[SCM] Samba Shared Repository - branch master updated
Stefan Metzmacher
metze at samba.org
Wed Jun 30 04:13:28 MDT 2010
The branch, master has been updated
via 14f8953... s4:dsdb: move dsdb python tests from lib/ldb/ to dsdb/
via 19d93c6... s4:ldb/python: make it possible to run tests standalone
from 45fc728... libcli: Fixed a build warning for a missing prototype.
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 14f8953aa4f000173a051b8010252063db5295c1
Author: Stefan Metzmacher <metze at samba.org>
Date: Wed Jun 30 11:09:10 2010 +0200
s4:dsdb: move dsdb python tests from lib/ldb/ to dsdb/
metze
commit 19d93c6a1e810dbd634f35cf440412c1ff958448
Author: Stefan Metzmacher <metze at samba.org>
Date: Wed Jun 30 10:57:37 2010 +0200
s4:ldb/python: make it possible to run tests standalone
metze
-----------------------------------------------------------------------
Summary of changes:
source4/dsdb/tests/python/acl.py | 1042 ++++++++
source4/dsdb/tests/python/deletetest.py | 201 ++
source4/dsdb/tests/python/dsdb_schema_info.py | 213 ++
source4/dsdb/tests/python/ldap.py | 2688 ++++++++++++++++++++
source4/dsdb/tests/python/ldap_schema.py | 556 ++++
source4/dsdb/tests/python/passwords.py | 615 +++++
source4/dsdb/tests/python/sec_descriptor.py | 1979 ++++++++++++++
source4/dsdb/tests/python/urgent_replication.py | 386 +++
source4/lib/ldb/tests/python/acl.py | 1039 --------
source4/lib/ldb/tests/python/deletetest.py | 201 --
source4/lib/ldb/tests/python/dsdb_schema_info.py | 210 --
source4/lib/ldb/tests/python/ldap.py | 2685 -------------------
source4/lib/ldb/tests/python/ldap_schema.py | 553 ----
source4/lib/ldb/tests/python/passwords.py | 612 -----
source4/lib/ldb/tests/python/sec_descriptor.py | 1976 --------------
source4/lib/ldb/tests/python/urgent_replication.py | 385 ---
source4/selftest/tests.sh | 16 +-
17 files changed, 7688 insertions(+), 7669 deletions(-)
create mode 100755 source4/dsdb/tests/python/acl.py
create mode 100755 source4/dsdb/tests/python/deletetest.py
create mode 100755 source4/dsdb/tests/python/dsdb_schema_info.py
create mode 100755 source4/dsdb/tests/python/ldap.py
create mode 100755 source4/dsdb/tests/python/ldap_schema.py
create mode 100755 source4/dsdb/tests/python/passwords.py
create mode 100755 source4/dsdb/tests/python/sec_descriptor.py
create mode 100755 source4/dsdb/tests/python/urgent_replication.py
delete mode 100755 source4/lib/ldb/tests/python/acl.py
delete mode 100755 source4/lib/ldb/tests/python/deletetest.py
delete mode 100755 source4/lib/ldb/tests/python/dsdb_schema_info.py
delete mode 100755 source4/lib/ldb/tests/python/ldap.py
delete mode 100755 source4/lib/ldb/tests/python/ldap_schema.py
delete mode 100755 source4/lib/ldb/tests/python/passwords.py
delete mode 100755 source4/lib/ldb/tests/python/sec_descriptor.py
delete mode 100755 source4/lib/ldb/tests/python/urgent_replication.py
Changeset truncated at 500 lines:
diff --git a/source4/dsdb/tests/python/acl.py b/source4/dsdb/tests/python/acl.py
new file mode 100755
index 0000000..5bf3ff9
--- /dev/null
+++ b/source4/dsdb/tests/python/acl.py
@@ -0,0 +1,1042 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+# This is unit with tests for LDAP access checks
+
+import optparse
+import sys
+import base64
+import re
+
+sys.path.append("bin/python")
+import samba
+samba.ensure_external_module("subunit", "subunit/python")
+samba.ensure_external_module("testtools", "testtools")
+
+import samba.getopt as options
+
+from ldb import (
+ SCOPE_BASE, LdbError, ERR_NO_SUCH_OBJECT, ERR_INSUFFICIENT_ACCESS_RIGHTS)
+
+from samba.ndr import ndr_pack, ndr_unpack
+from samba.dcerpc import security
+
+from samba.auth import system_session
+from samba import gensec
+from samba.samdb import SamDB
+from samba.credentials import Credentials
+import samba.tests
+from subunit.run import SubunitTestRunner
+import unittest
+
+parser = optparse.OptionParser("ldap [options] <host>")
