|
 |
3280a9 |
From 0f309fee0e2b337ee333d9ce80a6c64d6f7161ef Mon Sep 17 00:00:00 2001
|
|
|
3280a9 |
From: Viktor Ashirov <vashirov@redhat.com>
|
|
|
3280a9 |
Date: Thu, 12 Nov 2020 17:53:09 +0100
|
|
|
3280a9 |
Subject: [PATCH] Backport tests from master branch, fix failing tests (#4425)
|
|
|
3280a9 |
|
|
|
3280a9 |
Relates: #2820
|
|
|
3280a9 |
|
|
|
3280a9 |
Reviewed by: mreynolds (Thanks!)
|
|
|
3280a9 |
---
|
|
|
3280a9 |
dirsrvtests/tests/suites/acl/acivattr_test.py | 50 +--
|
|
|
3280a9 |
dirsrvtests/tests/suites/acl/acl_deny_test.py | 10 +-
|
|
|
3280a9 |
dirsrvtests/tests/suites/acl/acl_test.py | 26 +-
|
|
|
3280a9 |
.../acl/default_aci_allows_self_write.py | 4 +-
|
|
|
3280a9 |
dirsrvtests/tests/suites/acl/deladd_test.py | 54 ++--
|
|
|
3280a9 |
.../suites/acl/enhanced_aci_modrnd_test.py | 22 +-
|
|
|
3280a9 |
.../suites/acl/globalgroup_part2_test.py | 36 ++-
|
|
|
3280a9 |
.../tests/suites/acl/globalgroup_test.py | 16 +-
|
|
|
3280a9 |
.../tests/suites/acl/keywords_part2_test.py | 30 +-
|
|
|
3280a9 |
dirsrvtests/tests/suites/acl/keywords_test.py | 71 ++---
|
|
|
3280a9 |
dirsrvtests/tests/suites/acl/misc_test.py | 104 +++---
|
|
|
3280a9 |
dirsrvtests/tests/suites/acl/modrdn_test.py | 180 +++++------
|
|
|
3280a9 |
dirsrvtests/tests/suites/acl/roledn_test.py | 4 +-
|
|
|
3280a9 |
.../suites/acl/selfdn_permissions_test.py | 23 +-
|
|
|
3280a9 |
dirsrvtests/tests/suites/acl/syntax_test.py | 56 ++--
|
|
|
3280a9 |
dirsrvtests/tests/suites/acl/userattr_test.py | 6 +-
|
|
|
3280a9 |
.../tests/suites/acl/valueacl_part2_test.py | 107 ++++---
|
|
|
3280a9 |
dirsrvtests/tests/suites/acl/valueacl_test.py | 207 ++++++------
|
|
|
3280a9 |
dirsrvtests/tests/suites/basic/basic_test.py | 23 +-
|
|
|
3280a9 |
.../tests/suites/ds_logs/ds_logs_test.py | 301 ++++++++++++++----
|
|
|
3280a9 |
.../filter/rfc3673_all_oper_attrs_test.py | 23 +-
|
|
|
3280a9 |
.../suites/mapping_tree/acceptance_test.py | 65 ++++
|
|
|
3280a9 |
.../be_del_and_default_naming_attr_test.py | 17 +-
|
|
|
3280a9 |
.../password/pwdPolicy_attribute_test.py | 9 +-
|
|
|
3280a9 |
.../suites/replication/changelog_test.py | 6 +-
|
|
|
3280a9 |
.../replication/conflict_resolve_test.py | 4 +-
|
|
|
3280a9 |
.../tests/suites/replication/rfc2307compat.py | 174 ++++++++++
|
|
|
3280a9 |
dirsrvtests/tests/suites/roles/__init__.py | 3 +
|
|
|
3280a9 |
dirsrvtests/tests/suites/roles/basic_test.py | 83 ++---
|
|
|
3280a9 |
.../tests/suites/sasl/regression_test.py | 21 +-
|
|
|
3280a9 |
.../tests/suites/syncrepl_plugin/__init__.py | 163 ++++++++++
|
|
|
3280a9 |
.../suites/syncrepl_plugin/basic_test.py | 66 ++--
|
|
|
3280a9 |
.../tests/suites/vlv/regression_test.py | 2 +-
|
|
|
3280a9 |
33 files changed, 1319 insertions(+), 647 deletions(-)
|
|
|
3280a9 |
create mode 100644 dirsrvtests/tests/suites/mapping_tree/acceptance_test.py
|
|
|
3280a9 |
create mode 100644 dirsrvtests/tests/suites/replication/rfc2307compat.py
|
|
|
3280a9 |
create mode 100644 dirsrvtests/tests/suites/roles/__init__.py
|
|
|
3280a9 |
create mode 100644 dirsrvtests/tests/suites/syncrepl_plugin/__init__.py
|
|
|
3280a9 |
|
|
|
3280a9 |
diff --git a/dirsrvtests/tests/suites/acl/acivattr_test.py b/dirsrvtests/tests/suites/acl/acivattr_test.py
|
|
|
3280a9 |
index 35759f36e..d55eea023 100644
|
|
|
3280a9 |
--- a/dirsrvtests/tests/suites/acl/acivattr_test.py
|
|
|
3280a9 |
+++ b/dirsrvtests/tests/suites/acl/acivattr_test.py
|
|
|
3280a9 |
@@ -174,18 +174,19 @@ LDAPURL_ACI = '(targetattr="*")(version 3.0; acl "url"; allow (all) userdn="ldap
|
|
|
3280a9 |
'(ENG_USER, ENG_MANAGER, LDAPURL_ACI)',
|
|
|
3280a9 |
])
|
|
|
3280a9 |
def test_positive(topo, _add_user, aci_of_user, user, entry, aci):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- :id: ba6d5e9c-786b-11e8-860d-8c16451d917b
|
|
|
3280a9 |
- :parametrized: yes
|
|
|
3280a9 |
- :setup: server
|
|
|
3280a9 |
- :steps:
|
|
|
3280a9 |
- 1. Add test entry
|
|
|
3280a9 |
- 2. Add ACI
|
|
|
3280a9 |
- 3. ACI role should be followed
|
|
|
3280a9 |
- :expectedresults:
|
|
|
3280a9 |
- 1. Entry should be added
|
|
|
3280a9 |
- 2. Operation should succeed
|
|
|
3280a9 |
- 3. Operation should succeed
|
|
|
3280a9 |
+ """Positive testing of ACLs
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ :id: ba6d5e9c-786b-11e8-860d-8c16451d917b
|
|
|
3280a9 |
+ :parametrized: yes
|
|
|
3280a9 |
+ :setup: server
|
|
|
3280a9 |
+ :steps:
|
|
|
3280a9 |
+ 1. Add test entry
|
|
|
3280a9 |
+ 2. Add ACI
|
|
|
3280a9 |
+ 3. ACI role should be followed
|
|
|
3280a9 |
+ :expectedresults:
|
|
|
3280a9 |
+ 1. Entry should be added
|
|
|
3280a9 |
+ 2. Operation should succeed
|
|
|
3280a9 |
+ 3. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
# set aci
|
|
|
3280a9 |
Domain(topo.standalone, DNBASE).set("aci", aci)
|
|
|
3280a9 |
@@ -225,18 +226,19 @@ def test_positive(topo, _add_user, aci_of_user, user, entry, aci):
|
|
|
3280a9 |
|
|
|
3280a9 |
])
|
|
|
3280a9 |
def test_negative(topo, _add_user, aci_of_user, user, entry, aci):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- :id: c4c887c2-786b-11e8-a328-8c16451d917b
|
|
|
3280a9 |
- :parametrized: yes
|
|
|
3280a9 |
- :setup: server
|
|
|
3280a9 |
- :steps:
|
|
|
3280a9 |
- 1. Add test entry
|
|
|
3280a9 |
- 2. Add ACI
|
|
|
3280a9 |
- 3. ACI role should be followed
|
|
|
3280a9 |
- :expectedresults:
|
|
|
3280a9 |
- 1. Entry should be added
|
|
|
3280a9 |
- 2. Operation should succeed
|
|
|
3280a9 |
- 3. Operation should succeed
|
|
|
3280a9 |
+ """Negative testing of ACLs
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ :id: c4c887c2-786b-11e8-a328-8c16451d917b
|
|
|
3280a9 |
+ :parametrized: yes
|
|
|
3280a9 |
+ :setup: server
|
|
|
3280a9 |
+ :steps:
|
|
|
3280a9 |
+ 1. Add test entry
|
|
|
3280a9 |
+ 2. Add ACI
|
|
|
3280a9 |
+ 3. ACI role should be followed
|
|
|
3280a9 |
+ :expectedresults:
|
|
|
3280a9 |
+ 1. Entry should be added
|
|
|
3280a9 |
+ 2. Operation should succeed
|
|
|
3280a9 |
+ 3. Operation should not succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
# set aci
|
|
|
3280a9 |
Domain(topo.standalone, DNBASE).set("aci", aci)
|
|
|
3280a9 |
diff --git a/dirsrvtests/tests/suites/acl/acl_deny_test.py b/dirsrvtests/tests/suites/acl/acl_deny_test.py
|
|
|
3280a9 |
index 8ea6cd27b..96d08e9da 100644
|
|
|
3280a9 |
--- a/dirsrvtests/tests/suites/acl/acl_deny_test.py
|
|
|
3280a9 |
+++ b/dirsrvtests/tests/suites/acl/acl_deny_test.py
|
|
|
3280a9 |
@@ -1,3 +1,11 @@
|
|
|
3280a9 |
+# --- BEGIN COPYRIGHT BLOCK ---
|
|
|
3280a9 |
+# Copyright (C) 2020 Red Hat, Inc.
|
|
|
3280a9 |
+# All rights reserved.
|
|
|
3280a9 |
+#
|
|
|
3280a9 |
+# License: GPL (version 3 or any later version).
|
|
|
3280a9 |
+# See LICENSE for details.
|
|
|
3280a9 |
+# --- END COPYRIGHT BLOCK ---
|
|
|
3280a9 |
+#
|
|
|
3280a9 |
import logging
|
|
|
3280a9 |
import pytest
|
|
|
3280a9 |
import os
|
|
|
3280a9 |
@@ -5,7 +13,7 @@ import ldap
|
|
|
3280a9 |
import time
|
|
|
3280a9 |
from lib389._constants import *
|
|
|
3280a9 |
from lib389.topologies import topology_st as topo
|
|
|
3280a9 |
-from lib389.idm.user import UserAccount, UserAccounts, TEST_USER_PROPERTIES
|
|
|
3280a9 |
+from lib389.idm.user import UserAccount, TEST_USER_PROPERTIES
|
|
|
3280a9 |
from lib389.idm.domain import Domain
|
|
|
3280a9 |
|
|
|
3280a9 |
pytestmark = pytest.mark.tier1
|
|
|
3280a9 |
diff --git a/dirsrvtests/tests/suites/acl/acl_test.py b/dirsrvtests/tests/suites/acl/acl_test.py
|
|
|
3280a9 |
index 5ca86523c..4c3214650 100644
|
|
|
3280a9 |
--- a/dirsrvtests/tests/suites/acl/acl_test.py
|
|
|
3280a9 |
+++ b/dirsrvtests/tests/suites/acl/acl_test.py
|
|
|
3280a9 |
@@ -1,5 +1,5 @@
|
|
|
3280a9 |
# --- BEGIN COPYRIGHT BLOCK ---
|
|
|
3280a9 |
-# Copyright (C) 2016 Red Hat, Inc.
|
|
|
3280a9 |
+# Copyright (C) 2020 Red Hat, Inc.
|
|
|
3280a9 |
# All rights reserved.
|
|
|
3280a9 |
#
|
|
|
3280a9 |
# License: GPL (version 3 or any later version).
|
|
|
3280a9 |
@@ -14,9 +14,8 @@ from lib389.schema import Schema
|
|
|
3280a9 |
from lib389.idm.domain import Domain
|
|
|
3280a9 |
from lib389.idm.user import UserAccount, UserAccounts, TEST_USER_PROPERTIES
|
|
|
3280a9 |
from lib389.idm.organizationalrole import OrganizationalRole, OrganizationalRoles
|
|
|
3280a9 |
-
|
|
|
3280a9 |
from lib389.topologies import topology_m2
|
|
|
3280a9 |
-from lib389._constants import SUFFIX, DN_SCHEMA, DN_DM, DEFAULT_SUFFIX, PASSWORD
|
|
|
3280a9 |
+from lib389._constants import SUFFIX, DN_DM, DEFAULT_SUFFIX, PASSWORD
|
|
|
3280a9 |
|
|
|
3280a9 |
pytestmark = pytest.mark.tier1
|
|
|
3280a9 |
|
|
|
3280a9 |
@@ -243,6 +242,14 @@ def moddn_setup(topology_m2):
|
|
|
3280a9 |
'userpassword': BIND_PW})
|
|
|
3280a9 |
user.create(properties=user_props, basedn=SUFFIX)
|
|
|
3280a9 |
|
|
|
3280a9 |
+ # Add anonymous read aci
|
|
|
3280a9 |
+ ACI_TARGET = "(target = \"ldap:///%s\")(targetattr=\"*\")" % (SUFFIX)
|
|
|
3280a9 |
+ ACI_ALLOW = "(version 3.0; acl \"Anonymous Read access\"; allow (read,search,compare)"
|
|
|
3280a9 |
+ ACI_SUBJECT = " userdn = \"ldap:///anyone\";)"
|
|
|
3280a9 |
+ ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
|
|
|
3280a9 |
+ suffix = Domain(m1, SUFFIX)
|
|
|
3280a9 |
+ suffix.add('aci', ACI_BODY)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
# DIT for staging
|
|
|
3280a9 |
m1.log.info("Add {}".format(STAGING_DN))
|
|
|
3280a9 |
o_roles.create(properties={'cn': STAGING_CN, 'description': "staging DIT"})
|
|
|
3280a9 |
@@ -411,7 +418,8 @@ def test_moddn_staging_prod(topology_m2, moddn_setup,
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_moddn_staging_prod_9(topology_m2, moddn_setup):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
+ """Test with nsslapd-moddn-aci set to off so that MODDN requires an 'add' aci.
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: 222dd7e8-7ff1-40b8-ad26-6f8e42fbfcd9
|
|
|
3280a9 |
:setup: MMR with two masters,
|
|
|
3280a9 |
M1 - staging DIT
|
|
|
3280a9 |
@@ -1061,10 +1069,12 @@ def test_mode_legacy_ger_with_moddn(topology_m2, moddn_setup):
|
|
|
3280a9 |
@pytest.fixture(scope="module")
|
|
|
3280a9 |
def rdn_write_setup(topology_m2):
|
|
|
3280a9 |
topology_m2.ms["master1"].log.info("\n\n######## Add entry tuser ########\n")
|
|
|
3280a9 |
- topology_m2.ms["master1"].add_s(Entry((SRC_ENTRY_DN, {
|
|
|
3280a9 |
- 'objectclass': "top person".split(),
|
|
|
3280a9 |
- 'sn': SRC_ENTRY_CN,
|
|
|
3280a9 |
- 'cn': SRC_ENTRY_CN})))
|
|
|
3280a9 |
+ user = UserAccount(topology_m2.ms["master1"], SRC_ENTRY_DN)
|
|
|
3280a9 |
+ user_props = TEST_USER_PROPERTIES.copy()
|
|
|
3280a9 |
+ user_props.update({'sn': SRC_ENTRY_CN,
|
|
|
3280a9 |
+ 'cn': SRC_ENTRY_CN,
|
|
|
3280a9 |
+ 'userpassword': BIND_PW})
|
|
|
3280a9 |
+ user.create(properties=user_props, basedn=SUFFIX)
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_rdn_write_get_ger(topology_m2, rdn_write_setup):
|
|
|
3280a9 |
diff --git a/dirsrvtests/tests/suites/acl/default_aci_allows_self_write.py b/dirsrvtests/tests/suites/acl/default_aci_allows_self_write.py
|
|
|
3280a9 |
index 5700abfba..9c7226b42 100644
|
|
|
3280a9 |
--- a/dirsrvtests/tests/suites/acl/default_aci_allows_self_write.py
|
|
|
3280a9 |
+++ b/dirsrvtests/tests/suites/acl/default_aci_allows_self_write.py
|
|
|
3280a9 |
@@ -21,7 +21,7 @@ pytestmark = pytest.mark.tier1
|
|
|
3280a9 |
USER_PASSWORD = "some test password"
|
|
|
3280a9 |
NEW_USER_PASSWORD = "some new password"
|
|
|
3280a9 |
|
|
|
3280a9 |
-@pytest.mark.skipif(default_paths.perl_enabled or ds_is_older('1.4.2.0'), reason="Default aci's in older versions do not support this functionality")
|
|
|
3280a9 |
+@pytest.mark.skipif(ds_is_older('1.4.2.0'), reason="Default aci's in older versions do not support this functionality")
|
|
|
3280a9 |
def test_acl_default_allow_self_write_nsuser(topology):
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
Testing nsusers can self write and self read. This it a sanity test
|
|
|
3280a9 |
@@ -80,7 +80,7 @@ def test_acl_default_allow_self_write_nsuser(topology):
|
|
|
3280a9 |
self_ent.change_password(USER_PASSWORD, NEW_USER_PASSWORD)
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
-@pytest.mark.skipif(default_paths.perl_enabled or ds_is_older('1.4.2.0'), reason="Default aci's in older versions do not support this functionality")
|
|
|
3280a9 |
+@pytest.mark.skipif(ds_is_older('1.4.2.0'), reason="Default aci's in older versions do not support this functionality")
|
|
|
3280a9 |
def test_acl_default_allow_self_write_user(topology):
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
Testing users can self write and self read. This it a sanity test
|
|
|
3280a9 |
diff --git a/dirsrvtests/tests/suites/acl/deladd_test.py b/dirsrvtests/tests/suites/acl/deladd_test.py
|
|
|
3280a9 |
index 45a66be94..afdc772d1 100644
|
|
|
3280a9 |
--- a/dirsrvtests/tests/suites/acl/deladd_test.py
|
|
|
3280a9 |
+++ b/dirsrvtests/tests/suites/acl/deladd_test.py
|
|
|
3280a9 |
@@ -86,8 +86,8 @@ def _add_user(request, topo):
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_allow_delete_access_to_groupdn(topo, _add_user, _aci_of_user):
|
|
|
3280a9 |
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Test allow delete access to groupdn
|
|
|
3280a9 |
+ """Test allow delete access to groupdn
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: 7cf15992-68ad-11e8-85af-54e1ad30572c
|
|
|
3280a9 |
:setup: topo.standalone
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -124,8 +124,8 @@ def test_allow_delete_access_to_groupdn(topo, _add_user, _aci_of_user):
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_allow_add_access_to_anyone(topo, _add_user, _aci_of_user):
|
|
|
3280a9 |
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Test to allow add access to anyone
|
|
|
3280a9 |
+ """Test to allow add access to anyone
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: 5ca31cc4-68e0-11e8-8666-8c16451d917b
|
|
|
3280a9 |
:setup: topo.standalone
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -160,8 +160,8 @@ def test_allow_add_access_to_anyone(topo, _add_user, _aci_of_user):
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_allow_delete_access_to_anyone(topo, _add_user, _aci_of_user):
|
|
|
3280a9 |
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Test to allow delete access to anyone
|
|
|
3280a9 |
+ """Test to allow delete access to anyone
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: f5447c7e-68e1-11e8-84c4-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -191,8 +191,8 @@ def test_allow_delete_access_to_anyone(topo, _add_user, _aci_of_user):
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_allow_delete_access_not_to_userdn(topo, _add_user, _aci_of_user):
|
|
|
3280a9 |
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Test to Allow delete access to != userdn
|
|
|
3280a9 |
+ """Test to Allow delete access to != userdn
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: 00637f6e-68e3-11e8-92a3-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -224,8 +224,8 @@ def test_allow_delete_access_not_to_userdn(topo, _add_user, _aci_of_user):
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_allow_delete_access_not_to_group(topo, _add_user, _aci_of_user):
|
|
|
3280a9 |
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Test to Allow delete access to != groupdn
|
|
|
3280a9 |
+ """Test to Allow delete access to != groupdn
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: f58fc8b0-68e5-11e8-9313-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -263,8 +263,8 @@ def test_allow_delete_access_not_to_group(topo, _add_user, _aci_of_user):
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_allow_add_access_to_parent(topo, _add_user, _aci_of_user):
|
|
|
3280a9 |
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Test to Allow add privilege to parent
|
|
|
3280a9 |
+ """Test to Allow add privilege to parent
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: 9f099845-9dbc-412f-bdb9-19a5ea729694
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -299,8 +299,8 @@ def test_allow_add_access_to_parent(topo, _add_user, _aci_of_user):
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_allow_delete_access_to_parent(topo, _add_user, _aci_of_user):
|
|
|
3280a9 |
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Test to Allow delete access to parent
|
|
|
3280a9 |
+ """Test to Allow delete access to parent
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: 2dd7f624-68e7-11e8-8591-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -333,10 +333,10 @@ def test_allow_delete_access_to_parent(topo, _add_user, _aci_of_user):
|
|
|
3280a9 |
new_user.delete()
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
-def test_allow_delete_access_to_dynamic_group(topo, _add_user, _aci_of_user):
|
|
|
3280a9 |
+def test_allow_delete_access_to_dynamic_group(topo, _add_user, _aci_of_user, request):
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ """Test to Allow delete access to dynamic group
|
|
|
3280a9 |
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Test to Allow delete access to dynamic group
|
|
|
3280a9 |
:id: 14ffa452-68ed-11e8-a60d-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -361,8 +361,8 @@ def test_allow_delete_access_to_dynamic_group(topo, _add_user, _aci_of_user):
|
|
|
3280a9 |
|
|
|
3280a9 |
# Set ACI
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).\
|
|
|
3280a9 |
- add("aci", f'(target = ldap:///{DEFAULT_SUFFIX})(targetattr=*)'
|
|
|
3280a9 |
- f'(version 3.0; acl "$tet_thistest"; '
|
|
|
3280a9 |
+ add("aci", f'(target = ldap:///{DEFAULT_SUFFIX})(targetattr="*")'
|
|
|
3280a9 |
+ f'(version 3.0; acl "{request.node.name}"; '
|
|
|
3280a9 |
f'allow (delete) (groupdn = "ldap:///{group.dn}"); )')
|
|
|
3280a9 |
|
|
|
3280a9 |
# create connection with USER_WITH_ACI_DELADD
|
|
|
3280a9 |
@@ -372,10 +372,10 @@ def test_allow_delete_access_to_dynamic_group(topo, _add_user, _aci_of_user):
|
|
|
3280a9 |
UserAccount(conn, USER_DELADD).delete()
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
-def test_allow_delete_access_to_dynamic_group_uid(topo, _add_user, _aci_of_user):
|
|
|
3280a9 |
+def test_allow_delete_access_to_dynamic_group_uid(topo, _add_user, _aci_of_user, request):
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ """Test to Allow delete access to dynamic group
|
|
|
3280a9 |
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Test to Allow delete access to dynamic group
|
|
|
3280a9 |
:id: 010a4f20-752a-4173-b763-f520c7a85b82
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -401,7 +401,7 @@ def test_allow_delete_access_to_dynamic_group_uid(topo, _add_user, _aci_of_user)
|
|
|
3280a9 |
# Set ACI
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).\
|
|
|
3280a9 |
add("aci", f'(target = ldap:///{DEFAULT_SUFFIX})'
|
|
|
3280a9 |
- f'(targetattr=uid)(version 3.0; acl "$tet_thistest"; '
|
|
|
3280a9 |
+ f'(targetattr="uid")(version 3.0; acl "{request.node.name}"; '
|
|
|
3280a9 |
f'allow (delete) (groupdn = "ldap:///{group.dn}"); )')
|
|
|
3280a9 |
|
|
|
3280a9 |
# create connection with USER_WITH_ACI_DELADD
|
|
|
3280a9 |
@@ -411,10 +411,10 @@ def test_allow_delete_access_to_dynamic_group_uid(topo, _add_user, _aci_of_user)
|
|
|
3280a9 |
UserAccount(conn, USER_DELADD).delete()
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
-def test_allow_delete_access_not_to_dynamic_group(topo, _add_user, _aci_of_user):
|
|
|
3280a9 |
+def test_allow_delete_access_not_to_dynamic_group(topo, _add_user, _aci_of_user, request):
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ """Test to Allow delete access to != dynamic group
|
|
|
3280a9 |
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Test to Allow delete access to != dynamic group
|
|
|
3280a9 |
:id: 9ecb139d-bca8-428e-9044-fd89db5a3d14
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -439,7 +439,7 @@ def test_allow_delete_access_not_to_dynamic_group(topo, _add_user, _aci_of_user)
|
|
|
3280a9 |
# Set ACI
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).\
|
|
|
3280a9 |
add("aci", f'(target = ldap:///{DEFAULT_SUFFIX})'
|
|
|
3280a9 |
- f'(targetattr=*)(version 3.0; acl "$tet_thistest"; '
|
|
|
3280a9 |
+ f'(targetattr="*")(version 3.0; acl "{request.node.name}"; '
|
|
|
3280a9 |
f'allow (delete) (groupdn != "ldap:///{group.dn}"); )')
|
|
|
3280a9 |
|
|
|
3280a9 |
# create connection with USER_WITH_ACI_DELADD
|
|
|
3280a9 |
diff --git a/dirsrvtests/tests/suites/acl/enhanced_aci_modrnd_test.py b/dirsrvtests/tests/suites/acl/enhanced_aci_modrnd_test.py
|
|
|
3280a9 |
index ca9456935..0cecde4b8 100644
|
|
|
3280a9 |
--- a/dirsrvtests/tests/suites/acl/enhanced_aci_modrnd_test.py
|
|
|
3280a9 |
+++ b/dirsrvtests/tests/suites/acl/enhanced_aci_modrnd_test.py
|
|
|
3280a9 |
@@ -1,5 +1,5 @@
|
|
|
3280a9 |
# --- BEGIN COPYRIGHT BLOCK ---
|
|
|
3280a9 |
-# Copyright (C) 2016 Red Hat, Inc.
|
|
|
3280a9 |
+# Copyright (C) 2020 Red Hat, Inc.
|
|
|
3280a9 |
# All rights reserved.
|
|
|
3280a9 |
#
|
|
|
3280a9 |
# License: GPL (version 3 or any later version).
|
|
|
3280a9 |
@@ -31,15 +31,13 @@ def env_setup(topology_st):
|
|
|
3280a9 |
|
|
|
3280a9 |
log.info("Add a container: %s" % CONTAINER_1)
|
|
|
3280a9 |
topology_st.standalone.add_s(Entry((CONTAINER_1,
|
|
|
3280a9 |
- {'objectclass': 'top',
|
|
|
3280a9 |
- 'objectclass': 'organizationalunit',
|
|
|
3280a9 |
+ {'objectclass': ['top','organizationalunit'],
|
|
|
3280a9 |
'ou': CONTAINER_1_OU,
|
|
|
3280a9 |
})))
|
|
|
3280a9 |
|
|
|
3280a9 |
log.info("Add a container: %s" % CONTAINER_2)
|
|
|
3280a9 |
topology_st.standalone.add_s(Entry((CONTAINER_2,
|
|
|
3280a9 |
- {'objectclass': 'top',
|
|
|
3280a9 |
- 'objectclass': 'organizationalunit',
|
|
|
3280a9 |
+ {'objectclass': ['top', 'organizationalunit'],
|
|
|
3280a9 |
'ou': CONTAINER_2_OU,
|
|
|
3280a9 |
})))
|
|
|
3280a9 |
|
|
|
3280a9 |
@@ -75,13 +73,13 @@ def test_enhanced_aci_modrnd(topology_st, env_setup):
|
|
|
3280a9 |
:id: 492cf2a9-2efe-4e3b-955e-85eca61d66b9
|
|
|
3280a9 |
:setup: Standalone instance
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
- 1. Create two containers
|
|
|
3280a9 |
- 2. Create a user within "ou=test_ou_1,dc=example,dc=com"
|
|
|
3280a9 |
- 3. Add an aci with a rule "cn=test_user is allowed all" within these containers
|
|
|
3280a9 |
- 4. Run MODRDN operation on the "cn=test_user" and set "newsuperior" to
|
|
|
3280a9 |
- the "ou=test_ou_2,dc=example,dc=com"
|
|
|
3280a9 |
- 5. Check there is no user under container one (ou=test_ou_1,dc=example,dc=com)
|
|
|
3280a9 |
- 6. Check there is a user under container two (ou=test_ou_2,dc=example,dc=com)
|
|
|
3280a9 |
+ 1. Create two containers
|
|
|
3280a9 |
+ 2. Create a user within "ou=test_ou_1,dc=example,dc=com"
|
|
|
3280a9 |
+ 3. Add an aci with a rule "cn=test_user is allowed all" within these containers
|
|
|
3280a9 |
+ 4. Run MODRDN operation on the "cn=test_user" and set "newsuperior" to
|
|
|
3280a9 |
+ the "ou=test_ou_2,dc=example,dc=com"
|
|
|
3280a9 |
+ 5. Check there is no user under container one (ou=test_ou_1,dc=example,dc=com)
|
|
|
3280a9 |
+ 6. Check there is a user under container two (ou=test_ou_2,dc=example,dc=com)
|
|
|
3280a9 |
|
|
|
3280a9 |
:expectedresults:
|
|
|
3280a9 |
1. Two containers should be created
|
|
|
3280a9 |
diff --git a/dirsrvtests/tests/suites/acl/globalgroup_part2_test.py b/dirsrvtests/tests/suites/acl/globalgroup_part2_test.py
|
|
|
3280a9 |
index b10fb1b65..7474f61f0 100644
|
|
|
3280a9 |
--- a/dirsrvtests/tests/suites/acl/globalgroup_part2_test.py
|
|
|
3280a9 |
+++ b/dirsrvtests/tests/suites/acl/globalgroup_part2_test.py
|
|
|
3280a9 |
@@ -1,5 +1,5 @@
|
|
|
3280a9 |
# --- BEGIN COPYRIGHT BLOCK ---
|
|
|
3280a9 |
-# Copyright (C) 2019 Red Hat, Inc.
|
|
|
3280a9 |
+# Copyright (C) 2020 Red Hat, Inc.
|
|
|
3280a9 |
# All rights reserved.
|
|
|
3280a9 |
#
|
|
|
3280a9 |
# License: GPL (version 3 or any later version).
|
|
|
3280a9 |
@@ -70,6 +70,14 @@ def test_user(request, topo):
|
|
|
3280a9 |
'userPassword': PW_DM
|
|
|
3280a9 |
})
|
|
|
3280a9 |
|
|
|
3280a9 |
+ # Add anonymous access aci
|
|
|
3280a9 |
+ ACI_TARGET = "(targetattr=\"*\")(target = \"ldap:///%s\")" % (DEFAULT_SUFFIX)
|
|
|
3280a9 |
+ ACI_ALLOW = "(version 3.0; acl \"Anonymous Read access\"; allow (read,search,compare)"
|
|
|
3280a9 |
+ ACI_SUBJECT = "(userdn=\"ldap:///anyone\");)"
|
|
|
3280a9 |
+ ANON_ACI = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
|
|
|
3280a9 |
+ suffix = Domain(topo.standalone, DEFAULT_SUFFIX)
|
|
|
3280a9 |
+ suffix.add('aci', ANON_ACI)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
uas = UserAccounts(topo.standalone, DEFAULT_SUFFIX, 'uid=GROUPDNATTRSCRATCHENTRY_GLOBAL,ou=nestedgroup')
|
|
|
3280a9 |
for demo1 in ['c1', 'CHILD1_GLOBAL']:
|
|
|
3280a9 |
uas.create(properties={
|
|
|
3280a9 |
@@ -112,7 +120,7 @@ def test_undefined_in_group_eval_five(topo, test_user, aci_of_user):
|
|
|
3280a9 |
5. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
|
|
|
3280a9 |
- Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",'(targetattr=*)(version 3.0; aci "tester"; allow(all) groupdn != "ldap:///{}\ || ldap:///{}";)'.format(ALLGROUPS_GLOBAL, GROUPF_GLOBAL))
|
|
|
3280a9 |
+ Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",'(targetattr="*")(version 3.0; aci "tester"; allow(all) groupdn != "ldap:///{}\ || ldap:///{}";)'.format(ALLGROUPS_GLOBAL, GROUPF_GLOBAL))
|
|
|
3280a9 |
conn = UserAccount(topo.standalone, DEEPUSER2_GLOBAL).bind(PW_DM)
|
|
|
3280a9 |
# This aci should NOT allow access
|
|
|
3280a9 |
user = UserAccount(conn, DEEPGROUPSCRATCHENTRY_GLOBAL)
|
|
|
3280a9 |
@@ -140,7 +148,7 @@ def test_undefined_in_group_eval_six(topo, test_user, aci_of_user):
|
|
|
3280a9 |
4. Operation should succeed
|
|
|
3280a9 |
5. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
- Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",'(targetattr=*)(version 3.0; aci "tester"; allow(all) groupdn = "ldap:///{} || ldap:///{}" ;)'.format(GROUPH_GLOBAL, ALLGROUPS_GLOBAL))
|
|
|
3280a9 |
+ Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",'(targetattr="*")(version 3.0; aci "tester"; allow(all) groupdn = "ldap:///{} || ldap:///{}" ;)'.format(GROUPH_GLOBAL, ALLGROUPS_GLOBAL))
|
|
|
3280a9 |
conn = UserAccount(topo.standalone, DEEPUSER3_GLOBAL).bind(PW_DM)
|
|
|
3280a9 |
# test UNDEFINED in group
|
|
|
3280a9 |
user = UserAccount(conn, DEEPGROUPSCRATCHENTRY_GLOBAL)
|
|
|
3280a9 |
@@ -168,7 +176,7 @@ def test_undefined_in_group_eval_seven(topo, test_user, aci_of_user):
|
|
|
3280a9 |
4. Operation should succeed
|
|
|
3280a9 |
5. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
- Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",'(targetattr=*)(version 3.0; aci "tester"; allow(all) groupdn = "ldap:///{}\ || ldap:///{}";)'.format(ALLGROUPS_GLOBAL, GROUPH_GLOBAL))
|
|
|
3280a9 |
+ Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",'(targetattr="*")(version 3.0; aci "tester"; allow(all) groupdn = "ldap:///{}\ || ldap:///{}";)'.format(ALLGROUPS_GLOBAL, GROUPH_GLOBAL))
|
|
|
3280a9 |
conn = UserAccount(topo.standalone, DEEPUSER3_GLOBAL).bind(PW_DM)
|
|
|
3280a9 |
# test UNDEFINED in group
|
|
|
3280a9 |
user = UserAccount(conn, DEEPGROUPSCRATCHENTRY_GLOBAL)
|
|
|
3280a9 |
@@ -196,7 +204,7 @@ def test_undefined_in_group_eval_eight(topo, test_user, aci_of_user):
|
|
|
3280a9 |
4. Operation should succeed
|
|
|
3280a9 |
5. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
- Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",'(targetattr=*)(version 3.0; aci "tester"; allow(all) groupdn != "ldap:///{} || ldap:///{} || ldap:///{}" ;)'.format(GROUPH_GLOBAL, GROUPA_GLOBAL, ALLGROUPS_GLOBAL))
|
|
|
3280a9 |
+ Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",'(targetattr="*")(version 3.0; aci "tester"; allow(all) groupdn != "ldap:///{} || ldap:///{} || ldap:///{}" ;)'.format(GROUPH_GLOBAL, GROUPA_GLOBAL, ALLGROUPS_GLOBAL))
|
|
|
3280a9 |
conn = UserAccount(topo.standalone, DEEPUSER3_GLOBAL).bind(PW_DM)
|
|
|
3280a9 |
# test UNDEFINED in group
|
|
|
3280a9 |
user = UserAccount(conn, DEEPGROUPSCRATCHENTRY_GLOBAL)
|
|
|
3280a9 |
@@ -224,7 +232,7 @@ def test_undefined_in_group_eval_nine(topo, test_user, aci_of_user):
|
|
|
3280a9 |
4. Operation should succeed
|
|
|
3280a9 |
5. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
- Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",'(targetattr=*)(version 3.0; aci "tester"; allow(all) groupdn != "ldap:///{}\ || ldap:///{} || ldap:///{}";)'.format(ALLGROUPS_GLOBAL, GROUPA_GLOBAL, GROUPH_GLOBAL))
|
|
|
3280a9 |
+ Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",'(targetattr="*")(version 3.0; aci "tester"; allow(all) groupdn != "ldap:///{}\ || ldap:///{} || ldap:///{}";)'.format(ALLGROUPS_GLOBAL, GROUPA_GLOBAL, GROUPH_GLOBAL))
|
|
|
3280a9 |
conn = UserAccount(topo.standalone, DEEPUSER3_GLOBAL).bind(PW_DM)
|
|
|
3280a9 |
# test UNDEFINED in group
|
|
|
3280a9 |
user = UserAccount(conn, DEEPGROUPSCRATCHENTRY_GLOBAL)
|
|
|
3280a9 |
@@ -252,7 +260,7 @@ def test_undefined_in_group_eval_ten(topo, test_user, aci_of_user):
|
|
|
3280a9 |
4. Operation should succeed
|
|
|
3280a9 |
5. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
- Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",'(targetattr=*)(version 3.0; aci "tester"; allow(all) userattr = "description#GROUPDN";)')
|
|
|
3280a9 |
+ Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",'(targetattr="*")(version 3.0; aci "tester"; allow(all) userattr = "description#GROUPDN";)')
|
|
|
3280a9 |
user = UserAccount(topo.standalone, DEEPGROUPSCRATCHENTRY_GLOBAL)
|
|
|
3280a9 |
user.add("description", [ALLGROUPS_GLOBAL, GROUPG_GLOBAL])
|
|
|
3280a9 |
conn = UserAccount(topo.standalone, DEEPUSER_GLOBAL).bind(PW_DM)
|
|
|
3280a9 |
@@ -281,7 +289,7 @@ def test_undefined_in_group_eval_eleven(topo, test_user, aci_of_user):
|
|
|
3280a9 |
4. Operation should succeed
|
|
|
3280a9 |
5. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
- Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",'(targetattr=*)(version 3.0; aci "tester"; allow(all) not( userattr = "description#GROUPDN");)')
|
|
|
3280a9 |
+ Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",'(targetattr="*")(version 3.0; aci "tester"; allow(all) not( userattr = "description#GROUPDN");)')
|
|
|
3280a9 |
user = UserAccount(topo.standalone, DEEPGROUPSCRATCHENTRY_GLOBAL)
|
|
|
3280a9 |
user.add("description", [ALLGROUPS_GLOBAL, GROUPH_GLOBAL])
|
|
|
3280a9 |
conn = UserAccount(topo.standalone, DEEPUSER_GLOBAL).bind(PW_DM)
|
|
|
3280a9 |
@@ -312,7 +320,7 @@ def test_undefined_in_group_eval_twelve(topo, test_user, aci_of_user):
|
|
|
3280a9 |
4. Operation should succeed
|
|
|
3280a9 |
5. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
- Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",'(targetattr=*)(version 3.0; aci "tester"; allow(all) userattr = "parent[0,1].description#GROUPDN";)')
|
|
|
3280a9 |
+ Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",'(targetattr="*")(version 3.0; aci "tester"; allow(all) userattr = "parent[0,1].description#GROUPDN";)')
|
|
|
3280a9 |
user = UserAccount(topo.standalone, GROUPDNATTRSCRATCHENTRY_GLOBAL)
|
|
|
3280a9 |
user.add("description", [ALLGROUPS_GLOBAL, GROUPD_GLOBAL])
|
|
|
3280a9 |
conn = UserAccount(topo.standalone, DEEPUSER_GLOBAL).bind(PW_DM)
|
|
|
3280a9 |
@@ -341,7 +349,7 @@ def test_undefined_in_group_eval_fourteen(topo, test_user, aci_of_user):
|
|
|
3280a9 |
4. Operation should succeed
|
|
|
3280a9 |
5. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
- Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",'(targetattr=*)(version 3.0; aci "tester"; allow(all) userattr = "parent[0,1].description#GROUPDN";)')
|
|
|
3280a9 |
+ Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",'(targetattr="*")(version 3.0; aci "tester"; allow(all) userattr = "parent[0,1].description#GROUPDN";)')
|
|
|
3280a9 |
user = UserAccount(topo.standalone, GROUPDNATTRSCRATCHENTRY_GLOBAL)
|
|
|
3280a9 |
user.add("description", [ALLGROUPS_GLOBAL, GROUPG_GLOBAL])
|
|
|
3280a9 |
conn = UserAccount(topo.standalone, DEEPUSER2_GLOBAL).bind(PW_DM)
|
|
|
3280a9 |
@@ -372,7 +380,7 @@ def test_undefined_in_group_eval_fifteen(topo, test_user, aci_of_user):
|
|
|
3280a9 |
4. Operation should succeed
|
|
|
3280a9 |
5. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
- Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",'(targetattr=*)(version 3.0; aci "tester"; allow(all) userattr = "parent[0,1].description#USERDN";)')
|
|
|
3280a9 |
+ Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",'(targetattr="*")(version 3.0; aci "tester"; allow(all) userattr = "parent[0,1].description#USERDN";)')
|
|
|
3280a9 |
UserAccount(topo.standalone, NESTEDGROUP_OU_GLOBAL).add("description", DEEPUSER_GLOBAL)
