From 970672905f7ca994f1d0f92e82f4c80484796181 Mon Sep 17 00:00:00 2001

From: Noriko Hosoi <nhosoi@redhat.com>

Date: Wed, 5 Aug 2015 14:40:12 -0700

Subject: [PATCH 38/39] Ticket #48228 - CI test: added test cases for ticket

 48228

Description: wrong password check if passwordInHistory is decreased.

(cherry picked from commit 6b138a2091bf7d78f3bc60a13f226a39296e0f4c)

(cherry picked from commit e62b4815f0682845992dc9a4375e1d7c5597bfba)

---

 dirsrvtests/tickets/ticket48228_test.py | 327 ++++++++++++++++++++++++++++++++

 1 file changed, 327 insertions(+)

 create mode 100644 dirsrvtests/tickets/ticket48228_test.py

diff --git a/dirsrvtests/tickets/ticket48228_test.py b/dirsrvtests/tickets/ticket48228_test.py

new file mode 100644

index 0000000..e0595bb

--- /dev/null

+++ b/dirsrvtests/tickets/ticket48228_test.py

@@ -0,0 +1,327 @@

+# --- BEGIN COPYRIGHT BLOCK ---

+# Copyright (C) 2015 Red Hat, Inc.

+# All rights reserved.

+#

+# License: GPL (version 3 or any later version).

+# See LICENSE for details. 

+# --- END COPYRIGHT BLOCK ---

+#

+import os

+import sys

+import time

+import ldap

+import logging

+import pytest

+from lib389 import DirSrv, Entry, tools, tasks

+from lib389.tools import DirSrvTools

+from lib389._constants import *

+from lib389.properties import *

+from lib389.tasks import *

+

+log = logging.getLogger(__name__)

+

+installation_prefix = None

+

+# Assuming DEFAULT_SUFFIX is "dc=example,dc=com", otherwise it does not work... :(

+SUBTREE_CONTAINER = 'cn=nsPwPolicyContainer,' + DEFAULT_SUFFIX

+SUBTREE_PWPDN = 'cn=nsPwPolicyEntry,' + DEFAULT_SUFFIX

+SUBTREE_PWP = 'cn=cn\3DnsPwPolicyEntry\2Cdc\3Dexample\2Cdc\3Dcom,' + SUBTREE_CONTAINER

+SUBTREE_COS_TMPLDN = 'cn=nsPwTemplateEntry,' + DEFAULT_SUFFIX

+SUBTREE_COS_TMPL = 'cn=cn\3DnsPwTemplateEntry\2Cdc\3Dexample\2Cdc\3Dcom,' + SUBTREE_CONTAINER

+SUBTREE_COS_DEF = 'cn=nsPwPolicy_CoS,' + DEFAULT_SUFFIX

+

+USER1_DN = 'uid=user1,' + DEFAULT_SUFFIX

+USER2_DN = 'uid=user2,' + DEFAULT_SUFFIX

+

+class TopologyStandalone(object):

+    def __init__(self, standalone):

+        standalone.open()

+        self.standalone = standalone

+

+

+@pytest.fixture(scope="module")

+def topology(request):

+    '''

+        This fixture is used to standalone topology for the 'module'.

+    '''

+    global installation_prefix

+

+    if installation_prefix:

+        args_instance[SER_DEPLOYED_DIR] = installation_prefix

+

+    standalone = DirSrv(verbose=False)

+

+    # Args for the standalone instance

+    args_instance[SER_HOST] = HOST_STANDALONE

+    args_instance[SER_PORT] = PORT_STANDALONE

+    args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE

+    args_standalone = args_instance.copy()

+    standalone.allocate(args_standalone)

+

+    # Get the status of the instance and restart it if it exists

+    instance_standalone = standalone.exists()

+

+    # Remove the instance

+    if instance_standalone:

+        standalone.delete()

+

+    # Create the instance

+    standalone.create()

+

+    # Used to retrieve configuration information (dbdir, confdir...)

+    standalone.open()

+

+    # clear the tmp directory

+    standalone.clearTmpDir(__file__)

+

+    # Here we have standalone instance up and running

+    return TopologyStandalone(standalone)

+

+def set_global_pwpolicy(topology, inhistory):

+    log.info("	+++++ Enable global password policy +++++\n")

+    topology.standalone.simple_bind_s(DN_DM, PASSWORD)

+    # Enable password policy

+    try:

+        topology.standalone.modify_s(DN_CONFIG, [(ldap.MOD_REPLACE, 'nsslapd-pwpolicy-local', 'on')])

+    except ldap.LDAPError, e:

+        log.error('Failed to set pwpolicy-local: error ' + e.message['desc'])

+        assert False

+

+    log.info("		Set global password history on\n")

+    try:

+        topology.standalone.modify_s(DN_CONFIG, [(ldap.MOD_REPLACE, 'passwordHistory', 'on')])

+    except ldap.LDAPError, e:

+        log.error('Failed to set passwordHistory: error ' + e.message['desc'])

+        assert False

+

+    log.info("		Set global passwords in history\n")

