nsswitch/tests/test_idmap_ad.sh

   1 #!/bin/sh
   2 #
   3 # Basic testing of id mapping with idmap_ad
   4 #
   5
   6 if [ $# -ne 6 ]; then
   7         echo Usage: $0 DOMAIN DC_SERVER DC_PASSWORD TRUST_DOMAIN TRUST_SERVER TRUST_PASSWORD
   8         exit 1
   9 fi
  10
  11 DOMAIN="$1"
  12 DC_SERVER="$2"
  13 DC_PASSWORD="$3"
  14 TRUST_DOMAIN="$4"
  15 TRUST_SERVER="$5"
  16 TRUST_PASSWORD="$6"
  17
  18 wbinfo="$VALGRIND $BINDIR/wbinfo"
  19 ldbmodify="${VALGRIND} ldbmodify"
  20 if [ -x "${BINDIR}/ldbmodify" ]; then
  21         ldbmodify="${VALGRIND} ${BINDIR}/ldbmodify"
  22 fi
  23
  24 ldbsearch="${VALGRIND} ldbsearch"
  25 if [ -x "${BINDIR}/ldbsearch" ]; then
  26         ldbsearch="${VALGRIND} ${BINDIR}/ldbsearch"
  27 fi
  28
  29 failed=0
  30
  31 . $(dirname $0)/../../testprogs/blackbox/subunit.sh
  32
  33 DOMAIN_SID=$($wbinfo -n "$DOMAIN/" | cut -f 1 -d " ")
  34 if [ $? -ne 0 ]; then
  35         echo "Could not find domain SID" | subunit_fail_test "test_idmap_ad"
  36         exit 1
  37 fi
  38
  39 TRUST_DOMAIN_SID=$($wbinfo -n "$TRUST_DOMAIN/" | cut -f 1 -d " ")
  40 if [ $? -ne 0 ]; then
  41         echo "Could not find trusted domain SID" | subunit_fail_test "test_idmap_ad"
  42         exit 1
  43 fi
  44
  45 BASE_DN=$($ldbsearch -H ldap://$DC_SERVER -b "" --scope=base defaultNamingContext | awk '/^defaultNamingContext/ {print $2}')
  46 if [ $? -ne 0 ]; then
  47         echo "Could not find base DN" | subunit_fail_test "test_idmap_ad"
  48         exit 1
  49 fi
  50
  51 TRUST_BASE_DN=$($ldbsearch -H ldap://$TRUST_SERVER -b "" --scope=base defaultNamingContext | awk '/^defaultNamingContext/ {print $2}')
  52 if [ $? -ne 0 ]; then
  53         echo "Could not find trusted base DN" | subunit_fail_test "test_idmap_ad"
  54         exit 1
  55 fi
  56
  57 #
  58 # Add POSIX ids to AD
  59 #
  60 cat <<EOF | $ldbmodify -H ldap://$DC_SERVER -U "$DOMAIN\Administrator%$DC_PASSWORD"
  61 dn: CN=Administrator,CN=Users,$BASE_DN
  62 changetype: modify
  63 add: uidNumber
  64 uidNumber: 2000000
  65 add: gidNumber
  66 gidNumber: 2000100
  67 add: unixHomeDirectory
  68 unixHomeDirectory: /home/admin
  69 add: loginShell
  70 loginShell: /bin/tcsh
  71 add: gecos
  72 gecos: Administrator Full Name
  73
  74 dn: CN=Domain Users,CN=Users,$BASE_DN
  75 changetype: modify
  76 add: gidNumber
  77 gidNumber: 2000001
  78
  79 dn: CN=Domain Admins,CN=Users,$BASE_DN
  80 changetype: modify
  81 add: gidNumber
  82 gidNumber: 2000002
  83
  84 dn: ou=sub,$BASE_DN
  85 changetype: add
  86 objectClass: organizationalUnit
  87
  88 dn: cn=forbidden,ou=sub,$BASE_DN
  89 changetype: add
  90 objectClass: user
  91 samaccountName: forbidden
  92 uidNumber: 2000003
  93 gidNumber: 2000001
  94 unixHomeDirectory: /home/forbidden
  95 loginShell: /bin/tcsh
  96 gecos: User in forbidden OU
  97
  98 dn: CN=no_posix_id,CN=Users,$BASE_DN
  99 changetype: add
 100 objectClass: user
 101 samaccountName: no_posix_id
 102 unixHomeDirectory: /home/no_posix_id
 103 loginShell: /bin/sh
 104 gecos: User without uidNumber and gidNumber
 105 EOF
 106
 107 #
 108 # Add POSIX ids to trusted domain
 109 #
