source4/lib/ldb/tests/python/sec_descriptor.py

   1 #!/usr/bin/python
   2 # -*- coding: utf-8 -*-
   3
   4 import getopt
   5 import optparse
   6 import sys
   7 import os
   8 import base64
   9 import re
  10 import random
  11 import time
  12
  13 sys.path.append("bin/python")
  14 sys.path.append("../lib/subunit/python")
  15
  16 import samba.getopt as options
  17
  18 # Some error messages that are being tested
  19 from ldb import SCOPE_SUBTREE, SCOPE_ONELEVEL, SCOPE_BASE, LdbError
  20 from ldb import ERR_NO_SUCH_OBJECT, ERR_INVALID_DN_SYNTAX, ERR_UNWILLING_TO_PERFORM
  21 from ldb import ERR_INSUFFICIENT_ACCESS_RIGHTS
  22
  23 # For running the test unit
  24 from samba.ndr import ndr_pack, ndr_unpack
  25 from samba.dcerpc import security
  26
  27 from samba.auth import system_session
  28 from samba import Ldb, DS_DOMAIN_FUNCTION_2008, SECINFO_OWNER, \
  29     SECINFO_GROUP, SECINFO_DACL, SECINFO_SACL
  30 from subunit import SubunitTestRunner
  31 import unittest
  32
  33 parser = optparse.OptionParser("sec_descriptor [options] <host>")
  34 sambaopts = options.SambaOptions(parser)
  35 parser.add_option_group(sambaopts)
  36 parser.add_option_group(options.VersionOptions(parser))
  37
  38 # use command line creds if available
  39 credopts = options.CredentialsOptions(parser)
  40 parser.add_option_group(credopts)
  41 opts, args = parser.parse_args()
  42
  43 if len(args) < 1:
  44     parser.print_usage()
  45     sys.exit(1)
  46
  47 host = args[0]
  48
  49 lp = sambaopts.get_loadparm()
  50 creds = credopts.get_credentials(lp)
  51
  52 #
  53 # Tests start here
  54 #
  55
  56 class DescriptorTests(unittest.TestCase):
  57
  58     def delete_force(self, ldb, dn):
  59         try:
  60             ldb.delete(dn)
  61         except LdbError, (num, _):
  62             self.assertEquals(num, ERR_NO_SUCH_OBJECT)
  63
  64     def find_basedn(self, ldb):
  65         res = ldb.search(base="", expression="", scope=SCOPE_BASE,
  66                          attrs=["defaultNamingContext"])
  67         self.assertEquals(len(res), 1)
  68         return res[0]["defaultNamingContext"][0]
  69
  70     def find_configurationdn(self, ldb):
  71         res = ldb.search(base="", expression="", scope=SCOPE_BASE, attrs=["configurationNamingContext"])
  72         self.assertEquals(len(res), 1)
  73         return res[0]["configurationNamingContext"][0]
  74
  75     def find_schemadn(self, ldb):
  76         res = ldb.search(base="", expression="", scope=SCOPE_BASE, attrs=["schemaNamingContext"])
  77         self.assertEquals(len(res), 1)
  78         return res[0]["schemaNamingContext"][0]
  79
  80     def find_domain_sid(self, ldb):
  81         res = ldb.search(base=self.base_dn, expression="(objectClass=*)", scope=SCOPE_BASE)
  82         return ndr_unpack( security.dom_sid,res[0]["objectSid"][0])
  83
  84     def get_users_domain_dn(self, name):
  85         return "CN=%s,CN=Users,%s" % (name, self.base_dn)
  86
  87     def modify_desc(self, _ldb, object_dn, desc, controls=None):
  88         assert(isinstance(desc, str) or isinstance(desc, security.descriptor))
  89         mod = """
  90 dn: """ + object_dn + """
  91 changetype: modify
  92 replace: nTSecurityDescriptor
  93 """
  94         if isinstance(desc, str):
  95             mod += "nTSecurityDescriptor: %s" % desc
  96         elif isinstance(desc, security.descriptor):
  97             mod += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
  98         _ldb.modify_ldif(mod, controls)
  99
 100     def create_domain_ou(self, _ldb, ou_dn, desc=None, controls=None):
 101         ldif = """
 102 dn: """ + ou_dn + """
 103 ou: """ + ou_dn.split(",")[0][3:] + """
 104 objectClass: organizationalUnit
 105 url: www.example.com
 106 """
 107         if desc:
 108             assert(isinstance(desc, str) or isinstance(desc, security.descriptor))
 109             if isinstance(desc, str):
 110                 ldif += "nTSecurityDescriptor: %s" % desc
 111             elif isinstance(desc, security.descriptor):
 112                 ldif += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
 113         _ldb.add_ldif(ldif, controls)
 114
 115     def create_domain_user(self, _ldb, user_dn, desc=None):
 116         ldif = """
 117 dn: """ + user_dn + """
 118 sAMAccountName: """ + user_dn.split(",")[0][3:] + """
 119 objectClass: user
 120 userPassword: samba123@
 121 url: www.example.com
 122 """
 123         if desc:
 124             assert(isinstance(desc, str) or isinstance(desc, security.descriptor))
 125             if isinstance(desc, str):
 126                 ldif += "nTSecurityDescriptor: %s" % desc
 127             elif isinstance(desc, security.descriptor):
 128                 ldif += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
 129         _ldb.add_ldif(ldif)
 130
 131     def create_domain_group(self, _ldb, group_dn, desc=None):
 132         ldif = """
 133 dn: """ + group_dn + """
 134 objectClass: group
 135 sAMAccountName: """ + group_dn.split(",")[0][3:] + """
 136 groupType: 4
 137 url: www.example.com
 138 """
 139         if desc:
 140             assert(isinstance(desc, str) or isinstance(desc, security.descriptor))
 141             if isinstance(desc, str):
 142                 ldif += "nTSecurityDescriptor: %s" % desc
 143             elif isinstance(desc, security.descriptor):
 144                 ldif += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
 145         _ldb.add_ldif(ldif)
 146
 147     def get_unique_schema_class_name(self):
 148         while True:
 149             class_name = "test-class%s" % random.randint(1,100000)
 150             class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
 151             try:
 152                 self.ldb_admin.search(base=class_dn, attrs=["*"])
 153             except LdbError, (num, _):
 154                 self.assertEquals(num, ERR_NO_SUCH_OBJECT)
 155                 return class_name
 156
 157     def create_schema_class(self, _ldb, object_dn, desc=None):
 158         ldif = """
 159 dn: """ + object_dn + """
 160 objectClass: classSchema
 161 objectCategory: CN=Class-Schema,""" + self.schema_dn + """
 162 defaultObjectCategory: """ + object_dn + """
 163 distinguishedName: """ + object_dn + """
 164 governsID: 1.2.840.""" + str(random.randint(1,100000)) + """.1.5.9939
 165 instanceType: 4
 166 objectClassCategory: 1
 167 subClassOf: organizationalPerson
 168 systemFlags: 16
 169 rDNAttID: cn
 170 systemMustContain: cn
 171 systemOnly: FALSE
 172 """
 173         if desc:
 174             assert(isinstance(desc, str) or isinstance(desc, security.descriptor))
 175             if isinstance(desc, str):
 176                 ldif += "nTSecurityDescriptor: %s" % desc
 177             elif isinstance(desc, security.descriptor):
 178                 ldif += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
 179         _ldb.add_ldif(ldif)
 180
 181     def create_configuration_container(self, _ldb, object_dn, desc=None):
 182         ldif = """
 183 dn: """ + object_dn + """
 184 objectClass: container
 185 objectCategory: CN=Container,""" + self.schema_dn + """
 186 showInAdvancedViewOnly: TRUE
 187 instanceType: 4
 188 """
 189         if desc:
 190             assert(isinstance(desc, str) or isinstance(desc, security.descriptor))
 191             if isinstance(desc, str):
 192                 ldif += "nTSecurityDescriptor: %s" % desc
 193             elif isinstance(desc, security.descriptor):
 194                 ldif += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
 195         _ldb.add_ldif(ldif)
 196
 197     def create_configuration_specifier(self, _ldb, object_dn, desc=None):
 198         ldif = """
 199 dn: """ + object_dn + """
 200 objectClass: displaySpecifier
 201 showInAdvancedViewOnly: TRUE
 202 """
 203         if desc:
 204             assert(isinstance(desc, str) or isinstance(desc, security.descriptor))
 205             if isinstance(desc, str):
 206                 ldif += "nTSecurityDescriptor: %s" % desc
 207             elif isinstance(desc, security.descriptor):
 208                 ldif += "nTSecurityDescriptor:: %s" % base64.b64encode(ndr_pack(desc))
 209         _ldb.add_ldif(ldif)
 210
 211     def read_desc(self, object_dn, controls=None):
 212         res = self.ldb_admin.search(base=object_dn, scope=SCOPE_BASE, attrs=["nTSecurityDescriptor"], controls=controls)
 213         desc = res[0]["nTSecurityDescriptor"][0]
 214         return ndr_unpack(security.descriptor, desc)
 215
 216     def enable_account(self,  user_dn):
 217         """Enable an account.
 218         :param user_dn: Dn of the account to enable.