|
|
|
3280a9 |
# Here do the same tests for userattr with the parent keyword.
|
|
|
3280a9 |
conn = UserAccount(topo.standalone, DEEPUSER_GLOBAL).bind(PW_DM)
|
|
|
3280a9 |
@@ -399,7 +407,7 @@ def test_undefined_in_group_eval_sixteen(topo, test_user, aci_of_user):
|
|
|
3280a9 |
5. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
domain = Domain(topo.standalone, DEFAULT_SUFFIX)
|
|
|
3280a9 |
- domain.add("aci",'(targetattr=*)(version 3.0; aci "tester"; allow(all) not ( userattr = "parent[0,1].description#USERDN");)')
|
|
|
3280a9 |
+ domain.add("aci",'(targetattr="*")(version 3.0; aci "tester"; allow(all) not ( userattr = "parent[0,1].description#USERDN");)')
|
|
|
3280a9 |
domain.add("description", DEEPUSER_GLOBAL)
|
|
|
3280a9 |
conn = UserAccount(topo.standalone, DEEPUSER_GLOBAL).bind(PW_DM)
|
|
|
3280a9 |
# Test with parent keyword with not key
|
|
|
3280a9 |
@@ -427,7 +435,7 @@ def test_undefined_in_group_eval_seventeen(topo, test_user, aci_of_user):
|
|
|
3280a9 |
4. Operation should succeed
|
|
|
3280a9 |
5. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
- Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",'(targetattr=*)(version 3.0; aci "tester"; allow(all) userattr = "parent[0,1].description#GROUPDN";)')
|
|
|
3280a9 |
+ Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",'(targetattr="*")(version 3.0; aci "tester"; allow(all) userattr = "parent[0,1].description#GROUPDN";)')
|
|
|
3280a9 |
user = UserAccount(topo.standalone, GROUPDNATTRSCRATCHENTRY_GLOBAL)
|
|
|
3280a9 |
# Test with the parent keyord
|
|
|
3280a9 |
user.add("description", [ALLGROUPS_GLOBAL, GROUPD_GLOBAL])
|
|
|
3280a9 |
@@ -455,7 +463,7 @@ def test_undefined_in_group_eval_eighteen(topo, test_user, aci_of_user):
|
|
|
3280a9 |
4. Operation should succeed
|
|
|
3280a9 |
5. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
- Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",'(targetattr=*)(version 3.0; aci "tester"; allow(all) not (userattr = "parent[0,1].description#GROUPDN" );)')
|
|
|
3280a9 |
+ Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",'(targetattr="*")(version 3.0; aci "tester"; allow(all) not (userattr = "parent[0,1].description#GROUPDN" );)')
|
|
|
3280a9 |
user = UserAccount(topo.standalone, GROUPDNATTRSCRATCHENTRY_GLOBAL)
|
|
|
3280a9 |
# Test with parent keyword with not key
|
|
|
3280a9 |
user.add("description", [ALLGROUPS_GLOBAL, GROUPH_GLOBAL])
|
|
|
3280a9 |
diff --git a/dirsrvtests/tests/suites/acl/globalgroup_test.py b/dirsrvtests/tests/suites/acl/globalgroup_test.py
|
|
|
3280a9 |
index 58c4392e5..dc51a8170 100644
|
|
|
3280a9 |
--- a/dirsrvtests/tests/suites/acl/globalgroup_test.py
|
|
|
3280a9 |
+++ b/dirsrvtests/tests/suites/acl/globalgroup_test.py
|
|
|
3280a9 |
@@ -1,5 +1,5 @@
|
|
|
3280a9 |
# --- BEGIN COPYRIGHT BLOCK ---
|
|
|
3280a9 |
-# Copyright (C) 2019 Red Hat, Inc.
|
|
|
3280a9 |
+# Copyright (C) 2020 Red Hat, Inc.
|
|
|
3280a9 |
# All rights reserved.
|
|
|
3280a9 |
#
|
|
|
3280a9 |
# License: GPL (version 3 or any later version).
|
|
|
3280a9 |
@@ -72,6 +72,14 @@ def test_user(request, topo):
|
|
|
3280a9 |
'userPassword': PW_DM
|
|
|
3280a9 |
})
|
|
|
3280a9 |
|
|
|
3280a9 |
+ # Add anonymous access aci
|
|
|
3280a9 |
+ ACI_TARGET = "(targetattr=\"*\")(target = \"ldap:///%s\")" % (DEFAULT_SUFFIX)
|
|
|
3280a9 |
+ ACI_ALLOW = "(version 3.0; acl \"Anonymous Read access\"; allow (read,search,compare)"
|
|
|
3280a9 |
+ ACI_SUBJECT = "(userdn=\"ldap:///anyone\");)"
|
|
|
3280a9 |
+ ANON_ACI = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
|
|
|
3280a9 |
+ suffix = Domain(topo.standalone, DEFAULT_SUFFIX)
|
|
|
3280a9 |
+ suffix.add('aci', ANON_ACI)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
uas = UserAccounts(topo.standalone, DEFAULT_SUFFIX, 'ou=nestedgroup')
|
|
|
3280a9 |
for demo1 in ['DEEPUSER_GLOBAL', 'scratchEntry', 'DEEPUSER2_GLOBAL', 'DEEPUSER1_GLOBAL',
|
|
|
3280a9 |
'DEEPUSER3_GLOBAL', 'GROUPDNATTRSCRATCHENTRY_GLOBAL', 'newChild']:
|
|
|
3280a9 |
@@ -361,7 +369,7 @@ def test_undefined_in_group_eval_two(topo, test_user, aci_of_user):
|
|
|
3280a9 |
4. Operation should succeed
|
|
|
3280a9 |
5. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
- Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",'(targetattr=*)(version 3.0; aci "tester"; allow(all) groupdn = "ldap:///{}\ || ldap:///{}";)'.format(ALLGROUPS_GLOBAL, GROUPG_GLOBAL))
|
|
|
3280a9 |
+ Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",'(targetattr="*")(version 3.0; aci "tester"; allow(all) groupdn = "ldap:///{}\ || ldap:///{}";)'.format(ALLGROUPS_GLOBAL, GROUPG_GLOBAL))
|
|
|
3280a9 |
conn = UserAccount(topo.standalone, DEEPUSER_GLOBAL).bind(PW_DM)
|
|
|
3280a9 |
user = UserAccount(conn, DEEPGROUPSCRATCHENTRY_GLOBAL)
|
|
|
3280a9 |
# This aci should allow access
|
|
|
3280a9 |
@@ -389,7 +397,7 @@ def test_undefined_in_group_eval_three(topo, test_user, aci_of_user):
|
|
|
3280a9 |
4. Operation should succeed
|
|
|
3280a9 |
5. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
- Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",'(targetattr=*)(version 3.0; aci "tester"; allow(all) groupdn = "ldap:///{}\ || ldap:///{}";)'.format(GROUPG_GLOBAL, ALLGROUPS_GLOBAL))
|
|
|
3280a9 |
+ Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",'(targetattr="*")(version 3.0; aci "tester"; allow(all) groupdn = "ldap:///{}\ || ldap:///{}";)'.format(GROUPG_GLOBAL, ALLGROUPS_GLOBAL))
|
|
|
3280a9 |
conn = UserAccount(topo.standalone, DEEPUSER_GLOBAL).bind(PW_DM)
|
|
|
3280a9 |
user = Domain(conn, DEEPGROUPSCRATCHENTRY_GLOBAL)
|
|
|
3280a9 |
# test UNDEFINED in group
|
|
|
3280a9 |
@@ -417,7 +425,7 @@ def test_undefined_in_group_eval_four(topo, test_user, aci_of_user):
|
|
|
3280a9 |
4. Operation should succeed
|
|
|
3280a9 |
5. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
- Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",'(targetattr=*)(version 3.0; aci "tester"; allow(all) groupdn != "ldap:///{}\ || ldap:///{}";)'.format(ALLGROUPS_GLOBAL, GROUPG_GLOBAL))
|
|
|
3280a9 |
+ Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",'(targetattr="*")(version 3.0; aci "tester"; allow(all) groupdn != "ldap:///{}\ || ldap:///{}";)'.format(ALLGROUPS_GLOBAL, GROUPG_GLOBAL))
|
|
|
3280a9 |
conn = UserAccount(topo.standalone, DEEPUSER1_GLOBAL).bind(PW_DM)
|
|
|
3280a9 |
# test UNDEFINED in group
|
|
|
3280a9 |
user = UserAccount(conn, DEEPGROUPSCRATCHENTRY_GLOBAL)
|
|
|
3280a9 |
diff --git a/dirsrvtests/tests/suites/acl/keywords_part2_test.py b/dirsrvtests/tests/suites/acl/keywords_part2_test.py
|
|
|
3280a9 |
index c2aa9ac53..642e65bad 100644
|
|
|
3280a9 |
--- a/dirsrvtests/tests/suites/acl/keywords_part2_test.py
|
|
|
3280a9 |
+++ b/dirsrvtests/tests/suites/acl/keywords_part2_test.py
|
|
|
3280a9 |
@@ -1,5 +1,5 @@
|
|
|
3280a9 |
# --- BEGIN COPYRIGHT BLOCK ---
|
|
|
3280a9 |
-# Copyright (C) 2019 Red Hat, Inc.
|
|
|
3280a9 |
+# Copyright (C) 2020 Red Hat, Inc.
|
|
|
3280a9 |
# All rights reserved.
|
|
|
3280a9 |
#
|
|
|
3280a9 |
# License: GPL (version 3 or any later version).
|
|
|
3280a9 |
@@ -68,7 +68,7 @@ def test_access_from_certain_network_only_ip(topo, add_user, aci_of_user):
|
|
|
3280a9 |
|
|
|
3280a9 |
# Add ACI
|
|
|
3280a9 |
domain = Domain(topo.standalone, DEFAULT_SUFFIX)
|
|
|
3280a9 |
- domain.add("aci", f'(target = "ldap:///{IP_OU_KEY}")(targetattr=*)(version 3.0; aci "IP aci"; '
|
|
|
3280a9 |
+ domain.add("aci", f'(target = "ldap:///{IP_OU_KEY}")(targetattr=\"*\")(version 3.0; aci "IP aci"; '
|
|
|
3280a9 |
f'allow(all)userdn = "ldap:///{NETSCAPEIP_KEY}" and ip = "{ip_ip}" ;)')
|
|
|
3280a9 |
|
|
|
3280a9 |
# create a new connection for the test
|
|
|
3280a9 |
@@ -76,12 +76,13 @@ def test_access_from_certain_network_only_ip(topo, add_user, aci_of_user):
|
|
|
3280a9 |
# Perform Operation
|
|
|
3280a9 |
org = OrganizationalUnit(conn, IP_OU_KEY)
|
|
|
3280a9 |
org.replace("seeAlso", "cn=1")
|
|
|
3280a9 |
+
|
|
|
3280a9 |
# remove the aci
|
|
|
3280a9 |
- domain.ensure_removed("aci", f'(target = "ldap:///{IP_OU_KEY}")(targetattr=*)(version 3.0; aci '
|
|
|
3280a9 |
+ domain.ensure_removed("aci", f'(target = "ldap:///{IP_OU_KEY}")(targetattr=\"*\")(version 3.0; aci '
|
|
|
3280a9 |
f'"IP aci"; allow(all)userdn = "ldap:///{NETSCAPEIP_KEY}" and '
|
|
|
3280a9 |
f'ip = "{ip_ip}" ;)')
|
|
|
3280a9 |
# Now add aci with new ip
|
|
|
3280a9 |
- domain.add("aci", f'(target = "ldap:///{IP_OU_KEY}")(targetattr=*)(version 3.0; aci "IP aci"; '
|
|
|
3280a9 |
+ domain.add("aci", f'(target = "ldap:///{IP_OU_KEY}")(targetattr="*")(version 3.0; aci "IP aci"; '
|
|
|
3280a9 |
f'allow(all)userdn = "ldap:///{NETSCAPEIP_KEY}" and ip = "100.1.1.1" ;)')
|
|
|
3280a9 |
|
|
|
3280a9 |
# After changing the ip user cant access data
|
|
|
3280a9 |
@@ -106,10 +107,11 @@ def test_connectin_from_an_unauthorized_network(topo, add_user, aci_of_user):
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
# Find the ip from ds logs , as we need to know the exact ip used by ds to run the instances.
|
|
|
3280a9 |
ip_ip = topo.standalone.ds_access_log.match('.* connection from ')[0].split()[-1]
|
|
|
3280a9 |
+
|
|
|
3280a9 |
# Add ACI
|
|
|
3280a9 |
domain = Domain(topo.standalone, DEFAULT_SUFFIX)
|
|
|
3280a9 |
domain.add("aci", f'(target = "ldap:///{IP_OU_KEY}")'
|
|
|
3280a9 |
- f'(targetattr=*)(version 3.0; aci "IP aci"; '
|
|
|
3280a9 |
+ f'(targetattr="*")(version 3.0; aci "IP aci"; '
|
|
|
3280a9 |
f'allow(all) userdn = "ldap:///{NETSCAPEIP_KEY}" '
|
|
|
3280a9 |
f'and ip != "{ip_ip}" ;)')
|
|
|
3280a9 |
|
|
|
3280a9 |
@@ -122,7 +124,7 @@ def test_connectin_from_an_unauthorized_network(topo, add_user, aci_of_user):
|
|
|
3280a9 |
# Remove the ACI
|
|
|
3280a9 |
domain.ensure_removed('aci', domain.get_attr_vals('aci')[-1])
|
|
|
3280a9 |
# Add new ACI
|
|
|
3280a9 |
- domain.add('aci', f'(target = "ldap:///{IP_OU_KEY}")(targetattr=*)'
|
|
|
3280a9 |
+ domain.add('aci', f'(target = "ldap:///{IP_OU_KEY}")(targetattr="*")'
|
|
|
3280a9 |
f'(version 3.0; aci "IP aci"; allow(all) '
|
|
|
3280a9 |
f'userdn = "ldap:///{NETSCAPEIP_KEY}" and ip = "{ip_ip}" ;)')
|
|
|
3280a9 |
|
|
|
3280a9 |
@@ -148,7 +150,7 @@ def test_ip_keyword_test_noip_cannot(topo, add_user, aci_of_user):
|
|
|
3280a9 |
# Add ACI
|
|
|
3280a9 |
Domain(topo.standalone,
|
|
|
3280a9 |
DEFAULT_SUFFIX).add("aci", f'(target ="ldap:///{IP_OU_KEY}")'
|
|
|
3280a9 |
- f'(targetattr=*)(version 3.0; aci "IP aci"; allow(all) '
|
|
|
3280a9 |
+ f'(targetattr="*")(version 3.0; aci "IP aci"; allow(all) '
|
|
|
3280a9 |
f'userdn = "ldap:///{FULLIP_KEY}" and ip = "*" ;)')
|
|
|
3280a9 |
|
|
|
3280a9 |
# Create a new connection for this test.
|
|
|
3280a9 |
@@ -177,7 +179,7 @@ def test_user_can_access_the_data_at_any_time(topo, add_user, aci_of_user):
|
|
|
3280a9 |
# Add ACI
|
|
|
3280a9 |
Domain(topo.standalone,
|
|
|
3280a9 |
DEFAULT_SUFFIX).add("aci", f'(target = "ldap:///{TIMEOFDAY_OU_KEY}")'
|
|
|
3280a9 |
- f'(targetattr=*)(version 3.0; aci "Timeofday aci"; '
|
|
|
3280a9 |
+ f'(targetattr="*")(version 3.0; aci "Timeofday aci"; '
|
|
|
3280a9 |
f'allow(all) userdn ="ldap:///{FULLWORKER_KEY}" and '
|
|
|
3280a9 |
f'(timeofday >= "0000" and timeofday <= "2359") ;)')
|
|
|
3280a9 |
|
|
|
3280a9 |
@@ -206,7 +208,7 @@ def test_user_can_access_the_data_only_in_the_morning(topo, add_user, aci_of_use
|
|
|
3280a9 |
# Add ACI
|
|
|
3280a9 |
Domain(topo.standalone,
|
|
|
3280a9 |
DEFAULT_SUFFIX).add("aci", f'(target = "ldap:///{TIMEOFDAY_OU_KEY}")'
|
|
|
3280a9 |
- f'(targetattr=*)(version 3.0; aci "Timeofday aci"; '
|
|
|
3280a9 |
+ f'(targetattr="*")(version 3.0; aci "Timeofday aci"; '
|
|
|
3280a9 |
f'allow(all) userdn = "ldap:///{DAYWORKER_KEY}" '
|
|
|
3280a9 |
f'and timeofday < "1200" ;)')
|
|
|
3280a9 |
|
|
|
3280a9 |
@@ -239,7 +241,7 @@ def test_user_can_access_the_data_only_in_the_afternoon(topo, add_user, aci_of_u
|
|
|
3280a9 |
# Add ACI
|
|
|
3280a9 |
Domain(topo.standalone,
|
|
|
3280a9 |
DEFAULT_SUFFIX).add("aci", f'(target = "ldap:///{TIMEOFDAY_OU_KEY}")'
|
|
|
3280a9 |
- f'(targetattr=*)(version 3.0; aci "Timeofday aci"; '
|
|
|
3280a9 |
+ f'(targetattr="*")(version 3.0; aci "Timeofday aci"; '
|
|
|
3280a9 |
f'allow(all) userdn = "ldap:///{NIGHTWORKER_KEY}" '
|
|
|
3280a9 |
f'and timeofday > \'1200\' ;)')
|
|
|
3280a9 |
|
|
|
3280a9 |
@@ -275,7 +277,7 @@ def test_timeofday_keyword(topo, add_user, aci_of_user):
|
|
|
3280a9 |
# Add ACI
|
|
|
3280a9 |
domain = Domain(topo.standalone, DEFAULT_SUFFIX)
|
|
|
3280a9 |
domain.add("aci", f'(target = "ldap:///{TIMEOFDAY_OU_KEY}")'
|
|
|
3280a9 |
- f'(targetattr=*)(version 3.0; aci "Timeofday aci"; '
|
|
|
3280a9 |
+ f'(targetattr="*")(version 3.0; aci "Timeofday aci"; '
|
|
|
3280a9 |
f'allow(all) userdn = "ldap:///{NOWORKER_KEY}" '
|
|
|
3280a9 |
f'and timeofday = \'{now_1}\' ;)')
|
|
|
3280a9 |
|
|
|
3280a9 |
@@ -312,7 +314,7 @@ def test_dayofweek_keyword_test_everyday_can_access(topo, add_user, aci_of_user)
|
|
|
3280a9 |
# Add ACI
|
|
|
3280a9 |
Domain(topo.standalone,
|
|
|
3280a9 |
DEFAULT_SUFFIX).add("aci", f'(target = "ldap:///{DAYOFWEEK_OU_KEY}")'
|
|
|
3280a9 |
- f'(targetattr=*)(version 3.0; aci "Dayofweek aci"; '
|
|
|
3280a9 |
+ f'(targetattr="*")(version 3.0; aci "Dayofweek aci"; '
|
|
|
3280a9 |
f'allow(all) userdn = "ldap:///{EVERYDAY_KEY}" and '
|
|
|
3280a9 |
f'dayofweek = "Sun, Mon, Tue, Wed, Thu, Fri, Sat" ;)')
|
|
|
3280a9 |
|
|
|
3280a9 |
@@ -342,7 +344,7 @@ def test_dayofweek_keyword_today_can_access(topo, add_user, aci_of_user):
|
|
|
3280a9 |
# Add ACI
|
|
|
3280a9 |
Domain(topo.standalone,
|
|
|
3280a9 |
DEFAULT_SUFFIX).add("aci", f'(target = "ldap:///{DAYOFWEEK_OU_KEY}")'
|
|
|
3280a9 |
- f'(targetattr=*)(version 3.0; aci "Dayofweek aci"; '
|
|
|
3280a9 |
+ f'(targetattr="*")(version 3.0; aci "Dayofweek aci"; '
|
|
|
3280a9 |
f'allow(all) userdn = "ldap:///{TODAY_KEY}" '
|
|
|
3280a9 |
f'and dayofweek = \'{today_1}\' ;)')
|
|
|
3280a9 |
|
|
|
3280a9 |
@@ -371,7 +373,7 @@ def test_user_cannot_access_the_data_at_all(topo, add_user, aci_of_user):
|
|
|
3280a9 |
# Add ACI
|
|
|
3280a9 |
Domain(topo.standalone,
|
|
|
3280a9 |
DEFAULT_SUFFIX).add("aci", f'(target = "ldap:///{DAYOFWEEK_OU_KEY}")'
|
|
|
3280a9 |
- f'(targetattr=*)(version 3.0; aci "Dayofweek aci"; '
|
|
|
3280a9 |
+ f'(targetattr="*")(version 3.0; aci "Dayofweek aci"; '
|
|
|
3280a9 |
f'allow(all) userdn = "ldap:///{TODAY_KEY}" '
|
|
|
3280a9 |
f'and dayofweek = "$NEW_DATE" ;)')
|
|
|
3280a9 |
|
|
|
3280a9 |
diff --git a/dirsrvtests/tests/suites/acl/keywords_test.py b/dirsrvtests/tests/suites/acl/keywords_test.py
|
|
|
3280a9 |
index 138e3ede1..0174152e3 100644
|
|
|
3280a9 |
--- a/dirsrvtests/tests/suites/acl/keywords_test.py
|
|
|
3280a9 |
+++ b/dirsrvtests/tests/suites/acl/keywords_test.py
|
|
|
3280a9 |
@@ -39,11 +39,11 @@ NONE_2_KEY = "uid=NONE_2_KEY,{}".format(AUTHMETHOD_OU_KEY)
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
NONE_ACI_KEY = f'(target = "ldap:///{AUTHMETHOD_OU_KEY}")' \
|
|
|
3280a9 |
- f'(targetattr=*)(version 3.0; aci "Authmethod aci"; ' \
|
|
|
3280a9 |
+ f'(targetattr="*")(version 3.0; aci "Authmethod aci"; ' \
|
|
|
3280a9 |
f'allow(all) userdn = "ldap:///{NONE_1_KEY}" and authmethod = "none" ;)'
|
|
|
3280a9 |
|
|
|
3280a9 |
SIMPLE_ACI_KEY = f'(target = "ldap:///{AUTHMETHOD_OU_KEY}")' \
|
|
|
3280a9 |
- f'(targetattr=*)(version 3.0; aci "Authmethod aci"; ' \
|
|
|
3280a9 |
+ f'(targetattr="*")(version 3.0; aci "Authmethod aci"; ' \
|
|
|
3280a9 |
f'allow(all) userdn = "ldap:///{SIMPLE_1_KEY}" and authmethod = "simple" ;)'
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
@@ -55,8 +55,7 @@ def _add_aci(topo, name):
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_user_binds_with_a_password_and_can_access_the_data(topo, add_user, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- User binds with a password and can access the data as per the ACI.
|
|
|
3280a9 |
+ """User binds with a password and can access the data as per the ACI.
|
|
|
3280a9 |
|
|
|
3280a9 |
:id: f6c4b6f0-7ac4-11e8-a517-8c16451d917b
|
|
|
3280a9 |
:setup: Standalone Server
|
|
|
3280a9 |
@@ -78,8 +77,7 @@ def test_user_binds_with_a_password_and_can_access_the_data(topo, add_user, aci_
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_user_binds_with_a_bad_password_and_cannot_access_the_data(topo, add_user, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- User binds with a BAD password and cannot access the data .
|
|
|
3280a9 |
+ """User binds with a BAD password and cannot access the data .
|
|
|
3280a9 |
|
|
|
3280a9 |
:id: 0397744e-7ac5-11e8-bfb1-8c16451d917b
|
|
|
3280a9 |
:setup: Standalone Server
|
|
|
3280a9 |
@@ -98,8 +96,7 @@ def test_user_binds_with_a_bad_password_and_cannot_access_the_data(topo, add_use
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_anonymous_user_cannot_access_the_data(topo, add_user, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Anonymous user cannot access the data
|
|
|
3280a9 |
+ """Anonymous user cannot access the data
|
|
|
3280a9 |
|
|
|
3280a9 |
:id: 0821a55c-7ac5-11e8-b214-8c16451d917b
|
|
|
3280a9 |
:setup: Standalone Server
|
|
|
3280a9 |
@@ -124,8 +121,7 @@ def test_anonymous_user_cannot_access_the_data(topo, add_user, aci_of_user):
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_authenticated_but_has_no_rigth_on_the_data(topo, add_user, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- User has a password. He is authenticated but has no rigth on the data.
|
|
|
3280a9 |
+ """User has a password. He is authenticated but has no rigth on the data.
|
|
|
3280a9 |
|
|
|
3280a9 |
:id: 11be7ebe-7ac5-11e8-b754-8c16451d917b
|
|
|
3280a9 |
:setup: Standalone Server
|
|
|
3280a9 |
@@ -150,10 +146,9 @@ def test_authenticated_but_has_no_rigth_on_the_data(topo, add_user, aci_of_user)
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_the_bind_client_is_accessing_the_directory(topo, add_user, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- The bind rule is evaluated to be true if the client is accessing the directory as per the ACI.
|
|
|
3280a9 |
+ """The bind rule is evaluated to be true if the client is accessing the directory as per the ACI.
|
|
|
3280a9 |
|
|
|
3280a9 |
- :id: 1715bfb2-7ac5-11e8-8f2c-8c16451d917b
|
|
|
3280a9 |
+ :id: 1715bfb2-7ac5-11e8-8f2c-8c16451d917b
|
|
|
3280a9 |
:setup: Standalone Server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
1. Add test entry
|
|
|
3280a9 |
@@ -175,8 +170,7 @@ def test_the_bind_client_is_accessing_the_directory(topo, add_user, aci_of_user)
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_users_binds_with_a_password_and_can_access_the_data(
|
|
|
3280a9 |
topo, add_user, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- User binds with a password and can access the data as per the ACI.
|
|
|
3280a9 |
+ """User binds with a password and can access the data as per the ACI.
|
|
|
3280a9 |
|
|
|
3280a9 |
:id: 1bd01cb4-7ac5-11e8-a2f1-8c16451d917b
|
|
|
3280a9 |
:setup: Standalone Server
|
|
|
3280a9 |
@@ -199,8 +193,7 @@ def test_users_binds_with_a_password_and_can_access_the_data(
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_user_binds_without_any_password_and_cannot_access_the_data(topo, add_user, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- User binds without any password and cannot access the data
|
|
|
3280a9 |
+ """User binds without any password and cannot access the data
|
|
|
3280a9 |
|
|
|
3280a9 |
:id: 205777fa-7ac5-11e8-ba2f-8c16451d917b
|
|
|
3280a9 |
:setup: Standalone Server
|
|
|
3280a9 |
@@ -227,8 +220,7 @@ def test_user_binds_without_any_password_and_cannot_access_the_data(topo, add_us
|
|
|
3280a9 |
def test_user_can_access_the_data_when_connecting_from_any_machine(
|
|
|
3280a9 |
topo, add_user, aci_of_user
|
|
|
3280a9 |
):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- User can access the data when connecting from any machine as per the ACI.
|
|
|
3280a9 |
+ """User can access the data when connecting from any machine as per the ACI.
|
|
|
3280a9 |
|
|
|
3280a9 |
:id: 28cbc008-7ac5-11e8-934e-8c16451d917b
|
|
|
3280a9 |
:setup: Standalone Server
|
|
|
3280a9 |
@@ -244,7 +236,7 @@ def test_user_can_access_the_data_when_connecting_from_any_machine(
|
|
|
3280a9 |
# Add ACI
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX)\
|
|
|
3280a9 |
.add("aci", f'(target ="ldap:///{DNS_OU_KEY}")'
|
|
|
3280a9 |
- f'(targetattr=*)(version 3.0; aci "DNS aci"; allow(all) '
|
|
|
3280a9 |
+ f'(targetattr="*")(version 3.0; aci "DNS aci"; allow(all) '
|
|
|
3280a9 |
f'userdn = "ldap:///{FULLDNS_KEY}" and dns = "*" ;)')
|
|
|
3280a9 |
|
|
|
3280a9 |
# Create a new connection for this test.
|
|
|
3280a9 |
@@ -256,8 +248,8 @@ def test_user_can_access_the_data_when_connecting_from_any_machine(
|
|
|
3280a9 |
def test_user_can_access_the_data_when_connecting_from_internal_ds_network_only(
|
|
|
3280a9 |
topo, add_user, aci_of_user
|
|
|
3280a9 |
):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- User can access the data when connecting from internal ICNC network only as per the ACI.
|
|
|
3280a9 |
+ """User can access the data when connecting from internal ICNC network only as per the ACI.
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: 2cac2136-7ac5-11e8-8328-8c16451d917b
|
|
|
3280a9 |
:setup: Standalone Server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -273,9 +265,9 @@ def test_user_can_access_the_data_when_connecting_from_internal_ds_network_only(
|
|
|
3280a9 |
# Add ACI
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).\
|
|
|
3280a9 |
add("aci", [f'(target = "ldap:///{DNS_OU_KEY}")'
|
|
|
3280a9 |
- f'(targetattr=*)(version 3.0; aci "DNS aci"; '
|
|
|
3280a9 |
+ f'(targetattr="*")(version 3.0; aci "DNS aci"; '
|
|
|
3280a9 |
f'allow(all) userdn = "ldap:///{SUNDNS_KEY}" and dns = "*redhat.com" ;)',
|
|
|
3280a9 |
- f'(target = "ldap:///{DNS_OU_KEY}")(targetattr=*)'
|
|
|
3280a9 |
+ f'(target = "ldap:///{DNS_OU_KEY}")(targetattr="*")'
|
|
|
3280a9 |
f'(version 3.0; aci "DNS aci"; allow(all) '
|
|
|
3280a9 |
f'userdn = "ldap:///{SUNDNS_KEY}" and dns = "{dns_name}" ;)'])
|
|
|
3280a9 |
|
|
|
3280a9 |
@@ -288,8 +280,7 @@ def test_user_can_access_the_data_when_connecting_from_internal_ds_network_only(
|
|
|
3280a9 |
def test_user_can_access_the_data_when_connecting_from_some_network_only(
|
|
|
3280a9 |
topo, add_user, aci_of_user
|
|
|
3280a9 |
):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- User can access the data when connecting from some network only as per the ACI.
|
|
|
3280a9 |
+ """User can access the data when connecting from some network only as per the ACI.
|
|
|
3280a9 |
|
|
|
3280a9 |
:id: 3098512a-7ac5-11e8-af85-8c16451d917b
|
|
|
3280a9 |
:setup: Standalone Server
|
|
|
3280a9 |
@@ -306,7 +297,7 @@ def test_user_can_access_the_data_when_connecting_from_some_network_only(
|
|
|
3280a9 |
# Add ACI
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX)\
|
|
|
3280a9 |
.add("aci", f'(target = "ldap:///{DNS_OU_KEY}")'
|
|
|
3280a9 |
- f'(targetattr=*)(version 3.0; aci "DNS aci"; allow(all) '
|
|
|
3280a9 |
+ f'(targetattr="*")(version 3.0; aci "DNS aci"; allow(all) '
|
|
|
3280a9 |
f'userdn = "ldap:///{NETSCAPEDNS_KEY}" '
|
|
|
3280a9 |
f'and dns = "{dns_name}" ;)')
|
|
|
3280a9 |
|
|
|
3280a9 |
@@ -317,8 +308,7 @@ def test_user_can_access_the_data_when_connecting_from_some_network_only(
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_from_an_unauthorized_network(topo, add_user, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- User cannot access the data when connecting from an unauthorized network as per the ACI.
|
|
|
3280a9 |
+ """User cannot access the data when connecting from an unauthorized network as per the ACI.
|
|
|
3280a9 |
|
|
|
3280a9 |
:id: 34cf9726-7ac5-11e8-bc12-8c16451d917b
|
|
|
3280a9 |
:setup: Standalone Server
|
|
|
3280a9 |
@@ -334,7 +324,7 @@ def test_from_an_unauthorized_network(topo, add_user, aci_of_user):
|
|
|
3280a9 |
# Add ACI
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).\
|
|
|
3280a9 |
add("aci", f'(target = "ldap:///{DNS_OU_KEY}")'
|
|
|
3280a9 |
- f'(targetattr=*)(version 3.0; aci "DNS aci"; allow(all) '
|
|
|
3280a9 |
+ f'(targetattr="*")(version 3.0; aci "DNS aci"; allow(all) '
|
|
|
3280a9 |
f'userdn = "ldap:///{NETSCAPEDNS_KEY}" and dns != "red.iplanet.com" ;)')
|
|
|
3280a9 |
|
|
|
3280a9 |
# Create a new connection for this test.
|
|
|
3280a9 |
@@ -345,8 +335,7 @@ def test_from_an_unauthorized_network(topo, add_user, aci_of_user):
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_user_cannot_access_the_data_when_connecting_from_an_unauthorized_network_2(
|
|
|
3280a9 |
topo, add_user, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- User cannot access the data when connecting from an unauthorized network as per the ACI.
|
|
|
3280a9 |
+ """User cannot access the data when connecting from an unauthorized network as per the ACI.
|
|
|
3280a9 |
|
|
|
3280a9 |
:id: 396bdd44-7ac5-11e8-8014-8c16451d917b
|
|
|
3280a9 |
:setup: Standalone Server
|
|
|
3280a9 |
@@ -362,7 +351,7 @@ def test_user_cannot_access_the_data_when_connecting_from_an_unauthorized_networ
|
|
|
3280a9 |
# Add ACI
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).\
|
|
|
3280a9 |
add("aci", f'(target = "ldap:///{DNS_OU_KEY}")'
|
|
|
3280a9 |
- f'(targetattr=*)(version 3.0; aci "DNS aci"; allow(all) '
|
|
|
3280a9 |
+ f'(targetattr="*")(version 3.0; aci "DNS aci"; allow(all) '
|
|
|
3280a9 |
f'userdn = "ldap:///{NETSCAPEDNS_KEY}" '
|
|
|
3280a9 |
f'and dnsalias != "www.redhat.com" ;)')
|
|
|
3280a9 |
|
|
|
3280a9 |
@@ -373,8 +362,8 @@ def test_user_cannot_access_the_data_when_connecting_from_an_unauthorized_networ
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_user_cannot_access_the_data_if_not_from_a_certain_domain(topo, add_user, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- User cannot access the data if not from a certain domain as per the ACI.
|
|
|
3280a9 |
+ """User cannot access the data if not from a certain domain as per the ACI.
