename_user5,OU=test_rename_ou1," + self.base_dn)
+        self.delete_force(self.ldb_admin, "OU=test_rename_ou1," + self.base_dn)
+
+    def get_user_dn(self, name):
+        return "CN=%s,CN=Users,%s" % (name, self.base_dn)
+
+    def modify_desc(self, object_dn, desc):
+        """ Modify security descriptor using either SDDL string
+            or security.descriptor object
+        """	
+        assert(isinstance(desc, str) or isinstance(desc, security.descriptor))
+        mod = """
+dn: """ + object_dn + """
+changetype: modify
+replace: nTSecurityDescriptor
+"""
+        if isinstance(desc, str):
+            mod += "nTSecurityDescriptor: %s" % desc
+        elif isinstance(desc, security.descriptor):
+            mod += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
+        self.ldb_admin.modify_ldif(mod)
+        return
+        # Everything below is used in case of emergency or 
+        # double modify verification of some sort
+        assert(isinstance(desc, security.descriptor))
+        fn = "/tmp/tmpMod"
+        f = open(fn, "w"); f.write(mod); f.close()
+        cmd = "ldapmodify -x -h %s -D %s -w %s -f %s" \
+                % (host[7:], self.get_user_dn(creds.get_username()), creds.get_password(), fn)
+        return os.system( cmd ) == 0
+
+    def add_group_member(self, _ldb, group_dn, member_dn):
+        """ Modify user to ge member of a group 
+            e.g. User to be 'Doamin Admin' group member
+        """
+        ldif = """
+dn: """ + group_dn + """
+changetype: add
+member: """ + member_dn
+        _ldb.modify_ldif(ldif)
+    
+    def create_ou(self, _ldb, ou_dn, desc=None):
+        ou_dict = {
+            "dn" : ou_dn,
+            "ou" : ou_dn.split(",")[0][3:],
+            "objectClass" : "organizationalUnit",
+            "url" : "www.bbc.co.uk",
+        }
+        if desc:
+            assert(isinstance(desc, str) or isinstance(desc, security.descriptor))
+            if isinstance(desc, str):
+                ldif += "nTSecurityDescriptor: %s" % desc
+            elif isinstance(desc, security.descriptor):
+                ldif += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
+        _ldb.add(ou_dict)
+
+    def create_user(self, _ldb, user_dn, desc=None):
+        user_dict = {
+            "dn" : user_dn,
+            "sAMAccountName" : user_dn.split(",")[0][3:],
+            "objectClass" : "user",
+            "userPassword" : "samba123@",
+            "url" : "www.bbc.co.uk",
+        }
+        if desc:
+            assert(isinstance(desc, str) or isinstance(desc, security.descriptor))
+            if isinstance(desc, str):
+                ldif += "nTSecurityDescriptor: %s" % desc
+            elif isinstance(desc, security.descriptor):
+                ldif += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
+        _ldb.add(user_dict)
+
+    def create_group(self, _ldb, group_dn, desc=None):
+        group_dict = {
+            "dn" : group_dn,
+            "objectClass" : "group",
+            "sAMAccountName" : group_dn.split(",")[0][3:],
+            "groupType" : "4",
+            "url" : "www.bbc.co.uk",
+        }
+        if desc:
+            assert(isinstance(desc, str) or isinstance(desc, security.descriptor))
+            if isinstance(desc, str):
+                ldif += "nTSecurityDescriptor: %s" % desc
+            elif isinstance(desc, security.descriptor):
+                ldif += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
+        _ldb.add(group_dict)
+
+    def read_desc(self, object_dn):
+        res = self.ldb_admin.search(object_dn, SCOPE_BASE, None, ["nTSecurityDescriptor"])
+        desc = res[0]["nTSecurityDescriptor"][0]
+        return ndr_unpack( security.descriptor, desc )
+
+    def enable_account(self,  user_dn):
+        """Enable an account.
+        :param user_dn: Dn of the account to enable.