 219         """
 220         res = self.ldb_admin.search(user_dn, SCOPE_BASE, None, ["userAccountControl"])
 221         assert len(res) == 1
 222         userAccountControl = res[0]["userAccountControl"][0]
 223         userAccountControl = int(userAccountControl)
 224         if (userAccountControl & 0x2):
 225             userAccountControl = userAccountControl & ~0x2 # remove disabled bit
 226         if (userAccountControl & 0x20):
 227             userAccountControl = userAccountControl & ~0x20 # remove 'no password required' bit
 228         mod = """
 229 dn: """ + user_dn + """
 230 changetype: modify
 231 replace: userAccountControl
 232 userAccountControl: %s""" % userAccountControl
 233         if self.WIN2003:
 234             mod = re.sub("userAccountControl: \d.*", "userAccountControl: 544", mod)
 235         self.ldb_admin.modify_ldif(mod)
 236
 237     def get_ldb_connection(self, target_username, target_password):
 238         username_save = creds.get_username(); password_save = creds.get_password()
 239         creds.set_username(target_username)
 240         creds.set_password(target_password)
 241         ldb_target = Ldb(host, credentials=creds, session_info=system_session(), lp=lp)
 242         creds.set_username(username_save); creds.set_password(password_save)
 243         return ldb_target
 244
 245     def get_object_sid(self, object_dn):
 246         res = self.ldb_admin.search(object_dn)
 247         return ndr_unpack( security.dom_sid, res[0]["objectSid"][0] )
 248
 249     def dacl_add_ace(self, object_dn, ace):
 250         desc = self.read_desc( object_dn )
 251         desc_sddl = desc.as_sddl( self.domain_sid )
 252         if ace in desc_sddl:
 253             return
 254         if desc_sddl.find("(") >= 0:
 255             desc_sddl = desc_sddl[:desc_sddl.index("(")] + ace + desc_sddl[desc_sddl.index("("):]
 256         else:
 257             desc_sddl = desc_sddl + ace
 258         self.modify_desc(self.ldb_admin, object_dn, desc_sddl)
 259
 260     def get_desc_sddl(self, object_dn, controls=None):
 261         """ Return object nTSecutiryDescriptor in SDDL format
 262         """
 263         desc = self.read_desc(object_dn, controls)
 264         return desc.as_sddl(self.domain_sid)
 265
 266     def setUp(self):
 267         self.ldb_admin = ldb
 268         self.base_dn = self.find_basedn(self.ldb_admin)
 269         self.configuration_dn = self.find_configurationdn(self.ldb_admin)
 270         self.schema_dn = self.find_schemadn(self.ldb_admin)
 271         self.domain_sid = self.find_domain_sid(self.ldb_admin)
 272         print "baseDN: %s" % self.base_dn
 273         self.SAMBA = False; self.WIN2003 = False
 274         res = self.ldb_admin.search(base="", expression="", scope=SCOPE_BASE, attrs=["vendorName"])
 275         if "vendorName" in res[0].keys() and "Samba Team" in res[0]["vendorName"][0]:
 276             self.SAMBA = True
 277         else:
 278             self.WIN2003 = True
 279
 280     ################################################################################################
 281
 282     ## Tests for DOMAIN
 283
 284     # Default descriptor tests #####################################################################
 285
 286 class OwnerGroupDescriptorTests(DescriptorTests):
 287
 288     def setUp(self):
 289         DescriptorTests.setUp(self)
 290         if self.SAMBA:
 291             ### Create users
 292             # User 1
 293             user_dn = self.get_users_domain_dn("testuser1")
 294             self.create_domain_user(self.ldb_admin, user_dn)
 295             self.enable_account(user_dn)
 296             ldif = """
 297 dn: CN=Enterprise Admins,CN=Users,""" + self.base_dn + """
 298 changetype: add
 299 member: """ + user_dn
 300             self.ldb_admin.modify_ldif(ldif)
 301             # User 2
 302             user_dn = self.get_users_domain_dn("testuser2")
 303             self.create_domain_user(self.ldb_admin, user_dn)
 304             self.enable_account(user_dn)
 305             ldif = """
 306 dn: CN=Domain Admins,CN=Users,""" + self.base_dn + """
 307 changetype: add
 308 member: """ + user_dn
 309             self.ldb_admin.modify_ldif(ldif)
 310             # User 3
 311             user_dn = self.get_users_domain_dn("testuser3")
 312             self.create_domain_user(self.ldb_admin, user_dn)
 313             self.enable_account(user_dn)
 314             ldif = """
 315 dn: CN=Schema Admins,CN=Users,""" + self.base_dn + """
 316 changetype: add
 317 member: """ + user_dn
 318             self.ldb_admin.modify_ldif(ldif)
 319             # User 4
 320             user_dn = self.get_users_domain_dn("testuser4")
 321             self.create_domain_user(self.ldb_admin, user_dn)
 322             self.enable_account(user_dn)
 323             # User 5
 324             user_dn = self.get_users_domain_dn("testuser5")
 325             self.create_domain_user(self.ldb_admin, user_dn)
 326             self.enable_account(user_dn)
 327             ldif = """
 328 dn: CN=Enterprise Admins,CN=Users,""" + self.base_dn + """
 329 changetype: add
 330 member: """ + user_dn + """
 331
 332 dn: CN=Domain Admins,CN=Users,""" + self.base_dn + """
 333 changetype: add
 334 member: """ + user_dn
 335             self.ldb_admin.modify_ldif(ldif)
 336             # User 6
 337             user_dn = self.get_users_domain_dn("testuser6")
 338             self.create_domain_user(self.ldb_admin, user_dn)
 339             self.enable_account(user_dn)
 340             ldif = """
 341 dn: CN=Enterprise Admins,CN=Users,""" + self.base_dn + """
 342 changetype: add
 343 member: """ + user_dn + """
 344
 345 dn: CN=Domain Admins,CN=Users,""" + self.base_dn + """
 346 changetype: add
 347 member: """ + user_dn + """
 348
 349 dn: CN=Schema Admins,CN=Users,""" + self.base_dn + """
 350 changetype: add
 351 member: """ + user_dn
 352             self.ldb_admin.modify_ldif(ldif)
 353             # User 7
 354             user_dn = self.get_users_domain_dn("testuser7")
 355             self.create_domain_user(self.ldb_admin, user_dn)
 356             self.enable_account(user_dn)
 357             ldif = """
 358 dn: CN=Domain Admins,CN=Users,""" + self.base_dn + """
 359 changetype: add
 360 member: """ + user_dn + """
 361
 362 dn: CN=Schema Admins,CN=Users,""" + self.base_dn + """
 363 changetype: add
 364 member: """ + user_dn
 365             self.ldb_admin.modify_ldif(ldif)
 366             # User 8
 367             user_dn = self.get_users_domain_dn("testuser8")
 368             self.create_domain_user(self.ldb_admin, user_dn)
 369             self.enable_account(user_dn)
 370             ldif = """
 371 dn: CN=Enterprise Admins,CN=Users,""" + self.base_dn + """
 372 changetype: add
 373 member: """ + user_dn + """
 374
 375 dn: CN=Schema Admins,CN=Users,""" + self.base_dn + """
 376 changetype: add
 377 member: """ + user_dn
 378             self.ldb_admin.modify_ldif(ldif)
 379         self.results = {
 380             # msDS-Behavior-Version < DS_DOMAIN_FUNCTION_2008
 381             "ds_behavior_win2003" : {
 382                 "100" : "O:EAG:DU",
 383                 "101" : "O:DAG:DU",
 384                 "102" : "O:%sG:DU",
 385                 "103" : "O:%sG:DU",
 386                 "104" : "O:DAG:DU",
 387                 "105" : "O:DAG:DU",
 388                 "106" : "O:DAG:DU",
 389                 "107" : "O:EAG:DU",
 390                 "108" : "O:DAG:DA",
 391                 "109" : "O:DAG:DA",
 392                 "110" : "O:%sG:DA",
 393                 "111" : "O:%sG:DA",
 394                 "112" : "O:DAG:DA",
 395                 "113" : "O:DAG:DA",
 396                 "114" : "O:DAG:DA",
 397                 "115" : "O:DAG:DA",
 398                 "130" : "O:EAG:DU",
 399                 "131" : "O:DAG:DU",
 400                 "132" : "O:SAG:DU",
 401                 "133" : "O:%sG:DU",
 402                 "134" : "O:EAG:DU",
 403                 "135" : "O:SAG:DU",
 404                 "136" : "O:SAG:DU",
 405                 "137" : "O:SAG:DU",
 406                 "138" : "O:DAG:DA",
 407                 "139" : "O:DAG:DA",
 408                 "140" : "O:%sG:DA",
 409                 "141" : "O:%sG:DA",
 410                 "142" : "O:DAG:DA",
 411                 "143" : "O:DAG:DA",
 412                 "144" : "O:DAG:DA",
 413                 "145" : "O:DAG:DA",
 414                 "160" : "O:EAG:DU",
 415                 "161" : "O:DAG:DU",
 416                 "162" : "O:%sG:DU",
 417                 "163" : "O:%sG:DU",
 418                 "164" : "O:EAG:DU",
 419                 "165" : "O:EAG:DU",
 420                 "166" : "O:DAG:DU",
 421                 "167" : "O:EAG:DU",
 422                 "168" : "O:DAG:DA",
 423                 "169" : "O:DAG:DA",
 424                 "170" : "O:%sG:DA",
 425                 "171" : "O:%sG:DA",
 426                 "172" : "O:DAG:DA",
 427                 "173" : "O:DAG:DA",
 428                 "174" : "O:DAG:DA",
 429                 "175" : "O:DAG:DA",
 430             },
 431             # msDS-Behavior-Version >= DS_DOMAIN_FUNCTION_2008
 432             "ds_behavior_win2008" : {
 433                 "100" : "O:EAG:EA",
 434                 "101" : "O:DAG:DA",
 435                 "102" : "O:%sG:DU",
 436                 "103" : "O:%sG:DU",
 437                 "104" : "O:DAG:DA",
 438                 "105" : "O:DAG:DA",
 439                 "106" : "O:DAG:DA",
 440                 "107" : "O:EAG:EA",
 441                 "108" : "O:DAG:DA",
 442                 "109" : "O:DAG:DA",
 443                 "110" : "O:%sG:DA",
 444                 "111" : "O:%sG:DA",
 445                 "112" : "O:DAG:DA",
 446                 "113" : "O:DAG:DA",
 447                 "114" : "O:DAG:DA",
 448                 "115" : "O:DAG:DA",
 449                 "130" : "O:EAG:EA",
 450                 "131" : "O:DAG:DA",
 451                 "132" : "O:SAG:SA",
 452                 "133" : "O:%sG:DU",
 453                 "134" : "O:EAG:EA",
 454                 "135" : "O:SAG:SA",
 455                 "136" : "O:SAG:SA",
 456                 "137" : "O:SAG:SA",
 457                 "138" : "",
 458                 "139" : "",
 459                 "140" : "O:%sG:DA",
 460                 "141" : "O:%sG:DA",
 461                 "142" : "",
 462                 "143" : "",
 463                 "144" : "",
 464                 "145" : "",
 465                 "160" : "O:EAG:EA",
 466                 "161" : "O:DAG:DA",
 467                 "162" : "O:%sG:DU",
 468                 "163" : "O:%sG:DU",
 469                 "164" : "O:EAG:EA",
 470                 "165" : "O:EAG:EA",
 471                 "166" : "O:DAG:DA",
 472                 "167" : "O:EAG:EA",
 473                 "168" : "O:DAG:DA",
 474                 "169" : "O:DAG:DA",
 475                 "170" : "O:%sG:DA",
 476                 "171" : "O:%sG:DA",
 477                 "172" : "O:DAG:DA",
 478                 "173" : "O:DAG:DA",
 479                 "174" : "O:DAG:DA",
 480                 "175" : "O:DAG:DA",
 481             },
 482         }
 483         # Discover 'msDS-Behavior-Version'
 484         res = self.ldb_admin.search(base=self.base_dn, expression="distinguishedName=%s" % self.base_dn, \
 485                 attrs=['msDS-Behavior-Version'])
 486         res = int(res[0]['msDS-Behavior-Version'][0])
 487         if res < DS_DOMAIN_FUNCTION_2008:
 488             self.DS_BEHAVIOR = "ds_behavior_win2003"
 489         else:
 490             self.DS_BEHAVIOR = "ds_behavior_win2008"
 491
 492     def tearDown(self):
 493         if self.SAMBA:
 494             self.delete_force(self.ldb_admin, self.get_users_domain_dn("testuser1"))
 495             self.delete_force(self.ldb_admin, self.get_users_domain_dn("testuser2"))
 496             self.delete_force(self.ldb_admin, self.get_users_domain_dn("testuser3"))
 497             self.delete_force(self.ldb_admin, self.get_users_domain_dn("testuser4"))
 498             self.delete_force(self.ldb_admin, self.get_users_domain_dn("testuser5"))
 499             self.delete_force(self.ldb_admin, self.get_users_domain_dn("testuser6"))
 500             self.delete_force(self.ldb_admin, self.get_users_domain_dn("testuser7"))
 501             self.delete_force(self.ldb_admin, self.get_users_domain_dn("testuser8"))
 502         # DOMAIN
 503         self.delete_force(self.ldb_admin, self.get_users_domain_dn("test_domain_group1"))
 504         self.delete_force(self.ldb_admin, "CN=test_domain_user1,OU=test_domain_ou1," + self.base_dn)
 505         self.delete_force(self.ldb_admin, "OU=test_domain_ou2,OU=test_domain_ou1," + self.base_dn)
 506         self.delete_force(self.ldb_admin, "OU=test_domain_ou1," + self.base_dn)
 507         # SCHEMA
 508         # CONFIGURATION
 509         self.delete_force(self.ldb_admin, "CN=test-specifier1,CN=test-container1,CN=DisplaySpecifiers," \
 510                 + self.configuration_dn)
 511         self.delete_force(self.ldb_admin, "CN=test-container1,CN=DisplaySpecifiers," + self.configuration_dn)
 512
 513     def check_user_belongs(self, user_dn, groups=[]):
 514         """ Test wether user is member of the expected group(s) """
 515         if groups != []:
 516             # User is member of at least one additional group
 517             res = self.ldb_admin.search(user_dn, attrs=["memberOf"])
