
    b2b                     N    d dl Z d dlZd dlmZ d dlmZmZ  G d de          ZdS )    N)SambaToolCmdTest)PasswordSettingsTestUserc                   h     e Zd ZdZ fdZ fdZd Zd Zd Zd Z	d Z
d	 Zd
 Zd Zd Zd Z xZS )PwdSettingsCmdTestCasez:Tests for 'samba-tool domain passwordsettings' subcommandsc                    t          t          |                                            dt          j        d         z  | _        dt          j        d         dt          j        d         | _        |                     d| j        | j                  | _        d| j        	                                z  }d	|z  | _
        g | _        d S )
Nz	ldap://%s	DC_SERVER-UDC_USERNAME%DC_PASSWORD-HzCN=System,%sz!CN=Password Settings Container,%s)superr   setUposenvironserver	user_authgetSamDBldb	domain_dnpso_containerobj_cleanup)self	system_dn	__class__s     I/usr/lib/python3/dist-packages/samba/tests/samba_tool/passwordsettings.pyr   zPwdSettingsCmdTestCase.setUp   s    $d++11333!BJ{$;;')z-'@'@'@')z-'@'@B==t{DNCC"TX%7%7%9%99	@9L    c                     t          t          |                                            | j        D ]}| j                            |           d S )N)r   r   tearDownr   r   delete)r   dnr   s     r   r    zPwdSettingsCmdTestCase.tearDown&   sS    $d++44666" 	  	 BHOOB	  	 r   c                 v   d|d| j         }g d}| j                            |t          j        |          }|                     t          |          dd           |j        rdnd}|j        rdnd}t          |j	        d	z             }t          |j
        d	z             }	t          |j        d	z             }
t          |j        d	z             }|                     t          |d
         d         d
                   |           |d
         d         d
         }|                     t          |          |           |                     t          |d
         d         d
                   |j                   |                     t          |d
         d         d
                   |j                   |                     t          |d
         d         d
                   |
           |                     t          |d
         d         d
                   |           |                     t          |d
         d         d
                   |	           |                     t          |d
         d         d
                   |           |                     t          |d
         d         d
                   |j                   |                     t          |d
         d         d
                   |j                   |                     dd|d| j        | j                  \  }}}|                     t          |                    d                    dk    d           |                     d|j        z  |           |                     d|j        z  |           d|j        z  }|                     ||           dS )z5Checks the PSO info in the DB matches what's expectedCN=,)namemsDS-PasswordSettingsPrecedence(msDS-PasswordReversibleEncryptionEnabledmsDS-PasswordHistoryLengthmsDS-MinimumPasswordLengthmsDS-PasswordComplexityEnabledmsDS-MinimumPasswordAgemsDS-MaximumPasswordAgemsDS-LockoutObservationWindowmsDS-LockoutThresholdmsDS-LockoutDurationscopeattrs   zPSO lookup failedTRUEFALSEg    cAr   r+   r(   r)   r*   r,   r-   r.   r0   r/   r'   domainpasswordsettingspsoshowr   :
   zExpect 10 fields displayedMinimum password length: %uzPassword history length: %uz lockout threshold (attempts): %uN)r   r   search
SCOPE_BASEassertEquallen
complexitystore_plaintextintlockout_durationlockout_windowpassword_age_minpassword_age_maxstrhistory_lenpassword_lenlockout_attempts
precedencerunsublevelcmdr   r   
assertTruesplitassertIn)r   pso_namer:   r"   	pso_attrsrescomplexity_strplaintext_strrF   rG   min_agemax_ageplaintext_resresultouterrlockout_strs                    r   	check_psoz PwdSettingsCmdTestCase.check_pso,   s     $88T%7%78F F F	 hoobioHHS1&9::: $'>>w"%"5B7 4 <===c0C8999s+s3444s+s3444 	SV$DEaHII(	* 	* 	*AIJ1M]++];;;SV$@A!DEE/	+ 	+ 	+SV$@A!DEE*	, 	, 	,SV$=>qABBGLLLSV$=>qABBGLLLSV$CDQGHH(	* 	* 	*SV$:;A>??*	, 	, 	,SV$;<Q?@@.	0 	0 	0SV$EFqIJJ.	* 	* 	* "00 <@AI15t{15A Ac 	CIIcNN++r14	6 	6 	6 	3c6FFLLL3coEsKKK83;OOk3'''''r   c                    t          d| j                  }d|_        d|_        d}|                     dd|ddd	| j        | j                  \  }}}| j                            d