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: 3d658972-7ac5-11e8-930f-8c16451d917b
|
|
|
3280a9 |
:setup: Standalone Server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -388,7 +377,7 @@ def test_user_cannot_access_the_data_if_not_from_a_certain_domain(topo, add_user
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
# Add ACI
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).\
|
|
|
3280a9 |
- add("aci", f'(target = "ldap:///{DNS_OU_KEY}")(targetattr=*)'
|
|
|
3280a9 |
+ add("aci", f'(target = "ldap:///{DNS_OU_KEY}")(targetattr="*")'
|
|
|
3280a9 |
f'(version 3.0; aci "DNS aci"; allow(all) '
|
|
|
3280a9 |
f'userdn = "ldap:///{NODNS_KEY}" '
|
|
|
3280a9 |
f'and dns = "RAP.rock.SALSA.house.COM" ;)')
|
|
|
3280a9 |
@@ -402,8 +391,7 @@ def test_user_cannot_access_the_data_if_not_from_a_certain_domain(topo, add_user
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_dnsalias_keyword_test_nodns_cannot(topo, add_user, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Dnsalias Keyword NODNS_KEY cannot assess data as per the ACI.
|
|
|
3280a9 |
+ """Dnsalias Keyword NODNS_KEY cannot assess data as per the ACI.
|
|
|
3280a9 |
|
|
|
3280a9 |
:id: 41b467be-7ac5-11e8-89a3-8c16451d917b
|
|
|
3280a9 |
:setup: Standalone Server
|
|
|
3280a9 |
@@ -418,7 +406,7 @@ def test_dnsalias_keyword_test_nodns_cannot(topo, add_user, aci_of_user):
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
# Add ACI
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).\
|
|
|
3280a9 |
- add("aci", f'(target = "ldap:///{DNS_OU_KEY}")(targetattr=*)'
|
|
|
3280a9 |
+ add("aci", f'(target = "ldap:///{DNS_OU_KEY}")(targetattr="*")'
|
|
|
3280a9 |
f'(version 3.0; aci "DNS aci"; allow(all) '
|
|
|
3280a9 |
f'userdn = "ldap:///{NODNS_KEY}" and '
|
|
|
3280a9 |
f'dnsalias = "RAP.rock.SALSA.house.COM" ;)')
|
|
|
3280a9 |
@@ -434,8 +422,7 @@ def test_dnsalias_keyword_test_nodns_cannot(topo, add_user, aci_of_user):
|
|
|
3280a9 |
@pytest.mark.bz1710848
|
|
|
3280a9 |
@pytest.mark.parametrize("ip_addr", ['127.0.0.1', "[::1]"])
|
|
|
3280a9 |
def test_user_can_access_from_ipv4_or_ipv6_address(topo, add_user, aci_of_user, ip_addr):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- User can modify the data when accessing the server from the allowed IPv4 and IPv6 addresses
|
|
|
3280a9 |
+ """User can modify the data when accessing the server from the allowed IPv4 and IPv6 addresses
|
|
|
3280a9 |
|
|
|
3280a9 |
:id: 461e761e-7ac5-11e8-9ae4-8c16451d917b
|
|
|
3280a9 |
:parametrized: yes
|
|
|
3280a9 |
@@ -451,7 +438,7 @@ def test_user_can_access_from_ipv4_or_ipv6_address(topo, add_user, aci_of_user,
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
# Add ACI that contains both IPv4 and IPv6
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).\
|
|
|
3280a9 |
- add("aci", f'(target ="ldap:///{IP_OU_KEY}")(targetattr=*) '
|
|
|
3280a9 |
+ add("aci", f'(target ="ldap:///{IP_OU_KEY}")(targetattr="*") '
|
|
|
3280a9 |
f'(version 3.0; aci "IP aci"; allow(all) '
|
|
|
3280a9 |
f'userdn = "ldap:///{FULLIP_KEY}" and (ip = "127.0.0.1" or ip = "::1");)')
|
|
|
3280a9 |
|
|
|
3280a9 |
diff --git a/dirsrvtests/tests/suites/acl/misc_test.py b/dirsrvtests/tests/suites/acl/misc_test.py
|
|
|
3280a9 |
index 8f122b7a7..5f0e3eb72 100644
|
|
|
3280a9 |
--- a/dirsrvtests/tests/suites/acl/misc_test.py
|
|
|
3280a9 |
+++ b/dirsrvtests/tests/suites/acl/misc_test.py
|
|
|
3280a9 |
@@ -1,6 +1,6 @@
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
# --- BEGIN COPYRIGHT BLOCK ---
|
|
|
3280a9 |
-# Copyright (C) 2019 RED Hat, Inc.
|
|
|
3280a9 |
+# Copyright (C) 2020 RED Hat, Inc.
|
|
|
3280a9 |
# All rights reserved.
|
|
|
3280a9 |
#
|
|
|
3280a9 |
# License: GPL (version 3 or any later version).
|
|
|
3280a9 |
@@ -8,6 +8,7 @@
|
|
|
3280a9 |
# --- END COPYRIGHT BLOCK ----
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
|
|
|
3280a9 |
+import ldap
|
|
|
3280a9 |
import os
|
|
|
3280a9 |
import pytest
|
|
|
3280a9 |
|
|
|
3280a9 |
@@ -21,8 +22,6 @@ from lib389.topologies import topology_st as topo
|
|
|
3280a9 |
from lib389.idm.domain import Domain
|
|
|
3280a9 |
from lib389.plugins import ACLPlugin
|
|
|
3280a9 |
|
|
|
3280a9 |
-import ldap
|
|
|
3280a9 |
-
|
|
|
3280a9 |
pytestmark = pytest.mark.tier1
|
|
|
3280a9 |
|
|
|
3280a9 |
PEOPLE = "ou=PEOPLE,{}".format(DEFAULT_SUFFIX)
|
|
|
3280a9 |
@@ -37,7 +36,19 @@ def aci_of_user(request, topo):
|
|
|
3280a9 |
:param request:
|
|
|
3280a9 |
:param topo:
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
- aci_list = Domain(topo.standalone, DEFAULT_SUFFIX).get_attr_vals('aci')
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ # Add anonymous access aci
|
|
|
3280a9 |
+ ACI_TARGET = "(targetattr != \"userpassword\")(target = \"ldap:///%s\")" % (DEFAULT_SUFFIX)
|
|
|
3280a9 |
+ ACI_ALLOW = "(version 3.0; acl \"Anonymous Read access\"; allow (read,search,compare)"
|
|
|
3280a9 |
+ ACI_SUBJECT = "(userdn=\"ldap:///anyone\");)"
|
|
|
3280a9 |
+ ANON_ACI = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
|
|
|
3280a9 |
+ suffix = Domain(topo.standalone, DEFAULT_SUFFIX)
|
|
|
3280a9 |
+ try:
|
|
|
3280a9 |
+ suffix.add('aci', ANON_ACI)
|
|
|
3280a9 |
+ except ldap.TYPE_OR_VALUE_EXISTS:
|
|
|
3280a9 |
+ pass
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ aci_list = suffix.get_attr_vals('aci')
|
|
|
3280a9 |
|
|
|
3280a9 |
def finofaci():
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
@@ -78,8 +89,8 @@ def clean(request, topo):
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_accept_aci_in_addition_to_acl(topo, clean, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Misc Test 2 accept aci in addition to acl
|
|
|
3280a9 |
+ """Misc Test 2 accept aci in addition to acl
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: 8e9408fa-7db8-11e8-adaa-8c16451d917b
|
|
|
3280a9 |
:setup: Standalone Instance
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -96,7 +107,7 @@ def test_accept_aci_in_addition_to_acl(topo, clean, aci_of_user):
|
|
|
3280a9 |
for i in [('mail', 'anujborah@okok.com'), ('givenname', 'Anuj'), ('userPassword', PW_DM)]:
|
|
|
3280a9 |
user.set(i[0], i[1])
|
|
|
3280a9 |
|
|
|
3280a9 |
- aci_target = "(targetattr=givenname)"
|
|
|
3280a9 |
+ aci_target = '(targetattr="givenname")'
|
|
|
3280a9 |
aci_allow = ('(version 3.0; acl "Name of the ACI"; deny (read, search, compare, write)')
|
|
|
3280a9 |
aci_subject = 'userdn="ldap:///anyone";)'
|
|
|
3280a9 |
Domain(topo.standalone, CONTAINER_1_DELADD).add("aci", aci_target + aci_allow + aci_subject)
|
|
|
3280a9 |
@@ -115,9 +126,9 @@ def test_accept_aci_in_addition_to_acl(topo, clean, aci_of_user):
|
|
|
3280a9 |
|
|
|
3280a9 |
@pytest.mark.bz334451
|
|
|
3280a9 |
def test_more_then_40_acl_will_crash_slapd(topo, clean, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- bug 334451 : more then 40 acl will crash slapd
|
|
|
3280a9 |
+ """bug 334451 : more then 40 acl will crash slapd
|
|
|
3280a9 |
superseded by Bug 772778 - acl cache overflown problem with > 200 acis
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: 93a44c60-7db8-11e8-9439-8c16451d917b
|
|
|
3280a9 |
:setup: Standalone Instance
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -132,7 +143,7 @@ def test_more_then_40_acl_will_crash_slapd(topo, clean, aci_of_user):
|
|
|
3280a9 |
uas = UserAccounts(topo.standalone, DEFAULT_SUFFIX, rdn='ou=Accounting')
|
|
|
3280a9 |
user = uas.create_test_user()
|
|
|
3280a9 |
|
|
|
3280a9 |
- aci_target = '(target ="ldap:///{}")(targetattr !="userPassword")'.format(CONTAINER_1_DELADD)
|
|
|
3280a9 |
+ aci_target = '(target ="ldap:///{}")(targetattr!="userPassword")'.format(CONTAINER_1_DELADD)
|
|
|
3280a9 |
# more_then_40_acl_will not crash_slapd
|
|
|
3280a9 |
for i in range(40):
|
|
|
3280a9 |
aci_allow = '(version 3.0;acl "ACI_{}";allow (read, search, compare)'.format(i)
|
|
|
3280a9 |
@@ -147,9 +158,9 @@ def test_more_then_40_acl_will_crash_slapd(topo, clean, aci_of_user):
|
|
|
3280a9 |
|
|
|
3280a9 |
@pytest.mark.bz345643
|
|
|
3280a9 |
def test_search_access_should_not_include_read_access(topo, clean, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- bug 345643
|
|
|
3280a9 |
+ """bug 345643
|
|
|
3280a9 |
Misc Test 4 search access should not include read access
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: 98ab173e-7db8-11e8-a309-8c16451d917b
|
|
|
3280a9 |
:setup: Standalone Instance
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -163,7 +174,7 @@ def test_search_access_should_not_include_read_access(topo, clean, aci_of_user):
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
assert Domain(topo.standalone, DEFAULT_SUFFIX).present('aci')
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX)\
|
|
|
3280a9 |
- .add("aci", [f'(target ="ldap:///{DEFAULT_SUFFIX}")(targetattr !="userPassword")'
|
|
|
3280a9 |
+ .replace("aci", [f'(target ="ldap:///{DEFAULT_SUFFIX}")(targetattr != "userPassword")'
|
|
|
3280a9 |
'(version 3.0;acl "anonymous access";allow (search)'
|
|
|
3280a9 |
'(userdn = "ldap:///anyone");)',
|
|
|
3280a9 |
f'(target="ldap:///{DEFAULT_SUFFIX}") (targetattr = "*")(version 3.0; '
|
|
|
3280a9 |
@@ -176,13 +187,13 @@ def test_search_access_should_not_include_read_access(topo, clean, aci_of_user):
|
|
|
3280a9 |
conn = Anonymous(topo.standalone).bind()
|
|
|
3280a9 |
# search_access_should_not_include_read_access
|
|
|
3280a9 |
suffix = Domain(conn, DEFAULT_SUFFIX)
|
|
|
3280a9 |
- with pytest.raises(AssertionError):
|
|
|
3280a9 |
+ with pytest.raises(Exception):
|
|
|
3280a9 |
assert suffix.present('aci')
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_only_allow_some_targetattr(topo, clean, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Misc Test 5 only allow some targetattr (1/2)
|
|
|
3280a9 |
+ """Misc Test 5 only allow some targetattr (1/2)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: 9d27f048-7db8-11e8-a71c-8c16451d917b
|
|
|
3280a9 |
:setup: Standalone Instance
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -211,17 +222,17 @@ def test_only_allow_some_targetattr(topo, clean, aci_of_user):
|
|
|
3280a9 |
# aci will allow only mail targetattr
|
|
|
3280a9 |
assert len(accounts.filter('(mail=*)')) == 2
|
|
|
3280a9 |
# aci will allow only mail targetattr
|
|
|
3280a9 |
- assert not accounts.filter('(cn=*)')
|
|
|
3280a9 |
+ assert not accounts.filter('(cn=*)', scope=1)
|
|
|
3280a9 |
# with root no , blockage
|
|
|
3280a9 |
- assert len(Accounts(topo.standalone, DEFAULT_SUFFIX).filter('(uid=*)')) == 2
|
|
|
3280a9 |
+ assert len(Accounts(topo.standalone, DEFAULT_SUFFIX).filter('(uid=*)', scope=1)) == 2
|
|
|
3280a9 |
|
|
|
3280a9 |
for i in uas.list():
|
|
|
3280a9 |
i.delete()
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
-def test_only_allow_some_targetattr_two(topo, clean, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Misc Test 6 only allow some targetattr (2/2)"
|
|
|
3280a9 |
+def test_only_allow_some_targetattr_two(topo, clean, aci_of_user, request):
|
|
|
3280a9 |
+ """Misc Test 6 only allow some targetattr (2/2)"
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: a188239c-7db8-11e8-903e-8c16451d917b
|
|
|
3280a9 |
:setup: Standalone Instance
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -244,15 +255,15 @@ def test_only_allow_some_targetattr_two(topo, clean, aci_of_user):
|
|
|
3280a9 |
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).\
|
|
|
3280a9 |
replace("aci", '(target="ldap:///{}") (targetattr="mail||objectClass")'
|
|
|
3280a9 |
- '(targetfilter="cn=Anuj") (version 3.0; acl "$tet_thistest"; '
|
|
|
3280a9 |
+ '(targetfilter="cn=Anuj") (version 3.0; acl "{}"; '
|
|
|
3280a9 |
'allow (compare,read,search) '
|
|
|
3280a9 |
- '(userdn = "ldap:///anyone"); )'.format(DEFAULT_SUFFIX))
|
|
|
3280a9 |
+ '(userdn = "ldap:///anyone"); )'.format(DEFAULT_SUFFIX, request.node.name))
|
|
|
3280a9 |
|
|
|
3280a9 |
conn = UserAccount(topo.standalone, user.dn).bind(PW_DM)
|
|
|
3280a9 |
# aci will allow only mail targetattr but only for cn=Anuj
|
|
|
3280a9 |
account = Accounts(conn, DEFAULT_SUFFIX)
|
|
|
3280a9 |
- assert len(account.filter('(mail=*)')) == 5
|
|
|
3280a9 |
- assert not account.filter('(cn=*)')
|
|
|
3280a9 |
+ assert len(account.filter('(mail=*)', scope=1)) == 5
|
|
|
3280a9 |
+ assert not account.filter('(cn=*)', scope=1)
|
|
|
3280a9 |
|
|
|
3280a9 |
for i in account.filter('(mail=*)'):
|
|
|
3280a9 |
assert i.get_attr_val_utf8('mail') == 'anujborah@anujborah.com'
|
|
|
3280a9 |
@@ -261,8 +272,8 @@ def test_only_allow_some_targetattr_two(topo, clean, aci_of_user):
|
|
|
3280a9 |
conn = Anonymous(topo.standalone).bind()
|
|
|
3280a9 |
# aci will allow only mail targetattr but only for cn=Anuj
|
|
|
3280a9 |
account = Accounts(conn, DEFAULT_SUFFIX)
|
|
|
3280a9 |
- assert len(account.filter('(mail=*)')) == 5
|
|
|
3280a9 |
- assert not account.filter('(cn=*)')
|
|
|
3280a9 |
+ assert len(account.filter('(mail=*)', scope=1)) == 5
|
|
|
3280a9 |
+ assert not account.filter('(cn=*)', scope=1)
|
|
|
3280a9 |
|
|
|
3280a9 |
for i in account.filter('(mail=*)'):
|
|
|
3280a9 |
assert i.get_attr_val_utf8('mail') == 'anujborah@anujborah.com'
|
|
|
3280a9 |
@@ -274,11 +285,10 @@ def test_only_allow_some_targetattr_two(topo, clean, aci_of_user):
|
|
|
3280a9 |
i.delete()
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
-
|
|
|
3280a9 |
@pytest.mark.bz326000
|
|
|
3280a9 |
def test_memberurl_needs_to_be_normalized(topo, clean, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Non-regression test for BUG 326000: MemberURL needs to be normalized
|
|
|
3280a9 |
+ """Non-regression test for BUG 326000: MemberURL needs to be normalized
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: a5d172e6-7db8-11e8-aca7-8c16451d917b
|
|
|
3280a9 |
:setup: Standalone Instance
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -291,7 +301,7 @@ def test_memberurl_needs_to_be_normalized(topo, clean, aci_of_user):
|
|
|
3280a9 |
3. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
ou_ou = OrganizationalUnit(topo.standalone, "ou=PEOPLE,{}".format(DEFAULT_SUFFIX))
|
|
|
3280a9 |
- ou_ou.set('aci', '(targetattr= *)'
|
|
|
3280a9 |
+ ou_ou.set('aci', '(targetattr="*")'
|
|
|
3280a9 |
'(version 3.0; acl "tester"; allow(all) '
|
|
|
3280a9 |
'groupdn = "ldap:///cn =DYNGROUP,ou=PEOPLE, {}";)'.format(DEFAULT_SUFFIX))
|
|
|
3280a9 |
|
|
|
3280a9 |
@@ -323,8 +333,8 @@ def test_memberurl_needs_to_be_normalized(topo, clean, aci_of_user):
|
|
|
3280a9 |
|
|
|
3280a9 |
@pytest.mark.bz624370
|
|
|
3280a9 |
def test_greater_than_200_acls_can_be_created(topo, clean, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Misc 10, check that greater than 200 ACLs can be created. Bug 624370
|
|
|
3280a9 |
+ """Misc 10, check that greater than 200 ACLs can be created. Bug 624370
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: ac020252-7db8-11e8-8652-8c16451d917b
|
|
|
3280a9 |
:setup: Standalone Instance
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -355,8 +365,8 @@ def test_greater_than_200_acls_can_be_created(topo, clean, aci_of_user):
|
|
|
3280a9 |
|
|
|
3280a9 |
@pytest.mark.bz624453
|
|
|
3280a9 |
def test_server_bahaves_properly_with_very_long_attribute_names(topo, clean, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Make sure the server bahaves properly with very long attribute names. Bug 624453.
|
|
|
3280a9 |
+ """Make sure the server bahaves properly with very long attribute names. Bug 624453.
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: b0d31942-7db8-11e8-a833-8c16451d917b
|
|
|
3280a9 |
:setup: Standalone Instance
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -378,24 +388,23 @@ def test_server_bahaves_properly_with_very_long_attribute_names(topo, clean, aci
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_do_bind_as_201_distinct_users(topo, clean, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Do bind as 201 distinct users
|
|
|
3280a9 |
- Increase the nsslapd-aclpb-max-selected-acls in cn=ACL Plugin,cn=plugins,cn=config
|
|
|
3280a9 |
- Restart the server
|
|
|
3280a9 |
- Do bind as 201 distinct users
|
|
|
3280a9 |
+ """Test bind as 201 distinct users
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: c0060532-7db8-11e8-a124-8c16451d917b
|
|
|
3280a9 |
:setup: Standalone Instance
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
- 1. Add test entry
|
|
|
3280a9 |
- 2. Add ACI
|
|
|
3280a9 |
- 3. User should follow ACI role
|
|
|
3280a9 |
+ 1. Add test entries
|
|
|
3280a9 |
+ 2. Increase the nsslapd-aclpb-max-selected-acls in cn=ACL Plugin,cn=plugins,cn=config
|
|
|
3280a9 |
+ 3. Restart the server
|
|
|
3280a9 |
+ 4. Do bind as 201 distinct users
|
|
|
3280a9 |
:expectedresults:
|
|
|
3280a9 |
- 1. Entry should be added
|
|
|
3280a9 |
- 2. Operation should succeed
|
|
|
3280a9 |
- 3. Operation should succeed
|
|
|
3280a9 |
+ 1. Entries should be added
|
|
|
3280a9 |
+ 2. Operation should succeed
|
|
|
3280a9 |
+ 3. Operation should succeed
|
|
|
3280a9 |
+ 4. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
uas = UserAccounts(topo.standalone, DEFAULT_SUFFIX)
|
|
|
3280a9 |
- for i in range(50):
|
|
|
3280a9 |
+ for i in range(201):
|
|
|
3280a9 |
user = uas.create_test_user(uid=i, gid=i)
|
|
|
3280a9 |
user.set('userPassword', PW_DM)
|
|
|
3280a9 |
|
|
|
3280a9 |
@@ -408,7 +417,6 @@ def test_do_bind_as_201_distinct_users(topo, clean, aci_of_user):
|
|
|
3280a9 |
for i in range(len(uas.list())):
|
|
|
3280a9 |
uas.list()[i].bind(PW_DM)
|
|
|
3280a9 |
|
|
|
3280a9 |
-
|
|
|
3280a9 |
if __name__ == "__main__":
|
|
|
3280a9 |
CURRENT_FILE = os.path.realpath(__file__)
|
|
|
3280a9 |
pytest.main("-s -v %s" % CURRENT_FILE)
|
|
|
3280a9 |
diff --git a/dirsrvtests/tests/suites/acl/modrdn_test.py b/dirsrvtests/tests/suites/acl/modrdn_test.py
|
|
|
3280a9 |
index f67f3e508..c4ae8eea5 100644
|
|
|
3280a9 |
--- a/dirsrvtests/tests/suites/acl/modrdn_test.py
|
|
|
3280a9 |
+++ b/dirsrvtests/tests/suites/acl/modrdn_test.py
|
|
|
3280a9 |
@@ -1,5 +1,5 @@
|
|
|
3280a9 |
# --- BEGIN COPYRIGHT BLOCK ---
|
|
|
3280a9 |
-# Copyright (C) 2019 Red Hat, Inc.
|
|
|
3280a9 |
+# Copyright (C) 2020 Red Hat, Inc.
|
|
|
3280a9 |
# All rights reserved.
|
|
|
3280a9 |
#
|
|
|
3280a9 |
# License: GPL (version 3 or any later version).
|
|
|
3280a9 |
@@ -87,9 +87,9 @@ def _add_user(request, topo):
|
|
|
3280a9 |
request.addfinalizer(fin)
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
-def test_allow_write_privilege_to_anyone(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Modrdn Test 1 Allow write privilege to anyone
|
|
|
3280a9 |
+def test_allow_write_privilege_to_anyone(topo, _add_user, aci_of_user, request):
|
|
|
3280a9 |
+ """Modrdn Test 1 Allow write privilege to anyone
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: 4406f12e-7932-11e8-9dea-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -102,8 +102,8 @@ def test_allow_write_privilege_to_anyone(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
3. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",
|
|
|
3280a9 |
- '(target ="ldap:///{}")(targetattr=*)(version 3.0;acl "$tet_thistest";allow '
|
|
|
3280a9 |
- '(write) (userdn = "ldap:///anyone");)'.format(DEFAULT_SUFFIX))
|
|
|
3280a9 |
+ '(target ="ldap:///{}")(targetattr="*")(version 3.0;acl "{}";allow '
|
|
|
3280a9 |
+ '(write) (userdn = "ldap:///anyone");)'.format(DEFAULT_SUFFIX, request.node.name))
|
|
|
3280a9 |
conn = Anonymous(topo.standalone).bind()
|
|
|
3280a9 |
# Allow write privilege to anyone
|
|
|
3280a9 |
useraccount = UserAccount(conn, USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
@@ -115,22 +115,22 @@ def test_allow_write_privilege_to_anyone(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_allow_write_privilege_to_dynamic_group_with_scope_set_to_base_in_ldap_url(
|
|
|
3280a9 |
- topo, _add_user, aci_of_user
|
|
|
3280a9 |
+ topo, _add_user, aci_of_user, request
|
|
|
3280a9 |
):
|
|
|
3280a9 |
+ """Modrdn Test 2 Allow write privilege to DYNAMIC_MODRDN group with scope set to base in LDAP URL
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ :id: 4c0f8c00-7932-11e8-8398-8c16451d917b
|
|
|
3280a9 |
+ :setup: server
|
|
|
3280a9 |
+ :steps:
|
|
|
3280a9 |
+ 1. Add test entry
|
|
|
3280a9 |
+ 2. Add ACI
|
|
|
3280a9 |
+ 3. User should follow ACI role
|
|
|
3280a9 |
+ :expectedresults:
|
|
|
3280a9 |
+ 1. Entry should be added
|
|
|
3280a9 |
+ 2. Operation should succeed
|
|
|
3280a9 |
+ 3. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
- Modrdn Test 2 Allow write privilege to DYNAMIC_MODRDN group with scope set to base in LDAP URL
|
|
|
3280a9 |
- :id: 4c0f8c00-7932-11e8-8398-8c16451d917b
|
|
|
3280a9 |
- :setup: server
|
|
|
3280a9 |
- :steps:
|
|
|
3280a9 |
- 1. Add test entry
|
|
|
3280a9 |
- 2. Add ACI
|
|
|
3280a9 |
- 3. User should follow ACI role
|
|
|
3280a9 |
- :expectedresults:
|
|
|
3280a9 |
- 1. Entry should be added
|
|
|
3280a9 |
- 2. Operation should succeed
|
|
|
3280a9 |
- 3. Operation should succeed
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",'(target = ldap:///{})(targetattr=*)(version 3.0; acl "$tet_thistest"; allow(all)(groupdn = "ldap:///{}"); )'.format(DEFAULT_SUFFIX, DYNAMIC_MODRDN))
|
|
|
3280a9 |
+ Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",'(target = ldap:///{})(targetattr="*")(version 3.0; acl "{}"; allow(all)(groupdn = "ldap:///{}"); )'.format(DEFAULT_SUFFIX, request.node.name, DYNAMIC_MODRDN))
|
|
|
3280a9 |
conn = UserAccount(topo.standalone, USER_WITH_ACI_DELADD).bind(PW_DM)
|
|
|
3280a9 |
# Allow write privilege to DYNAMIC_MODRDN group with scope set to base in LDAP URL
|
|
|
3280a9 |
useraccount = UserAccount(conn, USER_DELADD)
|
|
|
3280a9 |
@@ -141,22 +141,22 @@ def test_allow_write_privilege_to_dynamic_group_with_scope_set_to_base_in_ldap_u
|
|
|
3280a9 |
assert 'cn=Jeff Vedder,ou=Product Development,dc=example,dc=com' == useraccount.dn
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
-def test_write_access_to_naming_atributes(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Test for write access to naming atributes (1)
|
|
|
3280a9 |
- Test that check for add writes to the new naming attr
|
|
|
3280a9 |
- :id: 532fc630-7932-11e8-8924-8c16451d917b
|
|
|
3280a9 |
- :setup: server
|
|
|
3280a9 |
- :steps:
|
|
|
3280a9 |
- 1. Add test entry
|
|
|
3280a9 |
- 2. Add ACI
|
|
|
3280a9 |
- 3. User should follow ACI role
|
|
|
3280a9 |
- :expectedresults:
|
|
|
3280a9 |
- 1. Entry should be added
|
|
|
3280a9 |
- 2. Operation should succeed
|
|
|
3280a9 |
- 3. Operation should succeed
|
|
|
3280a9 |
+def test_write_access_to_naming_atributes(topo, _add_user, aci_of_user, request):
|
|
|
3280a9 |
+ """Test for write access to naming atributes
|
|
|
3280a9 |
+ Test that check for add writes to the new naming attr
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ :id: 532fc630-7932-11e8-8924-8c16451d917b
|
|
|
3280a9 |
+ :setup: server
|
|
|
3280a9 |
+ :steps:
|
|
|
3280a9 |
+ 1. Add test entry
|
|
|
3280a9 |
+ 2. Add ACI
|
|
|
3280a9 |
+ 3. User should follow ACI role
|
|
|
3280a9 |
+ :expectedresults:
|
|
|
3280a9 |
+ 1. Entry should be added
|
|
|
3280a9 |
+ 2. Operation should succeed
|
|
|
3280a9 |
+ 3. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
- Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", '(target ="ldap:///{}")(targetattr != "uid")(version 3.0;acl "$tet_thistest";allow (write) (userdn = "ldap:///anyone");)'.format(DEFAULT_SUFFIX))
|
|
|
3280a9 |
+ Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", '(target ="ldap:///{}")(targetattr != "uid")(version 3.0;acl "{}";allow (write) (userdn = "ldap:///anyone");)'.format(DEFAULT_SUFFIX, request.node.name))
|
|
|
3280a9 |
conn = UserAccount(topo.standalone, USER_WITH_ACI_DELADD).bind(PW_DM)
|
|
|
3280a9 |
#Test for write access to naming atributes
|
|
|
3280a9 |
useraccount = UserAccount(conn, USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
@@ -164,23 +164,23 @@ def test_write_access_to_naming_atributes(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
useraccount.rename("uid=Jeffbo Vedder")
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
-def test_write_access_to_naming_atributes_two(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Test for write access to naming atributes (2)
|
|
|
3280a9 |
- :id: 5a2077d2-7932-11e8-9e7b-8c16451d917b
|
|
|
3280a9 |
- :setup: server
|
|
|
3280a9 |
- :steps:
|
|
|
3280a9 |
- 1. Add test entry
|
|
|
3280a9 |
- 2. Add ACI
|
|
|
3280a9 |
- 3. User should follow ACI role
|
|
|
3280a9 |
- 4. Now try to modrdn it to cn, won't work if request deleteoldrdn.
|
|
|
3280a9 |
- :expectedresults:
|
|
|
3280a9 |
- 1. Entry should be added
|
|
|
3280a9 |
- 2. Operation should succeed
|
|
|
3280a9 |
- 3. Operation should succeed
|
|
|
3280a9 |
- 4. Operation should not succeed
|
|
|
3280a9 |
+def test_write_access_to_naming_atributes_two(topo, _add_user, aci_of_user, request):
|
|
|
3280a9 |
+ """Test for write access to naming atributes (2)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ :id: 5a2077d2-7932-11e8-9e7b-8c16451d917b
|
|
|
3280a9 |
+ :setup: server
|
|
|
3280a9 |
+ :steps:
|
|
|
3280a9 |
+ 1. Add test entry
|
|
|
3280a9 |
+ 2. Add ACI
|
|
|
3280a9 |
+ 3. User should follow ACI role
|
|
|
3280a9 |
+ 4. Now try to modrdn it to cn, won't work if request deleteoldrdn.
|
|
|
3280a9 |
+ :expectedresults:
|
|
|
3280a9 |
+ 1. Entry should be added
|
|
|
3280a9 |
+ 2. Operation should succeed
|
|
|
3280a9 |
+ 3. Operation should succeed
|
|
|
3280a9 |
+ 4. Operation should not succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
- Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", '(target ="ldap:///{}")(targetattr != "uid")(version 3.0;acl "$tet_thistest";allow (write) (userdn = "ldap:///anyone");)'.format(DEFAULT_SUFFIX))
|
|
|
3280a9 |
+ Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", '(target ="ldap:///{}")(targetattr != "uid")(version 3.0;acl "{}";allow (write) (userdn = "ldap:///anyone");)'.format(DEFAULT_SUFFIX, request.node.name))
|
|
|
3280a9 |
properties = {
|
|
|
3280a9 |
'uid': 'Sam Carter1',
|
|
|
3280a9 |
'cn': 'Sam Carter1',
|
|
|
3280a9 |
@@ -202,22 +202,22 @@ def test_write_access_to_naming_atributes_two(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
|
|
|
3280a9 |
@pytest.mark.bz950351
|
|
|
3280a9 |
def test_access_aci_list_contains_any_deny_rule(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Testing bug #950351: RHDS denies MODRDN access if ACI list contains any DENY rule
|
|
|
3280a9 |
- Bug description: If you create a deny ACI for some or more attributes there is incorrect behaviour
|
|
|
3280a9 |
- as you cannot rename the entry anymore
|
|
|
3280a9 |
- :id: 62cbbb8a-7932-11e8-96a7-8c16451d917b
|
|
|
3280a9 |
- :setup: server
|
|
|
3280a9 |
- :steps:
|
|
|
3280a9 |
- 1. Add test entry
|
|
|
3280a9 |
- 2. Adding a new ou ou=People to $BASEDN
|
|
|
3280a9 |
- 3. Adding a user NEWENTRY9_MODRDN to ou=People,$BASEDN
|
|
|
3280a9 |
- 4. Adding an allow rule for NEWENTRY9_MODRDN and for others an aci deny rule
|
|
|
3280a9 |
- :expectedresults:
|
|
|
3280a9 |
- 1. Entry should be added
|
|
|
3280a9 |
- 2. Operation should succeed
|
|
|
3280a9 |
- 3. Operation should succeed
|
|
|
3280a9 |
- 4. Operation should succeed
|
|
|
3280a9 |
+ """RHDS denies MODRDN access if ACI list contains any DENY rule
|
|
|
3280a9 |
+ Bug description: If you create a deny ACI for some or more attributes there is incorrect behaviour
|
|
|
3280a9 |
+ as you cannot rename the entry anymore
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ :id: 62cbbb8a-7932-11e8-96a7-8c16451d917b
|
|
|
3280a9 |
+ :setup: server
|
|
|
3280a9 |
+ :steps:
|
|
|
3280a9 |
+ 1. Add test entry
|
|
|
3280a9 |
+ 2. Adding a new ou ou=People to $BASEDN
|
|
|
3280a9 |
+ 3. Adding a user NEWENTRY9_MODRDN to ou=People,$BASEDN
|
|
|
3280a9 |
+ 4. Adding an allow rule for NEWENTRY9_MODRDN and for others an aci deny rule
|
|
|
3280a9 |
+ :expectedresults:
|
|
|
3280a9 |
+ 1. Entry should be added
|
|
|
3280a9 |
+ 2. Operation should succeed
|
|
|
3280a9 |
+ 3. Operation should succeed
|
|
|
3280a9 |
+ 4. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
properties = {
|
|
|
3280a9 |
'uid': 'NEWENTRY9_MODRDN',
|
|
|
3280a9 |
@@ -245,28 +245,28 @@ def test_access_aci_list_contains_any_deny_rule(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_renaming_target_entry(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Test for renaming target entry
|
|
|
3280a9 |
- :id: 6be1d33a-7932-11e8-9115-8c16451d917b
|
|
|
3280a9 |
- :setup: server
|
|
|
3280a9 |
- :steps:
|
|
|
3280a9 |
- 1. Add test entry
|
|
|
3280a9 |
- 2. Create a test user entry
|
|
|
3280a9 |
- 3.Create a new ou entry with an aci
|
|
|
3280a9 |
- 4. Make sure uid=$MYUID has the access
|
|
|
3280a9 |
- 5. Rename ou=OU0 to ou=OU1
|
|
|
3280a9 |
- 6. Create another ou=OU2
|
|
|
3280a9 |
- 7. Move ou=OU1 under ou=OU2
|
|
|
3280a9 |
- 8. Make sure uid=$MYUID still has the access
|
|
|
3280a9 |
- :expectedresults:
|
|
|
3280a9 |
- 1. Entry should be added
|
|
|
3280a9 |
- 2. Operation should succeed
|
|
|
3280a9 |
- 3. Operation should succeed
|
|
|
3280a9 |
- 4. Operation should succeed
|
|
|
3280a9 |
- 5. Operation should succeed
|
|
|
3280a9 |
- 6. Operation should succeed
|
|
|
3280a9 |
- 7. Operation should succeed
|
|
|
3280a9 |
- 8. Operation should succeed
|
|
|
3280a9 |
+ """Test for renaming target entry
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ :id: 6be1d33a-7932-11e8-9115-8c16451d917b
|
|
|
3280a9 |
+ :setup: server
|
|
|
3280a9 |
+ :steps:
|
|
|
3280a9 |
+ 1. Add test entry
|
|
|
3280a9 |
+ 2. Create a test user entry
|
|
|
3280a9 |
+ 3. Create a new ou entry with an aci
|
|
|
3280a9 |
+ 4. Make sure uid=$MYUID has the access
|
|
|
3280a9 |
+ 5. Rename ou=OU0 to ou=OU1
|
|
|
3280a9 |
+ 6. Create another ou=OU2
|
|
|
3280a9 |
+ 7. Move ou=OU1 under ou=OU2
|
|
|
3280a9 |
+ 8. Make sure uid=$MYUID still has the access
|
|
|
3280a9 |
+ :expectedresults:
|
|
|
3280a9 |
+ 1. Entry should be added
|
|
|
3280a9 |
+ 2. Operation should succeed
|
|
|
3280a9 |
+ 3. Operation should succeed
|
|
|
3280a9 |
+ 4. Operation should succeed
|
|
|
3280a9 |
+ 5. Operation should succeed
|
|
|
3280a9 |
+ 6. Operation should succeed
|
|
|
3280a9 |
+ 7. Operation should succeed
|
|
|
3280a9 |
+ 8. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
properties = {
|
|
|
3280a9 |
'uid': 'TRAC340_MODRDN',
|
|
|
3280a9 |
@@ -281,7 +281,7 @@ def test_renaming_target_entry(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
user.set("userPassword", "password")
|
|
|
3280a9 |
ou = OrganizationalUnit(topo.standalone, 'ou=OU0,{}'.format(DEFAULT_SUFFIX))
|
|
|
3280a9 |
ou.create(properties={'ou': 'OU0'})
|
|
|
3280a9 |
- ou.set('aci', '(targetattr=*)(version 3.0; acl "$MYUID";allow(read, search, compare) userdn = "ldap:///{}";)'.format(TRAC340_MODRDN))
|
|
|
3280a9 |
+ ou.set('aci', '(targetattr="*")(version 3.0; acl "$MYUID";allow(read, search, compare) userdn = "ldap:///{}";)'.format(TRAC340_MODRDN))
|
|
|
3280a9 |
conn = UserAccount(topo.standalone, TRAC340_MODRDN).bind(PW_DM)
|
|
|
3280a9 |
assert OrganizationalUnits(conn, DEFAULT_SUFFIX).get('OU0')
|
|
|
3280a9 |
# Test for renaming target entry
|
|
|
3280a9 |
diff --git a/dirsrvtests/tests/suites/acl/roledn_test.py b/dirsrvtests/tests/suites/acl/roledn_test.py
|
|
|
3280a9 |
index 227ebd95f..6ccd652cf 100644
|
|
|
3280a9 |
--- a/dirsrvtests/tests/suites/acl/roledn_test.py
|
|
|
3280a9 |
+++ b/dirsrvtests/tests/suites/acl/roledn_test.py
|
|
|
3280a9 |
@@ -78,10 +78,10 @@ def _add_user(request, topo):
|
|
|
3280a9 |
f'(target="ldap:///{OR_RULE_ACCESS}")(targetattr="*")'
|
|
|
3280a9 |
f'(version 3.0; aci "or role aci"; allow(all) '
|
|
|
3280a9 |
f'roledn = "ldap:///{ROLE1} || ldap:///{ROLE21}";)',
|
|
|
3280a9 |
- f'(target="ldap:///{ALL_ACCESS}")(targetattr=*)'
|
|
|
3280a9 |
+ f'(target="ldap:///{ALL_ACCESS}")(targetattr="*")'
|
|
|
3280a9 |
f'(version 3.0; aci "anyone role aci"; allow(all) '
|
|
|
3280a9 |
f'roledn = "ldap:///anyone";)',
|
|
|
3280a9 |
- f'(target="ldap:///{NOT_RULE_ACCESS}")(targetattr=*)'
|
|
|
3280a9 |
+ f'(target="ldap:///{NOT_RULE_ACCESS}")(targetattr="*")'
|
|
|
3280a9 |
f'(version 3.0; aci "not role aci"; allow(all)'
|
|
|
3280a9 |
f'roledn != "ldap:///{ROLE1} || ldap:///{ROLE21}";)'])
|
|
|
3280a9 |
|
|
|
3280a9 |
diff --git a/dirsrvtests/tests/suites/acl/selfdn_permissions_test.py b/dirsrvtests/tests/suites/acl/selfdn_permissions_test.py
|
|
|
3280a9 |
index af7501338..dd506a786 100644
|
|
|
3280a9 |
--- a/dirsrvtests/tests/suites/acl/selfdn_permissions_test.py
|
|
|
3280a9 |
+++ b/dirsrvtests/tests/suites/acl/selfdn_permissions_test.py
|
|
|
3280a9 |
@@ -1,5 +1,5 @@
|
|
|
3280a9 |
# --- BEGIN COPYRIGHT BLOCK ---
|
|
|
3280a9 |
-# Copyright (C) 2016 Red Hat, Inc.
|
|
|
3280a9 |
+# Copyright (C) 2020 Red Hat, Inc.