 518             res = [x.upper() for x in sorted(list(res[0]["memberOf"]))]
 519             expected = []
 520             for x in groups:
 521                 expected.append(self.get_users_domain_dn(x))
 522             expected = [x.upper() for x in sorted(expected)]
 523             self.assertEqual(expected, res)
 524         else:
 525             # User is not a member of any additional groups but default
 526             res = self.ldb_admin.search(user_dn, attrs=["*"])
 527             res = [x.upper() for x in res[0].keys()]
 528             self.assertFalse( "MEMBEROF" in res)
 529
 530     def check_modify_inheritance(self, _ldb, object_dn, owner_group=""):
 531         # Modify
 532         ace = "(D;;CC;;;LG)" # Deny Create Children to Guest account
 533         if owner_group != "":
 534             self.modify_desc(_ldb, object_dn, owner_group + "D:" + ace)
 535         else:
 536             self.modify_desc(_ldb, object_dn, "D:" + ace)
 537         # Make sure the modify operation has been applied
 538         desc_sddl = self.get_desc_sddl(object_dn)
 539         self.assertTrue(ace in desc_sddl)
 540         # Make sure we have identical result for both "add" and "modify"
 541         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
 542         print self._testMethodName
 543         test_number = self._testMethodName[5:]
 544         self.assertEqual(self.results[self.DS_BEHAVIOR][test_number], res)
 545
 546     def test_100(self):
 547         """ Enterprise admin group member creates object (default nTSecurityDescriptor) in DOMAIN
 548         """
 549         user_name = "testuser1"
 550         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Enterprise Admins"])
 551         # Open Ldb connection with the tested user
 552         _ldb = self.get_ldb_connection(user_name, "samba123@")
 553         object_dn = "CN=test_domain_group1,CN=Users," + self.base_dn
 554         self.delete_force(self.ldb_admin, object_dn)
 555         self.create_domain_group(_ldb, object_dn)
 556         desc_sddl = self.get_desc_sddl(object_dn)
 557         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
 558         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]], res)
 559         self.check_modify_inheritance(_ldb, object_dn)
 560
 561     def test_101(self):
 562         """ Domain admin group member creates object (default nTSecurityDescriptor) in DOMAIN
 563         """
 564         user_name = "testuser2"
 565         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Domain Admins"])
 566         # Open Ldb connection with the tested user
 567         _ldb = self.get_ldb_connection(user_name, "samba123@")
 568         object_dn = "CN=test_domain_group1,CN=Users," + self.base_dn
 569         self.delete_force(self.ldb_admin, object_dn)
 570         self.create_domain_group(_ldb, object_dn)
 571         desc_sddl = self.get_desc_sddl(object_dn)
 572         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
 573         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]], res)
 574         self.check_modify_inheritance(_ldb, object_dn)
 575
 576     def test_102(self):
 577         """ Schema admin group member with CC right creates object (default nTSecurityDescriptor) in DOMAIN
 578         """
 579         user_name = "testuser3"
 580         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Schema Admins"])
 581         # Open Ldb connection with the tested user
 582         _ldb = self.get_ldb_connection(user_name, "samba123@")
 583         object_dn = "OU=test_domain_ou1," + self.base_dn
 584         self.delete_force(self.ldb_admin, object_dn)
 585         self.create_domain_ou(self.ldb_admin, object_dn)
 586         user_sid = self.get_object_sid( self.get_users_domain_dn(user_name) )
 587         mod = "(A;CI;WPWDCC;;;%s)" % str(user_sid)
 588         self.dacl_add_ace(object_dn, mod)
 589         # Create additional object into the first one
 590         object_dn = "CN=test_domain_user1," + object_dn
 591         self.delete_force(self.ldb_admin, object_dn)
 592         self.create_domain_user(_ldb, object_dn)
 593         desc_sddl = self.get_desc_sddl(object_dn)
 594         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
 595         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]] % str(user_sid), res)
 596         # This fails, research why
 597         #self.check_modify_inheritance(_ldb, object_dn)
 598
 599     def test_103(self):
 600         """ Regular user with CC right creates object (default nTSecurityDescriptor) in DOMAIN
 601         """
 602         user_name = "testuser4"
 603         self.check_user_belongs(self.get_users_domain_dn(user_name), [])
 604         # Open Ldb connection with the tested user
 605         _ldb = self.get_ldb_connection(user_name, "samba123@")
 606         object_dn = "OU=test_domain_ou1," + self.base_dn
 607         self.delete_force(self.ldb_admin, object_dn)
 608         self.create_domain_ou(self.ldb_admin, object_dn)
 609         user_sid = self.get_object_sid( self.get_users_domain_dn(user_name) )
 610         mod = "(A;CI;WPWDCC;;;%s)" % str(user_sid)
 611         self.dacl_add_ace(object_dn, mod)
 612         # Create additional object into the first one
 613         object_dn = "CN=test_domain_user1," + object_dn
 614         self.delete_force(self.ldb_admin, object_dn)
 615         self.create_domain_user(_ldb, object_dn)
 616         desc_sddl = self.get_desc_sddl(object_dn)
 617         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
 618         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]] % str(user_sid), res)
 619         #this fails, research why
 620         #self.check_modify_inheritance(_ldb, object_dn)
 621
 622     def test_104(self):
 623         """ Enterprise & Domain admin group member creates object (default nTSecurityDescriptor) in DOMAIN
 624         """
 625         user_name = "testuser5"
 626         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Enterprise Admins", "Domain Admins"])
 627         # Open Ldb connection with the tested user
 628         _ldb = self.get_ldb_connection(user_name, "samba123@")
 629         object_dn = "CN=test_domain_group1,CN=Users," + self.base_dn
 630         self.delete_force(self.ldb_admin, object_dn)
 631         self.create_domain_group(_ldb, object_dn)
 632         desc_sddl = self.get_desc_sddl(object_dn)
 633         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
 634         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]], res)
 635         self.check_modify_inheritance(_ldb, object_dn)
 636
 637     def test_105(self):
 638         """ Enterprise & Domain & Schema admin group member creates object (default nTSecurityDescriptor) in DOMAIN
 639         """
 640         user_name = "testuser6"
 641         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Enterprise Admins", "Domain Admins", "Schema Admins"])
 642         # Open Ldb connection with the tested user
 643         _ldb = self.get_ldb_connection(user_name, "samba123@")
 644         object_dn = "CN=test_domain_group1,CN=Users," + self.base_dn
 645         self.delete_force(self.ldb_admin, object_dn)
 646         self.create_domain_group(_ldb, object_dn)
 647         desc_sddl = self.get_desc_sddl(object_dn)
 648         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
 649         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]], res)
 650         self.check_modify_inheritance(_ldb, object_dn)
 651
 652     def test_106(self):
 653         """ Domain & Schema admin group member creates object (default nTSecurityDescriptor) in DOMAIN
 654         """
 655         user_name = "testuser7"
 656         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Domain Admins", "Schema Admins"])
 657         # Open Ldb connection with the tested user
 658         _ldb = self.get_ldb_connection(user_name, "samba123@")
 659         object_dn = "CN=test_domain_group1,CN=Users," + self.base_dn
 660         self.delete_force(self.ldb_admin, object_dn)
 661         self.create_domain_group(_ldb, object_dn)
 662         desc_sddl = self.get_desc_sddl(object_dn)
 663         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
 664         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]], res)
 665         self.check_modify_inheritance(_ldb, object_dn)
 666
 667     def test_107(self):
 668         """ Enterprise & Schema admin group member creates object (default nTSecurityDescriptor) in DOMAIN
 669         """
 670         user_name = "testuser8"
 671         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Enterprise Admins", "Schema Admins"])
 672         # Open Ldb connection with the tested user
 673         _ldb = self.get_ldb_connection(user_name, "samba123@")
 674         object_dn = "CN=test_domain_group1,CN=Users," + self.base_dn
 675         self.delete_force(self.ldb_admin, object_dn)
 676         self.create_domain_group(_ldb, object_dn)
 677         desc_sddl = self.get_desc_sddl(object_dn)
 678         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
 679         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]], res)
 680         self.check_modify_inheritance(_ldb, object_dn)
 681
 682     # Control descriptor tests #####################################################################
 683
 684     def test_108(self):
 685         """ Enterprise admin group member creates object (custom descriptor) in DOMAIN
 686         """
 687         user_name = "testuser1"
 688         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Enterprise Admins"])
 689         # Open Ldb connection with the tested user
 690         _ldb = self.get_ldb_connection(user_name, "samba123@")
 691         object_dn = "CN=test_domain_group1,CN=Users," + self.base_dn
 692         self.delete_force(self.ldb_admin, object_dn)
 693         # Create a custom security descriptor
 694         desc_sddl = "O:DAG:DAD:(A;;RP;;;DU)"
 695         self.create_domain_group(_ldb, object_dn, desc_sddl)
 696         desc_sddl = self.get_desc_sddl(object_dn)
 697         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
 698         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]], res)
 699
 700     def test_109(self):
 701         """ Domain admin group member creates object (custom descriptor) in DOMAIN
 702         """
 703         user_name = "testuser2"
 704         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Domain Admins"])
 705         # Open Ldb connection with the tested user
 706         _ldb = self.get_ldb_connection(user_name, "samba123@")
 707         object_dn = "CN=test_domain_group1,CN=Users," + self.base_dn
 708         self.delete_force(self.ldb_admin, object_dn)
 709         # Create a custom security descriptor
 710         desc_sddl = "O:DAG:DAD:(A;;RP;;;DU)"
 711         self.create_domain_group(_ldb, object_dn, desc_sddl)
 712         desc_sddl = self.get_desc_sddl(object_dn)
 713         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
 714         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]], res)
 715
 716     def test_110(self):
 717         """ Schema admin group member with CC right creates object (custom descriptor) in DOMAIN
 718         """
 719         user_name = "testuser3"
 720         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Schema Admins"])
 721         # Open Ldb connection with the tested user
 722         _ldb = self.get_ldb_connection(user_name, "samba123@")
 723         object_dn = "OU=test_domain_ou1," + self.base_dn
 724         self.delete_force(self.ldb_admin, object_dn)
 725         self.create_domain_ou(self.ldb_admin, object_dn)
 726         user_sid = self.get_object_sid( self.get_users_domain_dn(user_name) )
 727         mod = "(A;CI;WOWDCC;;;%s)" % str(user_sid)
 728         self.dacl_add_ace(object_dn, mod)
 729         # Create a custom security descriptor
 730         # NB! Problematic owner part won't accept DA only <User Sid> !!!
 731         desc_sddl = "O:%sG:DAD:(A;;RP;;;DU)" % str(user_sid)
 732         # Create additional object into the first one
 733         object_dn = "CN=test_domain_user1," + object_dn
 734         self.delete_force(self.ldb_admin, object_dn)
 735         self.create_domain_user(_ldb, object_dn, desc_sddl)
 736         desc = self.read_desc(object_dn)
 737         desc_sddl = self.get_desc_sddl(object_dn)
 738         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
 739         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]] % str(user_sid), res)
 740
 741     def test_111(self):
 742         """ Regular user with CC right creates object (custom descriptor) in DOMAIN
 743         """
 744         user_name = "testuser4"
 745         self.check_user_belongs(self.get_users_domain_dn(user_name), [])
 746         # Open Ldb connection with the tested user
 747         _ldb = self.get_ldb_connection(user_name, "samba123@")
 748         object_dn = "OU=test_domain_ou1," + self.base_dn
 749         self.delete_force(self.ldb_admin, object_dn)
 750         self.create_domain_ou(self.ldb_admin, object_dn)
 751         user_sid = self.get_object_sid( self.get_users_domain_dn(user_name) )
 752         mod = "(A;CI;WOWDCC;;;%s)" % str(user_sid)
 753         self.dacl_add_ace(object_dn, mod)
 754         # Create a custom security descriptor
 755         # NB! Problematic owner part won't accept DA only <User Sid> !!!