|d| j	                   | 
                    |||           |                     |dd           |                     d|           |                     ||           |                     dd|ddd	| j        | j                  \  }}}|                     |d           |                     d|           d}|                     dd|dd	| j        | j                  \  }}}|                     |d           |                     d|           d|_        d|_        d|_        d|_        d}d|z  |_        d|z  |_        |                     dd|ddddddd	| j        | j                  \  }}}| j                            d
|d| j	                   | 
                    |||           |                     |dd           |                     d|           |                     ||           |                     ddd	| j        | j                  \  }}}| 
                    |||           |                     d|           |                     d|           dS )z-Tests basic PSO creation using the samba-toolNFd   ztest-create-PSOr7   r9   r:   create100--complexity=offr   r$   r%    Shouldn't be any error messagessuccessfully createdz)Ensure that create for existing PSO failszalready existsztest-create-PSO2z,specify at least one password policy settingT2      iQ    50z--complexity=onz--store-plaintext=onz--min-pwd-length=12z--min-pwd-age=11z--max-pwd-age=50r9   r:   list)r   r   rC   rN   rO   r   r   r   appendr   assertCmdSuccessrA   rR   r_   assertCmdFailrD   rL   rH   rI   )r   expected_psorS   r[   r\   r]   day_in_secss          r   test_pso_createz&PwdSettingsCmdTestCase.test_pso_createh   sN   
 (dh77"'"% %!00 <BCK168J15t{15	A Ac 	hhh8J8J KLLLfc3///b"CDDD,c222x... "00 <BCK168J15t{15	A Ac
 	6#NOOO&,,, &!00 <BCK16dk15A Ac 	6#NOOODcJJJ #''+$"$$&!"(*[(8%(*[(8%!00 <BCK157H1G1F1C1C15t{15A Ac 	hhh8J8J KLLLfc3///b"CDDD,c222x... "00 <@15t{15A Ac 	fc3///'---(#.....r   c           
         t          d| j                  }||_        d|_        d|_        |                     dd|ddd| j        | j                  \  }}}d	|d
| j        |_	        | j
                            |j	                   |                     |||           |                     |dd           |                     d|           |                     ||           |S )z$Creates a PSO for use in other testsNr=      r7   rb   200z--min-pwd-length=10r   r$   r%   rf   rg   rh   )r   r   r&   rL   rN   rO   r   r   r   r"   r   ro   rp   rA   rR   r_   )r   rS   pso_settingsr[   r\   r]   s         r   _create_psoz"PwdSettingsCmdTestCase._create_pso   s     (dh77$$&!"%!00 <BCK168M15t{15	A Acc )1$2D2DE000 	fc3///b"CDDD,c222x...r   c                 h   d}|                      |          }d|_        d|_        d|_        |                     dd|ddd	d
| j        | j        	  	        \  }}}|                     |||           |                     |dd           | 	                    d|           | 
                    ||           dS )z.Tests we can modify a PSO using the samba-toolztest-set-PSOc   r=   i  r7   r9   r:   setz--precedence=99z--account-lockout-threshold=10z--account-lockout-duration=17r   rf   rg   zSuccessfully updatedN)ry   rN   rM   rF   rO   r   r   rp   rA   rR   r_   )r   rS   rx   rU   r\   r]   s         r   test_pso_setz#PwdSettingsCmdTestCase.test_pso_set   s     "''11 #%(*%(/%--h 9<=E.?.N.M.2DK.2n> >c3 	c3,,,b"CDDD,c222 	x.....r   c                    d}|                      |           |                     dd|d| j        | j                  \  }}}|                     |||           |                     |dd           |                     d|           d|d	| j        }| j        	                    |           	 | j
                            |t          j        d
g           |                     d           nF# t          j        $ r4}|j        \  }}|                     |t          j                   Y d}~nd}~ww xY w|                     dd|d| j        | j                  \  }}}|                     |d           |                     d|           dS )z.Tests we can delete a PSO using the samba-toolztest-delete-PSOr7   r9   r:   r!   r   rf   rg   zDeleted PSOr$   r%   r&   r1   zPSO shouldn't existNz(Deleteing a non-existent PSO should failzUnable to find PSO)ry   rO   r   r   rp   rA   rR   r   r   remover   r?   r@   failLdbErrorargsERR_NO_SUCH_OBJECTrq   )	r   rS   r[   r\   r]   r"   eenumestrs	            r   test_pso_deletez&PwdSettingsCmdTestCase.test_pso_delete   s    %""" "00 <BCK15t{15A Ac 	fc3///b"CDDDmS))))#88T%7%78###	;HOOBcnVHOEEEII+,,,,| 	; 	; 	;6LT4T3#9::::::::	;
