nsswitch/tests/test_idmap_rfc2307.sh

   1 #!/bin/sh
   2 # Test id mapping through idmap_rfc2307 module
   3 if [ $# -lt 15 ]; then
   4     echo Usage: $0 DOMAIN USERNAME UID USERNAME2 UID2 \
   5          GROUPNAME GID GROUPNAME2 GID2 GID_START NUMGROUPS \
   6          LDAPPREFIX DC_SERVER DC_USERNAME DC_PASSWORD
   7         exit 1
   8 fi
   9
  10 DOMAIN="$1"
  11 USERNAME="$2"
  12 USERUID="$3"
  13 USERNAME2="$4"
  14 USERUID2="$5"
  15 GROUPNAME="$6"
  16 GROUPGID="$7"
  17 GROUPNAME2="$8"
  18 GROUPGID2="$9"
  19 shift 9
  20 GID_START="$1"
  21 NUMGROUPS="$2"
  22 LDAPPREFIX="$3"
  23 DC_SERVER="$4"
  24 DC_USERNAME="$5"
  25 DC_PASSWORD="$6"
  26
  27 wbinfo="$VALGRIND $BINDIR/wbinfo"
  28 net="$VALGRIND $BINDIR/net"
  29
  30 ldbsearch="ldbsearch"
  31 if [ -x "$BINDIR/ldbsearch" ]; then
  32         ldbsearch="$BINDIR/ldbsearch"
  33 fi
  34
  35 ldbadd="ldbadd"
  36 if [ -x "$BINDIR/ldbadd" ]; then
  37         ldbadd="$BINDIR/ldbadd"
  38 fi
  39
  40 ldbdel="ldbdel"
  41 if [ -x "$BINDIR/ldbdel" ]; then
  42         ldbdel="$BINDIR/ldbdel"
  43 fi
  44
  45 failed=0
  46
  47 . `dirname $0`/../../testprogs/blackbox/subunit.sh
  48
  49 # Delete LDAP records
  50 $VALGRIND $ldbsearch -H ldap://$DC_SERVER -U$DOMAIN/$DC_USERNAME%$DC_PASSWORD \
  51           -s one -b "$LDAPPREFIX" | grep '^dn:' | cut -d ' ' -f 2- |
  52     xargs -d '\n' -n 1 -IDEL_DN \
  53           $ldbdel -H ldap://$DC_SERVER -U$DOMAIN/$DC_USERNAME%$DC_PASSWORD \
  54           "DEL_DN"
  55 $VALGRIND $ldbdel -H ldap://$DC_SERVER -U$DOMAIN/$DC_USERNAME%$DC_PASSWORD "$LDAPPREFIX"
  56
  57 # Add id mapping information to LDAP
  58
  59 testit "add ldap prefix" $VALGRIND $ldbadd -H ldap://$DC_SERVER \
  60         -U$DOMAIN/$DC_USERNAME%$DC_PASSWORD <<EOF
  61 dn: $LDAPPREFIX
  62 objectclass: organizationalUnit
  63 EOF
  64
  65 testit "add ldap user mapping record" $VALGRIND $ldbadd -H ldap://$DC_SERVER \
  66         -U$DOMAIN/$DC_USERNAME%$DC_PASSWORD <<EOF
  67 dn: cn=$USERNAME,$LDAPPREFIX
  68 objectClass: organizationalPerson
  69 objectClass: posixAccount
  70 ou: People
  71 cn: $USERNAME
  72 uid: $USERNAME
  73 uidNumber: $USERUID
  74 gidNumber: 1
  75 homeDirectory: /home/admin
  76 EOF
  77
  78 testit "add second ldap user mapping record" $VALGRIND $ldbadd \
  79        -H ldap://$DC_SERVER -U$DOMAIN/$DC_USERNAME%$DC_PASSWORD <<EOF
  80 dn: cn=$USERNAME2,$LDAPPREFIX
  81 objectClass: organizationalPerson
  82 objectClass: posixAccount
  83 ou: People
  84 cn: $USERNAME2
  85 uid: $USERNAME2
  86 uidNumber: $USERUID2
  87 gidNumber: 2
  88 homeDirectory: /home/admin
  89 EOF
  90
  91 testit "add ldap group mapping record" $VALGRIND $ldbadd \
  92        -H ldap://$DC_SERVER -U$DOMAIN/$DC_USERNAME%$DC_PASSWORD <<EOF
  93 dn: cn=$GROUPNAME,$LDAPPREFIX
  94 objectClass: posixGroup
  95 objectClass: groupOfNames