 756         desc_sddl = "O:%sG:DAD:(A;;RP;;;DU)" % str(user_sid)
 757         # Create additional object into the first one
 758         object_dn = "CN=test_domain_user1," + object_dn
 759         self.delete_force(self.ldb_admin, object_dn)
 760         self.create_domain_user(_ldb, object_dn, desc_sddl)
 761         desc = self.read_desc(object_dn)
 762         desc_sddl = self.get_desc_sddl(object_dn)
 763         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
 764         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]] % str(user_sid), res)
 765
 766     def test_112(self):
 767         """ Domain & Enterprise admin group member creates object (custom descriptor) in DOMAIN
 768         """
 769         user_name = "testuser5"
 770         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Enterprise Admins", "Domain Admins"])
 771         # Open Ldb connection with the tested user
 772         _ldb = self.get_ldb_connection(user_name, "samba123@")
 773         object_dn = "CN=test_domain_group1,CN=Users," + self.base_dn
 774         self.delete_force(self.ldb_admin, object_dn)
 775         # Create a custom security descriptor
 776         desc_sddl = "O:DAG:DAD:(A;;RP;;;DU)"
 777         self.create_domain_group(_ldb, object_dn, desc_sddl)
 778         desc_sddl = self.get_desc_sddl(object_dn)
 779         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
 780         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]], res)
 781
 782     def test_113(self):
 783         """ Domain & Enterprise & Schema admin group  member creates object (custom descriptor) in DOMAIN
 784         """
 785         user_name = "testuser6"
 786         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Enterprise Admins", "Domain Admins", "Schema Admins"])
 787         # Open Ldb connection with the tested user
 788         _ldb = self.get_ldb_connection(user_name, "samba123@")
 789         object_dn = "CN=test_domain_group1,CN=Users," + self.base_dn
 790         self.delete_force(self.ldb_admin, object_dn)
 791         # Create a custom security descriptor
 792         desc_sddl = "O:DAG:DAD:(A;;RP;;;DU)"
 793         self.create_domain_group(_ldb, object_dn, desc_sddl)
 794         desc_sddl = self.get_desc_sddl(object_dn)
 795         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
 796         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]], res)
 797
 798     def test_114(self):
 799         """ Domain & Schema admin group  member creates object (custom descriptor) in DOMAIN
 800         """
 801         user_name = "testuser7"
 802         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Domain Admins", "Schema Admins"])
 803         # Open Ldb connection with the tested user
 804         _ldb = self.get_ldb_connection(user_name, "samba123@")
 805         object_dn = "CN=test_domain_group1,CN=Users," + self.base_dn
 806         self.delete_force(self.ldb_admin, object_dn)
 807         # Create a custom security descriptor
 808         desc_sddl = "O:DAG:DAD:(A;;RP;;;DU)"
 809         self.create_domain_group(_ldb, object_dn, desc_sddl)
 810         desc_sddl = self.get_desc_sddl(object_dn)
 811         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
 812         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]], res)
 813
 814     def test_115(self):
 815         """ Enterprise & Schema admin group  member creates object (custom descriptor) in DOMAIN
 816         """
 817         user_name = "testuser8"
 818         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Enterprise Admins", "Schema Admins"])
 819         # Open Ldb connection with the tested user
 820         _ldb = self.get_ldb_connection(user_name, "samba123@")
 821         object_dn = "CN=test_domain_group1,CN=Users," + self.base_dn
 822         self.delete_force(self.ldb_admin, object_dn)
 823         # Create a custom security descriptor
 824         desc_sddl = "O:DAG:DAD:(A;;RP;;;DU)"
 825         self.create_domain_group(_ldb, object_dn, desc_sddl)
 826         desc_sddl = self.get_desc_sddl(object_dn)
 827         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
 828         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]], res)
 829
 830     def test_999(self):
 831         user_name = "Administrator"
 832         object_dn = "OU=test_domain_ou1," + self.base_dn
 833         self.delete_force(self.ldb_admin, object_dn)
 834         self.create_domain_ou(self.ldb_admin, object_dn)
 835         user_sid = self.get_object_sid( self.get_users_domain_dn(user_name) )
 836         mod = "(D;CI;WP;;;S-1-3-0)"
 837         #mod = ""
 838         self.dacl_add_ace(object_dn, mod)
 839         desc_sddl = self.get_desc_sddl(object_dn)
 840         # Create additional object into the first one
 841         object_dn = "OU=test_domain_ou2," + object_dn
 842         self.delete_force(self.ldb_admin, object_dn)
 843         self.create_domain_ou(self.ldb_admin, object_dn)
 844         desc_sddl = self.get_desc_sddl(object_dn)
 845
 846     ## Tests for SCHEMA
 847
 848     # Defalt descriptor tests ##################################################################
 849
 850     def test_130(self):
 851         user_name = "testuser1"
 852         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Enterprise Admins"])
 853         # Open Ldb connection with the tested user
 854         _ldb = self.get_ldb_connection(user_name, "samba123@")
 855         # Change Schema partition descriptor
 856         user_sid = self.get_object_sid( self.get_users_domain_dn(user_name) )
 857         mod = "(A;;WDCC;;;AU)"
 858         self.dacl_add_ace(self.schema_dn, mod)
 859         # Create example Schema class
 860         class_name = self.get_unique_schema_class_name()
 861         class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
 862         self.create_schema_class(_ldb, class_dn)
 863         desc_sddl = self.get_desc_sddl(class_dn)
 864         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
 865         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]], res)
 866         self.check_modify_inheritance(_ldb, class_dn)
 867
 868     def test_131(self):
 869         user_name = "testuser2"
 870         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Domain Admins"])
 871         # Open Ldb connection with the tested user
 872         _ldb = self.get_ldb_connection(user_name, "samba123@")
 873         # Change Schema partition descriptor
 874         mod = "(A;CI;WDCC;;;AU)"
 875         self.dacl_add_ace(self.schema_dn, mod)
 876         # Create example Schema class
 877         class_name = self.get_unique_schema_class_name()
 878         class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
 879         self.create_schema_class(_ldb, class_dn)
 880         desc_sddl = self.get_desc_sddl(class_dn)
 881         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
 882         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]], res)
 883         self.check_modify_inheritance(_ldb, class_dn)
 884
 885     def test_132(self):
 886         user_name = "testuser3"
 887         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Schema Admins"])
 888         # Open Ldb connection with the tested user
 889         _ldb = self.get_ldb_connection(user_name, "samba123@")
 890         # Change Schema partition descriptor
 891         mod = "(A;CI;WDCC;;;AU)"
 892         self.dacl_add_ace(self.schema_dn, mod)
 893         # Create example Schema class
 894         class_name = self.get_unique_schema_class_name()
 895         class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
 896         self.create_schema_class(_ldb, class_dn)
 897         desc_sddl = self.get_desc_sddl(class_dn)
 898         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
 899         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]], res)
 900         #self.check_modify_inheritance(_ldb, class_dn)
 901
 902     def test_133(self):
 903         user_name = "testuser4"
 904         self.check_user_belongs(self.get_users_domain_dn(user_name), [])
 905         # Open Ldb connection with the tested user
 906         _ldb = self.get_ldb_connection(user_name, "samba123@")
 907         #Change Schema partition descriptor
 908         user_sid = self.get_object_sid( self.get_users_domain_dn(user_name) )
 909         mod = "(A;CI;WDCC;;;AU)"
 910         self.dacl_add_ace(self.schema_dn, mod)
 911         # Create example Schema class
 912         class_name = self.get_unique_schema_class_name()
 913         class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
 914         self.create_schema_class(_ldb, class_dn)
 915         desc_sddl = self.get_desc_sddl(class_dn)
 916         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
 917         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]] % str(user_sid), res)
 918         #self.check_modify_inheritance(_ldb, class_dn)
 919
 920     def test_134(self):
 921         user_name = "testuser5"
 922         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Enterprise Admins", "Domain Admins"])
 923         # Open Ldb connection with the tested user
 924         _ldb = self.get_ldb_connection(user_name, "samba123@")
 925         #Change Schema partition descriptor
 926         mod = "(A;CI;WDCC;;;AU)"
 927         self.dacl_add_ace(self.schema_dn, mod)
 928         # Create example Schema class
 929         class_name = self.get_unique_schema_class_name()
 930         class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
 931         self.create_schema_class(_ldb, class_dn)
 932         desc_sddl = self.get_desc_sddl(class_dn)
 933         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
 934         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]], res)
 935         self.check_modify_inheritance(_ldb, class_dn)
 936
 937     def test_135(self):
 938         user_name = "testuser6"
 939         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Enterprise Admins", "Domain Admins", "Schema Admins"])
 940         # Open Ldb connection with the tested user
 941         _ldb = self.get_ldb_connection(user_name, "samba123@")
 942         # Change Schema partition descriptor
 943         mod = "(A;CI;WDCC;;;AU)"
 944         self.dacl_add_ace(self.schema_dn, mod)
 945         # Create example Schema class
 946         class_name = self.get_unique_schema_class_name()
 947         class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
 948         self.create_schema_class(_ldb, class_dn)
 949         desc_sddl = self.get_desc_sddl(class_dn)
 950         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
 951         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]], res)
 952         self.check_modify_inheritance(_ldb, class_dn)
 953
 954     def test_136(self):
 955         user_name = "testuser7"
 956         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Domain Admins", "Schema Admins"])
 957         # Open Ldb connection with the tested user
 958         _ldb = self.get_ldb_connection(user_name, "samba123@")
 959         # Change Schema partition descriptor
 960         mod = "(A;CI;WDCC;;;AU)"
 961         self.dacl_add_ace(self.schema_dn, mod)
 962         # Create example Schema class
 963         class_name = self.get_unique_schema_class_name()
 964         class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
 965         self.create_schema_class(_ldb, class_dn)
 966         desc_sddl = self.get_desc_sddl(class_dn)
 967         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
 968         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]], res)
 969         self.check_modify_inheritance(_ldb, class_dn)
 970
 971     def test_137(self):
 972         user_name = "testuser8"
 973         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Enterprise Admins", "Schema Admins"])
 974         # Open Ldb connection with the tested user
 975         _ldb = self.get_ldb_connection(user_name, "samba123@")
 976         # Change Schema partition descriptor
 977         mod = "(A;CI;WDCC;;;AU)"
 978         self.dacl_add_ace(self.schema_dn, mod)
 979         # Create example Schema class
 980         class_name = self.get_unique_schema_class_name()
 981         class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
 982         self.create_schema_class(_ldb, class_dn)
 983         desc_sddl = self.get_desc_sddl(class_dn)
 984         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
 985         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]], res)
 986         self.check_modify_inheritance(_ldb, class_dn)
 987
 988     # Custom descriptor tests ##################################################################
 989
 990     def test_138(self):
 991         user_name = "testuser1"
 992         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Enterprise Admins"])
 993         # Open Ldb connection with the tested user
 994         _ldb = self.get_ldb_connection(user_name, "samba123@")
 995         # Change Schema partition descriptor
 996         mod = "(A;;CC;;;AU)"
 997         self.dacl_add_ace(self.schema_dn, mod)
 998         # Create a custom security descriptor
 999         desc_sddl = "O:DAG:DAD:(A;;RP;;;DU)"
1000         # Create example Schema class
1001         class_name = self.get_unique_schema_class_name()
1002         class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
1003         self.create_schema_class(_ldb, class_dn, desc_sddl)
1004         desc_sddl = self.get_desc_sddl(class_dn)
1005         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
1006         self.assertEqual("O:DAG:DA", res)
1007
1008     def test_139(self):
1009         user_name = "testuser2"
1010         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Domain Admins"])
1011         # Open Ldb connection with the tested user
1012         _ldb = self.get_ldb_connection(user_name, "samba123@")
1013         # Change Schema partition descriptor
1014         mod = "(A;;CC;;;AU)"
1015         self.dacl_add_ace(self.schema_dn, mod)
1016         # Create a custom security descriptor
1017         desc_sddl = "O:DAG:DAD:(A;;RP;;;DU)"
1018         # Create example Schema class
1019         class_name = self.get_unique_schema_class_name()
1020         class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
1021         self.create_schema_class(_ldb, class_dn, desc_sddl)
1022         desc_sddl = self.get_desc_sddl(class_dn)
1023         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
1024         self.assertEqual("O:DAG:DA", res)
1025
1026     def test_140(self):
1027         user_name = "testuser3"
1028         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Schema Admins"])
1029         # Open Ldb connection with the tested user
1030         _ldb = self.get_ldb_connection(user_name, "samba123@")
1031         # Create a custom security descriptor
1032         # NB! Problematic owner part won't accept DA only <User Sid> !!!
1033         user_sid = self.get_object_sid( self.get_users_domain_dn(user_name) )
1034         desc_sddl = "O:%sG:DAD:(A;;RP;;;DU)" % str(user_sid)
1035         # Create example Schema class
1036         class_name = self.get_unique_schema_class_name()
1037         class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
1038         self.create_schema_class(_ldb, class_dn, desc_sddl)
1039         desc_sddl = self.get_desc_sddl(class_dn)
1040         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
1041         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]] % str(user_sid), res)
1042
1043     def test_141(self):
1044         user_name = "testuser4"
1045         self.check_user_belongs(self.get_users_domain_dn(user_name), [])
1046         # Open Ldb connection with the tested user
1047         _ldb = self.get_ldb_connection(user_name, "samba123@")
1048         # Create a custom security descriptor
1049         # NB! Problematic owner part won't accept DA only <User Sid> !!!