 "00 <BCK15t{15A Ac 	6#MNNN*C00000s   ,=C* *D-9*D((D-c                    |                      dd|j        d| j        | j                  \  }}}|                     |||           |                     |dd           ||                     d|           n|                     |j        |           |*|                     |                                d           dS |                     |                                |j                   dS )z6Checks that the correct PSO is applied to a given userr7   )r9   r:   z	show-userr   rf   rg   NzNo PSO applies to user)	rO   r&   r   r   rp   rA   rR   get_resultant_PSOr"   )r   userr:   r[   r\   r]   s         r   check_pso_appliedz(PwdSettingsCmdTestCase.check_pso_applied  s     "00 <E15D$+15A Ac 	fc3///b"CDDD;MM2C8888MM#(C((( ;T3355t<<<<<T3355sv>>>>>r   c           	         d}|                      |          }t          d| j                  }| j                            |j                   |                     |d           d}d|d| j                                        }| j                            |d|d	           | j                            |           t          j	                    }t          j
        | j        |          |_        t          j        |j        t          j        d
          |d
<   | j                            |           |                     dd||d| j        | j                  \  }}}	|                     |||	           |                     |	dd           |                     ||           |                     dd||d| j        | j                  \  }}}	|                     |d           |                     d|	           |                     dd||j        d| j        | j                  \  }}}	|                     |||	           |                     |	dd           |                     ||           |                     dd||d| j        | j                  \  }}}	|                     |||	           |                     |	dd           |                     ||           |                     dd||j        d| j        | j                  \  }}}	|                     |||	           |                     |	dd           |                     |d           dS )z+Checks we can apply/unapply a PSO to a userztest-apply-PSOztest-PSO-userN)r:   ztest-PSO-groupr$   r%   group)r"   objectclasssAMAccountNamememberr7   r9   r:   applyr   rf   rg   z$Shouldn't be able to apply PSO twicezalready appliesr9   r:   unapply)ry   r   r   r   ro   r"   r   r   addMessageDnMessageElementFLAG_MOD_ADDmodifyrO   r   r   rp   rA   rq   rR   r&   )
r   rS   test_psor   
group_namer"   mr[   r\   r]   s
             r   test_pso_apply_to_userz-PwdSettingsCmdTestCase.test_pso_apply_to_user  s    $##H-- 22(((t... &

%::tx'9'9';';';<Bw(24 4 	5 	5 	5###KMMvdh##(#2BHMM( "00 <ABJ1;T4;15A Ac 	fc3///b"CDDDt222 "00 <ABJ1;T4;15A Ac 	6#IJJJ'--- "00 <ABJ15D$+15A Ac 	fc3///b"CDDDt222 "00 <CDL1;T4;15A Ac 	fc3///b"CDDDt222 "00 <CDL15D$+15A Ac 	fc3///b"CDDDt.....r   c           
      v   d}|                      |           t          d| j                  }| j                            |j                   d|j        d|                                }|                     dd|dd| j	        |          \  }}}| 
                    |d	           |                     d
|           |                     dddddd| j	        |          \  }}}| 
                    |d	           |                     d|           |                     dd|d| j	        |          \  }}}| 
                    |d           |                     d
|           |                     dd|d| j	        |          \  }}}| 
                    |d           |                     d
|           |                     dd||j        d| j	        |          \  }}}| 
                    |d	           |                     d
|           |                     dd||j        d| j	        |          \  }}}| 
