python/samba/tests/dsdb_quiet_provision_tests.py

   1 # Unix SMB/CIFS implementation. Tests for dsdb
   2 # Copyright (C) Matthieu Patou <mat@matws.net> 2010
   3 #
   4 # This program is free software; you can redistribute it and/or modify
   5 # it under the terms of the GNU General Public License as published by
   6 # the Free Software Foundation; either version 3 of the License, or
   7 # (at your option) any later version.
   8 #
   9 # This program is distributed in the hope that it will be useful,
  10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12 # GNU General Public License for more details.
  13 #
  14 # You should have received a copy of the GNU General Public License
  15 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  16 #
  17
  18 """These tests want to be run on a freshly provisioned domain that has
  19 not been greatly modified by other tests (which at the time of writing
  20 probably means 'chgdcpass').
  21
  22 Tests here should only read the database.
  23
  24 This is to avoid flapping tests.
  25 """
  26
  27 from samba.credentials import Credentials
  28 from samba.samdb import SamDB
  29 from samba.auth import system_session
  30 from samba.tests import TestCase
  31 from samba.gkdi import (
  32     KEY_CYCLE_DURATION,
  33     MAX_CLOCK_SKEW
  34 )
  35 from samba.nt_time import nt_now
  36 import ldb
  37 import samba
  38
  39
  40 class DsdbQuietProvisionTests(TestCase):
  41
  42     @classmethod
  43     def setUpClass(cls):
  44         super().setUpClass()
  45         cls.lp = samba.tests.env_loadparm()
  46         cls.creds = Credentials()
  47         cls.creds.guess(cls.lp)
  48         cls.session = system_session()
  49         cls.samdb = SamDB(session_info=cls.session,
  50                           credentials=cls.creds,
  51                           lp=cls.lp)
  52
  53     def test_dsdb_dn_gkdi_gmsa_root_keys_exist(self):
  54         """In provision we set up a GKDI root key.
  55
  56         There should always be at least one that is already valid
  57         """
  58         current_time = nt_now()
  59         # We need the GKDI key to be already available for use
  60         min_use_start_time = current_time \
  61             - KEY_CYCLE_DURATION - MAX_CLOCK_SKEW
  62
  63         dn = self.samdb.get_config_basedn()
  64         dn.add_child("CN=Master Root Keys,CN=Group Key Distribution Service,CN=Services")
  65         res = self.samdb.search(dn,
  66                                 scope=ldb.SCOPE_SUBTREE,
  67                                 expression=f"(&(objectClass = msKds-ProvRootKey)(msKds-UseStartTime<={min_use_start_time}))")
  68
  69         self.assertGreater(len(res), 0)
  70
  71     def test_dsdb_smartcard_expire_set(self):
  72         """In provision we set msDS-ExpirePasswordsOnSmartCardOnlyAccounts: TRUE for a new 2016 provision
  73         """
  74         dn = self.samdb.get_default_basedn()
  75         res = self.samdb.search(dn,
  76                                 scope=ldb.SCOPE_BASE,
  77                                 expression="(msDS-ExpirePasswordsOnSmartCardOnlyAccounts=TRUE)")
  78
  79         self.assertEqual(len(res), 1)