1050         user_sid = self.get_object_sid( self.get_users_domain_dn(user_name) )
1051         desc_sddl = "O:%sG:DAD:(A;;RP;;;DU)" % str(user_sid)
1052         # Create example Schema class
1053         class_name = self.get_unique_schema_class_name()
1054         class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
1055         self.create_schema_class(_ldb, class_dn, desc_sddl)
1056         desc_sddl = self.get_desc_sddl(class_dn)
1057         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
1058         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]] % str(user_sid), res)
1059
1060     def test_142(self):
1061         user_name = "testuser5"
1062         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Enterprise Admins", "Domain Admins"])
1063         # Open Ldb connection with the tested user
1064         _ldb = self.get_ldb_connection(user_name, "samba123@")
1065         # Change Schema partition descriptor
1066         mod = "(A;;CC;;;AU)"
1067         self.dacl_add_ace(self.schema_dn, mod)
1068         # Create a custom security descriptor
1069         desc_sddl = "O:DAG:DAD:(A;;RP;;;DU)"
1070         # Create example Schema class
1071         class_name = self.get_unique_schema_class_name()
1072         class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
1073         self.create_schema_class(_ldb, class_dn, desc_sddl)
1074         desc_sddl = self.get_desc_sddl(class_dn)
1075         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
1076         self.assertEqual("O:DAG:DA", res)
1077
1078     def test_143(self):
1079         user_name = "testuser6"
1080         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Enterprise Admins", "Domain Admins", "Schema Admins"])
1081         # Open Ldb connection with the tested user
1082         _ldb = self.get_ldb_connection(user_name, "samba123@")
1083         # Change Schema partition descriptor
1084         mod = "(A;;CC;;;AU)"
1085         self.dacl_add_ace(self.schema_dn, mod)
1086         # Create a custom security descriptor
1087         desc_sddl = "O:DAG:DAD:(A;;RP;;;DU)"
1088         # Create example Schema class
1089         class_name = self.get_unique_schema_class_name()
1090         class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
1091         self.create_schema_class(_ldb, class_dn, desc_sddl)
1092         desc_sddl = self.get_desc_sddl(class_dn)
1093         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
1094         self.assertEqual("O:DAG:DA", res)
1095
1096     def test_144(self):
1097         user_name = "testuser7"
1098         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Domain Admins", "Schema Admins"])
1099         # Open Ldb connection with the tested user
1100         _ldb = self.get_ldb_connection(user_name, "samba123@")
1101         # Change Schema partition descriptor
1102         mod = "(A;;CC;;;AU)"
1103         self.dacl_add_ace(self.schema_dn, mod)
1104         # Create a custom security descriptor
1105         desc_sddl = "O:DAG:DAD:(A;;RP;;;DU)"
1106         # Create example Schema class
1107         class_name = self.get_unique_schema_class_name()
1108         class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
1109         self.create_schema_class(_ldb, class_dn, desc_sddl)
1110         desc_sddl = self.get_desc_sddl(class_dn)
1111         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
1112         self.assertEqual("O:DAG:DA", res)
1113
1114     def test_145(self):
1115         user_name = "testuser8"
1116         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Enterprise Admins", "Schema Admins"])
1117         # Open Ldb connection with the tested user
1118         _ldb = self.get_ldb_connection(user_name, "samba123@")
1119         # Change Schema partition descriptor
1120         mod = "(A;;CC;;;AU)"
1121         self.dacl_add_ace(self.schema_dn, mod)
1122         # Create a custom security descriptor
1123         desc_sddl = "O:DAG:DAD:(A;;RP;;;DU)"
1124         # Create example Schema class
1125         class_name = self.get_unique_schema_class_name()
1126         class_dn = "CN=%s,%s" % (class_name, self.schema_dn)
1127         self.create_schema_class(_ldb, class_dn, desc_sddl)
1128         desc_sddl = self.get_desc_sddl(class_dn)
1129         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
1130         self.assertEqual("O:DAG:DA", res)
1131
1132     ## Tests for CONFIGURATION
1133
1134     # Defalt descriptor tests ##################################################################
1135
1136     def test_160(self):
1137         user_name = "testuser1"
1138         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Enterprise Admins"])
1139         # Open Ldb connection with the tested user
1140         _ldb = self.get_ldb_connection(user_name, "samba123@")
1141         # Create example Configuration container
1142         container_name = "test-container1"
1143         object_dn = "CN=%s,CN=DisplaySpecifiers,%s" % (container_name, self.configuration_dn)
1144         self.delete_force(self.ldb_admin, object_dn)
1145         self.create_configuration_container(_ldb, object_dn, )
1146         desc_sddl = self.get_desc_sddl(object_dn)
1147         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
1148         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]], res)
1149         self.check_modify_inheritance(_ldb, object_dn)
1150
1151     def test_161(self):
1152         user_name = "testuser2"
1153         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Domain Admins"])
1154         # Open Ldb connection with the tested user
1155         _ldb = self.get_ldb_connection(user_name, "samba123@")
1156         # Create example Configuration container
1157         container_name = "test-container1"
1158         object_dn = "CN=%s,CN=DisplaySpecifiers,%s" % (container_name, self.configuration_dn)
1159         self.delete_force(self.ldb_admin, object_dn)
1160         self.create_configuration_container(_ldb, object_dn, )
1161         desc_sddl = self.get_desc_sddl(object_dn)
1162         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
1163         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]], res)
1164         self.check_modify_inheritance(_ldb, object_dn)
1165
1166     def test_162(self):
1167         user_name = "testuser3"
1168         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Schema Admins"])
1169         # Open Ldb connection with the tested user
1170         _ldb = self.get_ldb_connection(user_name, "samba123@")
1171         # Create example Configuration container
1172         object_dn = "CN=test-container1,CN=DisplaySpecifiers," + self.configuration_dn
1173         self.delete_force(self.ldb_admin, object_dn)
1174         self.create_configuration_container(self.ldb_admin, object_dn, )
1175         user_sid = self.get_object_sid( self.get_users_domain_dn(user_name) )
1176         mod = "(A;;WDCC;;;AU)"
1177         self.dacl_add_ace(object_dn, mod)
1178         # Create child object with user's credentials
1179         object_dn = "CN=test-specifier1," + object_dn
1180         self.delete_force(self.ldb_admin, object_dn)
1181         self.create_configuration_specifier(_ldb, object_dn)
1182         desc_sddl = self.get_desc_sddl(object_dn)
1183         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
1184         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]] % str(user_sid), res)
1185         #self.check_modify_inheritance(_ldb, object_dn)
1186
1187     def test_163(self):
1188         user_name = "testuser4"
1189         self.check_user_belongs(self.get_users_domain_dn(user_name), [])
1190         # Open Ldb connection with the tested user
1191         _ldb = self.get_ldb_connection(user_name, "samba123@")
1192         # Create example Configuration container
1193         object_dn = "CN=test-container1,CN=DisplaySpecifiers," + self.configuration_dn
1194         self.delete_force(self.ldb_admin, object_dn)
1195         self.create_configuration_container(self.ldb_admin, object_dn, )
1196         user_sid = self.get_object_sid( self.get_users_domain_dn(user_name) )
1197         mod = "(A;CI;WDCC;;;AU)"
1198         self.dacl_add_ace(object_dn, mod)
1199         # Create child object with user's credentials
1200         object_dn = "CN=test-specifier1," + object_dn
1201         self.delete_force(self.ldb_admin, object_dn)
1202         self.create_configuration_specifier(_ldb, object_dn)
1203         desc_sddl = self.get_desc_sddl(object_dn)
1204         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
1205         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]] % str(user_sid), res)
1206         #self.check_modify_inheritance(_ldb, object_dn)
1207
1208     def test_164(self):
1209         user_name = "testuser5"
1210         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Enterprise Admins", "Domain Admins"])
1211         # Open Ldb connection with the tested user
1212         _ldb = self.get_ldb_connection(user_name, "samba123@")
1213         # Create example Configuration container
1214         container_name = "test-container1"
1215         object_dn = "CN=%s,CN=DisplaySpecifiers,%s" % (container_name, self.configuration_dn)
1216         self.delete_force(self.ldb_admin, object_dn)
1217         self.create_configuration_container(_ldb, object_dn, )
1218         desc_sddl = self.get_desc_sddl(object_dn)
1219         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
1220         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]], res)
1221         self.check_modify_inheritance(_ldb, object_dn)
1222
1223     def test_165(self):
1224         user_name = "testuser6"
1225         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Enterprise Admins", "Domain Admins", "Schema Admins"])
1226         # Open Ldb connection with the tested user
1227         _ldb = self.get_ldb_connection(user_name, "samba123@")
1228         # Create example Configuration container
1229         container_name = "test-container1"
1230         object_dn = "CN=%s,CN=DisplaySpecifiers,%s" % (container_name, self.configuration_dn)
1231         self.delete_force(self.ldb_admin, object_dn)
1232         self.create_configuration_container(_ldb, object_dn, )
1233         desc_sddl = self.get_desc_sddl(object_dn)
1234         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
1235         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]], res)
1236         self.check_modify_inheritance(_ldb, object_dn)
1237
1238     def test_166(self):
1239         user_name = "testuser7"
1240         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Domain Admins", "Schema Admins"])
1241         # Open Ldb connection with the tested user
1242         _ldb = self.get_ldb_connection(user_name, "samba123@")
1243         # Create example Configuration container
1244         container_name = "test-container1"
1245         object_dn = "CN=%s,CN=DisplaySpecifiers,%s" % (container_name, self.configuration_dn)
1246         self.delete_force(self.ldb_admin, object_dn)
1247         self.create_configuration_container(_ldb, object_dn, )
1248         desc_sddl = self.get_desc_sddl(object_dn)
1249         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
1250         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]], res)
1251         self.check_modify_inheritance(_ldb, object_dn)
1252
1253     def test_167(self):
1254         user_name = "testuser8"
1255         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Enterprise Admins", "Schema Admins"])
1256         # Open Ldb connection with the tested user
1257         _ldb = self.get_ldb_connection(user_name, "samba123@")
1258         # Create example Configuration container
1259         container_name = "test-container1"
1260         object_dn = "CN=%s,CN=DisplaySpecifiers,%s" % (container_name, self.configuration_dn)
1261         self.delete_force(self.ldb_admin, object_dn)
1262         self.create_configuration_container(_ldb, object_dn, )
1263         desc_sddl = self.get_desc_sddl(object_dn)
1264         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
1265         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]], res)
1266         self.check_modify_inheritance(_ldb, object_dn)
1267
1268     # Custom descriptor tests ##################################################################
1269
1270     def test_168(self):
1271         user_name = "testuser1"
1272         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Enterprise Admins"])
1273         # Open Ldb connection with the tested user
1274         _ldb = self.get_ldb_connection(user_name, "samba123@")
1275         # Create example Configuration container
1276         container_name = "test-container1"
1277         object_dn = "CN=%s,CN=DisplaySpecifiers,%s" % (container_name, self.configuration_dn)
1278         self.delete_force(self.ldb_admin, object_dn)
1279         # Create a custom security descriptor
1280         desc_sddl = "O:DAG:DAD:(A;;RP;;;DU)"
1281         self.create_configuration_container(_ldb, object_dn, desc_sddl)
1282         desc_sddl = self.get_desc_sddl(object_dn)
1283         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
1284         self.assertEqual("O:DAG:DA", res)
1285
1286     def test_169(self):
1287         user_name = "testuser2"
1288         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Domain Admins"])
1289         # Open Ldb connection with the tested user
1290         _ldb = self.get_ldb_connection(user_name, "samba123@")
1291         # Create example Configuration container
1292         container_name = "test-container1"
1293         object_dn = "CN=%s,CN=DisplaySpecifiers,%s" % (container_name, self.configuration_dn)
1294         self.delete_force(self.ldb_admin, object_dn)
1295         # Create a custom security descriptor
1296         desc_sddl = "O:DAG:DAD:(A;;RP;;;DU)"
1297         self.create_configuration_container(_ldb, object_dn, desc_sddl)
1298         desc_sddl = self.get_desc_sddl(object_dn)
1299         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
1300         self.assertEqual("O:DAG:DA", res)
1301
1302     def test_170(self):
1303         user_name = "testuser3"
1304         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Schema Admins"])
1305         # Open Ldb connection with the tested user
1306         _ldb = self.get_ldb_connection(user_name, "samba123@")
1307         # Create example Configuration container
1308         object_dn = "CN=test-container1,CN=DisplaySpecifiers," + self.configuration_dn
1309         self.delete_force(self.ldb_admin, object_dn)
1310         self.create_configuration_container(self.ldb_admin, object_dn, )
1311         user_sid = self.get_object_sid( self.get_users_domain_dn(user_name) )
1312         mod = "(A;;CC;;;AU)"
1313         self.dacl_add_ace(object_dn, mod)
1314         # Create child object with user's credentials
1315         object_dn = "CN=test-specifier1," + object_dn
1316         self.delete_force(self.ldb_admin, object_dn)
1317         # Create a custom security descriptor
1318         # NB! Problematic owner part won't accept DA only <User Sid> !!!