 110 cat <<EOF | $ldbmodify -H ldap://$TRUST_SERVER \
 111         -U "$TRUST_DOMAIN\Administrator%$TRUST_PASSWORD"
 112 dn: CN=Administrator,CN=Users,$TRUST_BASE_DN
 113 changetype: modify
 114 add: uidNumber
 115 uidNumber: 2500000
 116
 117 dn: CN=Domain Users,CN=Users,$TRUST_BASE_DN
 118 changetype: modify
 119 add: gidNumber
 120 gidNumber: 2500001
 121
 122 dn: CN=Domain Admins,CN=Users,$TRUST_BASE_DN
 123 changetype: modify
 124 add: gidNumber
 125 gidNumber: 2500002
 126 EOF
 127
 128 #
 129 # Test 1: Test uid of Administrator, should be 2000000
 130 #
 131
 132 out="$($wbinfo -S $DOMAIN_SID-500)"
 133 echo "wbinfo returned: \"$out\", expecting \"2000000\""
 134 test "$out" = "2000000"
 135 ret=$?
 136 testit "Test uid of Administrator is 2000000" test $ret -eq 0 || failed=$(expr $failed + 1)
 137
 138 #
 139 # Test 2: Test gid of Domain Users, should be 2000001
 140 #
 141
 142 out="$($wbinfo -Y $DOMAIN_SID-513)"
 143 echo "wbinfo returned: \"$out\", expecting \"2000001\""
 144 test "$out" = "2000001"
 145 ret=$?
 146 testit "Test uid of Domain Users is 2000001" test $ret -eq 0 || failed=$(expr $failed + 1)
 147
 148 #
 149 # Test 3: Test get userinfo for Administrator works
 150 #
 151
 152 out="$($wbinfo -i $DOMAIN/Administrator)"
 153 echo "wbinfo returned: \"$out\", expecting \"$DOMAIN/administrator:*:2000000:2000100:Administrator Full Name:/home/admin:/bin/tcsh\""
 154 test "$out" = "$DOMAIN/administrator:*:2000000:2000100:Administrator Full Name:/home/admin:/bin/tcsh"
 155 ret=$?
 156 testit "Test get userinfo for Administrator works" test $ret -eq 0 || failed=$(expr $failed + 1)
 157
 158 #
 159 # Test 4: Test lookup from gid to sid
 160 #
 161
 162 out="$($wbinfo -G 2000002)"
 163 echo "wbinfo returned: \"$out\", expecting \"$DOMAIN_SID-512\""
 164 test "$out" = "$DOMAIN_SID-512"
 165 ret=$?
 166 testit "Test gid lookup of Domain Admins" test $ret -eq 0 || failed=$(expr $failed + 1)
 167
 168 #
 169 # Test 5: Make sure deny_ou is really denied
 170 # This depends on the "deny ous" setting in Samba3.pm
 171 #
 172
 173 sid="$($wbinfo -n $DOMAIN/forbidden | awk '{print $1}')"
 174 testit "Could create forbidden" test -n "$sid" || failed=$(expr $failed + 1)
 175 if [ -n "$sid" ]
 176 then
 177     uid="$($wbinfo --sid-to-uid $sid)"
 178     testit "Can not resolve forbidden user" test -z "$uid" ||
 179         failed=$(($failed + 1))
 180 fi
 181
 182 #
 183 # Test 6: Make sure that with the default "all_groups=no"
 184 # the group "domain users" will not show user "no_posix_id"
 185 # but will show "SAMBA2008R2/administrator"
 186 #
 187
 188 dom_users="$DOMAIN/domain users"  # Extra step to make sure that all is one word
 189 out="$($wbinfo --group-info "$dom_users")"
 190 testit_grep_count "no_posix_id1" "no_posix_id" 0 echo "$out" || failed=$(expr $failed + 1)
 191 testit_grep "no_posix_id2" "SAMBA2008R2/administrator" echo "$out" || failed=$(expr $failed + 1)
 192
 193 #
 194 # Trusted domain test 1: Test uid of Administrator, should be 2500000
 195 #
 196
 197 out="$($wbinfo -S $TRUST_DOMAIN_SID-500)"
 198 echo "wbinfo returned: \"$out\", expecting \"2500000\""
 199 test "$out" = "2500000"
 200 ret=$?