+    try:

+        count = "%d" % inhistory

+        topology.standalone.modify_s(DN_CONFIG, [(ldap.MOD_REPLACE, 'passwordInHistory', count)])

+    except ldap.LDAPError, e:

+        log.error('Failed to set passwordInHistory: error ' + e.message['desc'])

+        assert False

+

+def set_subtree_pwpolicy(topology):

+    log.info("	+++++ Enable subtree level password policy +++++\n")

+    topology.standalone.simple_bind_s(DN_DM, PASSWORD)

+    log.info("		Add the container")

+    try:

+        topology.standalone.add_s(Entry((SUBTREE_CONTAINER, {'objectclass': 'top nsContainer'.split(),

+                                                             'cn': 'nsPwPolicyContainer'})))

+    except ldap.LDAPError, e:

+        log.error('Failed to add subtree container: error ' + e.message['desc'])

+        assert False

+

+    log.info("		Add the password policy subentry {passwordHistory: on, passwordInHistory: 6}")

+    try:

+        topology.standalone.add_s(Entry((SUBTREE_PWP, {'objectclass': 'top ldapsubentry passwordpolicy'.split(),

+                                                       'cn': SUBTREE_PWPDN,

+                                                       'passwordMustChange': 'off',

+                                                       'passwordExp': 'off',

+                                                       'passwordHistory': 'on',

+                                                       'passwordInHistory': '6',

+                                                       'passwordMinAge': '0',

+                                                       'passwordChange': 'on',

+                                                       'passwordStorageScheme': 'clear'})))

+    except ldap.LDAPError, e:

+        log.error('Failed to add passwordpolicy: error ' + e.message['desc'])

+        assert False

+

+    log.info("		Add the COS template")

+    try:

+        topology.standalone.add_s(Entry((SUBTREE_COS_TMPL, {'objectclass': 'top ldapsubentry costemplate extensibleObject'.split(),

+                                                            'cn': SUBTREE_PWPDN,

+                                                            'cosPriority': '1',

+                                                            'cn': SUBTREE_COS_TMPLDN,

+                                                            'pwdpolicysubentry': SUBTREE_PWP})))

+    except ldap.LDAPError, e:

+        log.error('Failed to add COS template: error ' + e.message['desc'])

+        assert False

+

+    log.info("		Add the COS definition")

+    try:

+        topology.standalone.add_s(Entry((SUBTREE_COS_DEF, {'objectclass': 'top ldapsubentry cosSuperDefinition cosPointerDefinition'.split(),

+                                                           'cn': SUBTREE_PWPDN,

+                                                           'costemplatedn': SUBTREE_COS_TMPL,

+                                                           'cosAttribute': 'pwdpolicysubentry default operational-default'})))

+    except ldap.LDAPError, e:

+        log.error('Failed to add COS def: error ' + e.message['desc'])

+        assert False

+

+def check_passwd_inhistory(topology, user, cpw, passwd):

+    inhistory = 0

+    log.info("		Bind as {%s,%s}" % (user, cpw))

+    topology.standalone.simple_bind_s(user, cpw)

+    try:

+        topology.standalone.modify_s(user, [(ldap.MOD_REPLACE, 'userpassword', passwd)])

+    except ldap.LDAPError, e:

+        log.info('		The password ' + passwd + ' of user' + USER1_DN + ' in history: error ' + e.message['desc'])

+        inhistory = 1

+    return inhistory

+

+def update_passwd(topology, user, passwd, times):

+    cpw = passwd

+    loop = 0

+    while loop < times:

+        log.info("		Bind as {%s,%s}" % (user, cpw))

+        topology.standalone.simple_bind_s(user, cpw)

+        cpw = 'password%d' % loop

+        try:

+            topology.standalone.modify_s(user, [(ldap.MOD_REPLACE, 'userpassword', cpw)])

+        except ldap.LDAPError, e:

+            log.fatal('test_ticket48228: Failed to update the password ' + cpw + ' of user ' + user + ': error ' + e.message['desc'])

+            assert False

+        loop += 1

+

+    # checking the first password, which is supposed to be in history

+    inhistory = check_passwd_inhistory(topology, user, cpw, passwd)

+    assert inhistory == 1

+

+def test_ticket48228_test_global_policy(topology):

+    """

+    Check global password policy

+    """

+

+    log.info('	Set inhistory = 6')

+    set_global_pwpolicy(topology, 6)

+

+    log.info('	Bind as directory manager')

+    log.info("Bind as %s" % DN_DM)

+    topology.standalone.simple_bind_s(DN_DM, PASSWORD)

+

+    log.info('	Add an entry' + USER1_DN)

+    try:

+        topology.standalone.add_s(Entry((USER1_DN, {'objectclass': "top person organizationalPerson inetOrgPerson".split(),

+                                     'sn': '1',

+                                     'cn': 'user 1',

+                                     'uid': 'user1',

+                                     'givenname': 'user',

+                                     'mail': 'user1@example.com',

+                                     'userpassword': 'password'})))