|
|
|
3280a9 |
# All rights reserved.
|
|
|
3280a9 |
#
|
|
|
3280a9 |
# License: GPL (version 3 or any later version).
|
|
|
3280a9 |
@@ -90,8 +90,8 @@ def test_selfdn_permission_add(topology_st, allow_user_init):
|
|
|
3280a9 |
|
|
|
3280a9 |
:id: e837a9ef-be92-48da-ad8b-ebf42b0fede1
|
|
|
3280a9 |
:setup: Standalone instance, add a entry which is used to bind,
|
|
|
3280a9 |
- enable acl error logging by setting 'nsslapd-errorlog-level' to '128',
|
|
|
3280a9 |
- remove aci's to start with a clean slate, and add dummy entries
|
|
|
3280a9 |
+ enable acl error logging by setting 'nsslapd-errorlog-level' to '128',
|
|
|
3280a9 |
+ remove aci's to start with a clean slate, and add dummy entries
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
1. Check we can not ADD an entry without the proper SELFDN aci
|
|
|
3280a9 |
2. Check with the proper ACI we can not ADD with 'member' attribute
|
|
|
3280a9 |
@@ -191,8 +191,8 @@ def test_selfdn_permission_search(topology_st, allow_user_init):
|
|
|
3280a9 |
|
|
|
3280a9 |
:id: 06d51ef9-c675-4583-99b2-4852dbda190e
|
|
|
3280a9 |
:setup: Standalone instance, add a entry which is used to bind,
|
|
|
3280a9 |
- enable acl error logging by setting 'nsslapd-errorlog-level' to '128',
|
|
|
3280a9 |
- remove aci's to start with a clean slate, and add dummy entries
|
|
|
3280a9 |
+ enable acl error logging by setting 'nsslapd-errorlog-level' to '128',
|
|
|
3280a9 |
+ remove aci's to start with a clean slate, and add dummy entries
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
1. Check we can not search an entry without the proper SELFDN aci
|
|
|
3280a9 |
2. Add proper ACI
|
|
|
3280a9 |
@@ -217,7 +217,7 @@ def test_selfdn_permission_search(topology_st, allow_user_init):
|
|
|
3280a9 |
topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
|
|
|
3280a9 |
|
|
|
3280a9 |
ACI_TARGET = "(target = \"ldap:///cn=*,%s\")" % SUFFIX
|
|
|
3280a9 |
- ACI_TARGETATTR = "(targetattr = *)"
|
|
|
3280a9 |
+ ACI_TARGETATTR = '(targetattr="*")'
|
|
|
3280a9 |
ACI_TARGETFILTER = "(targetfilter =\"(objectClass=%s)\")" % OC_NAME
|
|
|
3280a9 |
ACI_ALLOW = "(version 3.0; acl \"SelfDN search-read\"; allow (read, search, compare)"
|
|
|
3280a9 |
ACI_SUBJECT = " userattr = \"member#selfDN\";)"
|
|
|
3280a9 |
@@ -241,8 +241,8 @@ def test_selfdn_permission_modify(topology_st, allow_user_init):
|
|
|
3280a9 |
|
|
|
3280a9 |
:id: 97a58844-095f-44b0-9029-dd29a7d83d68
|
|
|
3280a9 |
:setup: Standalone instance, add a entry which is used to bind,
|
|
|
3280a9 |
- enable acl error logging by setting 'nsslapd-errorlog-level' to '128',
|
|
|
3280a9 |
- remove aci's to start with a clean slate, and add dummy entries
|
|
|
3280a9 |
+ enable acl error logging by setting 'nsslapd-errorlog-level' to '128',
|
|
|
3280a9 |
+ remove aci's to start with a clean slate, and add dummy entries
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
1. Check we can not modify an entry without the proper SELFDN aci
|
|
|
3280a9 |
2. Add proper ACI
|
|
|
3280a9 |
@@ -272,7 +272,7 @@ def test_selfdn_permission_modify(topology_st, allow_user_init):
|
|
|
3280a9 |
topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
|
|
|
3280a9 |
|
|
|
3280a9 |
ACI_TARGET = "(target = \"ldap:///cn=*,%s\")" % SUFFIX
|
|
|
3280a9 |
- ACI_TARGETATTR = "(targetattr = *)"
|
|
|
3280a9 |
+ ACI_TARGETATTR = '(targetattr="*")'
|
|
|
3280a9 |
ACI_TARGETFILTER = "(targetfilter =\"(objectClass=%s)\")" % OC_NAME
|
|
|
3280a9 |
ACI_ALLOW = "(version 3.0; acl \"SelfDN write\"; allow (write)"
|
|
|
3280a9 |
ACI_SUBJECT = " userattr = \"member#selfDN\";)"
|
|
|
3280a9 |
@@ -300,8 +300,8 @@ def test_selfdn_permission_delete(topology_st, allow_user_init):
|
|
|
3280a9 |
|
|
|
3280a9 |
:id: 0ec4c0ec-e7b0-4ef1-8373-ab25aae34516
|
|
|
3280a9 |
:setup: Standalone instance, add a entry which is used to bind,
|
|
|
3280a9 |
- enable acl error logging by setting 'nsslapd-errorlog-level' to '128',
|
|
|
3280a9 |
- remove aci's to start with a clean slate, and add dummy entries
|
|
|
3280a9 |
+ enable acl error logging by setting 'nsslapd-errorlog-level' to '128',
|
|
|
3280a9 |
+ remove aci's to start with a clean slate, and add dummy entries
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
1. Check we can not delete an entry without the proper SELFDN aci
|
|
|
3280a9 |
2. Add proper ACI
|
|
|
3280a9 |
@@ -309,6 +309,7 @@ def test_selfdn_permission_delete(topology_st, allow_user_init):
|
|
|
3280a9 |
:expectedresults:
|
|
|
3280a9 |
1. Operation should be successful
|
|
|
3280a9 |
2. Operation should be successful
|
|
|
3280a9 |
+ 3. Operation should be successful
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
topology_st.standalone.log.info("\n\n######################### DELETE ######################\n")
|
|
|
3280a9 |
|
|
|
3280a9 |
diff --git a/dirsrvtests/tests/suites/acl/syntax_test.py b/dirsrvtests/tests/suites/acl/syntax_test.py
|
|
|
3280a9 |
index c143ff7c9..b8f27480a 100644
|
|
|
3280a9 |
--- a/dirsrvtests/tests/suites/acl/syntax_test.py
|
|
|
3280a9 |
+++ b/dirsrvtests/tests/suites/acl/syntax_test.py
|
|
|
3280a9 |
@@ -1,12 +1,10 @@
|
|
|
3280a9 |
-"""
|
|
|
3280a9 |
# --- BEGIN COPYRIGHT BLOCK ---
|
|
|
3280a9 |
-# Copyright (C) 2019 Red Hat, Inc.
|
|
|
3280a9 |
+# Copyright (C) 2020 Red Hat, Inc.
|
|
|
3280a9 |
# All rights reserved.
|
|
|
3280a9 |
#
|
|
|
3280a9 |
# License: GPL (version 3 or any later version).
|
|
|
3280a9 |
# See LICENSE for details.
|
|
|
3280a9 |
# --- END COPYRIGHT BLOCK ----
|
|
|
3280a9 |
-"""
|
|
|
3280a9 |
|
|
|
3280a9 |
import os
|
|
|
3280a9 |
import pytest
|
|
|
3280a9 |
@@ -74,66 +72,66 @@ INVALID = [('test_targattrfilters_1',
|
|
|
3280a9 |
f'(version 3.0; acl "Name of the ACI"; deny absolute (all)userdn="ldap:///anyone";)'),
|
|
|
3280a9 |
('test_targattrfilters_19',
|
|
|
3280a9 |
f'(target = ldap:///cn=Jeff Vedder,ou=Product Development,{DEFAULT_SUFFIX})'
|
|
|
3280a9 |
- f'(targetattr=*)'
|
|
|
3280a9 |
+ f'(targetattr="*")'
|
|
|
3280a9 |
f'(version 3.0; acl "Name of the ACI"; deny(write)gropdn="ldap:///anyone";)'),
|
|
|
3280a9 |
('test_targattrfilters_21',
|
|
|
3280a9 |
f'(target = ldap:///cn=Jeff Vedder,ou=Product Development,{DEFAULT_SUFFIX})'
|
|
|
3280a9 |
- f'(targetattr=*)'
|
|
|
3280a9 |
+ f'(targetattr="*")'
|
|
|
3280a9 |
f'(version 3.0; acl "Name of the ACI"; deny(rite)userdn="ldap:///anyone";)'),
|
|
|
3280a9 |
('test_targattrfilters_22',
|
|
|
3280a9 |
f'(targt = ldap:///cn=Jeff Vedder,ou=Product Development,{DEFAULT_SUFFIX})'
|
|
|
3280a9 |
- f'(targetattr=*)'
|
|
|
3280a9 |
+ f'(targetattr="*")'
|
|
|
3280a9 |
f'(version 3.0; acl "Name of the ACI"; deny absolute (all)userdn="ldap:///anyone";)'),
|
|
|
3280a9 |
('test_targattrfilters_23',
|
|
|
3280a9 |
f'(target = ldap:///cn=Jeff Vedder,ou=Product Development,{DEFAULT_SUFFIX})'
|
|
|
3280a9 |
- f'(targetattr=*)'
|
|
|
3280a9 |
+ f'(targetattr="*")'
|
|
|
3280a9 |
f'(version 3.0; acl "Name of the ACI"; absolute (all)userdn="ldap:///anyone";)'),
|
|
|
3280a9 |
('test_Missing_acl_mispel',
|
|
|
3280a9 |
f'(target = ldap:///cn=Jeff Vedder,ou=Product Development,{DEFAULT_SUFFIX})'
|
|
|
3280a9 |
- f'(targetattr=*)'
|
|
|
3280a9 |
+ f'(targetattr="*")'
|
|
|
3280a9 |
f'(version 3.0; alc "Name of the ACI"; deny absolute (all)userdn="ldap:///anyone";)'),
|
|
|
3280a9 |
('test_Missing_acl_string',
|
|
|
3280a9 |
f'(target = ldap:///cn=Jeff Vedder,ou=Product Development,{DEFAULT_SUFFIX})'
|
|
|
3280a9 |
- f'(targetattr=*)'
|
|
|
3280a9 |
+ f'(targetattr="*")'
|
|
|
3280a9 |
f'(version 3.0; "Name of the ACI"; deny absolute (all)userdn="ldap:///anyone";)'),
|
|
|
3280a9 |
('test_Wrong_version_string',
|
|
|
3280a9 |
f'(target = ldap:///cn=Jeff Vedder,ou=Product Development,{DEFAULT_SUFFIX})'
|
|
|
3280a9 |
- f'(targetattr=*)'
|
|
|
3280a9 |
+ f'(targetattr="*")'
|
|
|
3280a9 |
f'(version 2.0; acl "Name of the ACI"; deny absolute (all)userdn="ldap:///anyone";)'),
|
|
|
3280a9 |
('test_Missing_version_string',
|
|
|
3280a9 |
f'(target = ldap:///cn=Jeff Vedder,ou=Product Development,{DEFAULT_SUFFIX})'
|
|
|
3280a9 |
- f'(targetattr=*)'
|
|
|
3280a9 |
+ f'(targetattr="*")'
|
|
|
3280a9 |
f'(; acl "Name of the ACI"; deny absolute (all)userdn="ldap:///anyone";)'),
|
|
|
3280a9 |
('test_Authenticate_statement',
|
|
|
3280a9 |
f'(target = ldap:///cn=Jeff Vedder,ou=Product Development,{DEFAULT_SUFFIX})'
|
|
|
3280a9 |
f'(targetattr != "uid")'
|
|
|
3280a9 |
- f'(targetattr=*)(version 3.0; acl "Name of the ACI"; deny absolute (all)'
|
|
|
3280a9 |
+ f'(targetattr="*")(version 3.0; acl "Name of the ACI"; deny absolute (all)'
|
|
|
3280a9 |
f'userdn="ldap:///anyone";)'),
|
|
|
3280a9 |
('test_Multiple_targets',
|
|
|
3280a9 |
f'(target = ldap:///ou=Product Development,{DEFAULT_SUFFIX})'
|
|
|
3280a9 |
- f'(target = ldap:///ou=Product Testing,{DEFAULT_SUFFIX})(targetattr=*)'
|
|
|
3280a9 |
+ f'(target = ldap:///ou=Product Testing,{DEFAULT_SUFFIX})(targetattr="*")'
|
|
|
3280a9 |
f'(version 3.0; acl "Name of the ACI"; deny absolute (all)userdn="ldap:///anyone";)'),
|
|
|
3280a9 |
('test_Target_set_to_self',
|
|
|
3280a9 |
- f'(target = ldap:///self)(targetattr=*)'
|
|
|
3280a9 |
+ f'(target = ldap:///self)(targetattr="*")'
|
|
|
3280a9 |
f'(version 3.0; acl "Name of the ACI"; deny absolute (all)userdn="ldap:///anyone";)'),
|
|
|
3280a9 |
('test_target_set_with_ldap_instead_of_ldap',
|
|
|
3280a9 |
- f'(target = ldap:\\\{DEFAULT_SUFFIX})(targetattr=*)'
|
|
|
3280a9 |
+ f'(target = ldap:\\\{DEFAULT_SUFFIX})(targetattr="*")'
|
|
|
3280a9 |
f'(version 3.0; acl "Name of the ACI"; deny absolute (all)userdn="ldap:///anyone";)'),
|
|
|
3280a9 |
('test_target_set_with_more_than_three',
|
|
|
3280a9 |
- f'(target = ldap:////{DEFAULT_SUFFIX})(targetattr=*)'
|
|
|
3280a9 |
+ f'(target = ldap:////{DEFAULT_SUFFIX})(targetattr="*")'
|
|
|
3280a9 |
f'(version 3.0; acl "Name of the ACI"; deny absolute (all)userdn="ldap:///anyone";)'),
|
|
|
3280a9 |
('test_target_set_with_less_than_three',
|
|
|
3280a9 |
- f'(target = ldap://{DEFAULT_SUFFIX})(targetattr=*)'
|
|
|
3280a9 |
+ f'(target = ldap://{DEFAULT_SUFFIX})(targetattr="*")'
|
|
|
3280a9 |
f'(version 3.0; acl "Name of the ACI"; deny absolute (all)userdn="ldap:///anyone";)'),
|
|
|
3280a9 |
('test_bind_rule_set_with_less_than_three',
|
|
|
3280a9 |
- f'(target = ldap:///{DEFAULT_SUFFIX})(targetattr=*)'
|
|
|
3280a9 |
+ f'(target = ldap:///{DEFAULT_SUFFIX})(targetattr="*")'
|
|
|
3280a9 |
f'(version 3.0; acl "Name of the ACI"; deny absolute (all)userdn="ldap:/anyone";)'),
|
|
|
3280a9 |
('test_Use_semicolon_instead_of_comma_in_permission',
|
|
|
3280a9 |
- f'(target = ldap:///{DEFAULT_SUFFIX})(targetattr=*)'
|
|
|
3280a9 |
+ f'(target = ldap:///{DEFAULT_SUFFIX})(targetattr="*")'
|
|
|
3280a9 |
f'(version 3.0; acl "Name of the ACI"; deny '
|
|
|
3280a9 |
f'(read; search; compare; write)userdn="ldap:///anyone";)'),
|
|
|
3280a9 |
('test_Use_double_equal_instead_of_equal_in_the_target',
|
|
|
3280a9 |
- f'(target == ldap:///{DEFAULT_SUFFIX})(targetattr=*)'
|
|
|
3280a9 |
+ f'(target == ldap:///{DEFAULT_SUFFIX})(targetattr="*")'
|
|
|
3280a9 |
f'(version 3.0; acl "Name of the ACI"; deny absolute (all)userdn="ldap:///anyone";)'),
|
|
|
3280a9 |
('test_use_double_equal_instead_of_equal_in_user_and_group_access',
|
|
|
3280a9 |
f'(target = ldap:///{DEFAULT_SUFFIX})'
|
|
|
3280a9 |
@@ -143,21 +141,21 @@ INVALID = [('test_targattrfilters_1',
|
|
|
3280a9 |
f'(target = ldap:///{DEFAULT_SUFFIX})'
|
|
|
3280a9 |
f'(version 3.0; acl Name of the ACI ; deny absolute (all)userdn = "ldap:///anyone";)'),
|
|
|
3280a9 |
('test_extra_parentheses_case_1',
|
|
|
3280a9 |
- f'( )(target = ldap:///{DEFAULT_SUFFIX}) (targetattr=*)'
|
|
|
3280a9 |
+ f'( )(target = ldap:///{DEFAULT_SUFFIX}) (targetattr="*")'
|
|
|
3280a9 |
f'(version 3.0; acl "Name of the ACI"; deny absolute (all)userdn = "ldap:///anyone";)'),
|
|
|
3280a9 |
('test_extra_parentheses_case_2',
|
|
|
3280a9 |
- f'(((((target = ldap:///{DEFAULT_SUFFIX})(targetattr=*)'
|
|
|
3280a9 |
+ f'(((((target = ldap:///{DEFAULT_SUFFIX})(targetattr="*")'
|
|
|
3280a9 |
f'(version 3.0; acl "Name of the ACI"; deny absolute (all)'
|
|
|
3280a9 |
f'userdn == "ldap:///anyone";)'),
|
|
|
3280a9 |
('test_extra_parentheses_case_3',
|
|
|
3280a9 |
- f'(((target = ldap:///{DEFAULT_SUFFIX}) (targetattr=*)'
|
|
|
3280a9 |
+ f'(((target = ldap:///{DEFAULT_SUFFIX}) (targetattr="*")'
|
|
|
3280a9 |
f'(version 3.0; acl "Name of the ACI"; deny absolute '
|
|
|
3280a9 |
f'(all)userdn = "ldap:///anyone";)))'),
|
|
|
3280a9 |
('test_no_semicolon_at_the_end_of_the_aci',
|
|
|
3280a9 |
- f'(target = ldap:///{DEFAULT_SUFFIX}) (targetattr=*)'
|
|
|
3280a9 |
+ f'(target = ldap:///{DEFAULT_SUFFIX}) (targetattr="*")'
|
|
|
3280a9 |
f'(version 3.0; acl "Name of the ACI"; deny absolute (all)userdn = "ldap:///anyone")'),
|
|
|
3280a9 |
('test_a_character_different_of_a_semicolon_at_the_end_of_the_aci',
|
|
|
3280a9 |
- f'(target = ldap:///{DEFAULT_SUFFIX}) (targetattr=*)'
|
|
|
3280a9 |
+ f'(target = ldap:///{DEFAULT_SUFFIX}) (targetattr="*")'
|
|
|
3280a9 |
f'(version 3.0; acl "Name of the ACI"; deny absolute (all)userdn = "ldap:///anyone"%)'),
|
|
|
3280a9 |
('test_bad_filter',
|
|
|
3280a9 |
f'(target = ldap:///{DEFAULT_SUFFIX}) '
|
|
|
3280a9 |
@@ -173,14 +171,14 @@ INVALID = [('test_targattrfilters_1',
|
|
|
3280a9 |
|
|
|
3280a9 |
FAILED = [('test_targattrfilters_18',
|
|
|
3280a9 |
f'(target = ldap:///cn=Jeff Vedder,ou=Product Development,{DEFAULT_SUFFIX})'
|
|
|
3280a9 |
- f'(targetattr=*)'
|
|
|
3280a9 |
+ f'(targetattr="*")'
|
|
|
3280a9 |
f'(version 3.0; acl "Name of the ACI"; deny(write)userdn="ldap:///{"123" * 300}";)'),
|
|
|
3280a9 |
('test_targattrfilters_20',
|
|
|
3280a9 |
f'(target = ldap:///cn=Jeff Vedder,ou=Product Development,{DEFAULT_SUFFIX})'
|
|
|
3280a9 |
- f'(targetattr=*)'
|
|
|
3280a9 |
+ f'(targetattr="*")'
|
|
|
3280a9 |
f'(version 3.0; acl "Name of the ACI"; deny(write)userdns="ldap:///anyone";)'),
|
|
|
3280a9 |
('test_bind_rule_set_with_more_than_three',
|
|
|
3280a9 |
- f'(target = ldap:///{DEFAULT_SUFFIX})(targetattr=*)'
|
|
|
3280a9 |
+ f'(target = ldap:///{DEFAULT_SUFFIX})(targetattr="*")'
|
|
|
3280a9 |
f'(version 3.0; acl "Name of the ACI"; deny absolute (all)'
|
|
|
3280a9 |
f'userdn="ldap:////////anyone";)'),
|
|
|
3280a9 |
('test_Use_double_equal_instead_of_equal_in_the_targetattr',
|
|
|
3280a9 |
@@ -253,7 +251,7 @@ def test_target_set_above_the_entry_test(topo):
|
|
|
3280a9 |
domain = Domain(topo.standalone, "ou=People,{}".format(DEFAULT_SUFFIX))
|
|
|
3280a9 |
with pytest.raises(ldap.INVALID_SYNTAX):
|
|
|
3280a9 |
domain.add("aci", f'(target = ldap:///{DEFAULT_SUFFIX})'
|
|
|
3280a9 |
- f'(targetattr=*)(version 3.0; acl "Name of the ACI"; deny absolute '
|
|
|
3280a9 |
+ f'(targetattr="*")(version 3.0; acl "Name of the ACI"; deny absolute '
|
|
|
3280a9 |
f'(all)userdn="ldap:///anyone";)')
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
diff --git a/dirsrvtests/tests/suites/acl/userattr_test.py b/dirsrvtests/tests/suites/acl/userattr_test.py
|
|
|
3280a9 |
index 542d7afc9..3a13d32dc 100644
|
|
|
3280a9 |
--- a/dirsrvtests/tests/suites/acl/userattr_test.py
|
|
|
3280a9 |
+++ b/dirsrvtests/tests/suites/acl/userattr_test.py
|
|
|
3280a9 |
@@ -1,5 +1,5 @@
|
|
|
3280a9 |
# --- BEGIN COPYRIGHT BLOCK ---
|
|
|
3280a9 |
-# Copyright (C) 2019 Red Hat, Inc.
|
|
|
3280a9 |
+# Copyright (C) 2020 Red Hat, Inc.
|
|
|
3280a9 |
# All rights reserved.
|
|
|
3280a9 |
#
|
|
|
3280a9 |
# License: GPL (version 3 or any later version).
|
|
|
3280a9 |
@@ -55,7 +55,7 @@ def _add_user(topo):
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
This function will create user for the test and in the end entries will be deleted .
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
- role_aci_body = '(targetattr=*)(version 3.0; aci "role aci"; allow(all)'
|
|
|
3280a9 |
+ role_aci_body = '(targetattr="*")(version 3.0; aci "role aci"; allow(all)'
|
|
|
3280a9 |
# Creating OUs
|
|
|
3280a9 |
ous = OrganizationalUnits(topo.standalone, DEFAULT_SUFFIX)
|
|
|
3280a9 |
ou_accounting = ous.create(properties={'ou': 'Accounting'})
|
|
|
3280a9 |
@@ -77,7 +77,7 @@ def _add_user(topo):
|
|
|
3280a9 |
'description': LEVEL_1,
|
|
|
3280a9 |
'businessCategory': LEVEL_0})
|
|
|
3280a9 |
|
|
|
3280a9 |
- inheritance_aci_body = '(targetattr=*)(version 3.0; aci "Inheritance aci"; allow(all) '
|
|
|
3280a9 |
+ inheritance_aci_body = '(targetattr="*")(version 3.0; aci "Inheritance aci"; allow(all) '
|
|
|
3280a9 |
ou_inheritance.set('aci', [f'{inheritance_aci_body} '
|
|
|
3280a9 |
f'userattr = "parent[0].businessCategory#USERDN";)',
|
|
|
3280a9 |
f'{inheritance_aci_body} '
|
|
|
3280a9 |
diff --git a/dirsrvtests/tests/suites/acl/valueacl_part2_test.py b/dirsrvtests/tests/suites/acl/valueacl_part2_test.py
|
|
|
3280a9 |
index 5f5b1c64e..763c0b5a2 100644
|
|
|
3280a9 |
--- a/dirsrvtests/tests/suites/acl/valueacl_part2_test.py
|
|
|
3280a9 |
+++ b/dirsrvtests/tests/suites/acl/valueacl_part2_test.py
|
|
|
3280a9 |
@@ -28,6 +28,17 @@ HUMAN_OU_GLOBAL = "ou=Human Resources,{}".format(DEFAULT_SUFFIX)
|
|
|
3280a9 |
|
|
|
3280a9 |
@pytest.fixture(scope="function")
|
|
|
3280a9 |
def aci_of_user(request, topo):
|
|
|
3280a9 |
+ # Add anonymous access aci
|
|
|
3280a9 |
+ ACI_TARGET = "(targetattr != \"userpassword\")(target = \"ldap:///%s\")" % (DEFAULT_SUFFIX)
|
|
|
3280a9 |
+ ACI_ALLOW = "(version 3.0; acl \"Anonymous Read access\"; allow (read,search,compare)"
|
|
|
3280a9 |
+ ACI_SUBJECT = "(userdn=\"ldap:///anyone\");)"
|
|
|
3280a9 |
+ ANON_ACI = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
|
|
|
3280a9 |
+ suffix = Domain(topo.standalone, DEFAULT_SUFFIX)
|
|
|
3280a9 |
+ try:
|
|
|
3280a9 |
+ suffix.add('aci', ANON_ACI)
|
|
|
3280a9 |
+ except ldap.TYPE_OR_VALUE_EXISTS:
|
|
|
3280a9 |
+ pass
|
|
|
3280a9 |
+
|
|
|
3280a9 |
aci_list = Domain(topo.standalone, DEFAULT_SUFFIX).get_attr_vals('aci')
|
|
|
3280a9 |
|
|
|
3280a9 |
def finofaci():
|
|
|
3280a9 |
@@ -107,10 +118,10 @@ def _add_user(request, topo):
|
|
|
3280a9 |
request.addfinalizer(fin)
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
-def test_we_can_search_as_expected(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Testing the targattrfilters keyword that allows access control based on the value of the attributes being added (or deleted))
|
|
|
3280a9 |
+def test_we_can_search_as_expected(topo, _add_user, aci_of_user, request):
|
|
|
3280a9 |
+ """Testing the targattrfilters keyword that allows access control based on the value of the attributes being added (or deleted))
|
|
|
3280a9 |
Test that we can search as expected
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: e845dbba-7aa9-11e8-8988-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -124,8 +135,8 @@ def test_we_can_search_as_expected(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
ACI_BODY = '(target="ldap:///cn=*,ou=Product Development, {}")' \
|
|
|
3280a9 |
'(targetfilter="cn=Jeff*")(targetattr="secretary || objectclass || mail")' \
|
|
|
3280a9 |
- '(targattrfilters = "add=title:(title=arch*)")(version 3.0; acl "$tet_thistest"; ' \
|
|
|
3280a9 |
- 'allow (write,read,search,compare) (userdn = "ldap:///anyone") ;)'.format(DEFAULT_SUFFIX)
|
|
|
3280a9 |
+ '(targattrfilters = "add=title:(title=arch*)")(version 3.0; acl "{}"; ' \
|
|
|
3280a9 |
+ 'allow (write,read,search,compare) (userdn = "ldap:///anyone") ;)'.format(DEFAULT_SUFFIX, request.node.name)
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
|
|
|
3280a9 |
conn = Anonymous(topo.standalone).bind()
|
|
|
3280a9 |
# aci will allow secretary , mail , objectclass
|
|
|
3280a9 |
@@ -135,11 +146,11 @@ def test_we_can_search_as_expected(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
assert user.get_attr_vals('objectclass')
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
-def test_we_can_mod_title_as_expected(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Testing the targattrfilters keyword that allows access control based on the
|
|
|
3280a9 |
+def test_we_can_mod_title_as_expected(topo, _add_user, aci_of_user, request):
|
|
|
3280a9 |
+ """Testing the targattrfilters keyword that allows access control based on the
|
|
|
3280a9 |
value of the attributes being added (or deleted))
|
|
|
3280a9 |
- "Valueacl Test $tet_thistest Test search will work with targattrfilters present."
|
|
|
3280a9 |
+ Test search will work with targattrfilters present.
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: f8c1ea88-7aa9-11e8-a55c-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -153,8 +164,8 @@ def test_we_can_mod_title_as_expected(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
ACI_BODY = '(target="ldap:///cn=*,ou=Product Development, {}")' \
|
|
|
3280a9 |
'(targetfilter="cn=Jeff*")(targetattr="secretary || objectclass || mail")' \
|
|
|
3280a9 |
- '(targattrfilters = "add=title:(title=arch*)")(version 3.0; acl "$tet_thistest"; ' \
|
|
|
3280a9 |
- 'allow (write,read,search,compare) (userdn = "ldap:///anyone") ;)'.format(DEFAULT_SUFFIX)
|
|
|
3280a9 |
+ '(targattrfilters = "add=title:(title=arch*)")(version 3.0; acl "{}"; ' \
|
|
|
3280a9 |
+ 'allow (write,read,search,compare) (userdn = "ldap:///anyone") ;)'.format(DEFAULT_SUFFIX, request.node.name)
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
|
|
|
3280a9 |
# aci will not allow 'title', 'topdog'
|
|
|
3280a9 |
conn = UserAccount(topo.standalone, USER_WITH_ACI_DELADD).bind(PW_DM)
|
|
|
3280a9 |
@@ -163,11 +174,11 @@ def test_we_can_mod_title_as_expected(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
user.add('title', 'topdog')
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
-def test_modify_with_multiple_filters(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Testing the targattrfilters keyword that allows access control based on the
|
|
|
3280a9 |
+def test_modify_with_multiple_filters(topo, _add_user, aci_of_user, request):
|
|
|
3280a9 |
+ """Testing the targattrfilters keyword that allows access control based on the
|
|
|
3280a9 |
value of the attributes being added (or deleted))
|
|
|
3280a9 |
- "Valueacl Test $tet_thistest Allowed by multiple."
|
|
|
3280a9 |
+ Allowed by multiple filters
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: fd9d223e-7aa9-11e8-a83b-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -181,9 +192,9 @@ def test_modify_with_multiple_filters(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
ACI_BODY = '(targattrfilters = "add=title:(title=architect) && secretary:' \
|
|
|
3280a9 |
'(secretary=cn=Meylan,{}), del=title:(title=architect) && secretary:' \
|
|
|
3280a9 |
- '(secretary=cn=Meylan,{})")(version 3.0; acl "$tet_thistest"; allow (write) ' \
|
|
|
3280a9 |
+ '(secretary=cn=Meylan,{})")(version 3.0; acl "{}"; allow (write) ' \
|
|
|
3280a9 |
'(userdn = "ldap:///anyone") ;)'.format(
|
|
|
3280a9 |
- DEFAULT_SUFFIX, DEFAULT_SUFFIX
|
|
|
3280a9 |
+ DEFAULT_SUFFIX, DEFAULT_SUFFIX, request.node.name
|
|
|
3280a9 |
)
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
|
|
|
3280a9 |
conn = UserAccount(topo.standalone, USER_WITH_ACI_DELADD).bind(PW_DM)
|
|
|
3280a9 |
@@ -195,11 +206,11 @@ def test_modify_with_multiple_filters(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
assert user.get_attr_val('secretary')
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
-def test_denied_by_multiple_filters(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Testing the targattrfilters keyword that allows access control based on the value of the
|
|
|
3280a9 |
+def test_denied_by_multiple_filters(topo, _add_user, aci_of_user, request):
|
|
|
3280a9 |
+ """Testing the targattrfilters keyword that allows access control based on the value of the
|
|
|
3280a9 |
attributes being added (or deleted))
|
|
|
3280a9 |
- "Valueacl Test $tet_thistest Denied by multiple filters."
|
|
|
3280a9 |
+ Denied by multiple filters
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: 034c6c62-7aaa-11e8-8634-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -213,8 +224,8 @@ def test_denied_by_multiple_filters(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
ACI_BODY = '(targattrfilters = "add=title:(title=architect) && secretary:' \
|
|
|
3280a9 |
'(secretary=cn=Meylan,{}), del=title:(title=architect) && secretary:' \
|
|
|
3280a9 |
- '(secretary=cn=Meylan,{})")(version 3.0; acl "$tet_thistest"; allow (write) ' \
|
|
|
3280a9 |
- '(userdn = "ldap:///anyone") ;)'.format(DEFAULT_SUFFIX, DEFAULT_SUFFIX)
|
|
|
3280a9 |
+ '(secretary=cn=Meylan,{})")(version 3.0; acl "{}"; allow (write) ' \
|
|
|
3280a9 |
+ '(userdn = "ldap:///anyone") ;)'.format(DEFAULT_SUFFIX, DEFAULT_SUFFIX, request.node.name)
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
|
|
|
3280a9 |
conn = UserAccount(topo.standalone, USER_WITH_ACI_DELADD).bind(PW_DM)
|
|
|
3280a9 |
# aci will allow title some attribute only
|
|
|
3280a9 |
@@ -228,11 +239,11 @@ def test_denied_by_multiple_filters(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
user.add("secretary", "cn=Grenoble,dc=example,dc=com")
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
-def test_allowed_add_one_attribute(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Testing the targattrfilters keyword that allows access control based on the value of the
|
|
|
3280a9 |
+def test_allowed_add_one_attribute(topo, _add_user, aci_of_user, request):
|
|
|
3280a9 |
+ """Testing the targattrfilters keyword that allows access control based on the value of the
|
|
|
3280a9 |
attributes being added (or deleted))
|
|
|
3280a9 |
- "Valueacl Test $tet_thistest Allowed add one attribute (in presence of multiple filters)"
|
|
|
3280a9 |
+ Allowed add one attribute (in presence of multiple filters)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: 086c7f0c-7aaa-11e8-b69f-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -245,9 +256,9 @@ def test_allowed_add_one_attribute(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
3. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
ACI_BODY = '(targattrfilters = "add=title:(title=architect) && secretary:(secretary=cn=Meylan, {}), ' \
|
|
|
3280a9 |
- 'del=title:(title=architect) && secretary:(secretary=cn=Meylan, {})")(version 3.0; acl "$tet_thistest"; ' \
|
|
|
3280a9 |
+ 'del=title:(title=architect) && secretary:(secretary=cn=Meylan, {})")(version 3.0; acl "{}"; ' \
|
|
|
3280a9 |
'allow (write) (userdn = "ldap:///{}") ;)'.format(
|
|
|
3280a9 |
- DEFAULT_SUFFIX, DEFAULT_SUFFIX, USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
+ DEFAULT_SUFFIX, DEFAULT_SUFFIX, request.node.name, USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
|
|
|
3280a9 |
conn = UserAccount(topo.standalone, USER_WITH_ACI_DELADD).bind(PW_DM)
|
|
|
3280a9 |
user = UserAccount(conn, USER_DELADD)
|
|
|
3280a9 |
@@ -258,12 +269,12 @@ def test_allowed_add_one_attribute(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_cannot_add_an_entry_with_attribute_values_we_are_not_allowed_add(
|
|
|
3280a9 |
- topo, _add_user, aci_of_user
|
|
|
3280a9 |
+ topo, _add_user, aci_of_user, request
|
|
|
3280a9 |
):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Testing the targattrfilters keyword that allows access control based on the value of the
|
|
|
3280a9 |
+ """Testing the targattrfilters keyword that allows access control based on the value of the
|
|
|
3280a9 |
attributes being added (or deleted))
|
|
|
3280a9 |
- "Valueacl Test $tet_thistest Test not allowed add an entry"
|
|
|
3280a9 |
+ Test not allowed add an entry
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: 0d0effee-7aaa-11e8-b673-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -277,8 +288,8 @@ def test_cannot_add_an_entry_with_attribute_values_we_are_not_allowed_add(
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
ACI_BODY = '(targattrfilters = "add=title:(|(title=engineer)(title=cool dude)(title=scum)) ' \
|
|
|
3280a9 |
'&& secretary:(secretary=cn=Meylan, {}), del=title:(|(title=engineer)(title=cool dude)' \
|
|
|
3280a9 |
- '(title=scum))")(version 3.0; aci "$tet_thistest"; allow (add) userdn = "ldap:///{}";)'.format(
|
|
|
3280a9 |
- DEFAULT_SUFFIX, DEFAULT_SUFFIX)
|
|
|
3280a9 |
+ '(title=scum))")(version 3.0; aci "{}"; allow (add) userdn = "ldap:///{}";)'.format(
|
|
|
3280a9 |
+ DEFAULT_SUFFIX, request.node.name, DEFAULT_SUFFIX)
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
|
|
|
3280a9 |
properties = {
|
|
|
3280a9 |
'uid': 'FRED',
|
|
|
3280a9 |
@@ -298,11 +309,11 @@ def test_cannot_add_an_entry_with_attribute_values_we_are_not_allowed_add(
|
|
|
3280a9 |
user.add("objectclass", "person")
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
-def test_on_modrdn(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Testing the targattrfilters keyword that allows access control based on the value of the
|
|
|
3280a9 |
+def test_on_modrdn(topo, _add_user, aci_of_user, request):
|
|
|
3280a9 |
+ """Testing the targattrfilters keyword that allows access control based on the value of the
|
|
|
3280a9 |
attributes being added (or deleted))
|
|
|
3280a9 |
Test that valuacls kick in for modrdn operation.