1319         desc_sddl = "O:%sG:DAD:(A;;RP;;;DU)" % str(user_sid)
1320         self.create_configuration_specifier(_ldb, object_dn, desc_sddl)
1321         desc_sddl = self.get_desc_sddl(object_dn)
1322         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
1323         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]] % str(user_sid), res)
1324
1325     def test_171(self):
1326         user_name = "testuser4"
1327         self.check_user_belongs(self.get_users_domain_dn(user_name), [])
1328         # Open Ldb connection with the tested user
1329         _ldb = self.get_ldb_connection(user_name, "samba123@")
1330         # Create example Configuration container
1331         object_dn = "CN=test-container1,CN=DisplaySpecifiers," + self.configuration_dn
1332         self.delete_force(self.ldb_admin, object_dn)
1333         self.create_configuration_container(self.ldb_admin, object_dn, )
1334         user_sid = self.get_object_sid( self.get_users_domain_dn(user_name) )
1335         mod = "(A;;CC;;;AU)"
1336         self.dacl_add_ace(object_dn, mod)
1337         # Create child object with user's credentials
1338         object_dn = "CN=test-specifier1," + object_dn
1339         self.delete_force(self.ldb_admin, object_dn)
1340         # Create a custom security descriptor
1341         # NB! Problematic owner part won't accept DA only <User Sid> !!!
1342         desc_sddl = "O:%sG:DAD:(A;;RP;;;DU)" % str(user_sid)
1343         self.create_configuration_specifier(_ldb, object_dn, desc_sddl)
1344         desc_sddl = self.get_desc_sddl(object_dn)
1345         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
1346         self.assertEqual(self.results[self.DS_BEHAVIOR][self._testMethodName[5:]] % str(user_sid), res)
1347
1348     def test_172(self):
1349         user_name = "testuser5"
1350         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Enterprise Admins", "Domain Admins"])
1351         # Open Ldb connection with the tested user
1352         _ldb = self.get_ldb_connection(user_name, "samba123@")
1353         # Create example Configuration container
1354         container_name = "test-container1"
1355         object_dn = "CN=%s,CN=DisplaySpecifiers,%s" % (container_name, self.configuration_dn)
1356         self.delete_force(self.ldb_admin, object_dn)
1357         # Create a custom security descriptor
1358         desc_sddl = "O:DAG:DAD:(A;;RP;;;DU)"
1359         self.create_configuration_container(_ldb, object_dn, desc_sddl)
1360         desc_sddl = self.get_desc_sddl(object_dn)
1361         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
1362         self.assertEqual("O:DAG:DA", res)
1363
1364     def test_173(self):
1365         user_name = "testuser6"
1366         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Enterprise Admins", "Domain Admins", "Schema Admins"])
1367         # Open Ldb connection with the tested user
1368         _ldb = self.get_ldb_connection(user_name, "samba123@")
1369         # Create example Configuration container
1370         container_name = "test-container1"
1371         object_dn = "CN=%s,CN=DisplaySpecifiers,%s" % (container_name, self.configuration_dn)
1372         self.delete_force(self.ldb_admin, object_dn)
1373         # Create a custom security descriptor
1374         desc_sddl = "O:DAG:DAD:(A;;RP;;;DU)"
1375         self.create_configuration_container(_ldb, object_dn, desc_sddl)
1376         desc_sddl = self.get_desc_sddl(object_dn)
1377         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
1378         self.assertEqual("O:DAG:DA", res)
1379
1380     def test_174(self):
1381         user_name = "testuser7"
1382         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Domain Admins", "Schema Admins"])
1383         # Open Ldb connection with the tested user
1384         _ldb = self.get_ldb_connection(user_name, "samba123@")
1385         # Create example Configuration container
1386         container_name = "test-container1"
1387         object_dn = "CN=%s,CN=DisplaySpecifiers,%s" % (container_name, self.configuration_dn)
1388         self.delete_force(self.ldb_admin, object_dn)
1389         # Create a custom security descriptor
1390         desc_sddl = "O:DAG:DAD:(A;;RP;;;DU)"
1391         self.create_configuration_container(_ldb, object_dn, desc_sddl)
1392         desc_sddl = self.get_desc_sddl(object_dn)
1393         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
1394         self.assertEqual("O:DAG:DA", res)
1395
1396     def test_175(self):
1397         user_name = "testuser8"
1398         self.check_user_belongs(self.get_users_domain_dn(user_name), ["Enterprise Admins", "Schema Admins"])
1399         # Open Ldb connection with the tested user
1400         _ldb = self.get_ldb_connection(user_name, "samba123@")
1401         # Create example Configuration container
1402         container_name = "test-container1"
1403         object_dn = "CN=%s,CN=DisplaySpecifiers,%s" % (container_name, self.configuration_dn)
1404         self.delete_force(self.ldb_admin, object_dn)
1405         # Create a custom security descriptor
1406         desc_sddl = "O:DAG:DAD:(A;;RP;;;DU)"
1407         self.create_configuration_container(_ldb, object_dn, desc_sddl)
1408         desc_sddl = self.get_desc_sddl(object_dn)
1409         res = re.search("(O:.*G:.*?)D:", desc_sddl).group(1)
1410         self.assertEqual("O:DAG:DA", res)
1411
1412     ########################################################################################
1413     # Inharitance tests for DACL
1414
1415 class DaclDescriptorTests(DescriptorTests):
1416
1417     def setUp(self):
1418         DescriptorTests.setUp(self)
1419
1420     def tearDown(self):
1421         self.delete_force(self.ldb_admin, "CN=test_inherit_group,OU=test_inherit_ou," + self.base_dn)
1422         self.delete_force(self.ldb_admin, "OU=test_inherit_ou," + self.base_dn)
1423
1424     def create_clean_ou(self, object_dn):
1425         """ Base repeating setup for unittests to follow """
1426         res = self.ldb_admin.search(base=self.base_dn, scope=SCOPE_SUBTREE, \
1427                 expression="distinguishedName=%s" % object_dn)
1428         # Make sure top testing OU has been deleted before starting the test
1429         self.assertEqual(res, [])
1430         self.create_domain_ou(self.ldb_admin, object_dn)
1431         desc_sddl = self.get_desc_sddl(object_dn)
1432         # Make sure there are inheritable ACEs initially
1433         self.assertTrue("CI" in desc_sddl or "OI" in desc_sddl)
1434         # Find and remove all inherit ACEs
1435         res = re.findall("\(.*?\)", desc_sddl)
1436         res = [x for x in res if ("CI" in x) or ("OI" in x)]
1437         for x in res:
1438             desc_sddl = desc_sddl.replace(x, "")
1439         # Add flag 'protected' in both DACL and SACL so no inherit ACEs
1440         # can propagate from above
1441         # remove SACL, we are not interested
1442         desc_sddl = desc_sddl.replace(":AI", ":AIP")
1443         self.modify_desc(self.ldb_admin, object_dn, desc_sddl)
1444         # Verify all inheritable ACEs are gone
1445         desc_sddl = self.get_desc_sddl(object_dn)
1446         self.assertFalse("CI" in desc_sddl)
1447         self.assertFalse("OI" in desc_sddl)
1448
1449     def test_200(self):
1450         """ OU with protected flag and child group. See if the group has inherit ACEs.
1451         """
1452         ou_dn = "OU=test_inherit_ou," + self.base_dn
1453         group_dn = "CN=test_inherit_group," + ou_dn
1454         # Create inheritable-free OU
1455         self.create_clean_ou(ou_dn)
1456         # Create group child object
1457         self.create_domain_group(self.ldb_admin, group_dn)
1458         # Make sure created group object contains NO inherit ACEs
1459         desc_sddl = self.get_desc_sddl(group_dn)
1460         self.assertFalse("ID" in desc_sddl)
1461
1462     def test_201(self):
1463         """ OU with protected flag and no inherit ACEs, child group with custom descriptor.
1464             Verify group has custom and default ACEs only.
1465         """
1466         ou_dn = "OU=test_inherit_ou," + self.base_dn
1467         group_dn = "CN=test_inherit_group," + ou_dn
1468         # Create inheritable-free OU
1469         self.create_clean_ou(ou_dn)
1470         # Create group child object using custom security descriptor
1471         sddl = "O:AUG:AUD:AI(D;;WP;;;DU)"
1472         self.create_domain_group(self.ldb_admin, group_dn, sddl)
1473         # Make sure created group descriptor has NO additional ACEs
1474         desc_sddl = self.get_desc_sddl(group_dn)
1475         self.assertEqual(desc_sddl, sddl)
1476         sddl = "O:AUG:AUD:AI(D;;CC;;;LG)"
1477         self.modify_desc(self.ldb_admin, group_dn, sddl)
1478         desc_sddl = self.get_desc_sddl(group_dn)
1479         self.assertEqual(desc_sddl, sddl)
1480
1481     def test_202(self):
1482         """ OU with protected flag and add couple non-inheritable ACEs, child group.
1483             See if the group has any of the added ACEs.
1484         """
1485         ou_dn = "OU=test_inherit_ou," + self.base_dn
1486         group_dn = "CN=test_inherit_group," + ou_dn
1487         # Create inheritable-free OU
1488         self.create_clean_ou(ou_dn)
1489         # Add some custom non-inheritable ACEs
1490         mod = "(D;;WP;;;DU)(A;;RP;;;DU)"
1491         moded = "(D;;CC;;;LG)"
1492         self.dacl_add_ace(ou_dn, mod)
1493         # Verify all inheritable ACEs are gone
1494         desc_sddl = self.get_desc_sddl(ou_dn)
1495         # Create group child object
1496         self.create_domain_group(self.ldb_admin, group_dn)
1497         # Make sure created group object contains NO inherit ACEs
1498         # also make sure the added above non-inheritable ACEs are absent too
1499         desc_sddl = self.get_desc_sddl(group_dn)
1500         self.assertFalse("ID" in desc_sddl)
1501         for x in re.findall("\(.*?\)", mod):
1502             self.assertFalse(x in desc_sddl)
1503         self.modify_desc(self.ldb_admin, group_dn, "D:" + moded)
1504         desc_sddl = self.get_desc_sddl(group_dn)
1505         self.assertFalse("ID" in desc_sddl)
1506         for x in re.findall("\(.*?\)", mod):
1507             self.assertFalse(x in desc_sddl)
1508
1509     def test_203(self):
1510         """ OU with protected flag and add 'CI' ACE, child group.
1511             See if the group has the added inherited ACE.
1512         """
1513         ou_dn = "OU=test_inherit_ou," + self.base_dn
1514         group_dn = "CN=test_inherit_group," + ou_dn
1515         # Create inheritable-free OU
1516         self.create_clean_ou(ou_dn)
1517         # Add some custom 'CI' ACE
1518         mod = "(D;CI;WP;;;DU)"
1519         moded = "(D;;CC;;;LG)"
1520         self.dacl_add_ace(ou_dn, mod)
1521         desc_sddl = self.get_desc_sddl(ou_dn)
1522         # Create group child object
1523         self.create_domain_group(self.ldb_admin, group_dn, "O:AUG:AUD:AI(A;;CC;;;AU)")
1524         # Make sure created group object contains only the above inherited ACE
1525         # that we've added manually
1526         desc_sddl = self.get_desc_sddl(group_dn)
1527         mod = mod.replace(";CI;", ";CIID;")
1528         self.assertTrue(mod in desc_sddl)
1529         self.modify_desc(self.ldb_admin, group_dn, "D:" + moded)
1530         desc_sddl = self.get_desc_sddl(group_dn)
1531         self.assertTrue(moded in desc_sddl)
1532         self.assertTrue(mod in desc_sddl)
1533
1534     def test_204(self):
1535         """ OU with protected flag and add 'OI' ACE, child group.
1536             See if the group has the added inherited ACE.
1537         """
1538         ou_dn = "OU=test_inherit_ou," + self.base_dn
1539         group_dn = "CN=test_inherit_group," + ou_dn
1540         # Create inheritable-free OU
1541         self.create_clean_ou(ou_dn)
1542         # Add some custom 'CI' ACE
1543         mod = "(D;OI;WP;;;DU)"
1544         moded = "(D;;CC;;;LG)"
1545         self.dacl_add_ace(ou_dn, mod)
1546         desc_sddl = self.get_desc_sddl(ou_dn)
1547         # Create group child object
1548         self.create_domain_group(self.ldb_admin, group_dn, "O:AUG:AUD:AI(A;;CC;;;AU)")
1549         # Make sure created group object contains only the above inherited ACE
1550         # that we've added manually
1551         desc_sddl = self.get_desc_sddl(group_dn)
1552         mod = mod.replace(";OI;", ";OIIOID;") # change it how it's gonna look like
1553         self.assertTrue(mod in desc_sddl)
1554         self.modify_desc(self.ldb_admin, group_dn, "D:" +moded)
1555         desc_sddl = self.get_desc_sddl(group_dn)
1556         self.assertTrue(moded in desc_sddl)
1557         self.assertTrue(mod in desc_sddl)
1558
1559     def test_205(self):
1560         """ OU with protected flag and add 'OA' for GUID & 'CI' ACE, child group.