+        """
+        res = self.ldb_admin.search(user_dn, SCOPE_BASE, None, ["userAccountControl"])
+        assert len(res) == 1
+        userAccountControl = res[0]["userAccountControl"][0]
+        userAccountControl = int(userAccountControl)
+        if (userAccountControl & 0x2):
+            userAccountControl = userAccountControl & ~0x2 # remove disabled bit
+        if (userAccountControl & 0x20):
+            userAccountControl = userAccountControl & ~0x20 # remove 'no password required' bit
+        mod = """
+dn: """ + user_dn + """
+changetype: modify
+replace: userAccountControl
+userAccountControl: %s""" % userAccountControl
+        if self.WIN:
+            mod = re.sub("userAccountControl: \d.*", "userAccountControl: 544", mod)
+        self.ldb_admin.modify_ldif(mod)
+
+    def get_ldb_connection(self, target_username, target_password):
+        username_save = creds.get_username(); password_save = creds.get_password()
+        creds.set_username(target_username)
+        creds.set_password(target_password)
+        ldb_target = Ldb(host, credentials=creds, session_info=system_session(), lp=lp)
+        creds.set_username(username_save); creds.set_password(password_save)
+        return ldb_target
+
+    def get_object_sid(self, object_dn):
+        res = self.ldb_admin.search(object_dn)
+        return ndr_unpack( security.dom_sid, res[0]["objectSid"][0] )
+
+    def dacl_add_ace(self, object_dn, ace):
+        desc = self.read_desc( object_dn )
+        desc_sddl = desc.as_sddl( self.domain_sid )
+        if ace in desc_sddl:
+            return
+        if desc_sddl.find("(") >= 0:
+            desc_sddl = desc_sddl[:desc_sddl.index("(")] + ace + desc_sddl[desc_sddl.index("("):]
+        else:
+            desc_sddl = desc_sddl + ace
+        self.modify_desc(object_dn, desc_sddl)
+
+    def get_desc_sddl(self, object_dn):
+        """ Return object nTSecutiryDescriptor in SDDL format
+        """
+        desc = self.read_desc(object_dn)
+        return desc.as_sddl(self.domain_sid)
+    
+    # Testing section
+
+    def test_add_domainadmin_notowner(self):
+        """ 1 Testing OU with the rights of Doman Admin not creator of the OU """
+        # Creating simple user
+        if self.SAMBA:
+            # Create domain admin that will be creator of OU parent-child structure
+            self.delete_force(self.ldb_admin, self.get_user_dn("acluser1"))
+            self.create_user(self.ldb_admin, self.get_user_dn("acluser1"))
+            self.enable_account(self.get_user_dn("acluser1"))
+            # Create second domain admin that will not be creator of OU parent-child structure
+            self.delete_force(self.ldb_admin, self.get_user_dn("acluser2"))
+            self.create_user(self.ldb_admin, self.get_user_dn("acluser2"))
+            self.enable_account(self.get_user_dn("acluser2"))
+        # Test if we have any additional groups for users than default ones
+        if self.WIN:
+            res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
+                    % self.get_user_dn("acluser1") )
+            try:
+                self.assertEqual( res[0]["memberOf"][0], "" )
+            except KeyError:
+                pass
+            else:
+                self.fail()
+            res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
+                    % self.get_user_dn("acluser2") )
+            try:
+                self.assertEqual( res[0]["memberOf"][0], "" )
+            except KeyError:
+                pass
+            else:
+                self.fail()
+        # Modify acluser1 & acluser2 to be 'Doamin Admin' group member
+        self.add_group_member(self.ldb_admin, "CN=Domain Admins,CN=Users," + self.base_dn, \
+                self.get_user_dn("acluser1"))
+        self.add_group_member(self.ldb_admin, "CN=Domain Admins,CN=Users," + self.base_dn, \
+                self.get_user_dn("acluser2"))
+        # Create LDAP connection with OUs crator domain admin credentials
+        ldb_owner = self.get_ldb_connection("acluser1", "samba123@")
+        # Create LDAP connection with second domain admin credentials that is not creator of the OUs
+        ldb_notowner = self.get_ldb_connection("acluser2", "samba123@")
+        # Make sure top OU is deleted (and so everything under it)
+        res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s,%s)" \
+                % ("OU=test_add_ou1", self.base_dn) )
+        self.assertEqual( res, [] )
+        # Change descriptor for top level OU
+        self.create_ou(ldb_owner, "OU=test_add_ou1," + self.base_dn)