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: 12985dde-7aaa-11e8-abde-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -315,8 +326,8 @@ def test_on_modrdn(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
3. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
ACI_BODY = '(target="ldap:///cn=*,ou=Accounting,{}")(targattrfilters = "add=cn:(|(cn=engineer)), ' \
|
|
|
3280a9 |
- 'del=title:(|(title=engineer)(title=cool dude)(title=scum))")(version 3.0; aci "$tet_thistest"; ' \
|
|
|
3280a9 |
- 'allow (write) userdn = "ldap:///{}";)'.format(DEFAULT_SUFFIX, USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
+ 'del=title:(|(title=engineer)(title=cool dude)(title=scum))")(version 3.0; aci "{}"; ' \
|
|
|
3280a9 |
+ 'allow (write) userdn = "ldap:///{}";)'.format(DEFAULT_SUFFIX, request.node.name, USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
|
|
|
3280a9 |
conn = UserAccount(topo.standalone, USER_WITH_ACI_DELADD).bind(PW_DM)
|
|
|
3280a9 |
# modrdn_s is not allowed with ou=OU1
|
|
|
3280a9 |
@@ -325,11 +336,11 @@ def test_on_modrdn(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
useraccount.rename("ou=OU1")
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
-def test_on_modrdn_allow(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Testing the targattrfilters keyword that allows access control based on the value of the attributes being
|
|
|
3280a9 |
+def test_on_modrdn_allow(topo, _add_user, aci_of_user, request):
|
|
|
3280a9 |
+ """Testing the targattrfilters keyword that allows access control based on the value of the attributes being
|
|
|
3280a9 |
added (or deleted))
|
|
|
3280a9 |
- "Valueacl Test $tet_thistest Test modrdn still works (2)"
|
|
|
3280a9 |
+ Test modrdn still works (2)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: 17720562-7aaa-11e8-82ee-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -342,8 +353,8 @@ def test_on_modrdn_allow(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
3. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
ACI_BODY = '(target="ldap:///{}")(targattrfilters = "add=cn:((cn=engineer)), del=cn:((cn=jonny))")' \
|
|
|
3280a9 |
- '(version 3.0; aci "$tet_thistest"; allow (write) ' \
|
|
|
3280a9 |
- 'userdn = "ldap:///{}";)'.format(DEFAULT_SUFFIX, USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
+ '(version 3.0; aci "{}"; allow (write) ' \
|
|
|
3280a9 |
+ 'userdn = "ldap:///{}";)'.format(DEFAULT_SUFFIX, request.node.name, USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
|
|
|
3280a9 |
properties = {
|
|
|
3280a9 |
'uid': 'jonny',
|
|
|
3280a9 |
@@ -364,12 +375,12 @@ def test_on_modrdn_allow(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
|
|
|
3280a9 |
@pytest.mark.bz979515
|
|
|
3280a9 |
def test_targattrfilters_keyword(topo):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Testing the targattrfilters keyword that allows access control based on the value
|
|
|
3280a9 |
+ """Testing the targattrfilters keyword that allows access control based on the value
|
|
|
3280a9 |
of the attributes being added (or deleted))
|
|
|
3280a9 |
"Bug #979515 - ACLs inoperative in some search scenarios [rhel-6.5]"
|
|
|
3280a9 |
"Bug #979516 is a clone for DS8.2 on RHEL5.9"
|
|
|
3280a9 |
"Bug #979514 is a clone for RHEL6.4 zStream errata"
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: 23f9e9d0-7aaa-11e8-b16b-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
diff --git a/dirsrvtests/tests/suites/acl/valueacl_test.py b/dirsrvtests/tests/suites/acl/valueacl_test.py
|
|
|
3280a9 |
index 54bc13452..3bbbdcabb 100644
|
|
|
3280a9 |
--- a/dirsrvtests/tests/suites/acl/valueacl_test.py
|
|
|
3280a9 |
+++ b/dirsrvtests/tests/suites/acl/valueacl_test.py
|
|
|
3280a9 |
@@ -1,5 +1,5 @@
|
|
|
3280a9 |
# --- BEGIN COPYRIGHT BLOCK ---
|
|
|
3280a9 |
-# Copyright (C) 2019 Red Hat, Inc.
|
|
|
3280a9 |
+# Copyright (C) 2020 Red Hat, Inc.
|
|
|
3280a9 |
# All rights reserved.
|
|
|
3280a9 |
#
|
|
|
3280a9 |
# License: GPL (version 3 or any later version).
|
|
|
3280a9 |
@@ -28,6 +28,17 @@ HUMAN_OU_GLOBAL = "ou=Human Resources,{}".format(DEFAULT_SUFFIX)
|
|
|
3280a9 |
|
|
|
3280a9 |
@pytest.fixture(scope="function")
|
|
|
3280a9 |
def aci_of_user(request, topo):
|
|
|
3280a9 |
+ # Add anonymous access aci
|
|
|
3280a9 |
+ ACI_TARGET = "(targetattr != \"userpassword\")(target = \"ldap:///%s\")" % (DEFAULT_SUFFIX)
|
|
|
3280a9 |
+ ACI_ALLOW = "(version 3.0; acl \"Anonymous Read access\"; allow (read,search,compare)"
|
|
|
3280a9 |
+ ACI_SUBJECT = "(userdn=\"ldap:///anyone\");)"
|
|
|
3280a9 |
+ ANON_ACI = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
|
|
|
3280a9 |
+ suffix = Domain(topo.standalone, DEFAULT_SUFFIX)
|
|
|
3280a9 |
+ try:
|
|
|
3280a9 |
+ suffix.add('aci', ANON_ACI)
|
|
|
3280a9 |
+ except ldap.TYPE_OR_VALUE_EXISTS:
|
|
|
3280a9 |
+ pass
|
|
|
3280a9 |
+
|
|
|
3280a9 |
aci_list = Domain(topo.standalone, DEFAULT_SUFFIX).get_attr_vals('aci')
|
|
|
3280a9 |
|
|
|
3280a9 |
def finofaci():
|
|
|
3280a9 |
@@ -167,10 +178,10 @@ class _AddFREDWithRoot:
|
|
|
3280a9 |
def test_delete_an_attribute_value_we_are_not_allowed_to_delete(
|
|
|
3280a9 |
topo, _add_user, aci_of_user
|
|
|
3280a9 |
):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Testing the targattrfilters keyword that allows access control based on the value
|
|
|
3280a9 |
+ """Testing the targattrfilters keyword that allows access control based on the value
|
|
|
3280a9 |
of the attributes being added (or deleted))
|
|
|
3280a9 |
Test that we can MODIFY:add an attribute value we are allowed to add
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: 7c41baa6-7aa9-11e8-9bdc-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -192,12 +203,12 @@ def test_delete_an_attribute_value_we_are_not_allowed_to_delete(
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_donot_allow_write_access_to_title_if_value_is_not_architect(
|
|
|
3280a9 |
- topo, _add_user, aci_of_user
|
|
|
3280a9 |
+ topo, _add_user, aci_of_user, request
|
|
|
3280a9 |
):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Testing the targattrfilters keyword that allows access control based on the value of the
|
|
|
3280a9 |
+ """Testing the targattrfilters keyword that allows access control based on the value of the
|
|
|
3280a9 |
attributes being added (or deleted))
|
|
|
3280a9 |
Test that we cannot MODIFY:add an attribute value we are not allowed to add
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: 822c607e-7aa9-11e8-b2e7-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -210,7 +221,7 @@ def test_donot_allow_write_access_to_title_if_value_is_not_architect(
|
|
|
3280a9 |
3. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
ACI_BODY = '(targattrfilters = "add=title:(title=architect), del=title:(title=architect)")' \
|
|
|
3280a9 |
- '(version 3.0; acl "$tet_thistest"; allow (write) (userdn = "ldap:///{}") ;)'.format(USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
+ '(version 3.0; acl "{}"; allow (write) (userdn = "ldap:///{}") ;)'.format(request.node.name, USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
|
|
|
3280a9 |
# aci will allow to add title architect
|
|
|
3280a9 |
conn = UserAccount(topo.standalone, USER_WITH_ACI_DELADD).bind(PW_DM)
|
|
|
3280a9 |
@@ -221,12 +232,12 @@ def test_donot_allow_write_access_to_title_if_value_is_not_architect(
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_delete_an_attribute_value_we_are_allowed_to_delete(
|
|
|
3280a9 |
- topo, _add_user, aci_of_user
|
|
|
3280a9 |
+ topo, _add_user, aci_of_user, request
|
|
|
3280a9 |
):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Testing the targattrfilters keyword that allows access control based on the value of
|
|
|
3280a9 |
+ """Testing the targattrfilters keyword that allows access control based on the value of
|
|
|
3280a9 |
the attributes being added (or deleted))
|
|
|
3280a9 |
- Test that we can MODIFY:delete an attribute value we are allowed to delete,
|
|
|
3280a9 |
+ Test that we can MODIFY:delete an attribute value we are allowed to delete
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: 86f36b34-7aa9-11e8-ab16-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -239,7 +250,7 @@ def test_delete_an_attribute_value_we_are_allowed_to_delete(
|
|
|
3280a9 |
3. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
ACI_BODY = '(targattrfilters = "add=title:(title=architect), del=title:(title=architect)")' \
|
|
|
3280a9 |
- '(version 3.0; acl "$tet_thistest"; allow (write) (userdn = "ldap:///{}") ;)'.format(USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
+ '(version 3.0; acl "{}"; allow (write) (userdn = "ldap:///{}") ;)'.format(request.node.name, USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
|
|
|
3280a9 |
_AddTitleWithRoot(topo, "architect").add()
|
|
|
3280a9 |
# aci will allow to delete title architect
|
|
|
3280a9 |
@@ -249,12 +260,12 @@ def test_delete_an_attribute_value_we_are_allowed_to_delete(
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_delete_an_attribute_value_we_are_not_allowed_to_deleted(
|
|
|
3280a9 |
- topo, _add_user, aci_of_user
|
|
|
3280a9 |
+ topo, _add_user, aci_of_user, request
|
|
|
3280a9 |
):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Testing the targattrfilters keyword that allows access control based on the value of the
|
|
|
3280a9 |
+ """Testing the targattrfilters keyword that allows access control based on the value of the
|
|
|
3280a9 |
attributes being added (or deleted))
|
|
|
3280a9 |
- Test that we cannot MODIFY:delete an attribute value we are allowed to delete,
|
|
|
3280a9 |
+ Test that we cannot MODIFY:delete an attribute value we are allowed to delete
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: 8c9f3a90-7aa9-11e8-bf2e-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -267,7 +278,7 @@ def test_delete_an_attribute_value_we_are_not_allowed_to_deleted(
|
|
|
3280a9 |
3. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
ACI_BODY = '(targattrfilters = "add=title:(title=architect), del=title:(title=architect)")' \
|
|
|
3280a9 |
- '(version 3.0; acl "$tet_thistest"; allow (write) (userdn = "ldap:///{}") ;)'.format(USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
+ '(version 3.0; acl "{}"; allow (write) (userdn = "ldap:///{}") ;)'.format(request.node.name, USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
|
|
|
3280a9 |
_AddTitleWithRoot(topo, "engineer").add()
|
|
|
3280a9 |
# acl will not allow to delete title engineer
|
|
|
3280a9 |
@@ -276,11 +287,11 @@ def test_delete_an_attribute_value_we_are_not_allowed_to_deleted(
|
|
|
3280a9 |
_ModTitleArchitectJeffVedder(topo, "engineer", conn).delete()
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
-def test_allow_modify_replace(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Testing the targattrfilters keyword that allows access control based on the value of the
|
|
|
3280a9 |
+def test_allow_modify_replace(topo, _add_user, aci_of_user, request):
|
|
|
3280a9 |
+ """Testing the targattrfilters keyword that allows access control based on the value of the
|
|
|
3280a9 |
attributes being added (or deleted))
|
|
|
3280a9 |
Test that we can MODIFY:replace an attribute if we have correct add/delete rights.
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: 9148a234-7aa9-11e8-a1f1-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -293,8 +304,8 @@ def test_allow_modify_replace(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
3. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
ACI_BODY = '(targattrfilters = "add=title:(title=engineer), del=title:(|(title=architect)' \
|
|
|
3280a9 |
- '(title=idiot))")(version 3.0; acl "$tet_thistest"; ' \
|
|
|
3280a9 |
- 'allow (write) (userdn = "ldap:///{}") ;)'.format(USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
+ '(title=idiot))")(version 3.0; acl "{}"; ' \
|
|
|
3280a9 |
+ 'allow (write) (userdn = "ldap:///{}") ;)'.format(request.node.name, USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
|
|
|
3280a9 |
_AddTitleWithRoot(topo, "architect").add()
|
|
|
3280a9 |
_AddTitleWithRoot(topo, "idiot").add()
|
|
|
3280a9 |
@@ -305,11 +316,11 @@ def test_allow_modify_replace(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
_ModTitleArchitectJeffVedder(topo, "engineer", conn).delete()
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
-def test_allow_modify_delete(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Testing the targattrfilters keyword that allows access control based on the value of the
|
|
|
3280a9 |
+def test_allow_modify_delete(topo, _add_user, aci_of_user, request):
|
|
|
3280a9 |
+ """Testing the targattrfilters keyword that allows access control based on the value of the
|
|
|
3280a9 |
attributes being added (or deleted))
|
|
|
3280a9 |
- "Valueacl Test $tet_thistest Don't Allow modify:replace because of lack of delete rights"
|
|
|
3280a9 |
+ Don't Allow modify:replace because of lack of delete rights
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: 962842d2-7aa9-11e8-b39e-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -322,8 +333,8 @@ def test_allow_modify_delete(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
3. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
ACI_BODY = '(targattrfilters = "add=title:(title=engineer), del=title:(|(title=architect))")' \
|
|
|
3280a9 |
- '(version 3.0; acl "$tet_thistest"; allow (write) ' \
|
|
|
3280a9 |
- '(userdn = "ldap:///{}") ;)'.format(USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
+ '(version 3.0; acl "{}"; allow (write) ' \
|
|
|
3280a9 |
+ '(userdn = "ldap:///{}") ;)'.format(request.node.name, USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
|
|
|
3280a9 |
_AddTitleWithRoot(topo, "architect").add()
|
|
|
3280a9 |
_AddTitleWithRoot(topo, "idiot").add()
|
|
|
3280a9 |
@@ -335,11 +346,11 @@ def test_allow_modify_delete(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
_ModTitleArchitectJeffVedder(topo, "idiot", conn).delete()
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
-def test_replace_an_attribute_if_we_lack(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Testing the targattrfilters keyword that allows access control based on the value of the
|
|
|
3280a9 |
+def test_replace_an_attribute_if_we_lack(topo, _add_user, aci_of_user, request):
|
|
|
3280a9 |
+ """Testing the targattrfilters keyword that allows access control based on the value of the
|
|
|
3280a9 |
attributes being added (or deleted))
|
|
|
3280a9 |
Test that we cannot MODIFY:replace an attribute if we lack
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: 9b1e6afa-7aa9-11e8-ac5b-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -352,8 +363,8 @@ def test_replace_an_attribute_if_we_lack(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
3. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
ACI_BODY = '(targattrfilters = "add=title:(title=engineer), del=title:(|(title=architect))")' \
|
|
|
3280a9 |
- '(version 3.0; acl "$tet_thistest"; allow (write) ' \
|
|
|
3280a9 |
- '(userdn = "ldap:///{}") ;)'.format(USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
+ '(version 3.0; acl "{}"; allow (write) ' \
|
|
|
3280a9 |
+ '(userdn = "ldap:///{}") ;)'.format(request.node.name, USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
|
|
|
3280a9 |
_AddTitleWithRoot(topo, "architect").add()
|
|
|
3280a9 |
_AddTitleWithRoot(topo, "idiot").add()
|
|
|
3280a9 |
@@ -365,13 +376,13 @@ def test_replace_an_attribute_if_we_lack(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_remove_an_attribute_if_we_have_del_rights_to_all_attr_value(
|
|
|
3280a9 |
- topo, _add_user, aci_of_user
|
|
|
3280a9 |
+ topo, _add_user, aci_of_user, request
|
|
|
3280a9 |
):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Testing the targattrfilters keyword that allows access control based on the value of the
|
|
|
3280a9 |
- attributes being added (or deleted))
|
|
|
3280a9 |
+ """Testing the targattrfilters keyword that allows access control based on the value of the
|
|
|
3280a9 |
+ attributes being added (or deleted))
|
|
|
3280a9 |
Test that we can use MODIFY:delete to entirely remove an attribute if we have del rights
|
|
|
3280a9 |
to all attr values negative case tested next.
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: a0c9e0c4-7aa9-11e8-8880-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -384,8 +395,8 @@ def test_remove_an_attribute_if_we_have_del_rights_to_all_attr_value(
|
|
|
3280a9 |
3. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
ACI_BODY = '(targattrfilters = "add=title:(title=engineer), del=title:(|(title=architect)' \
|
|
|
3280a9 |
- '(title=idiot))")(version 3.0; acl "$tet_thistest"; allow (write)' \
|
|
|
3280a9 |
- ' (userdn = "ldap:///{}") ;)'.format(USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
+ '(title=idiot))")(version 3.0; acl "{}"; allow (write)' \
|
|
|
3280a9 |
+ ' (userdn = "ldap:///{}") ;)'.format(request.node.name, USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
|
|
|
3280a9 |
_AddTitleWithRoot(topo, "architect").add()
|
|
|
3280a9 |
_AddTitleWithRoot(topo, "idiot").add()
|
|
|
3280a9 |
@@ -395,13 +406,13 @@ def test_remove_an_attribute_if_we_have_del_rights_to_all_attr_value(
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_remove_an_attribute_if_we_donot_have_del_rights_to_all_attr_value(
|
|
|
3280a9 |
- topo, _add_user, aci_of_user
|
|
|
3280a9 |
+ topo, _add_user, aci_of_user, request
|
|
|
3280a9 |
):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Testing the targattrfilters keyword that allows access control based on the value of the
|
|
|
3280a9 |
+ """Testing the targattrfilters keyword that allows access control based on the value of the
|
|
|
3280a9 |
attributes being added (or deleted))
|
|
|
3280a9 |
Test that we can use MODIFY:delete to entirely remove an attribute if we have not del
|
|
|
3280a9 |
rights to all attr values
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: a6862eaa-7aa9-11e8-8bf9-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -414,8 +425,8 @@ def test_remove_an_attribute_if_we_donot_have_del_rights_to_all_attr_value(
|
|
|
3280a9 |
3. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
ACI_BODY = '(targattrfilters = "add=title:(title=engineer), del=title:(|(title=architect)' \
|
|
|
3280a9 |
- '(title=idiot))")(version 3.0; acl "$tet_thistest"; allow (write) ' \
|
|
|
3280a9 |
- '(userdn = "ldap:///{}") ;)'.format(USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
+ '(title=idiot))")(version 3.0; acl "{}"; allow (write) ' \
|
|
|
3280a9 |
+ '(userdn = "ldap:///{}") ;)'.format(request.node.name, USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
|
|
|
3280a9 |
_AddTitleWithRoot(topo, "architect").add()
|
|
|
3280a9 |
_AddTitleWithRoot(topo, "sailor").add()
|
|
|
3280a9 |
@@ -426,12 +437,12 @@ def test_remove_an_attribute_if_we_donot_have_del_rights_to_all_attr_value(
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_remove_an_attribute_if_we_have_del_rights_to_all_attr_values(
|
|
|
3280a9 |
- topo, _add_user, aci_of_user
|
|
|
3280a9 |
+ topo, _add_user, aci_of_user, request
|
|
|
3280a9 |
):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Testing the targattrfilters keyword that allows access control based on the value of the
|
|
|
3280a9 |
+ """Testing the targattrfilters keyword that allows access control based on the value of the
|
|
|
3280a9 |
attributes being added (or deleted))
|
|
|
3280a9 |
Test that we can use MODIFY:replace to entirely remove an attribute if we have del rights to all attr values
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: ab04c7e8-7aa9-11e8-84db-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -444,8 +455,8 @@ def test_remove_an_attribute_if_we_have_del_rights_to_all_attr_values(
|
|
|
3280a9 |
3. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
ACI_BODY = '(targattrfilters = "add=title:(title=engineer), del=title:(|(title=architect)' \
|
|
|
3280a9 |
- '(title=idiot))")(version 3.0; acl "$tet_thistest"; allow (write) ' \
|
|
|
3280a9 |
- '(userdn = "ldap:///{}") ;)'.format(USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
+ '(title=idiot))")(version 3.0; acl "{}"; allow (write) ' \
|
|
|
3280a9 |
+ '(userdn = "ldap:///{}") ;)'.format(request.node.name, USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
|
|
|
3280a9 |
_AddTitleWithRoot(topo, "architect").add()
|
|
|
3280a9 |
_AddTitleWithRoot(topo, "idiot").add()
|
|
|
3280a9 |
@@ -455,12 +466,12 @@ def test_remove_an_attribute_if_we_have_del_rights_to_all_attr_values(
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_cantnot_delete_an_entry_with_attribute_values_we_are_not_allowed_delete(
|
|
|
3280a9 |
- topo, _add_user, aci_of_user
|
|
|
3280a9 |
+ topo, _add_user, aci_of_user, request
|
|
|
3280a9 |
):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Testing the targattrfilters keyword that allows access control based on the value of
|
|
|
3280a9 |
+ """Testing the targattrfilters keyword that allows access control based on the value of
|
|
|
3280a9 |
the attributes being added (or deleted))
|
|
|
3280a9 |
- Test we cannot DELETE an entry with attribute values we are not allowed delete,
|
|
|
3280a9 |
+ Test we cannot DELETE an entry with attribute values we are not allowed delete
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: b525d94c-7aa9-11e8-8539-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -474,7 +485,7 @@ def test_cantnot_delete_an_entry_with_attribute_values_we_are_not_allowed_delete
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
ACI_BODY = '(targattrfilters = "add=title:(|(title=engineer)(title=cool dude)(title=scum)), ' \
|
|
|
3280a9 |
'del=title:(|(title=engineer)(title=cool dude)(title=scum))")(version 3.0; ' \
|
|
|
3280a9 |
- 'aci "$tet_thistest"; allow (delete) userdn = "ldap:///{}";)'.format(USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
+ 'aci "{}"; allow (delete) userdn = "ldap:///{}";)'.format(request.node.name, USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
|
|
|
3280a9 |
_AddFREDWithRoot(topo, "engineer", "cool dude", "ANuj").create()
|
|
|
3280a9 |
conn = UserAccount(topo.standalone, USER_WITH_ACI_DELADD).bind(PW_DM)
|
|
|
3280a9 |
@@ -484,12 +495,12 @@ def test_cantnot_delete_an_entry_with_attribute_values_we_are_not_allowed_delete
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_we_can_add_and_delete_an_entry_with_attribute_values_we_are_allowed_add_and_delete(
|
|
|
3280a9 |
- topo, _add_user, aci_of_user
|
|
|
3280a9 |
+ topo, _add_user, aci_of_user, request
|
|
|
3280a9 |
):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Testing the targattrfilters keyword that allows access control based on the value of the
|
|
|
3280a9 |
+ """Testing the targattrfilters keyword that allows access control based on the value of the
|
|
|
3280a9 |
attributes being added (or deleted))
|
|
|
3280a9 |
Test we can DELETE an entry with attribute values we are allowed delete
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: ba138e54-7aa9-11e8-8037-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -503,7 +514,7 @@ def test_we_can_add_and_delete_an_entry_with_attribute_values_we_are_allowed_add
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
ACI_BODY = '(targattrfilters = "add=title:(|(title=engineer)(title=cool dude)(title=scum)), ' \
|
|
|
3280a9 |
'del=title:(|(title=engineer)(title=cool dude)(title=scum))")(version 3.0; ' \
|
|
|
3280a9 |
- 'aci "$tet_thistest"; allow (delete) userdn = "ldap:///{}";)'.format(USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
+ 'aci "{}"; allow (delete) userdn = "ldap:///{}";)'.format(request.node.name, USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
|
|
|
3280a9 |
_AddFREDWithRoot(topo, "engineer", "cool dude", "scum").create()
|
|
|
3280a9 |
conn = UserAccount(topo.standalone, USER_WITH_ACI_DELADD).bind(PW_DM)
|
|
|
3280a9 |
@@ -511,12 +522,12 @@ def test_we_can_add_and_delete_an_entry_with_attribute_values_we_are_allowed_add
|
|
|
3280a9 |
UserAccount(conn, FRED).delete()
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
-def test_allow_title(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Testing the targattrfilters keyword that allows access control based on the value of the
|
|
|
3280a9 |
+def test_allow_title(topo, _add_user, aci_of_user, request):
|
|
|
3280a9 |
+ """Testing the targattrfilters keyword that allows access control based on the value of the
|
|
|
3280a9 |
attributes being added (or deleted))
|
|
|
3280a9 |
Test that if attr appears in targetattr and in targattrfilters then targattrfilters
|
|
|
3280a9 |
applies--ie. targattrfilters is a refinement of targattrfilters.
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: beadf328-7aa9-11e8-bb08-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -530,8 +541,8 @@ def test_allow_title(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
ACI_BODY = '(targetattr="title")(targattrfilters = "add=title:(|(title=engineer)' \
|
|
|
3280a9 |
'(title=cool dude)(title=scum)), del=title:(|(title=engineer)(title=cool dude)' \
|
|
|
3280a9 |
- '(title=scum))")(version 3.0; aci "$tet_thistest"; allow (write) ' \
|
|
|
3280a9 |
- 'userdn = "ldap:///{}";)'.format(USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
+ '(title=scum))")(version 3.0; aci "{}"; allow (write) ' \
|
|
|
3280a9 |
+ 'userdn = "ldap:///{}";)'.format(request.node.name, USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
|
|
|
3280a9 |
_AddTitleWithRoot(topo, "engineer").add()
|
|
|
3280a9 |
_AddTitleWithRoot(topo, "cool dude").add()
|
|
|
3280a9 |
@@ -541,11 +552,11 @@ def test_allow_title(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
_ModTitleArchitectJeffVedder(topo, "topdog", conn).add()
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
-def test_allow_to_modify(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Testing the targattrfilters keyword that allows access control based on the value of the
|
|
|
3280a9 |
+def test_allow_to_modify(topo, _add_user, aci_of_user, request):
|
|
|
3280a9 |
+ """Testing the targattrfilters keyword that allows access control based on the value of the
|
|
|
3280a9 |
attributes being added (or deleted))
|
|
|
3280a9 |
Test that I can have secretary in targetattr and title in targattrfilters.
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: c32e4704-7aa9-11e8-951d-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -559,8 +570,8 @@ def test_allow_to_modify(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
ACI_BODY = '(targetattr="secretary")(targattrfilters = "add=title:(|(title=engineer)' \
|
|
|
3280a9 |
'(title=cool dude)(title=scum)), del=title:(|(title=engineer)(title=cool dude)' \
|
|
|
3280a9 |
- '(title=scum))")(version 3.0; aci "$tet_thistest"; allow (write)' \
|
|
|
3280a9 |
- ' userdn = "ldap:///{}";)'.format(USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
+ '(title=scum))")(version 3.0; aci "{}"; allow (write)' \
|
|
|
3280a9 |
+ ' userdn = "ldap:///{}";)'.format(request.node.name, USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
|
|
|
3280a9 |
_AddTitleWithRoot(topo, "engineer").add()
|
|
|
3280a9 |
_AddTitleWithRoot(topo, "cool dude").add()
|
|
|
3280a9 |
@@ -571,11 +582,11 @@ def test_allow_to_modify(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
assert user.get_attr_val('secretary')
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
-def test_selfwrite_does_not_confer_write_on_a_targattrfilters_atribute(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Testing the targattrfilters keyword that allows access control based on the value of
|
|
|
3280a9 |
+def test_selfwrite_does_not_confer_write_on_a_targattrfilters_atribute(topo, _add_user, aci_of_user, request):
|
|
|
3280a9 |
+ """Testing the targattrfilters keyword that allows access control based on the value of
|
|
|
3280a9 |
the attributes being added (or deleted))
|
|
|
3280a9 |
Selfwrite does not confer "write" on a targattrfilters atribute.
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: c7b9ec2e-7aa9-11e8-ba4a-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -589,7 +600,7 @@ def test_selfwrite_does_not_confer_write_on_a_targattrfilters_atribute(topo, _ad
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
ACI_BODY = '(targattrfilters = "add=title:(|(title=engineer)(title=cool dude)(title=scum)), ' \
|
|
|
3280a9 |
'del=title:(|(title=engineer)(title=cool dude)(title=scum))")(version 3.0; ' \
|
|
|
3280a9 |
- 'aci "$tet_thistest"; allow (selfwrite) userdn = "ldap:///{}";)'.format(USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
+ 'aci "{}"; allow (selfwrite) userdn = "ldap:///{}";)'.format(request.node.name, USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
|
|
|
3280a9 |
# aci will not allow to add selfwrite_does_not_confer_write_on_a_targattrfilters_atribute
|
|
|
3280a9 |
conn = UserAccount(topo.standalone, USER_WITH_ACI_DELADD).bind(PW_DM)
|
|
|
3280a9 |
@@ -598,12 +609,12 @@ def test_selfwrite_does_not_confer_write_on_a_targattrfilters_atribute(topo, _ad
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_selfwrite_continues_to_give_rights_to_attr_in_targetattr_list(
|
|
|
3280a9 |
- topo, _add_user, aci_of_user
|
|
|
3280a9 |
+ topo, _add_user, aci_of_user, request
|
|
|
3280a9 |
):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Testing the targattrfilters keyword that allows access control based on the value of
|
|
|
3280a9 |
+ """Testing the targattrfilters keyword that allows access control based on the value of
|
|
|
3280a9 |
the attributes being added (or deleted))
|
|
|
3280a9 |
Selfwrite continues to give rights to attr in targetattr list.
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: cd287680-7aa9-11e8-a8e2-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -617,8 +628,8 @@ def test_selfwrite_continues_to_give_rights_to_attr_in_targetattr_list(
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
ACI_BODY = '(targetattr="secretary")(targattrfilters = "add=title:(|(title=engineer)' \
|
|
|
3280a9 |
'(title=cool dude)(title=scum)), del=title:(|(title=engineer)(title=cool dude)' \
|
|
|
3280a9 |
- '(title=scum))")(version 3.0; aci "$tet_thistest"; allow (selfwrite) ' \
|
|
|
3280a9 |
- 'userdn = "ldap:///{}";)'.format(USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
+ '(title=scum))")(version 3.0; aci "{}"; allow (selfwrite) ' \
|
|
|
3280a9 |
+ 'userdn = "ldap:///{}";)'.format(request.node.name, USER_WITH_ACI_DELADD)
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
|
|
|
3280a9 |
# selfwrite_continues_to_give_rights_to_attr_in_targetattr_list
|
|
|
3280a9 |
conn = UserAccount(topo.standalone, USER_WITH_ACI_DELADD).bind(PW_DM)
|
|
|
3280a9 |
@@ -627,12 +638,12 @@ def test_selfwrite_continues_to_give_rights_to_attr_in_targetattr_list(
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_add_an_attribute_value_we_are_allowed_to_add_with_ldapanyone(
|
|
|
3280a9 |
- topo, _add_user, aci_of_user
|
|
|
3280a9 |
+ topo, _add_user, aci_of_user, request
|
|
|
3280a9 |
):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Testing the targattrfilters keyword that allows access control based on the value of the
|
|
|
3280a9 |
+ """Testing the targattrfilters keyword that allows access control based on the value of the
|
|
|
3280a9 |
attributes being added (or deleted))
|
|
|
3280a9 |
Test that we can MODIFY:add an attribute value we are allowed to add with ldap:///anyone
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: d1e1d7ac-7aa9-11e8-b968-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -645,7 +656,7 @@ def test_add_an_attribute_value_we_are_allowed_to_add_with_ldapanyone(
|
|
|
3280a9 |
3. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
ACI_BODY = '(targattrfilters = "add=title:(title=architect), del=title:(title=architect)")' \
|
|
|
3280a9 |
- '(version 3.0; acl "$tet_thistest"; allow (write) userdn = "ldap:///anyone";)'
|
|
|
3280a9 |
+ '(version 3.0; acl "{}"; allow (write) userdn = "ldap:///anyone";)'.format(request.node.name)
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
|
|
|
3280a9 |
_AddTitleWithRoot(topo, "engineer").add()
|
|
|
3280a9 |
# aci will allow to add title architect
|
|
|
3280a9 |
@@ -653,12 +664,12 @@ def test_add_an_attribute_value_we_are_allowed_to_add_with_ldapanyone(
|
|
|
3280a9 |
_ModTitleArchitectJeffVedder(topo, "architect", conn).add()
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
-def test_hierarchy(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Testing the targattrfilters keyword that allows access control based on the value of
|
|
|
3280a9 |
+def test_hierarchy(topo, _add_user, aci_of_user, request):
|
|
|
3280a9 |
+ """Testing the targattrfilters keyword that allows access control based on the value of
|
|
|
3280a9 |
the attributes being added (or deleted))
|
|
|
3280a9 |
Test that with two targattrfilters in the hierarchy that the general one applies.
|
|
|
3280a9 |
- This is the correct behaviour, even if it's a bit
|
|
|
3280a9 |
+ This is the correct behaviour, even if it's a bit confusing
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: d7ae354a-7aa9-11e8-8b0d-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -670,10 +681,10 @@ def test_hierarchy(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
2. Operation should succeed
|
|
|
3280a9 |
3. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
- ACI_BODY = '(targattrfilters = "add=title:(title=arch*)")(version 3.0; acl "$tet_thistest"; ' \
|
|
|
3280a9 |
- 'allow (write) (userdn = "ldap:///anyone") ;)'
|
|
|
3280a9 |
+ ACI_BODY = '(targattrfilters = "add=title:(title=arch*)")(version 3.0; acl "{}"; ' \
|
|
|
3280a9 |
+ 'allow (write) (userdn = "ldap:///anyone") ;)'.format(request.node.name)
|
|
|
3280a9 |
ACI_BODY1 = '(targattrfilters = "add=title:(title=architect)")(version 3.0; ' \
|
|
|
3280a9 |
- 'acl "$tet_thistest"; allow (write) (userdn = "ldap:///anyone") ;)'
|
|
|
3280a9 |
+ 'acl "{}"; allow (write) (userdn = "ldap:///anyone") ;)'.format(request.node.name)
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY1)
|
|
|
3280a9 |
_AddTitleWithRoot(topo, "engineer").add()
|
|
|
3280a9 |
@@ -686,12 +697,12 @@ def test_hierarchy(topo, _add_user, aci_of_user):
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_targattrfilters_and_search_permissions_and_that_ldapmodify_works_as_expected(
|
|
|
3280a9 |
- topo, _add_user, aci_of_user
|
|
|
3280a9 |
+ topo, _add_user, aci_of_user, request
|
|
|
3280a9 |
):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Testing the targattrfilters keyword that allows access control based on the value of the
|
|
|
3280a9 |
+ """Testing the targattrfilters keyword that allows access control based on the value of the
|
|
|
3280a9 |
attributes being added (or deleted))
|
|
|
3280a9 |
Test that we can have targattrfilters and search permissions and that ldapmodify works as expected.
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: ddae7a22-7aa9-11e8-ad6b-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -704,8 +715,8 @@ def test_targattrfilters_and_search_permissions_and_that_ldapmodify_works_as_exp
|
|
|
3280a9 |
3. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
ACI_BODY = '(targetattr="secretary || objectclass || mail")(targattrfilters = "add=title:' \
|
|
|
3280a9 |
- '(title=arch*)")(version 3.0; acl "$tet_thistest"; ' \
|
|
|
3280a9 |
- 'allow (write,read,search,compare) (userdn = "ldap:///anyone") ;)'
|
|
|
3280a9 |
+ '(title=arch*)")(version 3.0; acl "{}"; ' \
|
|
|
3280a9 |
+ 'allow (write,read,search,compare) (userdn = "ldap:///anyone") ;)'.format(request.node.name)
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
|
|
|
3280a9 |
# aci will allow to add title architect
|
|
|
3280a9 |
conn = UserAccount(topo.standalone, USER_WITH_ACI_DELADD).bind(PW_DM)
|
|
|
3280a9 |
@@ -713,12 +724,12 @@ def test_targattrfilters_and_search_permissions_and_that_ldapmodify_works_as_exp
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_targattrfilters_and_search_permissions_and_that_ldapmodify_works_as_expected_two(
|
|
|
3280a9 |
- topo, _add_user, aci_of_user
|
|
|
3280a9 |
+ topo, _add_user, aci_of_user, request
|
|
|
3280a9 |
):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- Testing the targattrfilters keyword that allows access control based on the value of
|
|
|
3280a9 |
+ """Testing the targattrfilters keyword that allows access control based on the value of
|
|
|
3280a9 |
the attributes being added (or deleted))
|
|
|
3280a9 |
Test that we can have targattrfilters and search permissions and that ldapsearch works as expected.
