samba.git/source4/dsdb/tests, branch talloc-2.3.4

tests/passwords: Add tests for password history with simple binds

2022-05-05T00:27:33+00:00

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

tests/passwords: Remove unused imports

2022-05-05T00:27:33+00:00

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

selftest: Rework password_lockout_base.py to allow logon_basics test to be run in ad_dc_no_ntlm

2022-05-05T00:27:33+00:00

We need to ensure that even if NTLM is disabled, that the test
can still bootstrap and fail normally.

Signed-off-by: Andrew Bartlett 
Reviewed-by: Joseph Sutton

s4:dsdb:tests: Also pass tests if asserted identity is present

2022-04-13T12:59:30+00:00

We should make sure that we use NTLMSSP or Kerberos consistently
for the tests and don't mix them.

We're also much stricter and symmetric_difference() to
check if the sets are actually the same.

Pair-Programmed-With: Stefan Metzmacher 

Signed-off-by: Andreas Schneider 
Signed-off-by: Stefan Metzmacher

tests/sam: Ensure that Protected Users group cannot be deleted

2022-03-18T11:55:30+00:00

Signed-off-by: Joseph Sutton 
Reviewed-by: Stefan Metzmacher

tests/passwords: Test that LDAP password changes work for Protected Users

2022-03-18T11:55:30+00:00

We want to disable SAMR password changes for Protected Users, but need
to ensure that other methods of changing the password still work.

Signed-off-by: Joseph Sutton 
Reviewed-by: Stefan Metzmacher

tests/password_lockout: Test NTLM and SAMR password changes with Protected Users

2022-03-18T11:55:30+00:00

Test that NTLM and SAMR password changes cannot be used for Protected
Users, and that lockouts are not triggered for attempting to use them.

Signed-off-by: Joseph Sutton 
Reviewed-by: Stefan Metzmacher

selftest: Cope with LM hash not being stored in the tombstone_reanimation test

2022-03-17T01:57:38+00:00

The removal of LM hash storage changes the expected metadata.

We do not need to track these values exactly to prove the
behaviour here.

This is not due to the changes in password_hash directly, which in
update_final_msg() sets DSDB_FLAG_INTERNAL_FORCE_META_DATA to force
a push out of the removed attribute to the replication state.

However at the stage of a subsequent LDAP Delete there is no longer
a lmPwdHistory nor dBCSPwd attribute, in the directory, so there is
no subsequent version bump to remove them when building a tombstone.

Samba's behaviour is different to that seen by Metze on windows 2022,
where he sees dBCSPwd removed (for the no LM store case) but
lmPwdHistory kept.  We in Samba choose to differ, not storing an
ambiguous LM hsitory (of "" values likely), so allowing any version
for these two attributes is the sensible choice.

Signed-off-by: Andrew Bartlett 
Reviewed-by: Stefan Metzmacher

rodc: Add tests for simple BIND alongside NTLMSSP binds

2022-03-10T03:16:35+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13879

Signed-off-by: Garming Sam 
Reviewed-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

dsdb/tests: add test_login_basics_simple()

2022-03-10T03:16:35+00:00

This demonstrates that 'old password allowed period' also
applies to LDAP simple binds and not only to GSS-SPNEGO/NTLMSSP binds.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13879
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15001

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett