Python and Samba and LDAP and ntSecurityDescriptor
Zahari Zahariev
zahari.zahariev at postpath.com
Mon Feb 23 04:42:22 MST 2009
This is the unittest file that can verity my point. It tests in case that ndr_unpack() works fine and in case it exits with an error:
***
#!/usr/bin/python
# -*- coding: utf-8 -*-
# This is unit with PPD tests
import getopt
import optparse
import sys
sys.path.append("bin/python")
sys.path.append("../lib/subunit/python")
import samba.getopt as options
# Some error messages that are being tested
from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError
from ldb import ERR_NO_SUCH_OBJECT, ERR_INVALID_DN_SYNTAX
# For running the test unit
from samba.ndr import ndr_pack, ndr_unpack
from samba.dcerpc import security
from samba.auth import system_session
from samba import Ldb
from subunit import SubunitTestRunner
import unittest
parser = optparse.OptionParser("ldap [options] <host>")
sambaopts = options.SambaOptions(parser)
parser.add_option_group(sambaopts)
parser.add_option_group(options.VersionOptions(parser))
# use command line creds if available
credopts = options.CredentialsOptions(parser)
parser.add_option_group(credopts)
opts, args = parser.parse_args()
if len(args) < 1:
parser.print_usage()
sys.exit(1)
host = args[0]
lp = sambaopts.get_loadparm()
creds = credopts.get_credentials(lp)
#
# Tests start here
#
class AclTests(unittest.TestCase):
def delete_force(self, ldb, dn):
try:
ldb.delete(dn)
except LdbError, (num, _):
self.assertEquals(num, ERR_NO_SUCH_OBJECT)
def find_basedn(self, ldb):
res = ldb.search(base="", expression="", scope=SCOPE_BASE,
attrs=["defaultNamingContext"])
self.assertEquals(len(res), 1)
return res[0]["defaultNamingContext"][0]
def setUp(self):
self.ldb = ldb
self.base_dn = self.find_basedn(self.ldb)
self.user1Name = "ACLUser1"
self.user1Dn = "CN=%s,CN=Users," % self.user1Name + self.base_dn
self.user2Name = "ACLUser2"
self.user2Dn = "CN=%s,CN=Users," % self.user2Name + self.base_dn
print "baseDN: %s\n" % self.base_dn
def test_acl_read(self):
"""Testing ACL read permissions"""
# Creating a regular user in group 'Users'
sddl = '''O:S-1-5-21-3057987782-846766930-1257911302-500G:S-1-5-21-3057987782-846766930-1257911302-513D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;S-1-5-21-3057987782-846766930-1257911302-512)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;AO)(A;;LCRPLORC;;;PS)(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;PS)(OA;;CR;ab721a54-1e2f-11d0-9819-00aa0040529b;;PS)(OA;;CR;ab721a56-1e2f-11d0-9819-00aa0040529b;;PS)(OA;;RPWP;77b5b886-944a-11d1-aebd-0000f80367c1;;PS)(OA;;RPWP;e45795b2-9455-11d1-aebd-0000f80367c1;;PS)(OA;;RPWP;e45795b3-9455-11d1-aebd-0000f80367c1;;PS)(OA;;RP;037088f8-0ae1-11d2-b422-00a0c968f939;;S-1-5-32-553)(OA;;RP;4c164200-20c0-11d0-a768-00aa006e0529;;S-1-5-32-553)(OA;;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;;S-1-5-32-553)(A;;RC;;;AU)(OA;;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;;AU)(OA;;RP;77b5b886-944a-11d1-aebd-0000f80367c1;;AU)(OA;;RP;e45795b3-9455-11d1-aebd-0000f80367c1;;AU)(OA;;RP;e48d0154-bcf8-11d1-8702-00c04fb96050;;AU)(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD)(OA;;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;;S-1-5-32-553)(OA;;RPWP;bf967a7f-0de6-11d0-a285-00aa003049e2;;S-1-5-21-3057987782-846766930-1257911302-517)(OA;;RP;46a9b11d-60ae-405a-b7e8-ff8a58d456d2;;S-1-5-32-560)(OA;;RPWP;6db69a1c-9422-11d1-aebd-0000f80367c1;;S-1-5-32-561)'''
