summaryrefslogtreecommitdiff
path: root/source4/dsdb/tests/python/password_lockout.py
AgeCommit message (Collapse)AuthorFilesLines
2024-03-12selftest: add tests for "samba-tool user list --locked-only"Jule Anger1-0/+16
Signed-off-by: Jule Anger <janger@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Jule Anger <janger@samba.org> Autobuild-Date(master): Tue Mar 12 10:54:49 UTC 2024 on atb-devel-224
2023-05-16pytest/password_lockout: Use more specific assertion methodsJoseph Sutton1-23/+23
These methods produce better error messages if an assertion fails. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-05-16pytest/password_lockout: Remove unused importsJoseph Sutton1-4/+2
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-16pytest/password_lockout: be less verbose by defaultDouglas Bagnall1-9/+9
leaving the carefully constructed verbosity there for whoever choses to switch it on. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-09-08pytest/password-lockout: fix using samba_tool functionDouglas Bagnall1-7/+5
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-05-05selftest: Rework password_lockout_base.py to allow logon_basics test to be ↵Andrew Bartlett1-4/+10
run in ad_dc_no_ntlm We need to ensure that even if NTLM is disabled, that the test can still bootstrap and fail normally. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2022-03-18tests/password_lockout: Test NTLM and SAMR password changes with Protected UsersJoseph Sutton1-0/+277
Test that NTLM and SAMR password changes cannot be used for Protected Users, and that lockouts are not triggered for attempting to use them. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-03-10dsdb/tests: let all BasePasswordTestCase tests provide self.host_url[_ldaps]Stefan Metzmacher1-4/+3
This will make further changes easier. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13879 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-04-28python: remove all 'from __future__ import print_function'Douglas Bagnall1-1/+0
This made Python 2's print behave like Python 3's print(). In some cases, where we had: from __future__ import print_function """Intended module documentation...""" this will have the side effect of making the intended module documentation work as the actual module documentation (i.e. becoming __doc__), because it is once again the first statement in the module. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-11-04selftest: add test for new "samba-tool user unlock" commandBjörn Baumbach1-0/+20
Signed-off-by: Björn Baumbach <bb@sernet.de> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Douglas Bagnall <dbagnall@samba.org> Autobuild-Date(master): Wed Nov 4 00:19:25 UTC 2020 on sn-devel-184
2020-02-07pytests: heed assertEquals deprecation warning en-masseDouglas Bagnall1-22/+22
TestCase.assertEquals() is an alias for TestCase.assertEqual() and has been deprecated since Python 2.7. When we run our tests with in python developer mode (`PYTHONDEVMODE=1 make test`) we get 580 DeprecationWarnings about this. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2018-12-14PY3: change shebang to python3 in source4/dsdb dirJoe Guo1-1/+1
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2018-12-10s4/dsdb/tests/python: PY3 Port samba4.ldap.password_lockoutNoel Power1-2/+2
use Exception.args member as exception is no longer supports indexing. Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-12-10PY3: net.change_password & net.set_password take string not bytesNoel Power1-4/+4
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-11-28CVE-2018-16857 tests: Sanity-check password lockout works with default valuesTim Beale1-0/+30
Sanity-check that when we use the default lockOutObservationWindow that user lockout actually works. The easiest way to do this is to reuse the _test_login_lockout() test-case, but stop at the point where we wait for the lockout duration to expire (because we don't want the test to wait 30 mins). This highlights a problem currently where the default values don't work. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13683 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-10-29python: do not use "is" for string equalityDouglas Bagnall1-3/+3
This is not always going to work, and is not guaranteed to be consistent even between minor versions. Here is a simple counterexample: >>> a = 'hello' >>> a is 'hello' True >>> a is 'hello'.lower() False >>> a == a.lower() True Possibly it always works for the empty string, but we cannot rely on that. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Mon Oct 29 23:13:36 CET 2018 on sn-devel-144
2018-09-03selftest: Split up password_lockout into tests with and without a call to ↵Andrew Bartlett1-142/+157
sleep() This means we can have a long observation window for many of the tests and so make them much more reliable. Many of these cause frustrating flapping failures in our CI systems. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Mon Sep 3 06:14:55 CEST 2018 on sn-devel-144
2018-09-03selftest: Prepare to allow override of lockout duration in password_lockout ↵Andrew Bartlett1-5/+4
tests This will make it easier to avoid flapping tests. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2018-08-24PEP8: improve formatting around bit-wise OR ("|")Douglas Bagnall1-12/+12
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-08-24PEP8: fix E703: statement ends with a semicolonJoe Guo1-1/+1
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E305: expected 2 blank lines after class or function definition, ↵Joe Guo1-0/+1
found 1 Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E302: expected 2 blank lines, found 1Joe Guo1-0/+1
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E251: unexpected spaces around keyword / parameter equalsJoe Guo1-90/+45
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E127: continuation line over-indented for visual indentJoe Guo1-53/+53
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-24PEP8: fix E121: continuation line under-indented for hanging indentJoe Guo1-1/+1
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-06-20tests: Increase PSO test timeouts to minimise failuresTim Beale1-1/+5