+        self.create_ou(ldb_owner, "OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
+        user_sid = self.get_object_sid(self.get_user_dn("acluser2"))
+        mod = "(D;CI;WPCC;;;%s)" % str(user_sid)
+        self.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
+        # Test user and group creation with another domain admin's credentials
+        self.create_user(ldb_notowner, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
+        self.create_group(ldb_notowner, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
+        # Make sure we HAVE created the two objects -- user and group
+        # !!! We should not be able to do that, but however beacuse of ACE ordering our inherited Deny ACE
+        # !!! comes after explicit (A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA) that comes from somewhere
+        res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s,%s)" \
+                % ("CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn) )
+        self.assertTrue( len(res) > 0 )
+        res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s,%s)" \
+                % ("CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn) )
+        self.assertTrue( len(res) > 0 )
+
+    def test_add_regular_user(self):
+        """ 2 Testing OU with the regular user that has no rights granted over the OU """
+        # Creating simple user
+        if self.SAMBA:
+            # Create domain admin that will be creator of OU parent-child structure
+            self.delete_force(self.ldb_admin, self.get_user_dn("acluser1"))
+            self.create_user(self.ldb_admin, self.get_user_dn("acluser1"))
+            self.enable_account(self.get_user_dn("acluser1"))
+            # Create regular user that will not be creator of OU parent-child structure
+            self.delete_force(self.ldb_admin, self.get_user_dn("acluser2"))
+            self.create_user(self.ldb_admin, self.get_user_dn("acluser2"))
+            self.enable_account(self.get_user_dn("acluser2"))
+        # Test if we have any additional groups for users than default ones
+        if self.WIN:
+            res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
+                    % self.get_user_dn("acluser1") )
+            try:
+                self.assertEqual( res[0]["memberOf"][0], "" )
+            except KeyError:
+                pass
+            else:
+                self.fail()
+            res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
+                    % self.get_user_dn("acluser2") )
+            try:
+                self.assertEqual( res[0]["memberOf"][0], "" )
+            except KeyError:
+                pass
+            else:
+                self.fail()
+        # Modify acluser1 to be 'Doamin Admin' group member
+        self.add_group_member(self.ldb_admin, "CN=Domain Admins,CN=Users," + self.base_dn, \
+                self.get_user_dn("acluser1"))
+        # Create LDAP connection with OUs crator domain admin credentials
+        ldb_owner = self.get_ldb_connection("acluser1", "samba123@")
+        # Create LDAP connection with a regular user that has the right 'Crate child User objects'
+        ldb_user = self.get_ldb_connection("acluser2", "samba123@")
+        # Make sure top OU is deleted (and so everything under it)
+        res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s,%s)" \
+                % ("OU=test_add_ou1", self.base_dn) )
+        self.assertEqual( res, [] )
+        # Create a parent-child OU structure with domain admin credentials
+        self.create_ou(ldb_owner, "OU=test_add_ou1," + self.base_dn)
+        self.create_ou(ldb_owner, "OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
+        # Test user and group creation with regular user credentials
+        try:
+            self.create_user(ldb_user, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
+            self.create_group(ldb_user, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
+        except LdbError, (num, _):
+            self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
+        else:
+            self.fail()
+        # Make sure we HAVEN'T created any of two objects -- user or group
+        res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s,%s)" \
+                % ("CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn) )
+        self.assertEqual( res, [])
+        res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s,%s)" \
+                % ("CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn) )
+        self.assertEqual( res, [])
+ 
+# ace is not inherited - filered out...