+sambaopts = options.SambaOptions(parser)
+parser.add_option_group(sambaopts)
+parser.add_option_group(options.VersionOptions(parser))
+
+# use command line creds if available
+credopts = options.CredentialsOptions(parser)
+parser.add_option_group(credopts)
+opts, args = parser.parse_args()
+
+if len(args) < 1:
+ parser.print_usage()
+ sys.exit(1)
+
+host = args[0]
+
+lp = sambaopts.get_loadparm()
+creds = credopts.get_credentials(lp)
+creds.set_gensec_features(creds.get_gensec_features() | gensec.FEATURE_SEAL)
+
+#
+# Tests start here
+#
+
+class AclTests(samba.tests.TestCase):
+
+ def delete_force(self, ldb, dn):
+ try:
+ ldb.delete(dn)
+ except LdbError, (num, _):
+ self.assertEquals(num, ERR_NO_SUCH_OBJECT)
+
+ def find_basedn(self, ldb):
+ res = ldb.search(base="", expression="", scope=SCOPE_BASE,
+ attrs=["defaultNamingContext"])
+ self.assertEquals(len(res), 1)
+ return res[0]["defaultNamingContext"][0]
+
+ def find_domain_sid(self, ldb):
+ res = ldb.search(base=self.base_dn, expression="(objectClass=*)", scope=SCOPE_BASE)
+ return ndr_unpack(security.dom_sid,res[0]["objectSid"][0])
+
+ def setUp(self):
+ super(AclTests, self).setUp()
+ self.ldb_admin = ldb
+ self.base_dn = self.find_basedn(self.ldb_admin)
+ self.domain_sid = self.find_domain_sid(self.ldb_admin)
+ self.user_pass = "samba123@"
+ print "baseDN: %s" % self.base_dn
+
+ def get_user_dn(self, name):
+ return "CN=%s,CN=Users,%s" % (name, self.base_dn)
+
+ def modify_desc(self, object_dn, desc):
+ """ Modify security descriptor using either SDDL string
+ or security.descriptor object
+ """
+ assert(isinstance(desc, str) or isinstance(desc, security.descriptor))
+ mod = """
+dn: """ + object_dn + """
+changetype: modify
+replace: nTSecurityDescriptor
+"""
+ if isinstance(desc, str):
+ mod += "nTSecurityDescriptor: %s" % desc
+ elif isinstance(desc, security.descriptor):
+ mod += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
+ self.ldb_admin.modify_ldif(mod)
+
+ def add_group_member(self, _ldb, group_dn, member_dn):
+ """ Modify user to ge member of a group
+ e.g. User to be 'Doamin Admin' group member
+ """
+ ldif = """
+dn: """ + group_dn + """
+changetype: modify
+add: member
+member: """ + member_dn
+ _ldb.modify_ldif(ldif)
+
+ def create_ou(self, _ldb, ou_dn, desc=None):
+ ldif = """
+dn: """ + ou_dn + """
+ou: """ + ou_dn.split(",")[0][3:] + """
+objectClass: organizationalUnit
+url: www.example.com
+"""
+ if desc:
+ assert(isinstance(desc, str) or isinstance(desc, security.descriptor))
+ if isinstance(desc, str):
+ ldif += "nTSecurityDescriptor: %s" % desc
+ elif isinstance(desc, security.descriptor):
+ ldif += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
+ _ldb.add_ldif(ldif)
+
+ def create_active_user(self, _ldb, user_dn):
+ ldif = """
+dn: """ + user_dn + """
+sAMAccountName: """ + user_dn.split(",")[0][3:] + """
+objectClass: user
+unicodePwd:: """ + base64.b64encode("\"samba123@\"".encode('utf-16-le')) + """
+url: www.example.com
+"""
+ _ldb.add_ldif(ldif)
+
+ def create_test_user(self, _ldb, user_dn, desc=None):
+ ldif = """
+dn: """ + user_dn + """
+sAMAccountName: """ + user_dn.split(",")[0][3:] + """
+objectClass: user
+userPassword: """ + self.user_pass + """
+url: www.example.com
+"""
+ if desc:
+ assert(isinstance(desc, str) or isinstance(desc, security.descriptor))
+ if isinstance(desc, str):
+ ldif += "nTSecurityDescriptor: %s" % desc
+ elif isinstance(desc, security.descriptor):
+ ldif += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
+ _ldb.add_ldif(ldif)
+
+ def create_group(self, _ldb, group_dn, desc=None):
+ ldif = """
+dn: """ + group_dn + """
+objectClass: group
+sAMAccountName: """ + group_dn.split(",")[0][3:] + """
+groupType: 2147483650
+url: www.example.com
+"""
+ if desc:
+ assert(isinstance(desc, str) or isinstance(desc, security.descriptor))
+ if isinstance(desc, str):
+ ldif += "nTSecurityDescriptor: %s" % desc