When PSOs exist in the DB, there is some extra overhead involved in user logins (an extra expand-nested-groups operation for every user login). Currently password_lockout tests are quite query-intensive - each call to _check_account() does ~6 RPC operations/LDB searches (plus sleeps for 20 millisecs). Plus the actual user login attempt being tested. It looks like the current test needs to do 3 login attempts/_check_account() calls within a 2-second window. While the PSO test cases usually work OK, sometimes they fail (presumably they take slightly longer and fall outside this 2-second window). Presumably this is due to the cloud instance's CPU being slightly more loaded when the test is run. Long-term the plan is to refactor the user login so that the extra expand-nested-groups operation is unnecessary for PSOs. In the short-term, increase the window the test uses from 2 seconds to 3 seconds. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-05-12s4/dsdb/tests: py2/py3 compatability always decode result of b64encodeNoel Power1-26/+26
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-05-11tests: Add test for password-lockout via SAMR RPCTim Beale1-0/+117
The existing password_lockout tests didn't check for changing the password via the SAMR password_change RPC. This patch adds a test-case for this, using the default domain lockout settings (which passes), and then repeats the same test using a PSO (which fails). Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
2018-05-11tests: Add PSO test case to existing password_lockout testsTim Beale1-0/+47
This checks that the lockout settings of the PSO take effect when one is applied to a user. Import the password_settings code to create/apply a PSO with the same lockout settings that the test cases normally use. Then update the global settings so that the default lockout settings are wildly different (i.e. so the test fails if the default lockout settings get used instead of the PSO's). As the password-lockout tests are quite slow, I've selected test cases that should provide sufficient PSO coverage (rather than repeat every single password-lockout test case in its entirety). Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
2018-05-11tests: Add comments to help explain password_lockout testsTim Beale1-0/+11
Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
2018-03-23s3/dsdb: convert print func to be py2/py3 compatibleNoel Power1-5/+6
Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-02-28dsdb python tests: convert 'except X, (tuple)' to 'except X as e'Noel Power1-20/+40
In addition to converting the except line another line is also added for each except to extract the tuple contents. Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-05-30tests/password_lockout: Remove unused users from baseGarming Sam1-0/+14
They take extra time to set-up... Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-04-13password_lockout: Move some unnecessary methods from baseGarming Sam1-0/+188
Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-04-13password_lockout: Move lockoutObservationWindow tests from setUpGarming Sam1-0/+25
These should not belong in the setUp, and should be a separate test. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-04-13password_lockout: Factor out a base testcaseGarming Sam1-892/+6
This allows it to be used for the RODC testing. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-04-13password_lockout: Remove use of global creds variablesGarming Sam1-18/+18
This is so that we can import the login tests into the RODC-RWDC tests. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-04-13password_lockout: Remove use of global lp and host varsGarming Sam1-21/+24
This is so that we can import the login tests into the RODC-RWDC tests. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-04-13password_lockout: Move more helper methods to a base classGarming Sam1-74/+75
This is so that we can import the login tests into the RODC-RWDC tests. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-04-13password_lockout: Move more helper methods to a base classGarming Sam1-330/+0
This is so that we can import the login tests into the RODC-RWDC tests. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-04-13password_lockout: Begin moving helper methods to a base classGarming Sam1-42/+371
This is so that we can import the login tests into the RODC-RWDC tests. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-03-29TestBase: move insta_creds from password_lockout.pyGary Lockyer1-42/+21
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
2016-06-30s4:dsdb/tests: let password_lockout.py verify the logonCount valuesStefan Metzmacher1-2/+91
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-06-30s4:dsdb/tests: let password_lockout.py validate the lastLogon and ↵Stefan Metzmacher1-24/+45
lastLogonTimestamp interaction Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-06-30s4:dsdb/tests: let password_lockout.py test with all combinations of krb5, ↵Stefan Metzmacher1-33/+67
ntlmssp and lockOutObservationWindow Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-06-30s4:dsdb/tests: let password_lockout.py verify more fields in _readd_user()Stefan Metzmacher1-11/+52
The results differ depending on Kerberos or NTLMSSP usage and the lockOutObservationWindow. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-06-30s4:dsdb/tests: let password_lockout.py copy user{name,pass} from the ↵Stefan Metzmacher1-2/+23
template in insta_creds() Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-06-30s4:dsdb/tests: let password_lockout.py use creds and other_ldb as function ↵Stefan Metzmacher1-18/+20
arguments Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-06-30s4:dsdb/tests: let password_lockout.py use userpass variables in all functionsStefan Metzmacher1-25/+42
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-06-30s4:dsdb/tests: let password_lockout.py use other_ldb variables instead of ↵Stefan Metzmacher1-23/+25
self.ldb3 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-06 22:56:28 +0000