  96 cn: $GROUPNAME
  97 gidNumber: $GROUPGID
  98 member: cn=$USERNAME,$LDAPPREFIX
  99 EOF
 100
 101 testit "add second ldap group mapping record" $VALGRIND $ldbadd \
 102        -H ldap://$DC_SERVER -U$DOMAIN/$DC_USERNAME%$DC_PASSWORD <<EOF
 103 dn: cn=$GROUPNAME2,$LDAPPREFIX
 104 objectClass: posixGroup
 105 objectClass: groupOfNames
 106 cn: $GROUPNAME2
 107 gidNumber: $GROUPGID2
 108 member: cn=$USERNAME,$LDAPPREFIX
 109 EOF
 110
 111 testit "wbinfo --name-to-sid" $wbinfo --name-to-sid "$DOMAIN/$USERNAME" || failed=$(expr $failed + 1)
 112 user_sid=$($wbinfo -n "$DOMAIN/$USERNAME" | cut -d " " -f1)
 113 echo "$DOMAIN/$USERNAME resolved to $user_sid"
 114
 115 testit "wbinfo --sid-to-uid=$user_sid" $wbinfo --sid-to-uid=$user_sid || failed=$(expr $failed + 1)
 116 user_uid=$($wbinfo --sid-to-uid=$user_sid | cut -d " " -f1)
 117 echo "$DOMAIN/$USERNAME resolved to $user_uid"
 118
 119 testit "test $user_uid -eq $USERUID" test $user_uid -eq $USERUID || failed=$(expr $failed + 1)
 120
 121 # Not sure how to get group names with spaces to resolve through testit
 122 #testit "wbinfo --name-to-sid" $wbinfo --name-to-sid="$DOMAIN/$GROUPNAME" || failed=$(expr $failed + 1)
 123 group_sid=$($wbinfo --name-to-sid="$DOMAIN/$GROUPNAME" | cut -d " " -f1)
 124 echo "$DOMAIN/$GROUPNAME resolved to $group_sid"
 125
 126 testit "wbinfo --sid-to-gid=$group_sid" $wbinfo --sid-to-gid=$group_sid || failed=$(expr $failed + 1)
 127 group_gid=$($wbinfo --sid-to-gid=$group_sid | cut -d " " -f1)
 128 echo "$DOMAIN/$GROUPNAME resolved to $group_gid"
 129
 130 testit "test $group_gid -eq $GROUPGID" test $group_gid -eq $GROUPGID || failed=$(expr $failed + 1)
 131
 132 # Use different user and group for reverse lookup to not read from cache
 133
 134 testit "$wbinfo --uid-to-sid=$USERUID2" $wbinfo --uid-to-sid=$USERUID2 || failed=$(expr $failed + 1)
 135 user_sid2=$($wbinfo --uid-to-sid=$USERUID2 | cut -d " " -f1)
 136 echo "UID $USERUID2 resolved to SID $user_sid2"
 137
 138 testit "$wbinfo --sid-to-name=$user_sid2" $wbinfo --sid-to-name=$user_sid2 || failed=$(expr $failed + 1)
 139 user_name2=$($wbinfo --sid-to-name=$user_sid2 | cut -d " " -f1)
 140 echo "SID $user_sid2 resolved to $user_name2"
 141
 142 testit "test $user_name2 = $DOMAIN/$USERNAME2" test "$(echo $user_name2 | tr A-Z a-z)" = "$(echo $DOMAIN/$USERNAME2 | tr A-Z a-z)" || failed=$(expr $failed + 1)
 143
 144 testit "$wbinfo --gid-to-sid=$GROUPGID2" $wbinfo --gid-to-sid=$GROUPGID2 || failed=$(expr $failed + 1)
 145 group_sid2=$($wbinfo --gid-to-sid=$GROUPGID2 | cut -d " " -f1)
 146 echo "GID $GROUPGID2 resolved to SID $group_sid2"
 147
 148 testit "$wbinfo --sid-to-name=$group_sid2" $wbinfo --sid-to-name=$group_sid2 || failed=$(expr $failed + 1)
 149 group_name2=$($wbinfo --sid-to-name=$group_sid2 | cut -d " " -f1)
 150 echo "SID $group_sid2 resolved to $group_name2"
 151