+ elif isinstance(desc, security.descriptor):
+ ldif += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
+ _ldb.add_ldif(ldif)
+
+ def read_desc(self, object_dn):
+ res = self.ldb_admin.search(object_dn, SCOPE_BASE, None, ["nTSecurityDescriptor"])
+ desc = res[0]["nTSecurityDescriptor"][0]
+ return ndr_unpack(security.descriptor, desc)
+
+ def get_ldb_connection(self, target_username, target_password):
+ creds_tmp = Credentials()
+ creds_tmp.set_username(target_username)
+ creds_tmp.set_password(target_password)
+ creds_tmp.set_domain(creds.get_domain())
+ creds_tmp.set_realm(creds.get_realm())
+ creds_tmp.set_workstation(creds.get_workstation())
+ creds_tmp.set_gensec_features(creds_tmp.get_gensec_features()
+ | gensec.FEATURE_SEAL)
+ ldb_target = SamDB(url=host, credentials=creds_tmp, lp=lp)
+ return ldb_target
+
+ def get_object_sid(self, object_dn):
+ res = self.ldb_admin.search(object_dn)
+ return ndr_unpack(security.dom_sid, res[0]["objectSid"][0])
+
+ def dacl_add_ace(self, object_dn, ace):
+ desc = self.read_desc(object_dn)
+ desc_sddl = desc.as_sddl(self.domain_sid)
+ if ace in desc_sddl:
+ return
+ if desc_sddl.find("(") >= 0:
+ desc_sddl = desc_sddl[:desc_sddl.index("(")] + ace + desc_sddl[desc_sddl.index("("):]
+ else:
+ desc_sddl = desc_sddl + ace
+ self.modify_desc(object_dn, desc_sddl)
+
+ def get_desc_sddl(self, object_dn):
+ """ Return object nTSecutiryDescriptor in SDDL format
+ """
+ desc = self.read_desc(object_dn)
+ return desc.as_sddl(self.domain_sid)
+
+ # Test if we have any additional groups for users than default ones
+ def assert_user_no_group_member(self, username):
+ res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s)" % self.get_user_dn(username))
+ try:
+ self.assertEqual(res[0]["memberOf"][0], "")
+ except KeyError:
+ pass
+ else:
+ self.fail()
+
+ def create_enable_user(self, username):
+ self.create_active_user(self.ldb_admin, self.get_user_dn(username))
+ self.ldb_admin.enable_account("(sAMAccountName=" + username + ")")
+
+#tests on ldap add operations
+class AclAddTests(AclTests):
+
+ def setUp(self):
+ super(AclAddTests, self).setUp()
+ # Domain admin that will be creator of OU parent-child structure
+ self.usr_admin_owner = "acl_add_user1"
+ # Second domain admin that will not be creator of OU parent-child structure
+ self.usr_admin_not_owner = "acl_add_user2"
+ # Regular user
+ self.regular_user = "acl_add_user3"
+ self.create_enable_user(self.usr_admin_owner)
+ self.create_enable_user(self.usr_admin_not_owner)
+ self.create_enable_user(self.regular_user)
+
+ # add admins to the Domain Admins group
+ self.add_group_member(self.ldb_admin, "CN=Domain Admins,CN=Users," + self.base_dn, \
+ self.get_user_dn(self.usr_admin_owner))
+ self.add_group_member(self.ldb_admin, "CN=Domain Admins,CN=Users," + self.base_dn, \
+ self.get_user_dn(self.usr_admin_not_owner))
+
+ self.ldb_owner = self.get_ldb_connection(self.usr_admin_owner, self.user_pass)
+ self.ldb_notowner = self.get_ldb_connection(self.usr_admin_not_owner, self.user_pass)
+ self.ldb_user = self.get_ldb_connection(self.regular_user, self.user_pass)
+
+ def tearDown(self):
+ super(AclAddTests, self).tearDown()
+ self.delete_force(self.ldb_admin, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
+ self.delete_force(self.ldb_admin, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
+ self.delete_force(self.ldb_admin, "OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
+ self.delete_force(self.ldb_admin, "OU=test_add_ou1," + self.base_dn)
+ self.delete_force(self.ldb_admin, self.get_user_dn(self.usr_admin_owner))
+ self.delete_force(self.ldb_admin, self.get_user_dn(self.usr_admin_not_owner))
+ self.delete_force(self.ldb_admin, self.get_user_dn(self.regular_user))
+
+ # Make sure top OU is deleted (and so everything under it)
+ def assert_top_ou_deleted(self):
+ res = self.ldb_admin.search(self.base_dn,
+ expression="(distinguishedName=%s,%s)" % (