x = security.descriptor.from_sddl( sddl, security.dom_sid('S-1-5-21') )
xPacked = ndr_pack(x)
#print '*** xPacked:', repr(xPacked)
xUnpacked = ndr_unpack( security.descriptor, xPacked )
#print '*** xUnpacked.as_sddl():', xUnpacked.as_sddl( security.dom_sid('S-1-5-21') )
# Creating User1
self.delete_force(self.ldb, self.user1Dn)
self.ldb.add({
"dn": self.user1Dn,
"objectclass": "user",
"sAMAccountName": self.user1Name,
"userPassword": 'acltest',
#"ntSecurityDescriptor" : ndr_pack(x),
})
# Creating User2
self.delete_force(self.ldb, self.user2Dn)
self.ldb.add({
"dn": self.user2Dn,
"objectclass": "user",
"sAMAccountName": self.user2Name,
"userPassword": 'acltest',
"ntSecurityDescriptor" : ndr_pack(x),
})
try:
# Reading and unpacking Samba4 generated descriptor
res = self.ldb.search( self.base_dn, expression="(cn=%s)" % self.user1Name )
xUnpacked = ndr_unpack( security.descriptor, res[0]["nTSecurityDescriptor"][0] )
self.assertTrue( len( xUnpacked.as_sddl( security.dom_sid('S-1-5-21') ) ) > 0 )
# Reading LDAP written descriptor (fails)
res = self.ldb.search( self.base_dn, expression="(cn=%s)" % self.user2Name )
xUnpacked = ndr_unpack( security.descriptor, res[0]["nTSecurityDescriptor"][0] )
self.assertTrue( len( xUnpacked.as_sddl( security.dom_sid('S-1-5-21') ) ) > 0 )
except LdbError:
self.fail()
self.delete_force(self.ldb, self.user1Dn)
self.delete_force(self.ldb, self.user2Dn)
#
# Important unit running information
#
if not "://" in host:
host = "ldap://%s" % host
ldb = Ldb(host, credentials=creds, session_info=system_session(), lp=lp)
runner = SubunitTestRunner()
rc = 0
if not runner.run(unittest.makeSuite(AclTests)).wasSuccessful():
rc = 1
sys.exit(rc)
***
It is located in source4/lib/ldb/tests/python/acl-test.py in my setup. The error I get is:
---
error: Testing ACL read permissions [
Traceback (most recent call last):
File "./selftest/../lib/ldb/tests/python/acl-test.py", line 112, in test_acl_read
xUnpacked = ndr_unpack( security.descriptor, res[0]["nTSecurityDescriptor"][0] )
File "bin/python/samba/ndr.py", line 27, in ndr_unpack
object.__ndr_unpack__(data)
RuntimeError: (11, 'Buffer Size Error')
]
UNEXPECTED(error): Testing ACL read permissions (samba4.acl-test.python (dc).Testing ACL read permissions)
CMD: /usr/bin/python ./selftest/../lib/ldb/tests/python/acl-test.py --configfile=$SMB_CONF_PATH $SERVER -U$USERNAME%$PASSWORD -W $DOMAIN
ERROR: Exit code was 1
A summary with detailed information can be found in:
./st/summary
FAILED (0 failures and 1 errors in 1 testsuites)
make: *** [test] Error 1
---
Hope did not miss anything valuble.
-Zahari
-----Original Message-----
From: Andrew Bartlett [mailto:abartlet at samba.org]
Sent: Sunday, February 22, 2009 2:03 PM
To: Zahari Zahariev
Cc: 'samba-technical at lists.samba.org'
Subject: Re: Python and Samba and LDAP and ntSecurityDescriptor
On Fri, 2009-02-20 at 16:25 +0200, Zahari Zahariev wrote:
> Hello Samba4 & Andrew,
>
> I have a problem with setting a custom ntSecurityDescriptor to a user
> I create within a unittest similar to those in
> source4/lib/ldb/tests/python/ldap.py.
I'm sorry, the crystal ball is a little foggy today:
Can you perhaps post the script you are using? Without it I'm really having trouble understanding what your problems are.
Andrew Bartlett
--
Andrew Bartlett http://samba.org/~abartlet/
Authentication Developer, Samba Team http://samba.org
Samba Developer, Red Hat Inc. http://redhat.com
More information about the samba-technical
mailing list