                    |d	           |                     d
|           |                     ddd| j	        |          \  }}}|                     |||           |                     d|           |                     d|           dS )z:Checks unprivileged users can't modify PSOs via samba-toolztest-unpriv-PSOztest-unpriv-userr
   r   r7   r|   re   r   z#Need admin privileges to modify PSOzYou may not have permissionrb   zbad-perm250z$Administrator permissions are neededr   z#Need admin privileges to delete PSOr8   z!Need admin privileges to view PSOr   r   rm   zNo PSOs
permissionN)ry   r   r   r   ro   r"   r&   get_passwordrO   r   rq   rR   rp   )r   rS   r   unpriv_authr[   r\   r]   s          r   test_pso_unprivz&PwdSettingsCmdTestCase.test_pso_unpriv]  s1    %"""*DH55(((($(IIIt/@/@/B/B/BC "00 <?@H1CT15kK Kc 	6#HIII3S999!00 <BCM168J15t{1<	> >c
 	6#HIII<cBBB!00 <BCK15t{1<> >c 	6#HIII3S999!00 <@AI15t{1<> >c 	6#FGGG3S999!00 <ABJ15D$+1<> >c 	6#HIII3S999!00 <CDL15D$+1<> >c 	6#HIII3S999
 "00 <@AE15kK Kc 	fc3///i%%%lC(((((r   c                    |                      ddd| j        | j                  \  }}}|                     |||           |                     |dd           | j                                        }|                     d|z  |           |                     | j        j	        |           t          |          dz   }d|z  }|                      dd	|d| j        | j                  \  }}}|                     |||           |                     |dd           |                     d
|           |                     || j                                                   |                      ddd| j        | j                  \  }}}|                     |||           |                     |dd           |                     d|z  |           dS )z@Checks the 'set/show' commands for the domain settings (non-PSO)r7   )r9   r;   r   rf   rg   zMinimum password length: %s   z--min-pwd-length=%ur9   r}   
successfulr>   N)rO   r   r   rp   rA   r   get_minPwdLengthrR   
addCleanupset_minPwdLengthrE   )r   r[   r\   r]   min_pwd_lennew_lenmin_pwd_argss          r   test_domain_passwordsettingsz3PwdSettingsCmdTestCase.test_domain_passwordsettings  s    "00 <9:>15A Ac 	fc3///b"CDDD h//113kA3GGG 	1;???k""Q&,w6!00 <89E15t{15A Ac 	fc3///b"CDDDlC((($(";";"="=>>> "00 <9:>15A Ac 	fc3///b"CDDD3g=sCCCCCr   c                    | j                                         }|                     | j         j        |           d}|                     dd|d| j        | j                  \  }}}|                     |||           |                     |dd           | 	                    d|           | 
                    || j                                                    | j                                         }|                     | j         j        |           d}|                     dd|d| j        | j                  \  }}}|                     |d	           | 	                    d
|           d}|                     dd|d| j        | j                  \  }}}|                     |||           |                     |dd           | 	                    d|           | 
                    || j                                                    dS )z>Checks the 'set' command for the domain password age (non-PSO)z--max-pwd-age=270r7   r   r   rf   rg   r   z--min-pwd-age=271z(minPwdAge > maxPwdAge should be rejectedzMaximum password agez--min-pwd-age=269N)r   get_maxPwdAger   set_maxPwdAgerO   r   r   rp   rA   rR   assertNotEqualsget_minPwdAgeset_minPwdAgerq   )r   max_pwd_agemax_pwd_argsr[   r\   r]   min_pwd_ager   s           r   #test_domain_passwordsettings_pwdagez:PwdSettingsCmdTestCase.test_domain_passwordsettings_pwdage  s    h,,...<<<*!00 <89E15t{15A Ac 	fc3///b"CDDDlC((([$(*@*@*B*BCCC h,,...<<<*!00 <89E15t{15A Ac 	6#MNNN,c222 +!00 <89E15t{15A Ac 	fc3///b"CDDDlC((([$(*@*@*B*BCCCCCr   )__name__
__module____qualname____doc__r   r    r_   rt   ry   r~   r   r   r   r   r   r   __classcell__)r   s   @r   r   r      s       DD             :( :( :(xI/ I/ I/V  2/ / /01 1 1B? ? ?*A/ A/ A/F>) >) >)@!D !D !DF$D $D $D $D $D $D $Dr   r   )r   r   samba.tests.samba_tool.baser   samba.tests.psor   r   r    r   r   <module>r      s   & 
			 



 8 8 8 8 8 8 6 6 6 6 6 6 6 6KD KD KD KD KD- KD KD KD KD KDr   