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: e25d116e-7aa9-11e8-81d8-8c16451d917b
|
|
|
3280a9 |
:setup: server
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -731,8 +742,8 @@ def test_targattrfilters_and_search_permissions_and_that_ldapmodify_works_as_exp
|
|
|
3280a9 |
3. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
ACI_BODY = '(targetattr="secretary || objectclass || mail")(targattrfilters = ' \
|
|
|
3280a9 |
- '"add=title:(title=arch*)")(version 3.0; acl "$tet_thistest"; allow ' \
|
|
|
3280a9 |
- '(write,read,search,compare) (userdn = "ldap:///anyone") ;)'
|
|
|
3280a9 |
+ '"add=title:(title=arch*)")(version 3.0; acl "{}"; allow ' \
|
|
|
3280a9 |
+ '(write,read,search,compare) (userdn = "ldap:///anyone") ;)'.format(request.node.name)
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
|
|
|
3280a9 |
conn = Anonymous(topo.standalone).bind()
|
|
|
3280a9 |
user = UserAccount(conn, USER_DELADD)
|
|
|
3280a9 |
diff --git a/dirsrvtests/tests/suites/basic/basic_test.py b/dirsrvtests/tests/suites/basic/basic_test.py
|
|
|
3280a9 |
index 02b73ee85..97908c31c 100644
|
|
|
3280a9 |
--- a/dirsrvtests/tests/suites/basic/basic_test.py
|
|
|
3280a9 |
+++ b/dirsrvtests/tests/suites/basic/basic_test.py
|
|
|
3280a9 |
@@ -7,10 +7,6 @@
|
|
|
3280a9 |
# --- END COPYRIGHT BLOCK ---
|
|
|
3280a9 |
#
|
|
|
3280a9 |
|
|
|
3280a9 |
-"""
|
|
|
3280a9 |
- :Requirement: Basic Directory Server Operations
|
|
|
3280a9 |
-"""
|
|
|
3280a9 |
-
|
|
|
3280a9 |
from subprocess import check_output, PIPE, run
|
|
|
3280a9 |
from lib389 import DirSrv
|
|
|
3280a9 |
from lib389.idm.user import UserAccounts
|
|
|
3280a9 |
@@ -255,11 +251,11 @@ def test_basic_import_export(topology_st, import_example_ldif):
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
|
|
|
3280a9 |
log.info('Running test_basic_import_export...')
|
|
|
3280a9 |
-
|
|
|
3280a9 |
#
|
|
|
3280a9 |
# Test online/offline LDIF imports
|
|
|
3280a9 |
#
|
|
|
3280a9 |
topology_st.standalone.start()
|
|
|
3280a9 |
+ # topology_st.standalone.config.set('nsslapd-errorlog-level', '1')
|
|
|
3280a9 |
|
|
|
3280a9 |
# Generate a test ldif (50k entries)
|
|
|
3280a9 |
log.info("Generating LDIF...")
|
|
|
3280a9 |
@@ -267,6 +263,7 @@ def test_basic_import_export(topology_st, import_example_ldif):
|
|
|
3280a9 |
import_ldif = ldif_dir + '/basic_import.ldif'
|
|
|
3280a9 |
dbgen_users(topology_st.standalone, 50000, import_ldif, DEFAULT_SUFFIX)
|
|
|
3280a9 |
|
|
|
3280a9 |
+
|
|
|
3280a9 |
# Online
|
|
|
3280a9 |
log.info("Importing LDIF online...")
|
|
|
3280a9 |
import_task = ImportTask(topology_st.standalone)
|
|
|
3280a9 |
@@ -937,7 +934,7 @@ def test_mod_def_rootdse_attr(topology_st, import_example_ldif, rootdse_attr):
|
|
|
3280a9 |
:id: c7831e04-f458-4e23-83c7-b6f66109f639
|
|
|
3280a9 |
:parametrized: yes
|
|
|
3280a9 |
:setup: Standalone instance and we are using rootdse_attr fixture which
|
|
|
3280a9 |
-adds nsslapd-return-default-opattr attr with value of one operation attribute.
|
|
|
3280a9 |
+ adds nsslapd-return-default-opattr attr with value of one operation attribute.
|
|
|
3280a9 |
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
1. Make an ldapsearch for rootdse attribute
|
|
|
3280a9 |
@@ -1003,7 +1000,7 @@ def test_basic_anonymous_search(topology_st, create_users):
|
|
|
3280a9 |
@pytest.mark.bz915801
|
|
|
3280a9 |
def test_search_original_type(topology_st, create_users):
|
|
|
3280a9 |
"""Test ldapsearch returning original attributes
|
|
|
3280a9 |
- using nsslapd-search-return-original-type-switch
|
|
|
3280a9 |
+ using nsslapd-search-return-original-type-switch
|
|
|
3280a9 |
|
|
|
3280a9 |
:id: d7831d04-f558-4e50-93c7-b6f77109f640
|
|
|
3280a9 |
:setup: Standalone instance
|
|
|
3280a9 |
@@ -1095,7 +1092,7 @@ def test_critical_msg_on_empty_range_idl(topology_st):
|
|
|
3280a9 |
:setup: Standalone instance
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
1. Create an index for internationalISDNNumber. (attribute chosen because it is
|
|
|
3280a9 |
- unlikely that previous tests used it)
|
|
|
3280a9 |
+ unlikely that previous tests used it)
|
|
|
3280a9 |
2. telephoneNumber being indexed by default create 20 users without telephoneNumber
|
|
|
3280a9 |
3. add a telephoneNumber value and delete it to trigger an empty index database
|
|
|
3280a9 |
4. Do a search that triggers a range lookup on empty telephoneNumber
|
|
|
3280a9 |
@@ -1105,7 +1102,7 @@ def test_critical_msg_on_empty_range_idl(topology_st):
|
|
|
3280a9 |
2. This should pass
|
|
|
3280a9 |
3. This should pass
|
|
|
3280a9 |
4. This should pass on normal build but could abort a debug build
|
|
|
3280a9 |
- 4. This should pass
|
|
|
3280a9 |
+ 5. This should pass
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
indexedAttr = 'internationalISDNNumber'
|
|
|
3280a9 |
|
|
|
3280a9 |
@@ -1206,7 +1203,7 @@ def test_ldbm_modification_audit_log(topology_st):
|
|
|
3280a9 |
assert conn.searchAuditLog('%s: %s' % (attr, VALUE))
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
-@pytest.mark.skipif(not get_user_is_root() or not default_paths.perl_enabled or ds_is_older('1.4.0.0'),
|
|
|
3280a9 |
+@pytest.mark.skipif(not get_user_is_root() or ds_is_older('1.4.0.0'),
|
|
|
3280a9 |
reason="This test is only required if perl is enabled, and requires root.")
|
|
|
3280a9 |
def test_dscreate(request):
|
|
|
3280a9 |
"""Test that dscreate works, we need this for now until setup-ds.pl is
|
|
|
3280a9 |
@@ -1356,7 +1353,7 @@ sample_entries = yes
|
|
|
3280a9 |
return inst
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
-@pytest.mark.skipif(not get_user_is_root() or not default_paths.perl_enabled or ds_is_older('1.4.2.0'),
|
|
|
3280a9 |
+@pytest.mark.skipif(not get_user_is_root() or ds_is_older('1.4.2.0'),
|
|
|
3280a9 |
reason="This test is only required with new admin cli, and requires root.")
|
|
|
3280a9 |
@pytest.mark.bz1748016
|
|
|
3280a9 |
@pytest.mark.ds50581
|
|
|
3280a9 |
@@ -1367,7 +1364,7 @@ def test_dscreate_ldapi(dscreate_long_instance):
|
|
|
3280a9 |
:id: 5d72d955-aff8-4741-8c9a-32c1c707cf1f
|
|
|
3280a9 |
:setup: None
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
- 1. create an instance with a long serverId name, that open a ldapi connection
|
|
|
3280a9 |
+ 1. Ccreate an instance with a long serverId name, that open a ldapi connection
|
|
|
3280a9 |
2. Connect with ldapi, that hit 50581 and crash the instance
|
|
|
3280a9 |
:expectedresults:
|
|
|
3280a9 |
1. Should succeeds
|
|
|
3280a9 |
@@ -1378,7 +1375,7 @@ def test_dscreate_ldapi(dscreate_long_instance):
|
|
|
3280a9 |
log.info(root_dse.get_supported_ctrls())
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
-@pytest.mark.skipif(not get_user_is_root() or not default_paths.perl_enabled or ds_is_older('1.4.2.0'),
|
|
|
3280a9 |
+@pytest.mark.skipif(not get_user_is_root() or ds_is_older('1.4.2.0'),
|
|
|
3280a9 |
reason="This test is only required with new admin cli, and requires root.")
|
|
|
3280a9 |
@pytest.mark.bz1715406
|
|
|
3280a9 |
@pytest.mark.ds50923
|
|
|
3280a9 |
diff --git a/dirsrvtests/tests/suites/ds_logs/ds_logs_test.py b/dirsrvtests/tests/suites/ds_logs/ds_logs_test.py
|
|
|
3280a9 |
index 94686f5f2..d67bcb13e 100644
|
|
|
3280a9 |
--- a/dirsrvtests/tests/suites/ds_logs/ds_logs_test.py
|
|
|
3280a9 |
+++ b/dirsrvtests/tests/suites/ds_logs/ds_logs_test.py
|
|
|
3280a9 |
@@ -1,25 +1,26 @@
|
|
|
3280a9 |
# --- BEGIN COPYRIGHT BLOCK ---
|
|
|
3280a9 |
-# Copyright (C) 2015 Red Hat, Inc.
|
|
|
3280a9 |
+# Copyright (C) 2020 Red Hat, Inc.
|
|
|
3280a9 |
# All rights reserved.
|
|
|
3280a9 |
#
|
|
|
3280a9 |
# License: GPL (version 3 or any later version).
|
|
|
3280a9 |
# See LICENSE for details.
|
|
|
3280a9 |
# --- END COPYRIGHT BLOCK ---
|
|
|
3280a9 |
#
|
|
|
3280a9 |
+from decimal import *
|
|
|
3280a9 |
import os
|
|
|
3280a9 |
import logging
|
|
|
3280a9 |
import pytest
|
|
|
3280a9 |
-import subprocess
|
|
|
3280a9 |
from lib389._mapped_object import DSLdapObject
|
|
|
3280a9 |
from lib389.topologies import topology_st
|
|
|
3280a9 |
from lib389.plugins import AutoMembershipPlugin, ReferentialIntegrityPlugin, AutoMembershipDefinitions
|
|
|
3280a9 |
from lib389.idm.user import UserAccounts
|
|
|
3280a9 |
from lib389.idm.group import Groups
|
|
|
3280a9 |
from lib389.idm.organizationalunit import OrganizationalUnits
|
|
|
3280a9 |
-from lib389._constants import DEFAULT_SUFFIX, LOG_ACCESS_LEVEL, DN_CONFIG, HOST_STANDALONE, PORT_STANDALONE, DN_DM, PASSWORD
|
|
|
3280a9 |
-from lib389.utils import ds_is_older
|
|
|
3280a9 |
+from lib389._constants import DEFAULT_SUFFIX, LOG_ACCESS_LEVEL
|
|
|
3280a9 |
+from lib389.utils import ds_is_older, ds_is_newer
|
|
|
3280a9 |
import ldap
|
|
|
3280a9 |
import glob
|
|
|
3280a9 |
+import re
|
|
|
3280a9 |
|
|
|
3280a9 |
pytestmark = pytest.mark.tier1
|
|
|
3280a9 |
|
|
|
3280a9 |
@@ -30,7 +31,6 @@ PLUGIN_TIMESTAMP = 'nsslapd-logging-hr-timestamps-enabled'
|
|
|
3280a9 |
PLUGIN_LOGGING = 'nsslapd-plugin-logging'
|
|
|
3280a9 |
USER1_DN = 'uid=user1,' + DEFAULT_SUFFIX
|
|
|
3280a9 |
|
|
|
3280a9 |
-
|
|
|
3280a9 |
def add_users(topology_st, users_num):
|
|
|
3280a9 |
users = UserAccounts(topology_st, DEFAULT_SUFFIX)
|
|
|
3280a9 |
log.info('Adding %d users' % users_num)
|
|
|
3280a9 |
@@ -161,6 +161,20 @@ def clean_access_logs(topology_st, request):
|
|
|
3280a9 |
|
|
|
3280a9 |
return clean_access_logs
|
|
|
3280a9 |
|
|
|
3280a9 |
+@pytest.fixture(scope="function")
|
|
|
3280a9 |
+def remove_users(topology_st, request):
|
|
|
3280a9 |
+ def _remove_users():
|
|
|
3280a9 |
+ topo = topology_st.standalone
|
|
|
3280a9 |
+ users = UserAccounts(topo, DEFAULT_SUFFIX)
|
|
|
3280a9 |
+ entries = users.list()
|
|
|
3280a9 |
+ assert len(entries) > 0
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ log.info("Removing all added users")
|
|
|
3280a9 |
+ for entry in entries:
|
|
|
3280a9 |
+ delete_obj(entry)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ request.addfinalizer(_remove_users)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
|
|
|
3280a9 |
def set_audit_log_config_values(topology_st, request, enabled, logsize):
|
|
|
3280a9 |
topo = topology_st.standalone
|
|
|
3280a9 |
@@ -181,6 +195,17 @@ def set_audit_log_config_values(topology_st, request, enabled, logsize):
|
|
|
3280a9 |
def set_audit_log_config_values_to_rotate(topology_st, request):
|
|
|
3280a9 |
set_audit_log_config_values(topology_st, request, 'on', '1')
|
|
|
3280a9 |
|
|
|
3280a9 |
+@pytest.fixture(scope="function")
|
|
|
3280a9 |
+def disable_access_log_buffering(topology_st, request):
|
|
|
3280a9 |
+ log.info('Disable access log buffering')
|
|
|
3280a9 |
+ topology_st.standalone.config.set('nsslapd-accesslog-logbuffering', 'off')
|
|
|
3280a9 |
+ def fin():
|
|
|
3280a9 |
+ log.info('Enable access log buffering')
|
|
|
3280a9 |
+ topology_st.standalone.config.set('nsslapd-accesslog-logbuffering', 'on')
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ request.addfinalizer(fin)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ return disable_access_log_buffering
|
|
|
3280a9 |
|
|
|
3280a9 |
@pytest.mark.bz1273549
|
|
|
3280a9 |
def test_check_default(topology_st):
|
|
|
3280a9 |
@@ -226,11 +251,11 @@ def test_plugin_set_invalid(topology_st):
|
|
|
3280a9 |
|
|
|
3280a9 |
log.info('test_plugin_set_invalid - Expect to fail with junk value')
|
|
|
3280a9 |
with pytest.raises(ldap.OPERATIONS_ERROR):
|
|
|
3280a9 |
- result = topology_st.standalone.config.set(PLUGIN_TIMESTAMP, 'JUNK')
|
|
|
3280a9 |
+ topology_st.standalone.config.set(PLUGIN_TIMESTAMP, 'JUNK')
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
@pytest.mark.bz1273549
|
|
|
3280a9 |
-def test_log_plugin_on(topology_st):
|
|
|
3280a9 |
+def test_log_plugin_on(topology_st, remove_users):
|
|
|
3280a9 |
"""Check access logs for millisecond, when
|
|
|
3280a9 |
nsslapd-logging-hr-timestamps-enabled=ON
|
|
|
3280a9 |
|
|
|
3280a9 |
@@ -266,7 +291,7 @@ def test_log_plugin_on(topology_st):
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
@pytest.mark.bz1273549
|
|
|
3280a9 |
-def test_log_plugin_off(topology_st):
|
|
|
3280a9 |
+def test_log_plugin_off(topology_st, remove_users):
|
|
|
3280a9 |
"""Milliseconds should be absent from access logs when
|
|
|
3280a9 |
nsslapd-logging-hr-timestamps-enabled=OFF
|
|
|
3280a9 |
|
|
|
3280a9 |
@@ -303,6 +328,7 @@ def test_log_plugin_off(topology_st):
|
|
|
3280a9 |
topology_st.standalone.deleteAccessLogs()
|
|
|
3280a9 |
|
|
|
3280a9 |
# Now generate some fresh logs
|
|
|
3280a9 |
+ add_users(topology_st.standalone, 10)
|
|
|
3280a9 |
search_users(topology_st.standalone)
|
|
|
3280a9 |
|
|
|
3280a9 |
log.info('Restart the server to flush the logs')
|
|
|
3280a9 |
@@ -317,8 +343,9 @@ def test_log_plugin_off(topology_st):
|
|
|
3280a9 |
@pytest.mark.xfail(ds_is_older('1.4.0'), reason="May fail on 1.3.x because of bug 1358706")
|
|
|
3280a9 |
@pytest.mark.bz1358706
|
|
|
3280a9 |
@pytest.mark.ds49029
|
|
|
3280a9 |
-def test_internal_log_server_level_0(topology_st, clean_access_logs):
|
|
|
3280a9 |
+def test_internal_log_server_level_0(topology_st, clean_access_logs, disable_access_log_buffering):
|
|
|
3280a9 |
"""Tests server-initiated internal operations
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: 798d06fe-92e8-4648-af66-21349c20638e
|
|
|
3280a9 |
:setup: Standalone instance
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
@@ -362,22 +389,23 @@ def test_internal_log_server_level_0(topology_st, clean_access_logs):
|
|
|
3280a9 |
@pytest.mark.xfail(ds_is_older('1.4.0'), reason="May fail on 1.3.x because of bug 1358706")
|
|
|
3280a9 |
@pytest.mark.bz1358706
|
|
|
3280a9 |
@pytest.mark.ds49029
|
|
|
3280a9 |
-def test_internal_log_server_level_4(topology_st, clean_access_logs):
|
|
|
3280a9 |
+def test_internal_log_server_level_4(topology_st, clean_access_logs, disable_access_log_buffering):
|
|
|
3280a9 |
"""Tests server-initiated internal operations
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: a3500e47-d941-4575-b399-e3f4b49bc4b6
|
|
|
3280a9 |
:setup: Standalone instance
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
1. Set nsslapd-plugin-logging to on
|
|
|
3280a9 |
2. Configure access log level to only 4
|
|
|
3280a9 |
3. Check the access logs, it should contain info about MOD operation of cn=config and other
|
|
|
3280a9 |
- internal operations should have the conn field set to Internal
|
|
|
3280a9 |
- and all values inside parenthesis set to 0.
|
|
|
3280a9 |
+ internal operations should have the conn field set to Internal
|
|
|
3280a9 |
+ and all values inside parenthesis set to 0.
|
|
|
3280a9 |
:expectedresults:
|
|
|
3280a9 |
1. Operation should be successful
|
|
|
3280a9 |
2. Operation should be successful
|
|
|
3280a9 |
3. Access log should contain correct internal log formats with cn=config modification:
|
|
|
3280a9 |
- "(Internal) op=2(1)(1)"
|
|
|
3280a9 |
- "conn=Internal(0)"
|
|
|
3280a9 |
+ "(Internal) op=2(1)(1)"
|
|
|
3280a9 |
+ "conn=Internal(0)"
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
|
|
|
3280a9 |
topo = topology_st.standalone
|
|
|
3280a9 |
@@ -398,8 +426,8 @@ def test_internal_log_server_level_4(topology_st, clean_access_logs):
|
|
|
3280a9 |
log.info("Check if access log contains internal MOD operation in correct format")
|
|
|
3280a9 |
# (Internal) op=2(2)(1) SRCH base="cn=config
|
|
|
3280a9 |
assert topo.ds_access_log.match(r'.*\(Internal\) op=[0-9]+\([0-9]+\)\([0-9]+\) SRCH base="cn=config.*')
|
|
|
3280a9 |
- # (Internal) op=2(2)(1) RESULT err=0 tag=48 nentries=1
|
|
|
3280a9 |
- assert topo.ds_access_log.match(r'.*\(Internal\) op=[0-9]+\([0-9]+\)\([0-9]+\) RESULT err=0 tag=48 nentries=1.*')
|
|
|
3280a9 |
+ # (Internal) op=2(2)(1) RESULT err=0 tag=48 nentries=
|
|
|
3280a9 |
+ assert topo.ds_access_log.match(r'.*\(Internal\) op=[0-9]+\([0-9]+\)\([0-9]+\) RESULT err=0 tag=48 nentries=.*')
|
|
|
3280a9 |
|
|
|
3280a9 |
log.info("Check if the other internal operations have the correct format")
|
|
|
3280a9 |
# conn=Internal(0) op=0
|
|
|
3280a9 |
@@ -411,8 +439,9 @@ def test_internal_log_server_level_4(topology_st, clean_access_logs):
|
|
|
3280a9 |
@pytest.mark.xfail(ds_is_older('1.4.0'), reason="May fail on 1.3.x because of bug 1358706")
|
|
|
3280a9 |
@pytest.mark.bz1358706
|
|
|
3280a9 |
@pytest.mark.ds49029
|
|
|
3280a9 |
-def test_internal_log_level_260(topology_st, add_user_log_level_260):
|
|
|
3280a9 |
+def test_internal_log_level_260(topology_st, add_user_log_level_260, disable_access_log_buffering):
|
|
|
3280a9 |
"""Tests client initiated operations when automember plugin is enabled
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: e68a303e-c037-42b2-a5a0-fbea27c338a9
|
|
|
3280a9 |
:setup: Standalone instance with internal operation
|
|
|
3280a9 |
logging on and nsslapd-plugin-logging to on
|
|
|
3280a9 |
@@ -465,9 +494,10 @@ def test_internal_log_level_260(topology_st, add_user_log_level_260):
|
|
|
3280a9 |
# 'newrdn="uid=new_test_user_777" newsuperior="dc=example,dc=com"
|
|
|
3280a9 |
assert topo.ds_access_log.match(r'.*op=[0-9]+ MODRDN dn="uid=test_user_777,ou=branch1,dc=example,dc=com" '
|
|
|
3280a9 |
'newrdn="uid=new_test_user_777" newsuperior="dc=example,dc=com".*')
|
|
|
3280a9 |
- # (Internal) op=12(1)(1) SRCH base="uid=test_user_777, ou=branch1,dc=example,dc=com"
|
|
|
3280a9 |
- assert topo.ds_access_log.match(r'.*\(Internal\) op=[0-9]+\([0-9]+\)\([0-9]+\) SRCH base="uid=test_user_777,'
|
|
|
3280a9 |
- 'ou=branch1,dc=example,dc=com".*')
|
|
|
3280a9 |
+ if ds_is_older(('1.4.3.9', '1.4.4.3')):
|
|
|
3280a9 |
+ # (Internal) op=12(1)(1) SRCH base="uid=test_user_777, ou=branch1,dc=example,dc=com"
|
|
|
3280a9 |
+ assert topo.ds_access_log.match(r'.*\(Internal\) op=[0-9]+\([0-9]+\)\([0-9]+\) SRCH base="uid=test_user_777,'
|
|
|
3280a9 |
+ 'ou=branch1,dc=example,dc=com".*')
|
|
|
3280a9 |
# (Internal) op=12(1)(1) RESULT err=0 tag=48 nentries=1
|
|
|
3280a9 |
assert topo.ds_access_log.match(r'.*\(Internal\) op=[0-9]+\([0-9]+\)\([0-9]+\) RESULT err=0 tag=48 nentries=1.*')
|
|
|
3280a9 |
# op=12 RESULT err=0 tag=109
|
|
|
3280a9 |
@@ -476,9 +506,10 @@ def test_internal_log_level_260(topology_st, add_user_log_level_260):
|
|
|
3280a9 |
log.info("Check the access logs for DEL operation of the user")
|
|
|
3280a9 |
# op=15 DEL dn="uid=new_test_user_777,dc=example,dc=com"
|
|
|
3280a9 |
assert topo.ds_access_log.match(r'.*op=[0-9]+ DEL dn="uid=new_test_user_777,dc=example,dc=com".*')
|
|
|
3280a9 |
- # (Internal) op=15(1)(1) SRCH base="uid=new_test_user_777, dc=example,dc=com"
|
|
|
3280a9 |
- assert topo.ds_access_log.match(r'.*\(Internal\) op=[0-9]+\([0-9]+\)\([0-9]+\) SRCH base="uid=new_test_user_777,'
|
|
|
3280a9 |
- 'dc=example,dc=com".*')
|
|
|
3280a9 |
+ if ds_is_older(('1.4.3.9', '1.4.4.3')):
|
|
|
3280a9 |
+ # (Internal) op=15(1)(1) SRCH base="uid=new_test_user_777, dc=example,dc=com"
|
|
|
3280a9 |
+ assert topo.ds_access_log.match(r'.*\(Internal\) op=[0-9]+\([0-9]+\)\([0-9]+\) SRCH base="uid=new_test_user_777,'
|
|
|
3280a9 |
+ 'dc=example,dc=com".*')
|
|
|
3280a9 |
# (Internal) op=15(1)(1) RESULT err=0 tag=48 nentries=1
|
|
|
3280a9 |
assert topo.ds_access_log.match(r'.*\(Internal\) op=[0-9]+\([0-9]+\)\([0-9]+\) RESULT err=0 tag=48 nentries=1.*')
|
|
|
3280a9 |
# op=15 RESULT err=0 tag=107
|
|
|
3280a9 |
@@ -492,8 +523,9 @@ def test_internal_log_level_260(topology_st, add_user_log_level_260):
|
|
|
3280a9 |
@pytest.mark.xfail(ds_is_older('1.4.0'), reason="May fail on 1.3.x because of bug 1358706")
|
|
|
3280a9 |
@pytest.mark.bz1358706
|
|
|
3280a9 |
@pytest.mark.ds49029
|
|
|
3280a9 |
-def test_internal_log_level_131076(topology_st, add_user_log_level_131076):
|
|
|
3280a9 |
+def test_internal_log_level_131076(topology_st, add_user_log_level_131076, disable_access_log_buffering):
|
|
|
3280a9 |
"""Tests client-initiated operations while referential integrity plugin is enabled
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: 44836ac9-dabd-4a8c-abd5-ecd7c2509739
|
|
|
3280a9 |
:setup: Standalone instance
|
|
|
3280a9 |
Configure access log level to - 131072 + 4
|
|
|
3280a9 |
@@ -547,9 +579,10 @@ def test_internal_log_level_131076(topology_st, add_user_log_level_131076):
|
|
|
3280a9 |
# 'newrdn="uid=new_test_user_777" newsuperior="dc=example,dc=com"
|
|
|
3280a9 |
assert not topo.ds_access_log.match(r'.*op=[0-9]+ MODRDN dn="uid=test_user_777,ou=branch1,dc=example,dc=com" '
|
|
|
3280a9 |
'newrdn="uid=new_test_user_777" newsuperior="dc=example,dc=com".*')
|
|
|
3280a9 |
- # (Internal) op=12(1)(1) SRCH base="uid=test_user_777, ou=branch1,dc=example,dc=com"
|
|
|
3280a9 |
- assert topo.ds_access_log.match(r'.*\(Internal\) op=[0-9]+\([0-9]+\)\([0-9]+\) SRCH base="uid=test_user_777,'
|
|
|
3280a9 |
- 'ou=branch1,dc=example,dc=com".*')
|
|
|
3280a9 |
+ if ds_is_older(('1.4.3.9', '1.4.4.3')):
|
|
|
3280a9 |
+ # (Internal) op=12(1)(1) SRCH base="uid=test_user_777, ou=branch1,dc=example,dc=com"
|
|
|
3280a9 |
+ assert topo.ds_access_log.match(r'.*\(Internal\) op=[0-9]+\([0-9]+\)\([0-9]+\) SRCH base="uid=test_user_777,'
|
|
|
3280a9 |
+ 'ou=branch1,dc=example,dc=com".*')
|
|
|
3280a9 |
# (Internal) op=12(1)(1) RESULT err=0 tag=48 nentries=1
|
|
|
3280a9 |
assert topo.ds_access_log.match(r'.*\(Internal\) op=[0-9]+\([0-9]+\)\([0-9]+\) RESULT err=0 tag=48 nentries=1.*')
|
|
|
3280a9 |
# op=12 RESULT err=0 tag=109
|
|
|
3280a9 |
@@ -558,9 +591,10 @@ def test_internal_log_level_131076(topology_st, add_user_log_level_131076):
|
|
|
3280a9 |
log.info("Check the access logs for DEL operation of the user")
|
|
|
3280a9 |
# op=15 DEL dn="uid=new_test_user_777,dc=example,dc=com"
|
|
|
3280a9 |
assert not topo.ds_access_log.match(r'.*op=[0-9]+ DEL dn="uid=new_test_user_777,dc=example,dc=com".*')
|
|
|
3280a9 |
- # (Internal) op=15(1)(1) SRCH base="uid=new_test_user_777, dc=example,dc=com"
|
|
|
3280a9 |
- assert topo.ds_access_log.match(r'.*\(Internal\) op=[0-9]+\([0-9]+\)\([0-9]+\) SRCH base="uid=new_test_user_777,'
|
|
|
3280a9 |
- 'dc=example,dc=com".*')
|
|
|
3280a9 |
+ if ds_is_older(('1.4.3.9', '1.4.4.3')):
|
|
|
3280a9 |
+ # (Internal) op=15(1)(1) SRCH base="uid=new_test_user_777, dc=example,dc=com"
|
|
|
3280a9 |
+ assert topo.ds_access_log.match(r'.*\(Internal\) op=[0-9]+\([0-9]+\)\([0-9]+\) SRCH base="uid=new_test_user_777,'
|
|
|
3280a9 |
+ 'dc=example,dc=com".*')
|
|
|
3280a9 |
# (Internal) op=15(1)(1) RESULT err=0 tag=48 nentries=1
|
|
|
3280a9 |
assert topo.ds_access_log.match(r'.*\(Internal\) op=[0-9]+\([0-9]+\)\([0-9]+\) RESULT err=0 tag=48 nentries=1.*')
|
|
|
3280a9 |
# op=15 RESULT err=0 tag=107
|
|
|
3280a9 |
@@ -574,8 +608,9 @@ def test_internal_log_level_131076(topology_st, add_user_log_level_131076):
|
|
|
3280a9 |
@pytest.mark.xfail(ds_is_older('1.4.0'), reason="May fail on 1.3.x because of bug 1358706")
|
|
|
3280a9 |
@pytest.mark.bz1358706
|
|
|
3280a9 |
@pytest.mark.ds49029
|
|
|
3280a9 |
-def test_internal_log_level_516(topology_st, add_user_log_level_516):
|
|
|
3280a9 |
+def test_internal_log_level_516(topology_st, add_user_log_level_516, disable_access_log_buffering):
|
|
|
3280a9 |
"""Tests client initiated operations when referential integrity plugin is enabled
|
|
|
3280a9 |
+
|
|
|
3280a9 |
:id: bee1d681-763d-4fa5-aca2-569cf93f8b71
|
|
|
3280a9 |
:setup: Standalone instance
|
|
|
3280a9 |
Configure access log level to - 512+4
|
|
|
3280a9 |
@@ -624,34 +659,34 @@ def test_internal_log_level_516(topology_st, add_user_log_level_516):
|
|
|
3280a9 |
assert topo.ds_access_log.match(r'.*\(Internal\) op=[0-9]+\([0-9]+\)\([0-9]+\) RESULT err=0 tag=48 nentries=1*')
|
|
|
3280a9 |
# (Internal) op=10(1)(1) RESULT err=0 tag=48
|
|
|
3280a9 |
assert topo.ds_access_log.match(r'.*\(Internal\) op=[0-9]+\([0-9]+\)\([0-9]+\) RESULT err=0 tag=48.*')
|
|
|
3280a9 |
- # op=10 RESULT err=0 tag=105
|
|
|
3280a9 |
- assert not topo.ds_access_log.match(r'.*op=[0-9]+ RESULT err=0 tag=105.*')
|
|
|
3280a9 |
|
|
|
3280a9 |
log.info("Check the access logs for MOD operation of the user")
|
|
|
3280a9 |
# op=12 MODRDN dn="uid=test_user_777,ou=branch1,dc=example,dc=com" '
|
|
|
3280a9 |
# 'newrdn="uid=new_test_user_777" newsuperior="dc=example,dc=com"
|
|
|
3280a9 |
assert not topo.ds_access_log.match(r'.*op=[0-9]+ MODRDN dn="uid=test_user_777,ou=branch1,dc=example,dc=com" '
|
|
|
3280a9 |
'newrdn="uid=new_test_user_777" newsuperior="dc=example,dc=com".*')
|
|
|
3280a9 |
- # Internal) op=12(1)(1) SRCH base="uid=test_user_777, ou=branch1,dc=example,dc=com"
|
|
|
3280a9 |
- assert topo.ds_access_log.match(r'.*\(Internal\) op=[0-9]+\([0-9]+\)\([0-9]+\) SRCH base="uid=test_user_777,'
|
|
|
3280a9 |
- 'ou=branch1,dc=example,dc=com".*')
|
|
|
3280a9 |
- # (Internal) op=12(1)(1) ENTRY dn="uid=test_user_777, ou=branch1,dc=example,dc=com"
|
|
|
3280a9 |
- assert topo.ds_access_log.match(r'.*\(Internal\) op=[0-9]+\([0-9]+\)\([0-9]+\) ENTRY dn="uid=test_user_777,'
|
|
|
3280a9 |
- 'ou=branch1,dc=example,dc=com".*')
|
|
|
3280a9 |
+ if ds_is_older(('1.4.3.9', '1.4.4.3')):
|
|
|
3280a9 |
+ # Internal) op=12(1)(1) SRCH base="uid=test_user_777, ou=branch1,dc=example,dc=com"
|
|
|
3280a9 |
+ assert topo.ds_access_log.match(r'.*\(Internal\) op=[0-9]+\([0-9]+\)\([0-9]+\) SRCH base="uid=test_user_777,'
|
|
|
3280a9 |
+ 'ou=branch1,dc=example,dc=com".*')
|
|
|
3280a9 |
+ # (Internal) op=12(1)(1) ENTRY dn="uid=test_user_777, ou=branch1,dc=example,dc=com"
|
|
|
3280a9 |
+ assert topo.ds_access_log.match(r'.*\(Internal\) op=[0-9]+\([0-9]+\)\([0-9]+\) ENTRY dn="uid=test_user_777,'
|
|
|
3280a9 |
+ 'ou=branch1,dc=example,dc=com".*')
|
|
|
3280a9 |
# (Internal) op=12(1)(1) RESULT err=0 tag=48 nentries=1
|
|
|
3280a9 |
assert topo.ds_access_log.match(r'.*\(Internal\) op=[0-9]+\([0-9]+\)\([0-9]+\) RESULT err=0 tag=48 nentries=1.*')
|
|
|
3280a9 |
- # op=12 RESULT err=0 tag=109
|
|
|
3280a9 |
- assert not topo.ds_access_log.match(r'.*op=[0-9]+ RESULT err=0 tag=109.*')
|
|
|
3280a9 |
+ # op=12 RESULT err=0 tag=48
|
|
|
3280a9 |
+ assert not topo.ds_access_log.match(r'.*op=[0-9]+ RESULT err=0 tag=48.*')
|
|
|
3280a9 |
|
|
|
3280a9 |
log.info("Check the access logs for DEL operation of the user")
|
|
|
3280a9 |
# op=15 DEL dn="uid=new_test_user_777,dc=example,dc=com"
|
|
|
3280a9 |
assert not topo.ds_access_log.match(r'.*op=[0-9]+ DEL dn="uid=new_test_user_777,dc=example,dc=com".*')
|
|
|
3280a9 |
- # (Internal) op=15(1)(1) SRCH base="uid=new_test_user_777, dc=example,dc=com"
|
|
|
3280a9 |
- assert topo.ds_access_log.match(r'.*\(Internal\) op=[0-9]+\([0-9]+\)\([0-9]+\) SRCH base="uid=new_test_user_777,'
|
|
|
3280a9 |
- 'dc=example,dc=com".*')
|
|
|
3280a9 |
- # (Internal) op=15(1)(1) ENTRY dn="uid=new_test_user_777, dc=example,dc=com"
|
|
|
3280a9 |
- assert topo.ds_access_log.match(r'.*\(Internal\) op=[0-9]+\([0-9]+\)\([0-9]+\) ENTRY dn="uid=new_test_user_777,'
|
|
|
3280a9 |
- 'dc=example,dc=com".*')
|
|
|
3280a9 |
+ if ds_is_older(('1.4.3.9', '1.4.4.3')):
|
|
|
3280a9 |
+ # (Internal) op=15(1)(1) SRCH base="uid=new_test_user_777, dc=example,dc=com"
|
|
|
3280a9 |
+ assert topo.ds_access_log.match(r'.*\(Internal\) op=[0-9]+\([0-9]+\)\([0-9]+\) SRCH base="uid=new_test_user_777,'
|
|
|
3280a9 |
+ 'dc=example,dc=com".*')
|
|
|
3280a9 |
+ # (Internal) op=15(1)(1) ENTRY dn="uid=new_test_user_777, dc=example,dc=com"
|
|
|
3280a9 |
+ assert topo.ds_access_log.match(r'.*\(Internal\) op=[0-9]+\([0-9]+\)\([0-9]+\) ENTRY dn="uid=new_test_user_777,'
|
|
|
3280a9 |
+ 'dc=example,dc=com".*')
|
|
|
3280a9 |
# (Internal) op=15(1)(1) RESULT err=0 tag=48 nentries=1
|
|
|
3280a9 |
assert topo.ds_access_log.match(r'.*\(Internal\) op=[0-9]+\([0-9]+\)\([0-9]+\) RESULT err=0 tag=48 nentries=1.*')
|
|
|
3280a9 |
# op=15 RESULT err=0 tag=107
|
|
|
3280a9 |
@@ -698,14 +733,13 @@ def test_access_log_truncated_search_message(topology_st, clean_access_logs):
|
|
|
3280a9 |
assert not topo.ds_access_log.match(r'.*cn500.*')
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
-
|
|
|
3280a9 |
+@pytest.mark.skipif(ds_is_newer("1.4.3"), reason="rsearch was removed")
|
|
|
3280a9 |
@pytest.mark.xfail(ds_is_older('1.4.2.0'), reason="May fail because of bug 1732053")
|
|
|
3280a9 |
@pytest.mark.bz1732053
|
|
|
3280a9 |
@pytest.mark.ds50510
|
|
|
3280a9 |
def test_etime_at_border_of_second(topology_st, clean_access_logs):
|
|
|
3280a9 |
topo = topology_st.standalone
|
|
|
3280a9 |
|
|
|
3280a9 |
-
|
|
|
3280a9 |
prog = os.path.join(topo.ds_paths.bin_dir, 'rsearch')
|
|
|
3280a9 |
|
|
|
3280a9 |
cmd = [prog]
|
|
|
3280a9 |
@@ -741,11 +775,167 @@ def test_etime_at_border_of_second(topology_st, clean_access_logs):
|
|
|
3280a9 |
assert not invalid_etime
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
+@pytest.mark.skipif(ds_is_older('1.3.10.1', '1.4.1'), reason="Fail because of bug 1749236")
|
|
|
3280a9 |
+@pytest.mark.bz1749236
|
|
|
3280a9 |
+def test_etime_order_of_magnitude(topology_st, clean_access_logs, remove_users, disable_access_log_buffering):
|
|
|
3280a9 |
+ """Test that the etime reported in the access log has a correct order of magnitude
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ :id: e815cfa0-8136-4932-b50f-c3dfac34b0e6
|
|
|
3280a9 |
+ :setup: Standalone instance
|
|
|
3280a9 |
+ :steps:
|
|
|
3280a9 |
+ 1. Unset log buffering for the access log
|
|
|
3280a9 |
+ 2. Delete potential existing access logs
|
|
|
3280a9 |
+ 3. Add users
|
|
|
3280a9 |
+ 4. Search users
|
|
|
3280a9 |
+ 5. Restart the server to flush the logs
|
|
|
3280a9 |
+ 6. Parse the access log looking for the SRCH operation log
|
|
|
3280a9 |
+ 7. From the SRCH string get the start time and op number of the operation
|
|
|
3280a9 |
+ 8. From the op num find the associated RESULT string in the access log
|
|
|
3280a9 |
+ 9. From the RESULT string get the end time and the etime for the operation
|
|
|
3280a9 |
+ 10. Calculate the ratio between the calculated elapsed time (end time - start time) and the logged etime
|
|
|
3280a9 |
+ :expectedresults:
|
|
|
3280a9 |
+ 1. access log buffering is off
|
|
|
3280a9 |
+ 2. Previously existing access logs are deleted
|
|
|
3280a9 |
+ 3. Users are successfully added
|
|
|
3280a9 |
+ 4. Search operation is successful
|
|
|
3280a9 |
+ 5. Server is restarted and logs are flushed
|
|
|
3280a9 |
+ 6. SRCH operation log string is catched
|
|
|
3280a9 |
+ 7. start time and op number are collected
|
|
|
3280a9 |
+ 8. RESULT string is catched from the access log
|
|
|
3280a9 |
+ 9. end time and etime are collected
|
|
|
3280a9 |
+ 10. ratio between calculated elapsed time and logged etime is less or equal to 1
|
|
|
3280a9 |
+ """
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ DSLdapObject(topology_st.standalone, DEFAULT_SUFFIX)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ log.info('add_users')
|
|
|
3280a9 |
+ add_users(topology_st.standalone, 30)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ log.info ('search users')
|
|
|
3280a9 |
+ search_users(topology_st.standalone)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ log.info('parse the access logs to get the SRCH string')
|
|
|
3280a9 |
+ # Here we are looking at the whole string logged for the search request with base ou=People,dc=example,dc=com
|
|
|
3280a9 |
+ search_str = str(topology_st.standalone.ds_access_log.match(r'.*SRCH base="ou=People,dc=example,dc=com.*'))[1:-1]