1561             See if the group has the added inherited ACE.
1562         """
1563         ou_dn = "OU=test_inherit_ou," + self.base_dn
1564         group_dn = "CN=test_inherit_group," + ou_dn
1565         # Create inheritable-free OU
1566         self.create_clean_ou(ou_dn)
1567         # Add some custom 'OA' for 'name' attribute & 'CI' ACE
1568         mod = "(OA;CI;WP;bf967a0e-0de6-11d0-a285-00aa003049e2;;DU)"
1569         moded = "(D;;CC;;;LG)"
1570         self.dacl_add_ace(ou_dn, mod)
1571         desc_sddl = self.get_desc_sddl(ou_dn)
1572         # Create group child object
1573         self.create_domain_group(self.ldb_admin, group_dn, "O:AUG:AUD:AI(A;;CC;;;AU)")
1574         # Make sure created group object contains only the above inherited ACE
1575         # that we've added manually
1576         desc_sddl = self.get_desc_sddl(group_dn)
1577         mod = mod.replace(";CI;", ";CIID;") # change it how it's gonna look like
1578         self.assertTrue(mod in desc_sddl)
1579         self.modify_desc(self.ldb_admin, group_dn, "D:" + moded)
1580         desc_sddl = self.get_desc_sddl(group_dn)
1581         self.assertTrue(moded in desc_sddl)
1582         self.assertTrue(mod in desc_sddl)
1583
1584     def test_206(self):
1585         """ OU with protected flag and add 'OA' for GUID & 'OI' ACE, child group.
1586             See if the group has the added inherited ACE.
1587         """
1588         ou_dn = "OU=test_inherit_ou," + self.base_dn
1589         group_dn = "CN=test_inherit_group," + ou_dn
1590         # Create inheritable-free OU
1591         self.create_clean_ou(ou_dn)
1592         # Add some custom 'OA' for 'name' attribute & 'OI' ACE
1593         mod = "(OA;OI;WP;bf967a0e-0de6-11d0-a285-00aa003049e2;;DU)"
1594         moded = "(D;;CC;;;LG)"
1595         self.dacl_add_ace(ou_dn, mod)
1596         desc_sddl = self.get_desc_sddl(ou_dn)
1597         # Create group child object
1598         self.create_domain_group(self.ldb_admin, group_dn, "O:AUG:AUD:AI(A;;CC;;;AU)")
1599         # Make sure created group object contains only the above inherited ACE
1600         # that we've added manually
1601         desc_sddl = self.get_desc_sddl(group_dn)
1602         mod = mod.replace(";OI;", ";OIIOID;") # change it how it's gonna look like
1603         self.assertTrue(mod in desc_sddl)
1604         self.modify_desc(self.ldb_admin, group_dn, "D:" + moded)
1605         desc_sddl = self.get_desc_sddl(group_dn)
1606         self.assertTrue(moded in desc_sddl)
1607         self.assertTrue(mod in desc_sddl)
1608
1609     def test_207(self):
1610         """ OU with protected flag and add 'OA' for OU specific GUID & 'CI' ACE, child group.
1611             See if the group has the added inherited ACE.
1612         """
1613         ou_dn = "OU=test_inherit_ou," + self.base_dn
1614         group_dn = "CN=test_inherit_group," + ou_dn
1615         # Create inheritable-free OU
1616         self.create_clean_ou(ou_dn)
1617         # Add some custom 'OA' for 'st' attribute (OU specific) & 'CI' ACE
1618         mod = "(OA;CI;WP;bf967a39-0de6-11d0-a285-00aa003049e2;;DU)"
1619         moded = "(D;;CC;;;LG)"
1620         self.dacl_add_ace(ou_dn, mod)
1621         desc_sddl = self.get_desc_sddl(ou_dn)
1622         # Create group child object
1623         self.create_domain_group(self.ldb_admin, group_dn, "O:AUG:AUD:AI(A;;CC;;;AU)")
1624         # Make sure created group object contains only the above inherited ACE
1625         # that we've added manually
1626         desc_sddl = self.get_desc_sddl(group_dn)
1627         mod = mod.replace(";CI;", ";CIID;") # change it how it's gonna look like
1628         self.assertTrue(mod in desc_sddl)
1629         self.modify_desc(self.ldb_admin, group_dn, "D:" + moded)
1630         desc_sddl = self.get_desc_sddl(group_dn)
1631         self.assertTrue(moded in desc_sddl)
1632         self.assertTrue(mod in desc_sddl)
1633
1634     def test_208(self):
1635         """ OU with protected flag and add 'OA' for OU specific GUID & 'OI' ACE, child group.
1636             See if the group has the added inherited ACE.
1637         """
1638         ou_dn = "OU=test_inherit_ou," + self.base_dn
1639         group_dn = "CN=test_inherit_group," + ou_dn
1640         # Create inheritable-free OU
1641         self.create_clean_ou(ou_dn)
1642         # Add some custom 'OA' for 'st' attribute (OU specific) & 'OI' ACE
1643         mod = "(OA;OI;WP;bf967a39-0de6-11d0-a285-00aa003049e2;;DU)"
1644         moded = "(D;;CC;;;LG)"
1645         self.dacl_add_ace(ou_dn, mod)
1646         desc_sddl = self.get_desc_sddl(ou_dn)
1647         # Create group child object
1648         self.create_domain_group(self.ldb_admin, group_dn, "O:AUG:AUD:AI(A;;CC;;;AU)")
1649         # Make sure created group object contains only the above inherited ACE
1650         # that we've added manually
1651         desc_sddl = self.get_desc_sddl(group_dn)
1652         mod = mod.replace(";OI;", ";OIIOID;") # change it how it's gonna look like
1653         self.assertTrue(mod in desc_sddl)
1654         self.modify_desc(self.ldb_admin, group_dn, "D:(OA;OI;WP;bf967a39-0de6-11d0-a285-00aa003049e2;;DU)" + moded)
1655         desc_sddl = self.get_desc_sddl(group_dn)
1656         self.assertTrue(moded in desc_sddl)
1657         self.assertTrue(mod in desc_sddl)
1658
1659     def test_209(self):
1660         """ OU with protected flag and add 'CI' ACE with 'CO' SID, child group.
1661             See if the group has the added inherited ACE.
1662         """
1663         ou_dn = "OU=test_inherit_ou," + self.base_dn
1664         group_dn = "CN=test_inherit_group," + ou_dn
1665         # Create inheritable-free OU
1666         self.create_clean_ou(ou_dn)
1667         # Add some custom 'CI' ACE
1668         mod = "(D;CI;WP;;;CO)"
1669         moded = "(D;;CC;;;LG)"
1670         self.dacl_add_ace(ou_dn, mod)
1671         desc_sddl = self.get_desc_sddl(ou_dn)
1672         # Create group child object
1673         self.create_domain_group(self.ldb_admin, group_dn, "O:AUG:AUD:AI(A;;CC;;;AU)")
1674         # Make sure created group object contains only the above inherited ACE(s)
1675         # that we've added manually
1676         desc_sddl = self.get_desc_sddl(group_dn)
1677         self.assertTrue("(D;ID;WP;;;AU)" in desc_sddl)
1678         self.assertTrue("(D;CIIOID;WP;;;CO)" in desc_sddl)
1679         self.modify_desc(self.ldb_admin, group_dn, "D:" + moded)
1680         desc_sddl = self.get_desc_sddl(group_dn)
1681         self.assertTrue(moded in desc_sddl)
1682         self.assertTrue("(D;ID;WP;;;DA)" in desc_sddl)
1683         self.assertTrue("(D;CIIOID;WP;;;CO)" in desc_sddl)
1684
1685     ########################################################################################
1686
1687
1688 class SdFlagsDescriptorTests(DescriptorTests):
1689     def setUp(self):
1690         DescriptorTests.setUp(self)
1691         self.test_descr = "O:AUG:AUD:(D;;CC;;;LG)S:(OU;;WP;;;AU)"
1692
1693     def tearDown(self):
1694         self.delete_force(self.ldb_admin, "OU=test_sdflags_ou," + self.base_dn)
1695
1696     def test_301(self):
1697         """ Modify a descriptor with OWNER_SECURITY_INFORMATION set.
1698             See that only the owner has been changed.
1699         """
1700         ou_dn = "OU=test_sdflags_ou," + self.base_dn
1701         self.create_domain_ou(self.ldb_admin, ou_dn)
1702         self.modify_desc(self.ldb_admin, ou_dn, self.test_descr, controls=["sd_flags:1:%d" % (SECINFO_OWNER)])
1703         desc_sddl = self.get_desc_sddl(ou_dn)
1704         # make sure we have modified the owner
1705         self.assertTrue("O:AU" in desc_sddl)
1706         # make sure nothing else has been modified
1707         self.assertFalse("G:AU" in desc_sddl)
1708         self.assertFalse("D:(D;;CC;;;LG)" in desc_sddl)
1709         self.assertFalse("(OU;;WP;;;AU)" in desc_sddl)
1710
1711     def test_302(self):
1712         """ Modify a descriptor with GROUP_SECURITY_INFORMATION set.
1713             See that only the owner has been changed.
1714         """
1715         ou_dn = "OU=test_sdflags_ou," + self.base_dn
1716         self.create_domain_ou(self.ldb_admin, ou_dn)
1717         self.modify_desc(self.ldb_admin, ou_dn, self.test_descr, controls=["sd_flags:1:%d" % (SECINFO_GROUP)])
1718         desc_sddl = self.get_desc_sddl(ou_dn)
1719         # make sure we have modified the group
1720         self.assertTrue("G:AU" in desc_sddl)
1721         # make sure nothing else has been modified
1722         self.assertFalse("O:AU" in desc_sddl)
1723         self.assertFalse("D:(D;;CC;;;LG)" in desc_sddl)
1724         self.assertFalse("(OU;;WP;;;AU)" in desc_sddl)
1725
1726     def test_303(self):
1727         """ Modify a descriptor with SACL_SECURITY_INFORMATION set.
1728             See that only the owner has been changed.
1729         """
1730         ou_dn = "OU=test_sdflags_ou," + self.base_dn
1731         self.create_domain_ou(self.ldb_admin, ou_dn)
1732         self.modify_desc(self.ldb_admin, ou_dn, self.test_descr, controls=["sd_flags:1:%d" % (SECINFO_DACL)])
1733         desc_sddl = self.get_desc_sddl(ou_dn)
1734         # make sure we have modified the DACL
1735         self.assertTrue("(D;;CC;;;LG)" in desc_sddl)
1736         # make sure nothing else has been modified
1737         self.assertFalse("O:AU" in desc_sddl)
1738         self.assertFalse("G:AU" in desc_sddl)
1739         self.assertFalse("(OU;;WP;;;AU)" in desc_sddl)
1740
1741     def test_304(self):
1742         """ Modify a descriptor with SACL_SECURITY_INFORMATION set.
1743             See that only the owner has been changed.
1744         """
1745         ou_dn = "OU=test_sdflags_ou," + self.base_dn
1746         self.create_domain_ou(self.ldb_admin, ou_dn)
1747         self.modify_desc(self.ldb_admin, ou_dn, self.test_descr, controls=["sd_flags:1:%d" % (SECINFO_SACL)])
1748         desc_sddl = self.get_desc_sddl(ou_dn)
1749         # make sure we have modified the DACL
1750         self.assertTrue("(OU;;WP;;;AU)" in desc_sddl)
1751         # make sure nothing else has been modified
1752         self.assertFalse("O:AU" in desc_sddl)
1753         self.assertFalse("G:AU" in desc_sddl)
1754         self.assertFalse("(D;;CC;;;LG)" in desc_sddl)
1755
1756     def test_305(self):
1757         """ Modify a descriptor with 0x0 set.
1758             Contrary to logic this is interpreted as no control,
1759             which is the same as 0xF
1760         """
1761         ou_dn = "OU=test_sdflags_ou," + self.base_dn
1762         self.create_domain_ou(self.ldb_admin, ou_dn)
1763         self.modify_desc(self.ldb_admin, ou_dn, self.test_descr, controls=["sd_flags:1:0"])
1764         desc_sddl = self.get_desc_sddl(ou_dn)
1765         # make sure we have modified the DACL
1766         self.assertTrue("(OU;;WP;;;AU)" in desc_sddl)
1767         # make sure nothing else has been modified
1768         self.assertTrue("O:AU" in desc_sddl)
1769         self.assertTrue("G:AU" in desc_sddl)
1770         self.assertTrue("(D;;CC;;;LG)" in desc_sddl)
1771
1772     def test_306(self):
1773         """ Modify a descriptor with 0xF set.