+ "OU=test_add_ou1", self.base_dn))
+ self.assertEqual(res, [])
+
+ def test_add_u1(self):
+ """Testing OU with the rights of Doman Admin not creator of the OU """
+ self.assert_top_ou_deleted()
+ # Change descriptor for top level OU
+ self.create_ou(self.ldb_owner, "OU=test_add_ou1," + self.base_dn)
+ self.create_ou(self.ldb_owner, "OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
+ user_sid = self.get_object_sid(self.get_user_dn(self.usr_admin_not_owner))
+ mod = "(D;CI;WPCC;;;%s)" % str(user_sid)
+ self.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
+ # Test user and group creation with another domain admin's credentials
+ self.create_test_user(self.ldb_notowner, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
+ self.create_group(self.ldb_notowner, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
+ # Make sure we HAVE created the two objects -- user and group
+ # !!! We should not be able to do that, but however beacuse of ACE ordering our inherited Deny ACE
+ # !!! comes after explicit (A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;DA) that comes from somewhere
+ res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s,%s)" % ("CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn))
+ self.assertTrue(len(res) > 0)
+ res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s,%s)" % ("CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn))
+ self.assertTrue(len(res) > 0)
+
+ def test_add_u2(self):
+ """Testing OU with the regular user that has no rights granted over the OU """
+ self.assert_top_ou_deleted()
+ # Create a parent-child OU structure with domain admin credentials
+ self.create_ou(self.ldb_owner, "OU=test_add_ou1," + self.base_dn)
+ self.create_ou(self.ldb_owner, "OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
+ # Test user and group creation with regular user credentials
+ try:
+ self.create_test_user(self.ldb_user, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
+ self.create_group(self.ldb_user, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
+ except LdbError, (num, _):
+ self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
+ else:
+ self.fail()
+ # Make sure we HAVEN'T created any of two objects -- user or group
+ res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s,%s)" % ("CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn))
+ self.assertEqual(res, [])
+ res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s,%s)" % ("CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn))
+ self.assertEqual(res, [])
+
+ def test_add_u3(self):
+ """Testing OU with the rights of regular user granted the right 'Create User child objects' """
+ self.assert_top_ou_deleted()
+ # Change descriptor for top level OU
+ self.create_ou(self.ldb_owner, "OU=test_add_ou1," + self.base_dn)
+ user_sid = self.get_object_sid(self.get_user_dn(self.regular_user))
+ mod = "(OA;CI;CC;bf967aba-0de6-11d0-a285-00aa003049e2;;%s)" % str(user_sid)
+ self.dacl_add_ace("OU=test_add_ou1," + self.base_dn, mod)
+ self.create_ou(self.ldb_owner, "OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
+ # Test user and group creation with granted user only to one of the objects
+ self.create_test_user(self.ldb_user, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
+ try:
+ self.create_group(self.ldb_user, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
+ except LdbError, (num, _):
+ self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
+ else:
+ self.fail()
+ # Make sure we HAVE created the one of two objects -- user
+ res = self.ldb_admin.search(self.base_dn,
+ expression="(distinguishedName=%s,%s)" %
+ ("CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1",
+ self.base_dn))
+ self.assertNotEqual(len(res), 0)
+ res = self.ldb_admin.search(self.base_dn,
+ expression="(distinguishedName=%s,%s)" %
+ ("CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1",