|
|
|
3280a9 |
+ assert len(search_str) > 0
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ # the search_str returned looks like :
|
|
|
3280a9 |
+ # [23/Apr/2020:06:06:14.360857624 -0400] conn=1 op=93 SRCH base="ou=People,dc=example,dc=com" scope=2 filter="(&(objectClass=account)(objectClass=posixaccount)(objectClass=inetOrgPerson)(objectClass=organizationalPerson))" attrs="distinguishedName"
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ log.info('get the operation start time from the SRCH string')
|
|
|
3280a9 |
+ # Here we are getting the sec.nanosec part of the date, '14.360857624' in the example above
|
|
|
3280a9 |
+ start_time = (search_str.split()[0]).split(':')[3]
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ log.info('get the OP number from the SRCH string')
|
|
|
3280a9 |
+ # Here we are getting the op number, 'op=93' in the above example
|
|
|
3280a9 |
+ op_num = search_str.split()[3]
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ log.info('get the RESULT string matching the SRCH OP number')
|
|
|
3280a9 |
+ # Here we are looking at the RESULT string for the above search op, 'op=93' in this example
|
|
|
3280a9 |
+ result_str = str(topology_st.standalone.ds_access_log.match(r'.*{} RESULT*'.format(op_num)))[1:-1]
|
|
|
3280a9 |
+ assert len(result_str) > 0
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ # The result_str returned looks like :
|
|
|
3280a9 |
+ # For ds older than 1.4.3.8: [23/Apr/2020:06:06:14.366429900 -0400] conn=1 op=93 RESULT err=0 tag=101 nentries=30 etime=0.005723017
|
|
|
3280a9 |
+ # For ds newer than 1.4.3.8: [21/Oct/2020:09:27:50.095209871 -0400] conn=1 op=96 RESULT err=0 tag=101 nentries=30 wtime=0.000412584 optime=0.005428971 etime=0.005836077
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ log.info('get the operation end time from the RESULT string')
|
|
|
3280a9 |
+ # Here we are getting the sec.nanosec part of the date, '14.366429900' in the above example
|
|
|
3280a9 |
+ end_time = (result_str.split()[0]).split(':')[3]
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ log.info('get the logged etime for the operation from the RESULT string')
|
|
|
3280a9 |
+ # Here we are getting the etime value, '0.005723017' in the example above
|
|
|
3280a9 |
+ if ds_is_older('1.4.3.8'):
|
|
|
3280a9 |
+ etime = result_str.split()[8].split('=')[1][:-3]
|
|
|
3280a9 |
+ else:
|
|
|
3280a9 |
+ etime = result_str.split()[10].split('=')[1][:-3]
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ log.info('Calculate the ratio between logged etime for the operation and elapsed time from its start time to its end time - should be around 1')
|
|
|
3280a9 |
+ etime_ratio = (Decimal(end_time) - Decimal(start_time)) // Decimal(etime)
|
|
|
3280a9 |
+ assert etime_ratio <= 1
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+@pytest.mark.skipif(ds_is_older('1.4.3.8'), reason="Fail because of bug 1850275")
|
|
|
3280a9 |
+@pytest.mark.bz1850275
|
|
|
3280a9 |
+def test_optime_and_wtime_keywords(topology_st, clean_access_logs, remove_users, disable_access_log_buffering):
|
|
|
3280a9 |
+ """Test that the new optime and wtime keywords are present in the access log and have correct values
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ :id: dfb4a49d-1cfc-400e-ba43-c107f58d62cf
|
|
|
3280a9 |
+ :setup: Standalone instance
|
|
|
3280a9 |
+ :steps:
|
|
|
3280a9 |
+ 1. Unset log buffering for the access log
|
|
|
3280a9 |
+ 2. Delete potential existing access logs
|
|
|
3280a9 |
+ 3. Add users
|
|
|
3280a9 |
+ 4. Search users
|
|
|
3280a9 |
+ 5. Parse the access log looking for the SRCH operation log
|
|
|
3280a9 |
+ 6. From the SRCH string get the op number of the operation
|
|
|
3280a9 |
+ 7. From the op num find the associated RESULT string in the access log
|
|
|
3280a9 |
+ 8. Search for the wtime optime keywords in the RESULT string
|
|
|
3280a9 |
+ 9. From the RESULT string get the wtime, optime and etime values for the operation
|
|
|
3280a9 |
+ 10. Check that optime + wtime is approximatively etime
|
|
|
3280a9 |
+ :expectedresults:
|
|
|
3280a9 |
+ 1. access log buffering is off
|
|
|
3280a9 |
+ 2. Previously existing access logs are deleted
|
|
|
3280a9 |
+ 3. Users are successfully added
|
|
|
3280a9 |
+ 4. Search operation is successful
|
|
|
3280a9 |
+ 5. SRCH operation log string is catched
|
|
|
3280a9 |
+ 6. op number is collected
|
|
|
3280a9 |
+ 7. RESULT string is catched from the access log
|
|
|
3280a9 |
+ 8. wtime and optime keywords are collected
|
|
|
3280a9 |
+ 9. wtime, optime and etime values are collected
|
|
|
3280a9 |
+ 10. (optime + wtime) =~ etime
|
|
|
3280a9 |
+ """
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ log.info('add_users')
|
|
|
3280a9 |
+ add_users(topology_st.standalone, 30)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ log.info ('search users')
|
|
|
3280a9 |
+ search_users(topology_st.standalone)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ log.info('parse the access logs to get the SRCH string')
|
|
|
3280a9 |
+ # Here we are looking at the whole string logged for the search request with base ou=People,dc=example,dc=com
|
|
|
3280a9 |
+ search_str = str(topology_st.standalone.ds_access_log.match(r'.*SRCH base="ou=People,dc=example,dc=com.*'))[1:-1]
|
|
|
3280a9 |
+ assert len(search_str) > 0
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ # the search_str returned looks like :
|
|
|
3280a9 |
+ # [22/Oct/2020:09:47:11.951316798 -0400] conn=1 op=96 SRCH base="ou=People,dc=example,dc=com" scope=2 filter="(&(objectClass=account)(objectClass=posixaccount)(objectClass=inetOrgPerson)(objectClass=organizationalPerson))" attrs="distinguishedName"
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ log.info('get the OP number from the SRCH string')
|
|
|
3280a9 |
+ # Here we are getting the op number, 'op=96' in the above example
|
|
|
3280a9 |
+ op_num = search_str.split()[3]
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ log.info('get the RESULT string matching the SRCH op number')
|
|
|
3280a9 |
+ # Here we are looking at the RESULT string for the above search op, 'op=96' in this example
|
|
|
3280a9 |
+ result_str = str(topology_st.standalone.ds_access_log.match(r'.*{} RESULT*'.format(op_num)))[1:-1]
|
|
|
3280a9 |
+ assert len(result_str) > 0
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ # The result_str returned looks like :
|
|
|
3280a9 |
+ # [22/Oct/2020:09:47:11.963276018 -0400] conn=1 op=96 RESULT err=0 tag=101 nentries=30 wtime=0.000180294 optime=0.011966632 etime=0.012141311
|
|
|
3280a9 |
+ log.info('Search for the wtime keyword in the RESULT string')
|
|
|
3280a9 |
+ assert re.search('wtime', result_str)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ log.info('get the wtime value from the RESULT string')
|
|
|
3280a9 |
+ wtime_value = result_str.split()[8].split('=')[1][:-3]
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ log.info('Search for the optime keyword in the RESULT string')
|
|
|
3280a9 |
+ assert re.search('optime', result_str)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ log.info('get the optime value from the RESULT string')
|
|
|
3280a9 |
+ optime_value = result_str.split()[9].split('=')[1][:-3]
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ log.info('get the etime value from the RESULT string')
|
|
|
3280a9 |
+ etime_value = result_str.split()[10].split('=')[1][:-3]
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ log.info('Check that (wtime + optime) is approximately equal to etime i.e. their ratio is 1')
|
|
|
3280a9 |
+ etime_ratio = (Decimal(wtime_value) + Decimal(optime_value)) // Decimal(etime_value)
|
|
|
3280a9 |
+ assert etime_ratio == 1
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+
|
|
|
3280a9 |
@pytest.mark.xfail(ds_is_older('1.3.10.1'), reason="May fail because of bug 1662461")
|
|
|
3280a9 |
@pytest.mark.bz1662461
|
|
|
3280a9 |
@pytest.mark.ds50428
|
|
|
3280a9 |
@pytest.mark.ds49969
|
|
|
3280a9 |
-def test_log_base_dn_when_invalid_attr_request(topology_st):
|
|
|
3280a9 |
+def test_log_base_dn_when_invalid_attr_request(topology_st, disable_access_log_buffering):
|
|
|
3280a9 |
"""Test that DS correctly logs the base dn when a search with invalid attribute request is performed
|
|
|
3280a9 |
|
|
|
3280a9 |
:id: 859de962-c261-4ffb-8705-97bceab1ba2c
|
|
|
3280a9 |
@@ -753,7 +943,7 @@ def test_log_base_dn_when_invalid_attr_request(topology_st):
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
1. Disable the accesslog-logbuffering config parameter
|
|
|
3280a9 |
2. Delete the previous access log
|
|
|
3280a9 |
- 3. Perform a base search on the DEFAULT_SUFFIX, using invalid "" "" attribute request
|
|
|
3280a9 |
+ 3. Perform a base search on the DEFAULT_SUFFIX, using ten empty attribute requests
|
|
|
3280a9 |
4. Check the access log file for 'invalid attribute request'
|
|
|
3280a9 |
5. Check the access log file for 'SRCH base="\(null\)"'
|
|
|
3280a9 |
6. Check the access log file for 'SRCH base="DEFAULT_SUFFIX"'
|
|
|
3280a9 |
@@ -768,17 +958,14 @@ def test_log_base_dn_when_invalid_attr_request(topology_st):
|
|
|
3280a9 |
|
|
|
3280a9 |
entry = DSLdapObject(topology_st.standalone, DEFAULT_SUFFIX)
|
|
|
3280a9 |
|
|
|
3280a9 |
- log.info('Set accesslog logbuffering to off to get the log in real time')
|
|
|
3280a9 |
- topology_st.standalone.config.set('nsslapd-accesslog-logbuffering', 'off')
|
|
|
3280a9 |
-
|
|
|
3280a9 |
log.info('delete the previous access logs to get a fresh new one')
|
|
|
3280a9 |
topology_st.standalone.deleteAccessLogs()
|
|
|
3280a9 |
|
|
|
3280a9 |
log.info("Search the default suffix, with invalid '\"\" \"\"' attribute request")
|
|
|
3280a9 |
- log.info("A Protocol error exception should be raised, see https://pagure.io/389-ds-base/issue/49969")
|
|
|
3280a9 |
- # A ldap.PROTOCOL_ERROR exception is expected
|
|
|
3280a9 |
+ log.info("A Protocol error exception should be raised, see https://github.com/389ds/389-ds-base/issues/3028")
|
|
|
3280a9 |
+ # A ldap.PROTOCOL_ERROR exception is expected after 10 empty values
|
|
|
3280a9 |
with pytest.raises(ldap.PROTOCOL_ERROR):
|
|
|
3280a9 |
- assert entry.get_attrs_vals_utf8(['', ''])
|
|
|
3280a9 |
+ assert entry.get_attrs_vals_utf8(['', '', '', '', '', '', '', '', '', '', ''])
|
|
|
3280a9 |
|
|
|
3280a9 |
# Search for appropriate messages in the access log
|
|
|
3280a9 |
log.info('Check the access logs for correct messages')
|
|
|
3280a9 |
diff --git a/dirsrvtests/tests/suites/filter/rfc3673_all_oper_attrs_test.py b/dirsrvtests/tests/suites/filter/rfc3673_all_oper_attrs_test.py
|
|
|
3280a9 |
index db2be9f67..c882bea5f 100644
|
|
|
3280a9 |
--- a/dirsrvtests/tests/suites/filter/rfc3673_all_oper_attrs_test.py
|
|
|
3280a9 |
+++ b/dirsrvtests/tests/suites/filter/rfc3673_all_oper_attrs_test.py
|
|
|
3280a9 |
@@ -11,6 +11,7 @@ from lib389.tasks import *
|
|
|
3280a9 |
from lib389.utils import *
|
|
|
3280a9 |
from lib389.topologies import topology_st
|
|
|
3280a9 |
from lib389.idm.user import UserAccounts
|
|
|
3280a9 |
+from lib389.idm.domain import Domain
|
|
|
3280a9 |
|
|
|
3280a9 |
from lib389._constants import DN_DM, DEFAULT_SUFFIX, DN_CONFIG, PASSWORD
|
|
|
3280a9 |
|
|
|
3280a9 |
@@ -26,15 +27,15 @@ TEST_USER_PWD = 'all_attrs_test'
|
|
|
3280a9 |
TEST_PARAMS = [(DN_ROOT, False, [
|
|
|
3280a9 |
'aci', 'createTimestamp', 'creatorsName',
|
|
|
3280a9 |
'modifiersName', 'modifyTimestamp', 'namingContexts',
|
|
|
3280a9 |
- 'nsBackendSuffix', 'nsUniqueId', 'subschemaSubentry',
|
|
|
3280a9 |
+ 'nsBackendSuffix', 'subschemaSubentry',
|
|
|
3280a9 |
'supportedControl', 'supportedExtension',
|
|
|
3280a9 |
'supportedFeatures', 'supportedLDAPVersion',
|
|
|
3280a9 |
'supportedSASLMechanisms', 'vendorName', 'vendorVersion'
|
|
|
3280a9 |
-]),
|
|
|
3280a9 |
+ ]),
|
|
|
3280a9 |
(DN_ROOT, True, [
|
|
|
3280a9 |
'createTimestamp', 'creatorsName',
|
|
|
3280a9 |
'modifiersName', 'modifyTimestamp', 'namingContexts',
|
|
|
3280a9 |
- 'nsBackendSuffix', 'nsUniqueId', 'subschemaSubentry',
|
|
|
3280a9 |
+ 'nsBackendSuffix', 'subschemaSubentry',
|
|
|
3280a9 |
'supportedControl', 'supportedExtension',
|
|
|
3280a9 |
'supportedFeatures', 'supportedLDAPVersion',
|
|
|
3280a9 |
'supportedSASLMechanisms', 'vendorName', 'vendorVersion'
|
|
|
3280a9 |
@@ -80,6 +81,18 @@ def create_user(topology_st):
|
|
|
3280a9 |
'homeDirectory': '/home/test'
|
|
|
3280a9 |
})
|
|
|
3280a9 |
|
|
|
3280a9 |
+ # Add anonymous access aci
|
|
|
3280a9 |
+ ACI_TARGET = "(targetattr != \"userpassword || aci\")(target = \"ldap:///%s\")" % (DEFAULT_SUFFIX)
|
|
|
3280a9 |
+ ACI_ALLOW = "(version 3.0; acl \"Anonymous Read access\"; allow (read,search,compare)"
|
|
|
3280a9 |
+ ACI_SUBJECT = "(userdn=\"ldap:///anyone\");)"
|
|
|
3280a9 |
+ ANON_ACI = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
|
|
|
3280a9 |
+ suffix = Domain(topology_st.standalone, DEFAULT_SUFFIX)
|
|
|
3280a9 |
+ try:
|
|
|
3280a9 |
+ suffix.add('aci', ANON_ACI)
|
|
|
3280a9 |
+ except ldap.TYPE_OR_VALUE_EXISTS:
|
|
|
3280a9 |
+ pass
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+
|
|
|
3280a9 |
@pytest.fixture(scope="module")
|
|
|
3280a9 |
def user_aci(topology_st):
|
|
|
3280a9 |
"""Don't allow modifiersName attribute for the test user
|
|
|
3280a9 |
@@ -156,7 +169,9 @@ def test_search_basic(topology_st, create_user, user_aci, add_attr,
|
|
|
3280a9 |
entries = topology_st.standalone.search_s(search_suffix, ldap.SCOPE_BASE,
|
|
|
3280a9 |
'(objectclass=*)',
|
|
|
3280a9 |
search_filter)
|
|
|
3280a9 |
- found_attrs = entries[0].data.keys()
|
|
|
3280a9 |
+ found_attrs = set(entries[0].data.keys())
|
|
|
3280a9 |
+ if search_suffix == DN_ROOT and "nsUniqueId" in found_attrs:
|
|
|
3280a9 |
+ found_attrs.remove("nsUniqueId")
|
|
|
3280a9 |
|
|
|
3280a9 |
if add_attr == '*':
|
|
|
3280a9 |
assert set(expected_attrs) - set(found_attrs) == set()
|
|
|
3280a9 |
diff --git a/dirsrvtests/tests/suites/mapping_tree/acceptance_test.py b/dirsrvtests/tests/suites/mapping_tree/acceptance_test.py
|
|
|
3280a9 |
new file mode 100644
|
|
|
3280a9 |
index 000000000..387c313ad
|
|
|
3280a9 |
--- /dev/null
|
|
|
3280a9 |
+++ b/dirsrvtests/tests/suites/mapping_tree/acceptance_test.py
|
|
|
3280a9 |
@@ -0,0 +1,65 @@
|
|
|
3280a9 |
+# --- BEGIN COPYRIGHT BLOCK ---
|
|
|
3280a9 |
+# Copyright (C) 2020 Red Hat, Inc.
|
|
|
3280a9 |
+# All rights reserved.
|
|
|
3280a9 |
+#
|
|
|
3280a9 |
+# License: GPL (version 3 or any later version).
|
|
|
3280a9 |
+# See LICENSE for details.
|
|
|
3280a9 |
+# --- END COPYRIGHT BLOCK ---
|
|
|
3280a9 |
+#
|
|
|
3280a9 |
+import ldap
|
|
|
3280a9 |
+import logging
|
|
|
3280a9 |
+import pytest
|
|
|
3280a9 |
+import os
|
|
|
3280a9 |
+from lib389._constants import *
|
|
|
3280a9 |
+from lib389.topologies import topology_st as topo
|
|
|
3280a9 |
+from lib389.mappingTree import MappingTrees
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+DEBUGGING = os.getenv("DEBUGGING", default=False)
|
|
|
3280a9 |
+if DEBUGGING:
|
|
|
3280a9 |
+ logging.getLogger(__name__).setLevel(logging.DEBUG)
|
|
|
3280a9 |
+else:
|
|
|
3280a9 |
+ logging.getLogger(__name__).setLevel(logging.INFO)
|
|
|
3280a9 |
+log = logging.getLogger(__name__)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+def test_invalid_mt(topo):
|
|
|
3280a9 |
+ """Test that you can not add a new suffix/mapping tree
|
|
|
3280a9 |
+ that does not already have the backend entry created.
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ :id: caabd407-f541-4695-b13f-8f92af1112a0
|
|
|
3280a9 |
+ :setup: Standalone Instance
|
|
|
3280a9 |
+ :steps:
|
|
|
3280a9 |
+ 1. Create a new suffix that specifies an existing backend which has a
|
|
|
3280a9 |
+ different suffix.
|
|
|
3280a9 |
+ 2. Create a suffix that has no backend entry at all.
|
|
|
3280a9 |
+ :expectedresults:
|
|
|
3280a9 |
+ 1. Should fail with UNWILLING_TO_PERFORM
|
|
|
3280a9 |
+ 1. Should fail with UNWILLING_TO_PERFORM
|
|
|
3280a9 |
+ """
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ bad_suffix = 'dc=does,dc=not,dc=exist'
|
|
|
3280a9 |
+ mts = MappingTrees(topo.standalone)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ properties = {
|
|
|
3280a9 |
+ 'cn': bad_suffix,
|
|
|
3280a9 |
+ 'nsslapd-state': 'backend',
|
|
|
3280a9 |
+ 'nsslapd-backend': 'userroot',
|
|
|
3280a9 |
+ }
|
|
|
3280a9 |
+ with pytest.raises(ldap.UNWILLING_TO_PERFORM):
|
|
|
3280a9 |
+ mts.create(properties=properties)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ properties = {
|
|
|
3280a9 |
+ 'cn': bad_suffix,
|
|
|
3280a9 |
+ 'nsslapd-state': 'backend',
|
|
|
3280a9 |
+ 'nsslapd-backend': 'notCreatedRoot',
|
|
|
3280a9 |
+ }
|
|
|
3280a9 |
+ with pytest.raises(ldap.UNWILLING_TO_PERFORM):
|
|
|
3280a9 |
+ mts.create(properties=properties)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+if __name__ == '__main__':
|
|
|
3280a9 |
+ # Run isolated
|
|
|
3280a9 |
+ # -s for DEBUG mode
|
|
|
3280a9 |
+ CURRENT_FILE = os.path.realpath(__file__)
|
|
|
3280a9 |
+ pytest.main(["-s", CURRENT_FILE])
|
|
|
3280a9 |
+
|
|
|
3280a9 |
diff --git a/dirsrvtests/tests/suites/mapping_tree/be_del_and_default_naming_attr_test.py b/dirsrvtests/tests/suites/mapping_tree/be_del_and_default_naming_attr_test.py
|
|
|
3280a9 |
index 34a2de2ad..c25d89cb0 100644
|
|
|
3280a9 |
--- a/dirsrvtests/tests/suites/mapping_tree/be_del_and_default_naming_attr_test.py
|
|
|
3280a9 |
+++ b/dirsrvtests/tests/suites/mapping_tree/be_del_and_default_naming_attr_test.py
|
|
|
3280a9 |
@@ -6,6 +6,8 @@ from lib389.topologies import topology_m1 as topo
|
|
|
3280a9 |
from lib389.backend import Backends
|
|
|
3280a9 |
from lib389.encrypted_attributes import EncryptedAttrs
|
|
|
3280a9 |
|
|
|
3280a9 |
+pytestmark = pytest.mark.tier1
|
|
|
3280a9 |
+
|
|
|
3280a9 |
DEBUGGING = os.getenv("DEBUGGING", default=False)
|
|
|
3280a9 |
if DEBUGGING:
|
|
|
3280a9 |
logging.getLogger(__name__).setLevel(logging.DEBUG)
|
|
|
3280a9 |
@@ -26,13 +28,13 @@ def test_be_delete(topo):
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
1. Create second backend/suffix
|
|
|
3280a9 |
2. Add an encrypted attribute to the default suffix
|
|
|
3280a9 |
- 2. Delete default suffix
|
|
|
3280a9 |
- 3. Check the nsslapd-defaultnamingcontext is updated
|
|
|
3280a9 |
- 4. Delete the last backend
|
|
|
3280a9 |
- 5. Check the namingcontext has not changed
|
|
|
3280a9 |
- 6. Add new backend
|
|
|
3280a9 |
- 7. Set default naming context
|
|
|
3280a9 |
- 8. Verify the naming context is correct
|
|
|
3280a9 |
+ 3. Delete default suffix
|
|
|
3280a9 |
+ 4. Check the nsslapd-defaultnamingcontext is updated
|
|
|
3280a9 |
+ 5. Delete the last backend
|
|
|
3280a9 |
+ 6. Check the namingcontext has not changed
|
|
|
3280a9 |
+ 7. Add new backend
|
|
|
3280a9 |
+ 8. Set default naming context
|
|
|
3280a9 |
+ 9. Verify the naming context is correct
|
|
|
3280a9 |
:expectedresults:
|
|
|
3280a9 |
1. Success
|
|
|
3280a9 |
2. Success
|
|
|
3280a9 |
@@ -42,6 +44,7 @@ def test_be_delete(topo):
|
|
|
3280a9 |
6. Success
|
|
|
3280a9 |
7. Success
|
|
|
3280a9 |
8. Success
|
|
|
3280a9 |
+ 9. Success
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
|
|
|
3280a9 |
inst = topo.ms["master1"]
|
|
|
3280a9 |
diff --git a/dirsrvtests/tests/suites/password/pwdPolicy_attribute_test.py b/dirsrvtests/tests/suites/password/pwdPolicy_attribute_test.py
|
|
|
3280a9 |
index b37eff70f..882faf513 100644
|
|
|
3280a9 |
--- a/dirsrvtests/tests/suites/password/pwdPolicy_attribute_test.py
|
|
|
3280a9 |
+++ b/dirsrvtests/tests/suites/password/pwdPolicy_attribute_test.py
|
|
|
3280a9 |
@@ -99,6 +99,7 @@ def test_pwd_reset(topology_st, create_user):
|
|
|
3280a9 |
# Reset user's password
|
|
|
3280a9 |
our_user = UserAccount(topology_st.standalone, TEST_USER_DN)
|
|
|
3280a9 |
our_user.replace('userpassword', PASSWORD)
|
|
|
3280a9 |
+ time.sleep(.5)
|
|
|
3280a9 |
|
|
|
3280a9 |
# Check that pwdReset is TRUE
|
|
|
3280a9 |
assert our_user.get_attr_val_utf8('pwdReset') == 'TRUE'
|
|
|
3280a9 |
@@ -106,6 +107,7 @@ def test_pwd_reset(topology_st, create_user):
|
|
|
3280a9 |
# Bind as user and change its own password
|
|
|
3280a9 |
our_user.rebind(PASSWORD)
|
|
|
3280a9 |
our_user.replace('userpassword', PASSWORD)
|
|
|
3280a9 |
+ time.sleep(.5)
|
|
|
3280a9 |
|
|
|
3280a9 |
# Check that pwdReset is FALSE
|
|
|
3280a9 |
topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
|
|
|
3280a9 |
@@ -114,6 +116,9 @@ def test_pwd_reset(topology_st, create_user):
|
|
|
3280a9 |
# Reset password policy config
|
|
|
3280a9 |
topology_st.standalone.config.replace('passwordMustChange', 'off')
|
|
|
3280a9 |
|
|
|
3280a9 |
+ # Reset user's password
|
|
|
3280a9 |
+ our_user.replace('userpassword', TEST_USER_PWD)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
|
|
|
3280a9 |
@pytest.mark.parametrize('subtree_pwchange,user_pwchange,exception',
|
|
|
3280a9 |
[('on', 'off', ldap.UNWILLING_TO_PERFORM),
|
|
|
3280a9 |
@@ -171,7 +176,7 @@ def test_change_pwd(topology_st, create_user, password_policy,
|
|
|
3280a9 |
user.reset_password('new_pass')
|
|
|
3280a9 |
except ldap.LDAPError as e:
|
|
|
3280a9 |
log.error('Failed to change userpassword for {}: error {}'.format(
|
|
|
3280a9 |
- TEST_USER_DN, e.message['info']))
|
|
|
3280a9 |
+ TEST_USER_DN, e.args[0['info']]))
|
|
|
3280a9 |
raise e
|
|
|
3280a9 |
finally:
|
|
|
3280a9 |
log.info('Bind as DM')
|
|
|
3280a9 |
@@ -245,7 +250,7 @@ def test_pwd_min_age(topology_st, create_user, password_policy):
|
|
|
3280a9 |
user.reset_password(TEST_USER_PWD)
|
|
|
3280a9 |
except ldap.LDAPError as e:
|
|
|
3280a9 |
log.error('Failed to change userpassword for {}: error {}'.format(
|
|
|
3280a9 |
- TEST_USER_DN, e.message['info']))
|
|
|
3280a9 |
+ TEST_USER_DN, e.args[0]['info']))
|
|
|
3280a9 |
raise e
|
|
|
3280a9 |
finally:
|
|
|
3280a9 |
log.info('Bind as DM')
|
|
|
3280a9 |
diff --git a/dirsrvtests/tests/suites/replication/changelog_test.py b/dirsrvtests/tests/suites/replication/changelog_test.py
|
|
|
3280a9 |
index e395f0e7c..66599286f 100644
|
|
|
3280a9 |
--- a/dirsrvtests/tests/suites/replication/changelog_test.py
|
|
|
3280a9 |
+++ b/dirsrvtests/tests/suites/replication/changelog_test.py
|
|
|
3280a9 |
@@ -367,7 +367,7 @@ def test_dsconf_dump_changelog_files_removed(topo):
|
|
|
3280a9 |
# primary condition before executing the core goal of this case : management of generated files.
|
|
|
3280a9 |
|
|
|
3280a9 |
log.info("Use dsconf dump-changelog with invalid parameters")
|
|
|
3280a9 |
- cmdline=['python', '/usr/sbin/dsconf', instance_url, '-D', DN_DM, '-w', 'badpasswd', 'replication', 'dump-changelog']
|
|
|
3280a9 |
+ cmdline=['/usr/sbin/dsconf', instance_url, '-D', DN_DM, '-w', 'badpasswd', 'replication', 'dump-changelog']
|
|
|
3280a9 |
log.info('Command used : %s' % cmdline)
|
|
|
3280a9 |
proc = subprocess.Popen(cmdline, stdout=subprocess.PIPE)
|
|
|
3280a9 |
msg = proc.communicate()
|
|
|
3280a9 |
@@ -377,7 +377,7 @@ def test_dsconf_dump_changelog_files_removed(topo):
|
|
|
3280a9 |
# Now the core goal of the test case
|
|
|
3280a9 |
# Using dsconf replication changelog without -l option
|
|
|
3280a9 |
log.info('Use dsconf replication changelog without -l option: no generated ldif files should be present in %s ' % changelog_dir)
|
|
|
3280a9 |
- cmdline=['python', '/usr/sbin/dsconf', instance_url, '-D', DN_DM, '-w', PASSWORD, 'replication', 'dump-changelog']
|
|
|
3280a9 |
+ cmdline=['/usr/sbin/dsconf', instance_url, '-D', DN_DM, '-w', PASSWORD, 'replication', 'dump-changelog']
|
|
|
3280a9 |
log.info('Command used : %s' % cmdline)
|
|
|
3280a9 |
proc = subprocess.Popen(cmdline, stdout=subprocess.PIPE)
|
|
|
3280a9 |
proc.communicate()
|
|
|
3280a9 |
@@ -396,7 +396,7 @@ def test_dsconf_dump_changelog_files_removed(topo):
|
|
|
3280a9 |
|
|
|
3280a9 |
# Using dsconf replication changelog without -l option
|
|
|
3280a9 |
log.info('Use dsconf replication changelog with -l option: generated ldif files should be kept in %s ' % changelog_dir)
|
|
|
3280a9 |
- cmdline=['python', '/usr/sbin/dsconf', instance_url, '-D', DN_DM, '-w', PASSWORD, 'replication', 'dump-changelog', '-l']
|
|
|
3280a9 |
+ cmdline=['/usr/sbin/dsconf', instance_url, '-D', DN_DM, '-w', PASSWORD, 'replication', 'dump-changelog', '-l']
|
|
|
3280a9 |
log.info('Command used : %s' % cmdline)
|
|
|
3280a9 |
proc = subprocess.Popen(cmdline, stdout=subprocess.PIPE)
|
|
|
3280a9 |
proc.communicate()
|
|
|
3280a9 |
diff --git a/dirsrvtests/tests/suites/replication/conflict_resolve_test.py b/dirsrvtests/tests/suites/replication/conflict_resolve_test.py
|
|
|
3280a9 |
index 48d0067db..ea3eacc48 100644
|
|
|
3280a9 |
--- a/dirsrvtests/tests/suites/replication/conflict_resolve_test.py
|
|
|
3280a9 |
+++ b/dirsrvtests/tests/suites/replication/conflict_resolve_test.py
|
|
|
3280a9 |
@@ -1,5 +1,5 @@
|
|
|
3280a9 |
# --- BEGIN COPYRIGHT BLOCK ---
|
|
|
3280a9 |
-# Copyright (C) 2018 Red Hat, Inc.
|
|
|
3280a9 |
+# Copyright (C) 2020 Red Hat, Inc.
|
|
|
3280a9 |
# All rights reserved.
|
|
|
3280a9 |
#
|
|
|
3280a9 |
# License: GPL (version 3 or any later version).
|
|
|
3280a9 |
@@ -117,7 +117,7 @@ def _test_base(topology):
|
|
|
3280a9 |
M1 = topology.ms["master1"]
|
|
|
3280a9 |
|
|
|
3280a9 |
conts = nsContainers(M1, SUFFIX)
|
|
|
3280a9 |
- base_m2 = conts.create(properties={'cn': 'test_container'})
|
|
|
3280a9 |
+ base_m2 = conts.ensure_state(properties={'cn': 'test_container'})
|
|
|
3280a9 |
|
|
|
3280a9 |
for inst in topology:
|
|
|
3280a9 |
inst.config.loglevel([ErrorLog.DEFAULT, ErrorLog.REPLICA], service='error')
|
|
|
3280a9 |
diff --git a/dirsrvtests/tests/suites/replication/rfc2307compat.py b/dirsrvtests/tests/suites/replication/rfc2307compat.py
|
|
|
3280a9 |
new file mode 100644
|
|
|
3280a9 |
index 000000000..ec98e9dac
|
|
|
3280a9 |
--- /dev/null
|
|
|
3280a9 |
+++ b/dirsrvtests/tests/suites/replication/rfc2307compat.py
|
|
|
3280a9 |
@@ -0,0 +1,174 @@
|
|
|
3280a9 |
+# --- BEGIN COPYRIGHT BLOCK ---
|
|
|
3280a9 |
+# Copyright (C) 2020 Red Hat, Inc.
|
|
|
3280a9 |
+# Copyright (C) 2020 William Brown <william@blackhats.net.au>
|
|
|
3280a9 |
+# All rights reserved.
|
|
|
3280a9 |
+#
|
|
|
3280a9 |
+# License: GPL (version 3 or any later version).
|
|
|
3280a9 |
+# See LICENSE for details.
|
|
|
3280a9 |
+# --- END COPYRIGHT BLOCK ---
|
|
|
3280a9 |
+#
|
|
|
3280a9 |
+import pytest
|
|
|
3280a9 |
+from lib389.replica import Replicas
|
|
|
3280a9 |
+from lib389.tasks import *
|
|
|
3280a9 |
+from lib389.utils import *
|
|
|
3280a9 |
+from lib389.topologies import topology_m2 as topo_m2
|
|
|
3280a9 |
+from . import get_repl_entries
|
|
|
3280a9 |
+from lib389.idm.user import UserAccount
|
|
|
3280a9 |
+from lib389.replica import ReplicationManager
|
|
|
3280a9 |
+from lib389._constants import *
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+pytestmark = pytest.mark.tier0
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+TEST_ENTRY_NAME = 'mmrepl_test'
|
|
|
3280a9 |
+TEST_ENTRY_DN = 'uid={},{}'.format(TEST_ENTRY_NAME, DEFAULT_SUFFIX)
|
|
|
3280a9 |
+NEW_SUFFIX_NAME = 'test_repl'
|
|
|
3280a9 |
+NEW_SUFFIX = 'o={}'.format(NEW_SUFFIX_NAME)
|
|
|
3280a9 |
+NEW_BACKEND = 'repl_base'
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+DEBUGGING = os.getenv("DEBUGGING", default=False)
|
|
|
3280a9 |
+if DEBUGGING:
|
|
|
3280a9 |
+ logging.getLogger(__name__).setLevel(logging.DEBUG)
|
|
|
3280a9 |
+else:
|
|
|
3280a9 |
+ logging.getLogger(__name__).setLevel(logging.INFO)
|
|
|
3280a9 |
+log = logging.getLogger(__name__)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+pytest.mark.skipif(not os.environ.get('UNSAFE_ACK', False), reason="UNSAFE tests may damage system configuration.")
|
|
|
3280a9 |
+def test_rfc2307compat(topo_m2):
|
|
|
3280a9 |
+ """ Test to verify if 10rfc2307compat.ldif does not prevent replication of schema
|
|
|
3280a9 |
+ - Create 2 masters and a test entry
|
|
|
3280a9 |
+ - Move 10rfc2307compat.ldif to be private to M1
|
|
|
3280a9 |
+ - Move 10rfc2307.ldif to be private to M2
|
|
|
3280a9 |
+ - Add 'objectCategory' to the schema of M1
|
|
|
3280a9 |
+ - Force a replication session
|
|
|
3280a9 |
+ - Check 'objectCategory' on M1 and M2
|
|
|
3280a9 |
+ """
|
|
|
3280a9 |
+ m1 = topo_m2.ms["master1"]
|
|
|
3280a9 |
+ m2 = topo_m2.ms["master2"]
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ m1.config.loglevel(vals=(ErrorLog.DEFAULT, ErrorLog.REPLICA))
|
|
|
3280a9 |
+ m2.config.loglevel(vals=(ErrorLog.DEFAULT, ErrorLog.REPLICA))
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ m1.add_s(Entry((
|
|
|
3280a9 |
+ TEST_ENTRY_DN, {
|
|
|
3280a9 |
+ "objectClass": "top",
|
|
|
3280a9 |
+ "objectClass": "extensibleObject",
|
|
|
3280a9 |
+ 'uid': TEST_ENTRY_NAME,
|
|
|
3280a9 |
+ 'cn': TEST_ENTRY_NAME,
|
|
|
3280a9 |
+ 'sn': TEST_ENTRY_NAME,
|
|
|
3280a9 |
+ }
|
|
|
3280a9 |
+ )))
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ entries = get_repl_entries(topo_m2, TEST_ENTRY_NAME, ["uid"])
|
|
|
3280a9 |
+ assert all(entries), "Entry {} wasn't replicated successfully".format(TEST_ENTRY_DN)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ # Clean the old locations (if any)
|
|
|
3280a9 |
+ m1_temp_schema = os.path.join(m1.get_config_dir(), 'schema')
|
|
|
3280a9 |
+ m2_temp_schema = os.path.join(m2.get_config_dir(), 'schema')
|
|
|
3280a9 |
+ m1_schema = os.path.join(m1.get_data_dir(), 'dirsrv/schema')
|
|
|
3280a9 |
+ m1_opt_schema = os.path.join(m1.get_data_dir(), 'dirsrv/data')
|
|
|
3280a9 |
+ m1_temp_backup = os.path.join(m1.get_tmp_dir(), 'schema')
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ # Does the system schema exist?
|
|
|
3280a9 |
+ if os.path.islink(m1_schema):
|
|
|
3280a9 |
+ # Then we need to put the m1 schema back.
|
|
|
3280a9 |
+ os.unlink(m1_schema)
|
|
|
3280a9 |
+ shutil.copytree(m1_temp_backup, m1_schema)
|
|
|
3280a9 |
+ if not os.path.exists(m1_temp_backup):
|
|
|
3280a9 |
+ shutil.copytree(m1_schema, m1_temp_backup)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ shutil.rmtree(m1_temp_schema, ignore_errors=True)
|
|
|
3280a9 |
+ shutil.rmtree(m2_temp_schema, ignore_errors=True)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ # Build a new copy
|
|
|
3280a9 |
+ shutil.copytree(m1_schema, m1_temp_schema)
|
|
|
3280a9 |
+ shutil.copytree(m1_schema, m2_temp_schema)
|
|
|
3280a9 |
+ # Ensure 99user.ldif exists
|
|
|
3280a9 |
+ with open(os.path.join(m1_temp_schema, '99user.ldif'), 'w') as f:
|
|
|
3280a9 |
+ f.write('dn: cn=schema')
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ with open(os.path.join(m2_temp_schema, '99user.ldif'), 'w') as f:
|
|
|
3280a9 |
+ f.write('dn: cn=schema')
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ # m1 has compat, m2 has legacy.
|
|
|
3280a9 |
+ os.unlink(os.path.join(m2_temp_schema, '10rfc2307compat.ldif'))
|
|
|
3280a9 |
+ shutil.copy(os.path.join(m1_opt_schema, '10rfc2307.ldif'), m2_temp_schema)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ # Configure the instances
|
|
|
3280a9 |
+ # m1.config.replace('nsslapd-schemadir', m1_temp_schema)
|
|
|
3280a9 |
+ # m2.config.replace('nsslapd-schemadir', m2_temp_schema)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ # Now mark the system schema as empty.