+
+    def test_add_granted_user(self):
+        """ 3 Testing OU with the rights of regular user granted the right 'Create User child objects' """
+        # Creating simple user
+        if self.SAMBA:
+            # Create domain admin that will be creator of OU parent-child structure
+            self.delete_force(self.ldb_admin, self.get_user_dn("acluser1"))
+            self.create_user(self.ldb_admin, self.get_user_dn("acluser1"))
+            self.enable_account(self.get_user_dn("acluser1"))
+            # Create second domain admin that will not be creator of OU parent-child structure
+            self.delete_force(self.ldb_admin, self.get_user_dn("acluser2"))
+            self.create_user(self.ldb_admin, self.get_user_dn("acluser2"))
+            self.enable_account(self.get_user_dn("acluser2"))
+        # Test if we have any additional groups for users than default ones
+        if self.WIN:
+            res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
+                    % self.get_user_dn("acluser1") )
+            try:
+                self.assertEqual( res[0]["memberOf"][0], "" )
+            except KeyError:
+                pass
+            else:
+                self.fail()
+            res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
+                    % self.get_user_dn("acluser2") )
+            try:
+                self.assertEqual( res[0]["memberOf"][0], "" )
+            except KeyError:
+                pass
+            else:
+                self.fail()
+        # Modify acluser1 to be 'Doamin Admin' group member
+        self.add_group_member(self.ldb_admin, "CN=Domain Admins,CN=Users," + self.base_dn, \
+                self.get_user_dn("acluser1"))
+        # Create LDAP connection with OUs crator domain admin credentials
+        ldb_owner = self.get_ldb_connection("acluser1", "samba123@")
+        # Create LDAP connection with a regular user that has the right 'Crate child User objects'
+        ldb_guser = self.get_ldb_connection("acluser2", "samba123@")
+        # Make sure top OU is deleted (and so everything under it)
+        res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s,%s)" \
+                % ("OU=test_add_ou1", self.base_dn) )
+        self.assertEqual( res, [] )
+        # Change descriptor for top level OU
+        self.create_ou(ldb_owner, "OU=test_add_ou1," + self.base_dn)
+        user_sid = self.get_object_sid(self.get_user_dn("acluser2"))
+        mod = "(OA;CI;CC;bf967aba-0de6-11d0-a285-00aa003049e2;;%s)" % str(user_sid)
+        self.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
+        self.create_ou(ldb_owner, "OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
+        # Test user and group creation with granted user only to one of the objects
+        self.create_user(ldb_guser, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
+        try:
+            self.create_group(ldb_guser, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
+        except LdbError, (num, _):
+            self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
+        else:
+            self.fail()
+        # Make sure we HAVE created the one of two objects -- user
+        res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s,%s)" \
+                % ("CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn) )
+        self.assertNotEqual( len(res), 0 )
+        res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s,%s)" \
+                % ("CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn) )
+        self.assertEqual( res, [])
+
+    def test_add_domainadmin_owner(self):
+        """ 4 Testing OU with the rights of Doman Admin creator of the OU"""
+        # Creating acluser1
+        if self.SAMBA:
+            self.delete_force(self.ldb_admin, self.get_user_dn("acluser1"))
+            self.create_user(self.ldb_admin, self.get_user_dn("acluser1"))
+            self.enable_account(self.get_user_dn("acluser1"))
+        # Test if we have any additional groups for user than default
+        if self.WIN:
+            res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s)" \
+                    % self.get_user_dn("acluser1") )
+            try:
+                self.assertEqual( res[0]["memberOf"][0], "" )
+            except KeyError:
+                pass
+            else:
+                self.fail()
+        # Modify acluser1 to be 'Doamin Admin' group member
+        self.add_group_member(self.ldb_admin, "CN=Domain Admins,CN=Users," + self.base_dn, \
+                self.get_user_dn("acluser1"))
+        # Create LDAP connection with OUs crator domain admin credentials
+        ldb_owner = self.get_ldb_connection("acluser1", "samba123@")
+        # Make sure top OU is deleted (and so everything under it)
+        res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s,%s)" \
+                % ("OU=test_add_ou1", self.base_dn) )
+        self.assertEqual( res, [] )
+        self.create_ou(ldb_owner, "OU=test_add_ou1," + self.base_dn)
+        self.create_ou(ldb_owner, "OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
+        self.create_user(ldb_owner, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
+        self.create_group(ldb_owner, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
+        # Make sure we have successfully created the two objects -- user and group
+        res = self.ldb_admin.search( self.base_dn, expression="(distinguishedName=%s,%s)" \
+                % ("CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn) )


-- 
Samba Shared Repository


More information about the samba-cvs mailing list