+    except ldap.LDAPError, e:

+        log.fatal('test_ticket48228: Failed to add user' + USER1_DN + ': error ' + e.message['desc'])

+        assert False

+

+    log.info('	Update the password of ' + USER1_DN + ' 6 times')

+    update_passwd(topology, USER1_DN, 'password', 6)

+

+    log.info('	Set inhistory = 4')

+    set_global_pwpolicy(topology, 4)

+

+    log.info('	checking the first password, which is supposed NOT to be in history any more')

+    cpw = 'password%d' % 5

+    tpw = 'password'

+    inhistory = check_passwd_inhistory(topology, USER1_DN, cpw, tpw)

+    assert inhistory == 0

+

+    log.info('	checking the second password, which is supposed NOT to be in history any more')

+    cpw = tpw

+    tpw = 'password%d' % 0

+    inhistory = check_passwd_inhistory(topology, USER1_DN, cpw, tpw)

+    assert inhistory == 0

+

+    log.info('	checking the second password, which is supposed NOT to be in history any more')

+    cpw = tpw

+    tpw = 'password%d' % 1

+    inhistory = check_passwd_inhistory(topology, USER1_DN, cpw, tpw)

+    assert inhistory == 0

+

+    log.info('	checking the third password, which is supposed to be in history')

+    cpw = tpw

+    tpw = 'password%d' % 2

+    inhistory = check_passwd_inhistory(topology, USER1_DN, cpw, tpw)

+    assert inhistory == 1

+

+    log.info("Global policy was successfully verified.")

+

+def test_ticket48228_test_subtree_policy(topology):

+    """

+    Check subtree level password policy

+    """

+

+    log.info('	Set inhistory = 6')

+    set_subtree_pwpolicy(topology)

+

+    log.info('	Bind as directory manager')

+    log.info("Bind as %s" % DN_DM)

+    topology.standalone.simple_bind_s(DN_DM, PASSWORD)

+

+    log.info('	Add an entry' + USER2_DN)

+    try:

+        topology.standalone.add_s(Entry((USER2_DN, {'objectclass': "top person organizationalPerson inetOrgPerson".split(),

+                                     'sn': '2',

+                                     'cn': 'user 2',

+                                     'uid': 'user2',

+                                     'givenname': 'user',

+                                     'mail': 'user2@example.com',

+                                     'userpassword': 'password'})))

+    except ldap.LDAPError, e:

+        log.fatal('test_ticket48228: Failed to add user' + USER2_DN + ': error ' + e.message['desc'])

+        assert False

+

+    log.info('	Update the password of ' + USER2_DN + ' 6 times')

+    update_passwd(topology, USER2_DN, 'password', 6)

+

+    log.info('	Set inhistory = 4')

+    topology.standalone.simple_bind_s(DN_DM, PASSWORD)

+    try:

+        topology.standalone.modify_s(SUBTREE_PWP, [(ldap.MOD_REPLACE, 'passwordInHistory', '4')])

+    except ldap.LDAPError, e:

+        log.error('Failed to set pwpolicy-local: error ' + e.message['desc'])

+        assert False

+

+    log.info('	checking the first password, which is supposed NOT to be in history any more')

+    cpw = 'password%d' % 5

+    tpw = 'password'

+    inhistory = check_passwd_inhistory(topology, USER2_DN, cpw, tpw)

+    assert inhistory == 0

+

+    log.info('	checking the second password, which is supposed NOT to be in history any more')

+    cpw = tpw

+    tpw = 'password%d' % 0

+    inhistory = check_passwd_inhistory(topology, USER2_DN, cpw, tpw)

+    assert inhistory == 0

+

+    log.info('	checking the second password, which is supposed NOT to be in history any more')

+    cpw = tpw

+    tpw = 'password%d' % 1

+    inhistory = check_passwd_inhistory(topology, USER2_DN, cpw, tpw)

+    assert inhistory == 0

+

+    log.info('	checking the third password, which is supposed to be in history')

+    cpw = tpw

+    tpw = 'password%d' % 2

+    inhistory = check_passwd_inhistory(topology, USER2_DN, cpw, tpw)

+    assert inhistory == 1

+

+    log.info("Subtree level policy was successfully verified.")

+

+def test_ticket48228_final(topology):

+    topology.standalone.delete()

+    log.info('Testcase PASSED')

+

+def run_isolated():

+    '''

+        run_isolated is used to run these test cases independently of a test scheduler (xunit, py.test..)

+        To run isolated without py.test, you need to

+            - edit this file and comment '@pytest.fixture' line before 'topology' function.

+            - set the installation prefix

+            - run this program

+    '''

+    global installation_prefix

+    installation_prefix = None

+

+    topo = topology(True)

+    log.info('Testing Ticket 48228 - wrong password check if passwordInHistory is decreased')

+

+    test_ticket48228_test_global_policy(topo)

+

+    test_ticket48228_test_subtree_policy(topo)

+

+    test_ticket48228_final(topo)

+

+

+if __name__ == '__main__':

+    run_isolated()

+

-- 

1.9.3