 152 testit "test $group_name2 = $DOMAIN/$GROUPNAME2" test "$(echo $group_name2 | tr A-Z a-z)" = "$(echo $DOMAIN/$GROUPNAME2 | tr A-Z a-z)" || failed=$(expr $failed + 1)
 153
 154 i=0
 155 while [ ${i} -lt ${NUMGROUPS} ] ; do
 156     GRP=$(printf "test_rfc2307_group_%3.3d" "$i")
 157     GRP_GID=$(expr "$GID_START" + "$i")
 158     testit "Add group $GRP" $net rpc group add "$GRP" -S "$DC_SERVER" \
 159            -U"${DOMAIN}\\${DC_USERNAME}"%"${DC_PASSWORD}" ||
 160         failed=$(expr $failed + 1)
 161     testit "Add groupmem $GRP $USERNAME" \
 162            $net rpc group addmem "$GRP" "$USERNAME" \
 163            -S "$DC_SERVER" \
 164            -U"${DOMAIN}\\${DC_USERNAME}"%"${DC_PASSWORD}" ||
 165         failed=$(expr $failed + 1)
 166     testit "Add group object for $GRP $GRP_GID" \
 167            $VALGRIND $ldbadd \
 168        -H ldap://$DC_SERVER -U$DOMAIN/$DC_USERNAME%$DC_PASSWORD <<EOF
 169 dn: cn=$GRP,$LDAPPREFIX
 170 objectClass: posixGroup
 171 objectClass: groupOfNames
 172 cn: $GRP
 173 gidNumber: $GRP_GID
 174 member: cn=$USERNAME,$LDAPPREFIX
 175 EOF
 176     i=$(expr "$i" + 1)
 177 done
 178
 179 # Test whether wbinfo --xids-to-sids finds everything
 180
 181 GIDS=""
 182 i=0
 183 while [ ${i} -lt ${NUMGROUPS} ] ; do
 184     GIDS="$GIDS g$(expr ${i} + ${GID_START})"
 185     i=$(expr "$i" + 1)
 186 done
 187 NUM_VALID_SIDS=$($wbinfo --unix-ids-to-sids="$GIDS" | grep -v ^S-0-0 | wc -l)
 188
 189 testit "Count number of valid sids found" \
 190        test ${NUM_VALID_SIDS} = ${NUMGROUPS} ||
 191        failed=$(expr $failed + 1)
 192
 193 # Test whether wbinfo -r shows all groups
 194
 195 EXPECTED_USERGROUPS="1000000/1000001/2000002/"
 196 i=0
 197 while [ ${i} -lt ${NUMGROUPS} ] ; do
 198     EXPECTED_USERGROUPS="$EXPECTED_USERGROUPS$(expr ${i} + ${GID_START})/"
 199     i=$(expr "$i" + 1)
 200 done
 201
 202 USERGROUPS=$($wbinfo -r $DOMAIN/$USERNAME | sort -n | tr '\n' '/')
 203
 204 testit "Testing for expected group memberships" \
 205        test "$USERGROUPS" = "$EXPECTED_USERGROUPS" ||
 206        failed=$(expr $failed + 1)
 207
 208 i=0
 209 while [ ${i} -lt ${NUMGROUPS} ] ; do
 210     GRP=$(printf "test_rfc2307_group_%3.3d" ${i})
 211     testit "Del group $GRP" $net rpc group delete "$GRP" -S "$DC_SERVER" \
 212            -U"${DOMAIN}\\${DC_USERNAME}"%"${DC_PASSWORD}" ||
 213         failed=$(expr $failed + 1)
 214     i=$(expr "$i" + 1)
 215 done
 216
 217 # Delete LDAP records
 218 $VALGRIND $ldbsearch -H ldap://$DC_SERVER -U$DOMAIN/$DC_USERNAME%$DC_PASSWORD \
 219           -s one -b "$LDAPPREFIX" | grep '^dn:' | cut -d ' ' -f 2- |
 220     xargs -d '\n' -n 1 -IDEL_DN \
 221           $ldbdel -H ldap://$DC_SERVER -U$DOMAIN/$DC_USERNAME%$DC_PASSWORD \
 222           "DEL_DN"
 223 $VALGRIND $ldbdel -H ldap://$DC_SERVER -U$DOMAIN/$DC_USERNAME%$DC_PASSWORD "$LDAPPREFIX"
 224
 225 exit $failed