|
|
|
3280a9 |
+ shutil.rmtree(m1_schema)
|
|
|
3280a9 |
+ os.symlink('/var/lib/empty', m1_schema)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ print("SETUP COMPLETE -->")
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ # Stop all instances
|
|
|
3280a9 |
+ m1.stop()
|
|
|
3280a9 |
+ m2.stop()
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ # udpate the schema on M1 to tag a schemacsn
|
|
|
3280a9 |
+ m1.start()
|
|
|
3280a9 |
+ objectcategory_attr = '( NAME \'objectCategory\' DESC \'test of objectCategory\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )'
|
|
|
3280a9 |
+ m1.schema.add_schema('attributetypes', [ensure_bytes(objectcategory_attr)])
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ # Now start M2 and trigger a replication M1->M2
|
|
|
3280a9 |
+ m2.start()
|
|
|
3280a9 |
+ m1.modify_s(TEST_ENTRY_DN, [(ldap.MOD_ADD, 'cn', [ensure_bytes('value_m1')])])
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ # Now check that objectCategory is in both schema
|
|
|
3280a9 |
+ time.sleep(10)
|
|
|
3280a9 |
+ ents = m1.search_s("cn=schema", ldap.SCOPE_SUBTREE, 'objectclass=*',['attributetypes'])
|
|
|
3280a9 |
+ for value in ents[0].getValues('attributetypes'):
|
|
|
3280a9 |
+ if ensure_bytes('objectCategory') in value:
|
|
|
3280a9 |
+ log.info("M1: " + str(value))
|
|
|
3280a9 |
+ break
|
|
|
3280a9 |
+ assert ensure_bytes('objectCategory') in value
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ ents = m2.search_s("cn=schema", ldap.SCOPE_SUBTREE, 'objectclass=*',['attributetypes'])
|
|
|
3280a9 |
+ for value in ents[0].getValues('attributetypes'):
|
|
|
3280a9 |
+ if ensure_bytes('objectCategory') in value:
|
|
|
3280a9 |
+ log.info("M2: " + str(value))
|
|
|
3280a9 |
+ break
|
|
|
3280a9 |
+ assert ensure_bytes('objectCategory') in value
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ # Stop m2
|
|
|
3280a9 |
+ m2.stop()
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ # "Update" it's schema,
|
|
|
3280a9 |
+ os.unlink(os.path.join(m2_temp_schema, '10rfc2307.ldif'))
|
|
|
3280a9 |
+ shutil.copy(os.path.join(m1_temp_backup, '10rfc2307compat.ldif'), m2_temp_schema)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ # Add some more to m1
|
|
|
3280a9 |
+ objectcategory_attr = '( NAME \'objectCategoryX\' DESC \'test of objectCategoryX\' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )'
|
|
|
3280a9 |
+ m1.schema.add_schema('attributetypes', [ensure_bytes(objectcategory_attr)])
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ # Start m2.
|
|
|
3280a9 |
+ m2.start()
|
|
|
3280a9 |
+ m1.modify_s(TEST_ENTRY_DN, [(ldap.MOD_ADD, 'cn', [ensure_bytes('value_m2')])])
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ time.sleep(10)
|
|
|
3280a9 |
+ ents = m1.search_s("cn=schema", ldap.SCOPE_SUBTREE, 'objectclass=*',['attributetypes'])
|
|
|
3280a9 |
+ for value in ents[0].getValues('attributetypes'):
|
|
|
3280a9 |
+ if ensure_bytes('objectCategoryX') in value:
|
|
|
3280a9 |
+ log.info("M1: " + str(value))
|
|
|
3280a9 |
+ break
|
|
|
3280a9 |
+ assert ensure_bytes('objectCategoryX') in value
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ ents = m2.search_s("cn=schema", ldap.SCOPE_SUBTREE, 'objectclass=*',['attributetypes'])
|
|
|
3280a9 |
+ for value in ents[0].getValues('attributetypes'):
|
|
|
3280a9 |
+ if ensure_bytes('objectCategoryX') in value:
|
|
|
3280a9 |
+ log.info("M2: " + str(value))
|
|
|
3280a9 |
+ break
|
|
|
3280a9 |
+ assert ensure_bytes('objectCategoryX') in value
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ # Success cleanup
|
|
|
3280a9 |
+ os.unlink(m1_schema)
|
|
|
3280a9 |
+ shutil.copytree(m1_temp_backup, m1_schema)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+if __name__ == '__main__':
|
|
|
3280a9 |
+ # Run isolated
|
|
|
3280a9 |
+ # -s for DEBUG mode
|
|
|
3280a9 |
+ CURRENT_FILE = os.path.realpath(__file__)
|
|
|
3280a9 |
+ pytest.main("-s %s" % CURRENT_FILE)
|
|
|
3280a9 |
diff --git a/dirsrvtests/tests/suites/roles/__init__.py b/dirsrvtests/tests/suites/roles/__init__.py
|
|
|
3280a9 |
new file mode 100644
|
|
|
3280a9 |
index 000000000..1981985fb
|
|
|
3280a9 |
--- /dev/null
|
|
|
3280a9 |
+++ b/dirsrvtests/tests/suites/roles/__init__.py
|
|
|
3280a9 |
@@ -0,0 +1,3 @@
|
|
|
3280a9 |
+"""
|
|
|
3280a9 |
+ :Requirement: 389-ds-base: Roles
|
|
|
3280a9 |
+"""
|
|
|
3280a9 |
diff --git a/dirsrvtests/tests/suites/roles/basic_test.py b/dirsrvtests/tests/suites/roles/basic_test.py
|
|
|
3280a9 |
index 3f1b7568c..47a531794 100644
|
|
|
3280a9 |
--- a/dirsrvtests/tests/suites/roles/basic_test.py
|
|
|
3280a9 |
+++ b/dirsrvtests/tests/suites/roles/basic_test.py
|
|
|
3280a9 |
@@ -1,5 +1,5 @@
|
|
|
3280a9 |
# --- BEGIN COPYRIGHT BLOCK ---
|
|
|
3280a9 |
-# Copyright (C) 2019 Red Hat, Inc.
|
|
|
3280a9 |
+# Copyright (C) 2020 Red Hat, Inc.
|
|
|
3280a9 |
# All rights reserved.
|
|
|
3280a9 |
#
|
|
|
3280a9 |
# License: GPL (version 3 or any later version).
|
|
|
3280a9 |
@@ -36,18 +36,19 @@ FILTERROLEENGROLE = "cn=FILTERROLEENGROLE,{}".format(DNBASE)
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_filterrole(topo):
|
|
|
3280a9 |
- '''
|
|
|
3280a9 |
- :id: 8ada4064-786b-11e8-8634-8c16451d917b
|
|
|
3280a9 |
- :setup: server
|
|
|
3280a9 |
- :steps:
|
|
|
3280a9 |
- 1. Add test entry
|
|
|
3280a9 |
- 2. Add ACI
|
|
|
3280a9 |
- 3. Search nsconsole role
|
|
|
3280a9 |
- :expectedresults:
|
|
|
3280a9 |
- 1. Entry should be added
|
|
|
3280a9 |
- 2. Operation should succeed
|
|
|
3280a9 |
- 3. Operation should succeed
|
|
|
3280a9 |
- '''
|
|
|
3280a9 |
+ """Test Filter Role
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ :id: 8ada4064-786b-11e8-8634-8c16451d917b
|
|
|
3280a9 |
+ :setup: server
|
|
|
3280a9 |
+ :steps:
|
|
|
3280a9 |
+ 1. Add test entry
|
|
|
3280a9 |
+ 2. Add ACI
|
|
|
3280a9 |
+ 3. Search nsconsole role
|
|
|
3280a9 |
+ :expectedresults:
|
|
|
3280a9 |
+ 1. Entry should be added
|
|
|
3280a9 |
+ 2. Operation should succeed
|
|
|
3280a9 |
+ 3. Operation should succeed
|
|
|
3280a9 |
+ """
|
|
|
3280a9 |
Organization(topo.standalone).create(properties={"o": "acivattr"}, basedn=DEFAULT_SUFFIX)
|
|
|
3280a9 |
properties = {
|
|
|
3280a9 |
'ou': 'eng',
|
|
|
3280a9 |
@@ -137,18 +138,19 @@ def test_filterrole(topo):
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_managedrole(topo):
|
|
|
3280a9 |
- '''
|
|
|
3280a9 |
- :id: d52a9c00-3bf6-11e9-9b7b-8c16451d917b
|
|
|
3280a9 |
- :setup: server
|
|
|
3280a9 |
- :steps:
|
|
|
3280a9 |
- 1. Add test entry
|
|
|
3280a9 |
- 2. Add ACI
|
|
|
3280a9 |
- 3. Search managed role entries
|
|
|
3280a9 |
- :expectedresults:
|
|
|
3280a9 |
- 1. Entry should be added
|
|
|
3280a9 |
- 2. Operation should succeed
|
|
|
3280a9 |
- 3. Operation should succeed
|
|
|
3280a9 |
- '''
|
|
|
3280a9 |
+ """Test Managed Role
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ :id: d52a9c00-3bf6-11e9-9b7b-8c16451d917b
|
|
|
3280a9 |
+ :setup: server
|
|
|
3280a9 |
+ :steps:
|
|
|
3280a9 |
+ 1. Add test entry
|
|
|
3280a9 |
+ 2. Add ACI
|
|
|
3280a9 |
+ 3. Search managed role entries
|
|
|
3280a9 |
+ :expectedresults:
|
|
|
3280a9 |
+ 1. Entry should be added
|
|
|
3280a9 |
+ 2. Operation should succeed
|
|
|
3280a9 |
+ 3. Operation should succeed
|
|
|
3280a9 |
+ """
|
|
|
3280a9 |
# Create Managed role entry
|
|
|
3280a9 |
roles = ManagedRoles(topo.standalone, DEFAULT_SUFFIX)
|
|
|
3280a9 |
role = roles.create(properties={"cn": 'ROLE1'})
|
|
|
3280a9 |
@@ -184,8 +186,12 @@ def test_managedrole(topo):
|
|
|
3280a9 |
|
|
|
3280a9 |
# Set an aci that will deny ROLE1 manage role
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).\
|
|
|
3280a9 |
- add('aci', '(targetattr=*)(version 3.0; aci "role aci";'
|
|
|
3280a9 |
+ add('aci', '(targetattr="*")(version 3.0; aci "role aci";'
|
|
|
3280a9 |
' deny(all) roledn="ldap:///{}";)'.format(role.dn),)
|
|
|
3280a9 |
+ # Add self user modification and anonymous aci
|
|
|
3280a9 |
+ ANON_ACI = "(targetattr=\"*\")(version 3.0; acl \"Anonymous Read access\"; allow (read,search,compare) userdn = \"ldap:///anyone\";)"
|
|
|
3280a9 |
+ suffix = Domain(topo.standalone, DEFAULT_SUFFIX)
|
|
|
3280a9 |
+ suffix.add('aci', ANON_ACI)
|
|
|
3280a9 |
|
|
|
3280a9 |
# Crate a connection with cn=Fail which is member of ROLE1
|
|
|
3280a9 |
conn = UserAccount(topo.standalone, "uid=Fail,{}".format(DEFAULT_SUFFIX)).bind(PW_DM)
|
|
|
3280a9 |
@@ -232,17 +238,18 @@ def _final(request, topo):
|
|
|
3280a9 |
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_nestedrole(topo, _final):
|
|
|
3280a9 |
- """
|
|
|
3280a9 |
- :id: 867b40c0-7fcf-4332-afc7-bd01025b77f2
|
|
|
3280a9 |
- :setup: Standalone server
|
|
|
3280a9 |
- :steps:
|
|
|
3280a9 |
- 1. Add test entry
|
|
|
3280a9 |
- 2. Add ACI
|
|
|
3280a9 |
- 3. Search managed role entries
|
|
|
3280a9 |
- :expectedresults:
|
|
|
3280a9 |
- 1. Entry should be added
|
|
|
3280a9 |
- 2. Operation should succeed
|
|
|
3280a9 |
- 3. Operation should succeed
|
|
|
3280a9 |
+ """Test Nested Role
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ :id: 867b40c0-7fcf-4332-afc7-bd01025b77f2
|
|
|
3280a9 |
+ :setup: Standalone server
|
|
|
3280a9 |
+ :steps:
|
|
|
3280a9 |
+ 1. Add test entry
|
|
|
3280a9 |
+ 2. Add ACI
|
|
|
3280a9 |
+ 3. Search managed role entries
|
|
|
3280a9 |
+ :expectedresults:
|
|
|
3280a9 |
+ 1. Entry should be added
|
|
|
3280a9 |
+ 2. Operation should succeed
|
|
|
3280a9 |
+ 3. Operation should succeed
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
# Create Managed role entry
|
|
|
3280a9 |
managed_roles = ManagedRoles(topo.standalone, DEFAULT_SUFFIX)
|
|
|
3280a9 |
@@ -271,7 +278,7 @@ def test_nestedrole(topo, _final):
|
|
|
3280a9 |
|
|
|
3280a9 |
# Create a ACI with deny access to nested role entry
|
|
|
3280a9 |
Domain(topo.standalone, DEFAULT_SUFFIX).\
|
|
|
3280a9 |
- add('aci', f'(targetattr=*)(version 3.0; aci '
|
|
|
3280a9 |
+ add('aci', f'(targetattr="*")(version 3.0; aci '
|
|
|
3280a9 |
f'"role aci"; deny(all) roledn="ldap:///{nested_role.dn}";)')
|
|
|
3280a9 |
|
|
|
3280a9 |
# Create connection with 'uid=test_user_1,ou=People,dc=example,dc=com' member of managed_role1
|
|
|
3280a9 |
diff --git a/dirsrvtests/tests/suites/sasl/regression_test.py b/dirsrvtests/tests/suites/sasl/regression_test.py
|
|
|
3280a9 |
index 2db76ce98..58ff9a225 100644
|
|
|
3280a9 |
--- a/dirsrvtests/tests/suites/sasl/regression_test.py
|
|
|
3280a9 |
+++ b/dirsrvtests/tests/suites/sasl/regression_test.py
|
|
|
3280a9 |
@@ -1,15 +1,14 @@
|
|
|
3280a9 |
# --- BEGIN COPYRIGHT BLOCK ---
|
|
|
3280a9 |
-# Copyright (C) 2016 Red Hat, Inc.
|
|
|
3280a9 |
+# Copyright (C) 2020 Red Hat, Inc.
|
|
|
3280a9 |
# All rights reserved.
|
|
|
3280a9 |
#
|
|
|
3280a9 |
# License: GPL (version 3 or any later version).
|
|
|
3280a9 |
# See LICENSE for details.
|
|
|
3280a9 |
# --- END COPYRIGHT BLOCK ---
|
|
|
3280a9 |
#
|
|
|
3280a9 |
-import base64
|
|
|
3280a9 |
+
|
|
|
3280a9 |
import os
|
|
|
3280a9 |
import pytest
|
|
|
3280a9 |
-import subprocess
|
|
|
3280a9 |
from lib389.tasks import *
|
|
|
3280a9 |
from lib389.utils import *
|
|
|
3280a9 |
from lib389.topologies import topology_m2
|
|
|
3280a9 |
@@ -48,7 +47,7 @@ def check_pems(confdir, mycacert, myservercert, myserverkey, notexist):
|
|
|
3280a9 |
log.info("\n######################### Check PEM files (%s, %s, %s)%s in %s ######################\n"
|
|
|
3280a9 |
% (mycacert, myservercert, myserverkey, notexist, confdir))
|
|
|
3280a9 |
global cacert
|
|
|
3280a9 |
- cacert = '%s/%s.pem' % (confdir, mycacert)
|
|
|
3280a9 |
+ cacert = f"{mycacert}.pem"
|
|
|
3280a9 |
if os.path.isfile(cacert):
|
|
|
3280a9 |
if notexist == "":
|
|
|
3280a9 |
log.info('%s is successfully generated.' % cacert)
|
|
|
3280a9 |
@@ -61,7 +60,7 @@ def check_pems(confdir, mycacert, myservercert, myserverkey, notexist):
|
|
|
3280a9 |
assert False
|
|
|
3280a9 |
else:
|
|
|
3280a9 |
log.info('%s is correctly not generated.' % cacert)
|
|
|
3280a9 |
- servercert = '%s/%s.pem' % (confdir, myservercert)
|
|
|
3280a9 |
+ servercert = f"{myservercert}.pem"
|
|
|
3280a9 |
if os.path.isfile(servercert):
|
|
|
3280a9 |
if notexist == "":
|
|
|
3280a9 |
log.info('%s is successfully generated.' % servercert)
|
|
|
3280a9 |
@@ -74,7 +73,7 @@ def check_pems(confdir, mycacert, myservercert, myserverkey, notexist):
|
|
|
3280a9 |
assert False
|
|
|
3280a9 |
else:
|
|
|
3280a9 |
log.info('%s is correctly not generated.' % servercert)
|
|
|
3280a9 |
- serverkey = '%s/%s.pem' % (confdir, myserverkey)
|
|
|
3280a9 |
+ serverkey = f"{myserverkey}.pem"
|
|
|
3280a9 |
if os.path.isfile(serverkey):
|
|
|
3280a9 |
if notexist == "":
|
|
|
3280a9 |
log.info('%s is successfully generated.' % serverkey)
|
|
|
3280a9 |
@@ -91,16 +90,16 @@ def check_pems(confdir, mycacert, myservercert, myserverkey, notexist):
|
|
|
3280a9 |
|
|
|
3280a9 |
def relocate_pem_files(topology_m2):
|
|
|
3280a9 |
log.info("######################### Relocate PEM files on master1 ######################")
|
|
|
3280a9 |
- mycacert = 'MyCA'
|
|
|
3280a9 |
+ certdir_prefix = "/dev/shm"
|
|
|
3280a9 |
+ mycacert = os.path.join(certdir_prefix, "MyCA")
|
|
|
3280a9 |
topology_m2.ms["master1"].encryption.set('CACertExtractFile', mycacert)
|
|
|
3280a9 |
- myservercert = 'MyServerCert1'
|
|
|
3280a9 |
- myserverkey = 'MyServerKey1'
|
|
|
3280a9 |
+ myservercert = os.path.join(certdir_prefix, "MyServerCert1")
|
|
|
3280a9 |
+ myserverkey = os.path.join(certdir_prefix, "MyServerKey1")
|
|
|
3280a9 |
topology_m2.ms["master1"].rsa.apply_mods([(ldap.MOD_REPLACE, 'ServerCertExtractFile', myservercert),
|
|
|
3280a9 |
(ldap.MOD_REPLACE, 'ServerKeyExtractFile', myserverkey)])
|
|
|
3280a9 |
log.info("##### restart master1")
|
|
|
3280a9 |
topology_m2.ms["master1"].restart()
|
|
|
3280a9 |
- m1confdir = topology_m2.ms["master1"].confdir
|
|
|
3280a9 |
- check_pems(m1confdir, mycacert, myservercert, myserverkey, "")
|
|
|
3280a9 |
+ check_pems(certdir_prefix, mycacert, myservercert, myserverkey, "")
|
|
|
3280a9 |
|
|
|
3280a9 |
@pytest.mark.ds47536
|
|
|
3280a9 |
def test_openldap_no_nss_crypto(topology_m2):
|
|
|
3280a9 |
diff --git a/dirsrvtests/tests/suites/syncrepl_plugin/__init__.py b/dirsrvtests/tests/suites/syncrepl_plugin/__init__.py
|
|
|
3280a9 |
new file mode 100644
|
|
|
3280a9 |
index 000000000..699d58f79
|
|
|
3280a9 |
--- /dev/null
|
|
|
3280a9 |
+++ b/dirsrvtests/tests/suites/syncrepl_plugin/__init__.py
|
|
|
3280a9 |
@@ -0,0 +1,163 @@
|
|
|
3280a9 |
+# --- BEGIN COPYRIGHT BLOCK ---
|
|
|
3280a9 |
+# Copyright (C) 2020 William Brown <william@blackhats.net.au>
|
|
|
3280a9 |
+# All rights reserved.
|
|
|
3280a9 |
+#
|
|
|
3280a9 |
+# License: GPL (version 3 or any later version).
|
|
|
3280a9 |
+# See LICENSE for details.
|
|
|
3280a9 |
+# --- END COPYRIGHT BLOCK ---
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+import logging
|
|
|
3280a9 |
+import ldap
|
|
|
3280a9 |
+import time
|
|
|
3280a9 |
+from ldap.syncrepl import SyncreplConsumer
|
|
|
3280a9 |
+import pytest
|
|
|
3280a9 |
+from lib389 import DirSrv
|
|
|
3280a9 |
+from lib389.idm.user import nsUserAccounts, UserAccounts
|
|
|
3280a9 |
+from lib389.topologies import topology_st as topology
|
|
|
3280a9 |
+from lib389.paths import Paths
|
|
|
3280a9 |
+from lib389.utils import ds_is_older
|
|
|
3280a9 |
+from lib389.plugins import RetroChangelogPlugin, ContentSynchronizationPlugin
|
|
|
3280a9 |
+from lib389._constants import *
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+log = logging.getLogger(__name__)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+class ISyncRepl(DirSrv, SyncreplConsumer):
|
|
|
3280a9 |
+ """
|
|
|
3280a9 |
+ This implements a test harness for checking syncrepl, and allowing us to check various actions or
|
|
|
3280a9 |
+ behaviours. During a "run" it stores the results in it's instance, so that they can be inspected
|
|
|
3280a9 |
+ later to ensure that syncrepl worked as expected.
|
|
|
3280a9 |
+ """
|
|
|
3280a9 |
+ def __init__(self, inst, openldap=False):
|
|
|
3280a9 |
+ self.inst = inst
|
|
|
3280a9 |
+ self.msgid = None
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ self.last_cookie = None
|
|
|
3280a9 |
+ self.next_cookie = None
|
|
|
3280a9 |
+ self.cookie = None
|
|
|
3280a9 |
+ self.openldap = openldap
|
|
|
3280a9 |
+ if self.openldap:
|
|
|
3280a9 |
+ # In openldap mode, our initial cookie needs to be a rid.
|
|
|
3280a9 |
+ self.cookie = "rid=123"
|
|
|
3280a9 |
+ self.delete = []
|
|
|
3280a9 |
+ self.present = []
|
|
|
3280a9 |
+ self.entries = {}
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ super().__init__()
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ def result4(self, *args, **kwargs):
|
|
|
3280a9 |
+ return self.inst.result4(*args, **kwargs, escapehatch='i am sure')
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ def search_ext(self, *args, **kwargs):
|
|
|
3280a9 |
+ return self.inst.search_ext(*args, **kwargs, escapehatch='i am sure')
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ def syncrepl_search(self, base=DEFAULT_SUFFIX, scope=ldap.SCOPE_SUBTREE, mode='refreshOnly', cookie=None, **search_args):
|
|
|
3280a9 |
+ # Wipe the last result set.
|
|
|
3280a9 |
+ self.delete = []
|
|
|
3280a9 |
+ self.present = []
|
|
|
3280a9 |
+ self.entries = {}
|
|
|
3280a9 |
+ self.next_cookie = None
|
|
|
3280a9 |
+ # Start the sync
|
|
|
3280a9 |
+ # If cookie is none, will call "get_cookie" we have.
|
|
|
3280a9 |
+ self.msgid = super().syncrepl_search(base, scope, mode, cookie, **search_args)
|
|
|
3280a9 |
+ log.debug(f'syncrepl_search -> {self.msgid}')
|
|
|
3280a9 |
+ assert self.msgid is not None
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ def syncrepl_complete(self):
|
|
|
3280a9 |
+ log.debug(f'syncrepl_complete -> {self.msgid}')
|
|
|
3280a9 |
+ assert self.msgid is not None
|
|
|
3280a9 |
+ # Loop until the operation is complete.
|
|
|
3280a9 |
+ while super().syncrepl_poll(msgid=self.msgid) is True:
|
|
|
3280a9 |
+ pass
|
|
|
3280a9 |
+ assert self.next_cookie is not None
|
|
|
3280a9 |
+ self.last_cookie = self.cookie
|
|
|
3280a9 |
+ self.cookie = self.next_cookie
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ def check_cookie(self):
|
|
|
3280a9 |
+ assert self.last_cookie != self.cookie
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ def syncrepl_set_cookie(self, cookie):
|
|
|
3280a9 |
+ log.debug(f'set_cookie -> {cookie}')
|
|
|
3280a9 |
+ if self.openldap:
|
|
|
3280a9 |
+ assert self.cookie.startswith("rid=123")
|
|
|
3280a9 |
+ self.next_cookie = cookie
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ def syncrepl_get_cookie(self):
|
|
|
3280a9 |
+ log.debug('get_cookie -> %s' % self.cookie)
|
|
|
3280a9 |
+ if self.openldap:
|
|
|
3280a9 |
+ assert self.cookie.startswith("rid=123")
|
|
|
3280a9 |
+ return self.cookie
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ def syncrepl_present(self, uuids, refreshDeletes=False):
|
|
|
3280a9 |
+ log.debug(f'=====> refdel -> {refreshDeletes} uuids -> {uuids}')
|
|
|
3280a9 |
+ if uuids is not None:
|
|
|
3280a9 |
+ self.present = self.present + uuids
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ def syncrepl_delete(self, uuids):
|
|
|
3280a9 |
+ log.debug(f'delete -> {uuids}')
|
|
|
3280a9 |
+ self.delete = uuids
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ def syncrepl_entry(self, dn, attrs, uuid):
|
|
|
3280a9 |
+ log.debug(f'entry -> {dn}')
|
|
|
3280a9 |
+ self.entries[dn] = (uuid, attrs)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ def syncrepl_refreshdone(self):
|
|
|
3280a9 |
+ log.debug('refreshdone')
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+def syncstate_assert(st, sync):
|
|
|
3280a9 |
+ # How many entries do we have?
|
|
|
3280a9 |
+ r = st.search_ext_s(
|
|
|
3280a9 |
+ base=DEFAULT_SUFFIX,
|
|
|
3280a9 |
+ scope=ldap.SCOPE_SUBTREE,
|
|
|
3280a9 |
+ filterstr='(objectClass=*)',
|
|
|
3280a9 |
+ attrsonly=1,
|
|
|
3280a9 |
+ escapehatch='i am sure'
|
|
|
3280a9 |
+ )
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ # Initial sync
|
|
|
3280a9 |
+ log.debug("*test* initial")
|
|
|
3280a9 |
+ sync.syncrepl_search()
|
|
|
3280a9 |
+ sync.syncrepl_complete()
|
|
|
3280a9 |
+ # check we caught them all
|
|
|
3280a9 |
+ assert len(r) == len(sync.entries.keys())
|
|
|
3280a9 |
+ assert len(r) == len(sync.present)
|
|
|
3280a9 |
+ assert 0 == len(sync.delete)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ # Add a new entry
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ account = nsUserAccounts(st, DEFAULT_SUFFIX).create_test_user()
|
|
|
3280a9 |
+ # Check
|
|
|
3280a9 |
+ log.debug("*test* add")
|
|
|
3280a9 |
+ sync.syncrepl_search()
|
|
|
3280a9 |
+ sync.syncrepl_complete()
|
|
|
3280a9 |
+ sync.check_cookie()
|
|
|
3280a9 |
+ assert 1 == len(sync.entries.keys())
|
|
|
3280a9 |
+ assert 1 == len(sync.present)
|
|
|
3280a9 |
+ assert 0 == len(sync.delete)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ # Mod
|
|
|
3280a9 |
+ account.replace('description', 'change')
|
|
|
3280a9 |
+ # Check
|
|
|
3280a9 |
+ log.debug("*test* mod")
|
|
|
3280a9 |
+ sync.syncrepl_search()
|
|
|
3280a9 |
+ sync.syncrepl_complete()
|
|
|
3280a9 |
+ sync.check_cookie()
|
|
|
3280a9 |
+ assert 1 == len(sync.entries.keys())
|
|
|
3280a9 |
+ assert 1 == len(sync.present)
|
|
|
3280a9 |
+ assert 0 == len(sync.delete)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ ## Delete
|
|
|
3280a9 |
+ account.delete()
|
|
|
3280a9 |
+
|
|
|
3280a9 |
+ # Check
|
|
|
3280a9 |
+ log.debug("*test* del")
|
|
|
3280a9 |
+ sync.syncrepl_search()
|
|
|
3280a9 |
+ sync.syncrepl_complete()
|
|
|
3280a9 |
+ # In a delete, the cookie isn't updated (?)
|
|
|
3280a9 |
+ sync.check_cookie()
|
|
|
3280a9 |
+ log.debug(f'{sync.entries.keys()}')
|
|
|
3280a9 |
+ log.debug(f'{sync.present}')
|
|
|
3280a9 |
+ log.debug(f'{sync.delete}')
|
|
|
3280a9 |
+ assert 0 == len(sync.entries.keys())
|
|
|
3280a9 |
+ assert 0 == len(sync.present)
|
|
|
3280a9 |
+ assert 1 == len(sync.delete)
|
|
|
3280a9 |
+
|
|
|
3280a9 |
diff --git a/dirsrvtests/tests/suites/syncrepl_plugin/basic_test.py b/dirsrvtests/tests/suites/syncrepl_plugin/basic_test.py
|
|
|
3280a9 |
index 7b35537d5..64b7425a5 100644
|
|
|
3280a9 |
--- a/dirsrvtests/tests/suites/syncrepl_plugin/basic_test.py
|
|
|
3280a9 |
+++ b/dirsrvtests/tests/suites/syncrepl_plugin/basic_test.py
|
|
|
3280a9 |
@@ -20,7 +20,7 @@ from lib389.idm.group import Groups
|
|
|
3280a9 |
from lib389.topologies import topology_st as topology
|
|
|
3280a9 |
from lib389.paths import Paths
|
|
|
3280a9 |
from lib389.utils import ds_is_older
|
|
|
3280a9 |
-from lib389.plugins import RetroChangelogPlugin, ContentSyncPlugin, AutoMembershipPlugin, MemberOfPlugin, MemberOfSharedConfig, AutoMembershipDefinitions, MEPTemplates, MEPConfigs, ManagedEntriesPlugin, MEPTemplate
|
|
|
3280a9 |
+from lib389.plugins import RetroChangelogPlugin, ContentSynchronizationPlugin, AutoMembershipPlugin, MemberOfPlugin, MemberOfSharedConfig, AutoMembershipDefinitions, MEPTemplates, MEPConfigs, ManagedEntriesPlugin, MEPTemplate
|
|
|
3280a9 |
from lib389._constants import *
|
|
|
3280a9 |
|
|
|
3280a9 |
from . import ISyncRepl, syncstate_assert
|
|
|
3280a9 |
@@ -54,7 +54,7 @@ def test_syncrepl_basic(topology):
|
|
|
3280a9 |
# Set the default targetid
|
|
|
3280a9 |
rcl.replace('nsslapd-attribute', 'nsuniqueid:targetUniqueId')
|
|
|
3280a9 |
# Enable sync repl
|
|
|
3280a9 |
- csp = ContentSyncPlugin(st)
|
|
|
3280a9 |
+ csp = ContentSynchronizationPlugin(st)
|
|
|
3280a9 |
csp.enable()
|
|
|
3280a9 |
# Restart DS
|
|
|
3280a9 |
st.restart()
|
|
|
3280a9 |
@@ -176,7 +176,7 @@ def test_sync_repl_mep(topology, request):
|
|
|
3280a9 |
plugin.set('nsslapd-attribute', 'nsuniqueid:targetuniqueid')
|
|
|
3280a9 |
|
|
|
3280a9 |
# Enable sync plugin
|
|
|
3280a9 |
- plugin = ContentSyncPlugin(inst)
|
|
|
3280a9 |
+ plugin = ContentSynchronizationPlugin(inst)
|
|
|
3280a9 |
plugin.enable()
|
|
|
3280a9 |
|
|
|
3280a9 |
# Check the plug-in status
|
|
|
3280a9 |
@@ -232,6 +232,8 @@ def test_sync_repl_mep(topology, request):
|
|
|
3280a9 |
prev = int(cookie)
|
|
|
3280a9 |
sync_repl.join()
|
|
|
3280a9 |
log.info('test_sync_repl_map: PASS\n')
|
|
|
3280a9 |
+ inst.start()
|
|
|
3280a9 |
+
|
|
|
3280a9 |
|
|
|
3280a9 |
def test_sync_repl_cookie(topology, request):
|
|
|
3280a9 |
"""Test sync_repl cookie are progressing is an increasing order
|
|
|
3280a9 |
@@ -240,33 +242,33 @@ def test_sync_repl_cookie(topology, request):
|
|
|
3280a9 |
:id: d7fbde25-5702-46ac-b38e-169d7a68e97c
|
|
|
3280a9 |
:setup: Standalone Instance
|
|
|
3280a9 |
:steps:
|
|
|
3280a9 |
- 1.: enable retroCL
|
|
|
3280a9 |
- 2.: configure retroCL to log nsuniqueid as targetUniqueId
|
|
|
3280a9 |
- 3.: enable content_sync plugin
|
|
|
3280a9 |
- 4.: enable automember
|
|
|
3280a9 |
- 5.: create (2) groups. Few groups can help to reproduce the concurrent updates problem.
|
|
|
3280a9 |
- 6.: configure automember to provision those groups with 'member'
|
|
|
3280a9 |
- 7.: enable and configure memberof plugin
|
|
|
3280a9 |
- 8.: enable plugin log level
|
|
|
3280a9 |
- 9.: restart the server
|
|
|
3280a9 |
- 10.: create a thread dedicated to run a sync repl client
|
|
|
3280a9 |
- 11.: Create (9) users that will generate nested updates (automember/memberof)
|
|
|
3280a9 |
- 12.: stop sync repl client and collect the list of cookie.change_no
|
|
|
3280a9 |
- 13.: check that cookies.change_no are in increasing order
|
|
|
3280a9 |
+ 1. enable retroCL
|
|
|
3280a9 |
+ 2. configure retroCL to log nsuniqueid as targetUniqueId
|
|
|
3280a9 |
+ 3. enable content_sync plugin
|
|
|
3280a9 |
+ 4. enable automember
|
|
|
3280a9 |
+ 5. create (2) groups. Few groups can help to reproduce the concurrent updates problem.
|
|
|
3280a9 |
+ 6. configure automember to provision those groups with 'member'
|
|
|
3280a9 |
+ 7. enable and configure memberof plugin
|
|
|
3280a9 |
+ 8. enable plugin log level
|
|
|
3280a9 |
+ 9. restart the server
|
|
|
3280a9 |
+ 10. create a thread dedicated to run a sync repl client
|
|
|
3280a9 |
+ 11. Create (9) users that will generate nested updates (automember/memberof)
|
|
|
3280a9 |
+ 12. stop sync repl client and collect the list of cookie.change_no
|
|
|
3280a9 |
+ 13. check that cookies.change_no are in increasing order
|
|
|
3280a9 |
:expectedresults:
|
|
|
3280a9 |
- 1.: succeeds
|
|
|
3280a9 |
- 2.: succeeds
|
|
|
3280a9 |
- 3.: succeeds
|
|
|
3280a9 |
- 4.: succeeds
|
|
|
3280a9 |
- 5.: succeeds
|
|
|
3280a9 |
- 6.: succeeds
|
|
|
3280a9 |
- 7.: succeeds
|
|
|
3280a9 |
- 8.: succeeds
|
|
|
3280a9 |
- 9.: succeeds
|
|
|
3280a9 |
- 10.: succeeds
|
|
|
3280a9 |
- 11.: succeeds
|
|
|
3280a9 |
- 12.: succeeds
|
|
|
3280a9 |
- 13.: succeeds
|
|
|
3280a9 |
+ 1. succeeds
|
|
|
3280a9 |
+ 2. succeeds
|
|
|
3280a9 |
+ 3. succeeds
|
|
|
3280a9 |
+ 4. succeeds
|
|
|
3280a9 |
+ 5. succeeds
|
|
|
3280a9 |
+ 6. succeeds
|
|
|
3280a9 |
+ 7. succeeds
|
|
|
3280a9 |
+ 8. succeeds
|
|
|
3280a9 |
+ 9. succeeds
|
|
|
3280a9 |
+ 10. succeeds
|
|
|
3280a9 |
+ 11. succeeds
|
|
|
3280a9 |
+ 12. succeeds
|
|
|
3280a9 |
+ 13. succeeds
|
|
|
3280a9 |
"""
|
|
|
3280a9 |
inst = topology[0]
|
|
|
3280a9 |
|
|
|
3280a9 |
@@ -277,7 +279,7 @@ def test_sync_repl_cookie(topology, request):
|
|
|
3280a9 |
plugin.set('nsslapd-attribute', 'nsuniqueid:targetuniqueid')
|
|
|
3280a9 |
|
|
|
3280a9 |
# Enable sync plugin
|
|
|
3280a9 |
- plugin = ContentSyncPlugin(inst)
|
|
|
3280a9 |
+ plugin = ContentSynchronizationPlugin(inst)
|
|
|
3280a9 |
plugin.enable()
|
|
|
3280a9 |
|
|
|
3280a9 |
# Enable automember
|
|
|
3280a9 |
@@ -409,7 +411,7 @@ def test_sync_repl_cookie_add_del(topology, request):
|
|
|
3280a9 |
plugin.set('nsslapd-attribute', 'nsuniqueid:targetuniqueid')
|
|
|
3280a9 |
|
|
|
3280a9 |
# Enable sync plugin
|
|
|
3280a9 |
- plugin = ContentSyncPlugin(inst)
|
|
|
3280a9 |
+ plugin = ContentSynchronizationPlugin(inst)
|
|
|
3280a9 |
plugin.enable()
|
|
|
3280a9 |
|
|
|
3280a9 |
# Enable automember
|
|
|
3280a9 |
@@ -541,7 +543,7 @@ def test_sync_repl_cookie_with_failure(topology, request):
|
|
|
3280a9 |
plugin.set('nsslapd-attribute', 'nsuniqueid:targetuniqueid')
|
|
|
3280a9 |
|
|
|
3280a9 |
# Enable sync plugin
|
|
|
3280a9 |
- plugin = ContentSyncPlugin(inst)
|
|
|
3280a9 |
+ plugin = ContentSynchronizationPlugin(inst)
|
|
|
3280a9 |
plugin.enable()
|
|
|
3280a9 |
|
|
|
3280a9 |
# Enable automember
|
|
|
3280a9 |
diff --git a/dirsrvtests/tests/suites/vlv/regression_test.py b/dirsrvtests/tests/suites/vlv/regression_test.py
|
|
|
3280a9 |
index 646cd97ba..2e1637a21 100644
|
|
|
3280a9 |
--- a/dirsrvtests/tests/suites/vlv/regression_test.py
|
|
|
3280a9 |
+++ b/dirsrvtests/tests/suites/vlv/regression_test.py
|
|
|
3280a9 |
@@ -84,8 +84,8 @@ def test_bulk_import_when_the_backend_with_vlv_was_recreated(topology_m2):
|
|
|
3280a9 |
MappingTrees(M2).list()[0].delete()
|
|
|
3280a9 |
Backends(M2).list()[0].delete()
|
|
|
3280a9 |
# Recreate the backend and the VLV index on Master 2.
|
|
|
3280a9 |
- M2.mappingtree.create(DEFAULT_SUFFIX, "userRoot")
|
|
|
3280a9 |
M2.backend.create(DEFAULT_SUFFIX, {BACKEND_NAME: "userRoot"})
|
|
|
3280a9 |
+ M2.mappingtree.create(DEFAULT_SUFFIX, "userRoot")
|
|
|
3280a9 |
# Recreating vlvSrchDn and vlvIndexDn on Master 2.
|
|
|
3280a9 |
vlv_searches.create(
|
|
|
3280a9 |
basedn="cn=userRoot,cn=ldbm database,cn=plugins,cn=config",
|
|
|
3280a9 |
--
|
|
|
3280a9 |
2.26.2
|
|
|
3280a9 |
|