1774         """
1775         ou_dn = "OU=test_sdflags_ou," + self.base_dn
1776         self.create_domain_ou(self.ldb_admin, ou_dn)
1777         self.modify_desc(self.ldb_admin, ou_dn, self.test_descr, controls=["sd_flags:1:15"])
1778         desc_sddl = self.get_desc_sddl(ou_dn)
1779         # make sure we have modified the DACL
1780         self.assertTrue("(OU;;WP;;;AU)" in desc_sddl)
1781         # make sure nothing else has been modified
1782         self.assertTrue("O:AU" in desc_sddl)
1783         self.assertTrue("G:AU" in desc_sddl)
1784         self.assertTrue("(D;;CC;;;LG)" in desc_sddl)
1785
1786     def test_307(self):
1787         """ Read a descriptor with OWNER_SECURITY_INFORMATION
1788             Only the owner part should be returned.
1789         """
1790         ou_dn = "OU=test_sdflags_ou," + self.base_dn
1791         self.create_domain_ou(self.ldb_admin, ou_dn)
1792         desc_sddl = self.get_desc_sddl(ou_dn, controls=["sd_flags:1:%d" % (SECINFO_OWNER)])
1793         # make sure we have read the owner
1794         self.assertTrue("O:" in desc_sddl)
1795         # make sure we have read nothing else
1796         self.assertFalse("G:" in desc_sddl)
1797         self.assertFalse("D:" in desc_sddl)
1798         self.assertFalse("S:" in desc_sddl)
1799
1800     def test_308(self):
1801         """ Read a descriptor with GROUP_SECURITY_INFORMATION
1802             Only the group part should be returned.
1803         """
1804         ou_dn = "OU=test_sdflags_ou," + self.base_dn
1805         self.create_domain_ou(self.ldb_admin, ou_dn)
1806         desc_sddl = self.get_desc_sddl(ou_dn, controls=["sd_flags:1:%d" % (SECINFO_GROUP)])
1807         # make sure we have read the owner
1808         self.assertTrue("G:" in desc_sddl)
1809         # make sure we have read nothing else
1810         self.assertFalse("O:" in desc_sddl)
1811         self.assertFalse("D:" in desc_sddl)
1812         self.assertFalse("S:" in desc_sddl)
1813
1814     def test_309(self):
1815         """ Read a descriptor with SACL_SECURITY_INFORMATION
1816             Only the sacl part should be returned.
1817         """
1818         ou_dn = "OU=test_sdflags_ou," + self.base_dn
1819         self.create_domain_ou(self.ldb_admin, ou_dn)
1820         desc_sddl = self.get_desc_sddl(ou_dn, controls=["sd_flags:1:%d" % (SECINFO_SACL)])
1821         # make sure we have read the owner
1822         self.assertTrue("S:" in desc_sddl)
1823         # make sure we have read nothing else
1824         self.assertFalse("O:" in desc_sddl)
1825         self.assertFalse("D:" in desc_sddl)
1826         self.assertFalse("G:" in desc_sddl)
1827
1828     def test_310(self):
1829         """ Read a descriptor with DACL_SECURITY_INFORMATION
1830             Only the dacl part should be returned.
1831         """
1832         ou_dn = "OU=test_sdflags_ou," + self.base_dn
1833         self.create_domain_ou(self.ldb_admin, ou_dn)
1834         desc_sddl = self.get_desc_sddl(ou_dn, controls=["sd_flags:1:%d" % (SECINFO_DACL)])
1835         # make sure we have read the owner
1836         self.assertTrue("D:" in desc_sddl)
1837         # make sure we have read nothing else
1838         self.assertFalse("O:" in desc_sddl)
1839         self.assertFalse("S:" in desc_sddl)
1840         self.assertFalse("G:" in desc_sddl)
1841
1842 class RightsAttributesTests(DescriptorTests):
1843
1844     def setUp(self):
1845         DescriptorTests.setUp(self)
1846         if self.SAMBA:
1847             ### Create users
1848             # User 1
1849             user_dn = self.get_users_domain_dn("testuser_attr")
1850             self.create_domain_user(self.ldb_admin, user_dn)
1851             self.enable_account(user_dn)
1852         # User 2, Domain Admins
1853             user_dn = self.get_users_domain_dn("testuser_attr2")
1854             self.create_domain_user(self.ldb_admin, user_dn)
1855             self.enable_account(user_dn)
1856             ldif = """
1857 dn: CN=Domain Admins,CN=Users,""" + self.base_dn + """
1858 changetype: add
1859 member: """ + user_dn
1860             self.ldb_admin.modify_ldif(ldif)
1861
1862     def tearDown(self):
1863
1864         if self.SAMBA:
1865            self.delete_force(self.ldb_admin, self.get_users_domain_dn("testuser_attr"))
1866            self.delete_force(self.ldb_admin, self.get_users_domain_dn("testuser_attr2"))
1867
1868         self.delete_force(self.ldb_admin, "OU=test_domain_ou1," + self.base_dn)
1869
1870     def test_sDRightsEffective(self):
1871         object_dn = "OU=test_domain_ou1," + self.base_dn
1872         self.delete_force(self.ldb_admin, object_dn)
1873         self.create_domain_ou(self.ldb_admin, object_dn)
1874         print self.get_users_domain_dn("testuser_attr")
1875         user_sid = self.get_object_sid(self.get_users_domain_dn("testuser_attr"))
1876         #give testuser1 read access so attributes can be retrieved
1877         mod = "(A;CI;RP;;;%s)" % str(user_sid)
1878         self.dacl_add_ace(object_dn, mod)
1879         _ldb = self.get_ldb_connection("testuser_attr", "samba123@")
1880         res = _ldb.search(base=object_dn, expression="", scope=SCOPE_BASE,
1881                          attrs=["sDRightsEffective"])
1882         #user whould have no rights at all
1883         self.assertEquals(len(res), 1)
1884         self.assertEquals(res[0]["sDRightsEffective"][0], "0")
1885         #give the user Write DACL and see what happens
1886         mod = "(A;CI;WD;;;%s)" % str(user_sid)
1887         self.dacl_add_ace(object_dn, mod)
1888         res = _ldb.search(base=object_dn, expression="", scope=SCOPE_BASE,
1889                          attrs=["sDRightsEffective"])
1890         #user whould have DACL_SECURITY_INFORMATION
1891         self.assertEquals(len(res), 1)
1892         self.assertEquals(res[0]["sDRightsEffective"][0], ("%d") % SECINFO_DACL)
1893         #give the user Write Owners and see what happens
1894         mod = "(A;CI;WO;;;%s)" % str(user_sid)
1895         self.dacl_add_ace(object_dn, mod)
1896         res = _ldb.search(base=object_dn, expression="", scope=SCOPE_BASE,
1897                          attrs=["sDRightsEffective"])
1898         #user whould have DACL_SECURITY_INFORMATION, OWNER_SECURITY_INFORMATION, GROUP_SECURITY_INFORMATION
1899         self.assertEquals(len(res), 1)
1900         self.assertEquals(res[0]["sDRightsEffective"][0], ("%d") % (SECINFO_DACL | SECINFO_GROUP | SECINFO_OWNER))
1901         #no way to grant security privilege bu adding ACE's so we use a memeber of Domain Admins
1902         _ldb = self.get_ldb_connection("testuser_attr2", "samba123@")
1903         res = _ldb.search(base=object_dn, expression="", scope=SCOPE_BASE,
1904                          attrs=["sDRightsEffective"])
1905         #user whould have DACL_SECURITY_INFORMATION, OWNER_SECURITY_INFORMATION, GROUP_SECURITY_INFORMATION
1906         self.assertEquals(len(res), 1)
1907         self.assertEquals(res[0]["sDRightsEffective"][0], \
1908                           ("%d") % (SECINFO_DACL | SECINFO_GROUP | SECINFO_OWNER | SECINFO_SACL))
1909
1910     def test_allowedChildClassesEffective(self):
1911         object_dn = "OU=test_domain_ou1," + self.base_dn
1912         self.delete_force(self.ldb_admin, object_dn)
1913         self.create_domain_ou(self.ldb_admin, object_dn)
1914         user_sid = self.get_object_sid(self.get_users_domain_dn("testuser_attr"))
1915         #give testuser1 read access so attributes can be retrieved
1916         mod = "(A;CI;RP;;;%s)" % str(user_sid)
1917         self.dacl_add_ace(object_dn, mod)
1918         _ldb = self.get_ldb_connection("testuser_attr", "samba123@")
1919         res = _ldb.search(base=object_dn, expression="", scope=SCOPE_BASE,
1920                          attrs=["allowedChildClassesEffective"])
1921         #there should be no allowed child classes
1922         self.assertEquals(len(res), 1)
1923         self.assertFalse("allowedChildClassesEffective" in res[0].keys())
1924         #give the user the right to create children of type user
1925         mod = "(OA;CI;CC;bf967aba-0de6-11d0-a285-00aa003049e2;;%s)" % str(user_sid)
1926         self.dacl_add_ace(object_dn, mod)
1927         res = _ldb.search(base=object_dn, expression="", scope=SCOPE_BASE,
1928                          attrs=["allowedChildClassesEffective"])
1929         # allowedChildClassesEffective should only have one value, user
1930         self.assertEquals(len(res), 1)
1931         self.assertEquals(len(res[0]["allowedChildClassesEffective"]), 1)
1932         self.assertEquals(res[0]["allowedChildClassesEffective"][0], "user")
1933
1934     def test_allowedAttributesEffective(self):
1935         object_dn = "OU=test_domain_ou1," + self.base_dn
1936         self.delete_force(self.ldb_admin, object_dn)
1937         self.create_domain_ou(self.ldb_admin, object_dn)
1938         user_sid = self.get_object_sid(self.get_users_domain_dn("testuser_attr"))
1939         #give testuser1 read access so attributes can be retrieved
1940         mod = "(A;CI;RP;;;%s)" % str(user_sid)
1941         self.dacl_add_ace(object_dn, mod)
1942         _ldb = self.get_ldb_connection("testuser_attr", "samba123@")
1943         #res = _ldb.search(base=object_dn, expression="", scope=SCOPE_BASE,
1944         #                 attrs=["allowedAttributes"])
1945         #print res
1946         res = _ldb.search(base=object_dn, expression="", scope=SCOPE_BASE,
1947                          attrs=["allowedAttributesEffective"])
1948         #there should be no allowed attributes
1949         self.assertEquals(len(res), 1)
1950         self.assertFalse("allowedAttributesEffective" in res[0].keys())
1951         #give the user the right to write displayName and managedBy
1952         mod2 = "(OA;CI;WP;bf967953-0de6-11d0-a285-00aa003049e2;;%s)" % str(user_sid)
1953         mod = "(OA;CI;WP;0296c120-40da-11d1-a9c0-0000f80367c1;;%s)" % str(user_sid)
1954         # also rights to modify an read only attribute, fromEntry
1955         mod3 = "(OA;CI;WP;9a7ad949-ca53-11d1-bbd0-0080c76670c0;;%s)" % str(user_sid)
1956         self.dacl_add_ace(object_dn, mod + mod2 + mod3)
1957         res = _ldb.search(base=object_dn, expression="", scope=SCOPE_BASE,
1958                          attrs=["allowedAttributesEffective"])
1959         # value should only contain user and managedBy
1960         print res
1961         self.assertEquals(len(res), 1)
1962         self.assertEquals(len(res[0]["allowedAttributesEffective"]), 2)
1963         self.assertTrue("displayName" in res[0]["allowedAttributesEffective"])
1964         self.assertTrue("managedBy" in res[0]["allowedAttributesEffective"])
1965
1966 if not "://" in host:
1967     host = "ldap://%s" % host
1968 ldb = Ldb(host, credentials=creds, session_info=system_session(), lp=lp, options=["modules:paged_searches"])
1969
1970 runner = SubunitTestRunner()
1971 rc = 0
1972 if not runner.run(unittest.makeSuite(OwnerGroupDescriptorTests)).wasSuccessful():
1973     rc = 1
1974 if not runner.run(unittest.makeSuite(DaclDescriptorTests)).wasSuccessful():
1975     rc = 1
1976 if not runner.run(unittest.makeSuite(SdFlagsDescriptorTests)).wasSuccessful():
1977     rc = 1
1978 if not runner.run(unittest.makeSuite(RightsAttributesTests)).wasSuccessful():
1979     rc = 1
1980 sys.exit(rc)