+ self.base_dn) )
+ self.assertEqual(res, [])
+
+ def test_add_u4(self):
+ """ 4 Testing OU with the rights of Doman Admin creator of the OU"""
+ self.assert_top_ou_deleted()
+ self.create_ou(self.ldb_owner, "OU=test_add_ou1," + self.base_dn)
+ self.create_ou(self.ldb_owner, "OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
+ self.create_test_user(self.ldb_owner, "CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
+ self.create_group(self.ldb_owner, "CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1," + self.base_dn)
+ # Make sure we have successfully created the two objects -- user and group
+ res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s,%s)" % ("CN=test_add_user1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn))
+ self.assertTrue(len(res) > 0)
+ res = self.ldb_admin.search(self.base_dn,
+ expression="(distinguishedName=%s,%s)" % ("CN=test_add_group1,OU=test_add_ou2,OU=test_add_ou1", self.base_dn))
+ self.assertTrue(len(res) > 0)
+
+#tests on ldap modify operations
+class AclModifyTests(AclTests):
+
+ def setUp(self):
+ super(AclModifyTests, self).setUp()
+ self.user_with_wp = "acl_mod_user1"
+ self.user_with_sm = "acl_mod_user2"
+ self.user_with_group_sm = "acl_mod_user3"
+ self.create_enable_user(self.user_with_wp)
+ self.create_enable_user(self.user_with_sm)
+ self.create_enable_user(self.user_with_group_sm)
+ self.ldb_user = self.get_ldb_connection(self.user_with_wp, self.user_pass)
+ self.ldb_user2 = self.get_ldb_connection(self.user_with_sm, self.user_pass)
+ self.ldb_user3 = self.get_ldb_connection(self.user_with_group_sm, self.user_pass)
+ self.user_sid = self.get_object_sid( self.get_user_dn(self.user_with_wp))
+ self.create_group(self.ldb_admin, "CN=test_modify_group2,CN=Users," + self.base_dn)
+ self.create_group(self.ldb_admin, "CN=test_modify_group3,CN=Users," + self.base_dn)
+ self.create_test_user(self.ldb_admin, self.get_user_dn("test_modify_user2"))
+
+ def tearDown(self):
+ super(AclModifyTests, self).tearDown()
+ self.delete_force(self.ldb_admin, self.get_user_dn("test_modify_user1"))
+ self.delete_force(self.ldb_admin, "CN=test_modify_group1,CN=Users," + self.base_dn)
+ self.delete_force(self.ldb_admin, "CN=test_modify_group2,CN=Users," + self.base_dn)
+ self.delete_force(self.ldb_admin, "CN=test_modify_group3,CN=Users," + self.base_dn)
+ self.delete_force(self.ldb_admin, "OU=test_modify_ou1," + self.base_dn)
+ self.delete_force(self.ldb_admin, self.get_user_dn(self.user_with_wp))
+ self.delete_force(self.ldb_admin, self.get_user_dn(self.user_with_sm))
+ self.delete_force(self.ldb_admin, self.get_user_dn(self.user_with_group_sm))
+ self.delete_force(self.ldb_admin, self.get_user_dn("test_modify_user2"))
+
+ def test_modify_u1(self):
+ """5 Modify one attribute if you have DS_WRITE_PROPERTY for it"""
+ mod = "(OA;;WP;bf967953-0de6-11d0-a285-00aa003049e2;;%s)" % str(self.user_sid)
+ # First test object -- User
+ print "Testing modify on User object"
+ self.create_test_user(self.ldb_admin, self.get_user_dn("test_modify_user1"))
+ self.dacl_add_ace(self.get_user_dn("test_modify_user1"), mod)
+ ldif = """
+dn: """ + self.get_user_dn("test_modify_user1") + """
+changetype: modify
+replace: displayName
+displayName: test_changed"""
+ self.ldb_user.modify_ldif(ldif)
+ res = self.ldb_admin.search(self.base_dn,
+ expression="(distinguishedName=%s)" % self.get_user_dn("test_modify_user1"))
+ self.assertEqual(res[0]["displayName"][0], "test_changed")
+ # Second test object -- Group
+ print "Testing modify on Group object"
+ self.create_group(self.ldb_admin, "CN=test_modify_group1,CN=Users," + self.base_dn)
+ self.dacl_add_ace("CN=test_modify_group1,CN=Users," + self.base_dn, mod)
+ ldif = """
+dn: CN=test_modify_group1,CN=Users,""" + self.base_dn + """
+changetype: modify
+replace: displayName
+displayName: test_changed"""
+ self.ldb_user.modify_ldif(ldif)