 201 testit "Test uid of Administrator in trusted domain is 2500000" test $ret -eq 0 || failed=$(expr $failed + 1)
 202
 203 #
 204 # Trusted domain test 2: Test gid of Domain Users, should be 2500001
 205 #
 206
 207 out="$($wbinfo -Y $TRUST_DOMAIN_SID-513)"
 208 echo "wbinfo returned: \"$out\", expecting \"2500001\""
 209 test "$out" = "2500001"
 210 ret=$?
 211 testit "Test uid of Domain Users in trusted domain is 2500001" test $ret -eq 0 || failed=$(expr $failed + 1)
 212
 213 #
 214 # Trusted domain test 3: Test get userinfo for Administrator works
 215 #
 216
 217 out="$($wbinfo -i $TRUST_DOMAIN/Administrator)"
 218 echo "wbinfo returned: \"$out\", expecting \"$TRUST_DOMAIN/administrator:*:2500000:2500001::/home/$TRUST_DOMAIN/administrator:/bin/false\""
 219 test "$out" = "$TRUST_DOMAIN/administrator:*:2500000:2500001::/home/$TRUST_DOMAIN/administrator:/bin/false"
 220 ret=$?
 221 testit "Test get userinfo for Administrator works" test $ret -eq 0 || failed=$(expr $failed + 1)
 222
 223 #
 224 # Trusted domain test 4: Test lookup from gid to sid
 225 #
 226
 227 out="$($wbinfo -G 2500002)"
 228 echo "wbinfo returned: \"$out\", expecting \"$TRUST_DOMAIN_SID-512\""
 229 test "$out" = "$TRUST_DOMAIN_SID-512"
 230 ret=$?
 231 testit "Test gid lookup of Domain Admins in trusted domain." test $ret -eq 0 || failed=$(expr $failed + 1)
 232
 233 #
 234 # Remove POSIX ids from AD
 235 #
 236 cat <<EOF | $ldbmodify -H ldap://$DC_SERVER -U "$DOMAIN\Administrator%$DC_PASSWORD"
 237 dn: CN=Administrator,CN=Users,$BASE_DN
 238 changetype: modify
 239 delete: uidNumber
 240 uidNumber: 2000000
 241 delete: gidNumber
 242 gidNumber: 2000100
 243 delete: unixHomeDirectory
 244 unixHomeDirectory: /home/admin
 245 delete: loginShell
 246 loginShell: /bin/tcsh
 247 delete: gecos
 248 gecos: Administrator Full Name
 249
 250 dn: CN=Domain Users,CN=Users,$BASE_DN
 251 changetype: modify
 252 delete: gidNumber
 253 gidNumber: 2000001
 254
 255 dn: CN=Domain Admins,CN=Users,$BASE_DN
 256 changetype: modify
 257 delete: gidNumber
 258 gidNumber: 2000002
 259
 260 dn: cn=forbidden,ou=sub,$BASE_DN
 261 changetype: delete
 262
 263 dn: CN=no_posix_id,CN=Users,$BASE_DN
 264 changetype: delete
 265
 266 dn: ou=sub,$BASE_DN
 267 changetype: delete
 268 EOF
 269
 270 #
 271 # Remove POSIX ids from trusted domain
 272 #
 273 cat <<EOF | $ldbmodify -H ldap://$TRUST_SERVER \
 274         -U "$TRUST_DOMAIN\Administrator%$TRUST_PASSWORD"
 275 dn: CN=Administrator,CN=Users,$TRUST_BASE_DN
 276 changetype: modify
 277 delete: uidNumber
 278 uidNumber: 2500000
 279
 280 dn: CN=Domain Users,CN=Users,$TRUST_BASE_DN
 281 changetype: modify
 282 delete: gidNumber
 283 gidNumber: 2500001
 284
 285 dn: CN=Domain Admins,CN=Users,$TRUST_BASE_DN
 286 changetype: modify
 287 delete: gidNumber
 288 gidNumber: 2500002
 289 EOF
 290
 291 exit $failed