+ res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s)" % str("CN=test_modify_group1,CN=Users," + self.base_dn))
+ self.assertEqual(res[0]["displayName"][0], "test_changed")
+ # Third test object -- Organizational Unit
+ print "Testing modify on OU object"
+ #self.delete_force(self.ldb_admin, "OU=test_modify_ou1," + self.base_dn)
+ self.create_ou(self.ldb_admin, "OU=test_modify_ou1," + self.base_dn)
+ self.dacl_add_ace("OU=test_modify_ou1," + self.base_dn, mod)
+ ldif = """
+dn: OU=test_modify_ou1,""" + self.base_dn + """
+changetype: modify
+replace: displayName
+displayName: test_changed"""
+ self.ldb_user.modify_ldif(ldif)
+ res = self.ldb_admin.search(self.base_dn, expression="(distinguishedName=%s)" % str("OU=test_modify_ou1," + self.base_dn))
+ self.assertEqual(res[0]["displayName"][0], "test_changed")
+
+ def _test_modify_u2(self):
+ """6 Modify two attributes as you have DS_WRITE_PROPERTY granted only for one of them"""
+ mod = "(OA;;WP;bf967953-0de6-11d0-a285-00aa003049e2;;%s)" % str(self.user_sid)
+ # First test object -- User
+ print "Testing modify on User object"
+ #self.delete_force(self.ldb_admin, self.get_user_dn("test_modify_user1"))
+ self.create_test_user(self.ldb_admin, self.get_user_dn("test_modify_user1"))
+ self.dacl_add_ace(self.get_user_dn("test_modify_user1"), mod)
+ # Modify on attribute you have rights for
+ ldif = """
+dn: """ + self.get_user_dn("test_modify_user1") + """
+changetype: modify
+replace: displayName
+displayName: test_changed"""
+ self.ldb_user.modify_ldif(ldif)
+ res = self.ldb_admin.search(self.base_dn,
+ expression="(distinguishedName=%s)" %
+ self.get_user_dn("test_modify_user1"))
+ self.assertEqual(res[0]["displayName"][0], "test_changed")
+ # Modify on attribute you do not have rights for granted
+ ldif = """
+dn: """ + self.get_user_dn("test_modify_user1") + """
+changetype: modify
+replace: url
+url: www.samba.org"""
+ try:
+ self.ldb_user.modify_ldif(ldif)
+ except LdbError, (num, _):
+ self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
+ else:
+ # This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
+ self.fail()
+ # Second test object -- Group
+ print "Testing modify on Group object"
+ self.create_group(self.ldb_admin, "CN=test_modify_group1,CN=Users," + self.base_dn)
+ self.dacl_add_ace("CN=test_modify_group1,CN=Users," + self.base_dn, mod)
+ ldif = """
+dn: CN=test_modify_group1,CN=Users,""" + self.base_dn + """
+changetype: modify
+replace: displayName
+displayName: test_changed"""
+ self.ldb_user.modify_ldif(ldif)
+ res = self.ldb_admin.search(self.base_dn,
+ expression="(distinguishedName=%s)" %
+ str("CN=test_modify_group1,CN=Users," + self.base_dn))
+ self.assertEqual(res[0]["displayName"][0], "test_changed")
+ # Modify on attribute you do not have rights for granted
+ ldif = """
+dn: CN=test_modify_group1,CN=Users,""" + self.base_dn + """
+changetype: modify
+replace: url
+url: www.samba.org"""
+ try:
+ self.ldb_user.modify_ldif(ldif)
+ except LdbError, (num, _):
+ self.assertEquals(num, ERR_INSUFFICIENT_ACCESS_RIGHTS)
+ else:
+ # This 'modify' operation should always throw ERR_INSUFFICIENT_ACCESS_RIGHTS
+ self.fail()
+ # Second test object -- Organizational Unit
+ print "Testing modify on OU object"
+ self.create_ou(self.ldb_admin, "OU=test_modify_ou1," + self.base_dn)
+ self.dacl_add_ace("OU=test_modify_ou1," + self.base_dn, mod)
+ ldif = """
+dn: OU=test_modify_ou1,""" + self.base_dn + """
+changetype: modify
+replace: displayName
+displayName: test_changed"""
+ self.ldb_user.modify_ldif(ldif)
+ res = self.ldb_admin.search(self.base_dn,
+ expression="(distinguishedName=%s)" % str("OU=test_modify_ou1,"
+ + self.base_dn))
+ self.assertEqual(res[0]["displayName"][0], "test_changed")
+ # Modify on attribute you do not have rights for granted
+ ldif = """
+dn: OU=test_modify_ou1,""" + self.base_dn + """
+changetype: modify
--
Samba Shared Repository
More information about the samba-cvs
mailing list