summaryrefslogtreecommitdiff
path: root/source4/dsdb/tests/python/password_settings.py
AgeCommit message (Collapse)AuthorFilesLines
2026-01-15dsdb:password_hash: reject password reset with UNWILLING_TO_PERFORMDouglas Bagnall1-2/+4
This is what Windows does: where a password change would cause CONSTRAINT_VIOLATION, a reset causes UNWILLING_TO_PERFORM. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12020 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2023-10-13s4:dsdb:tests: Fix assertion messagesJoseph Sutton1-2/+2
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-03s4:dsdb:tests: Fix code spellingAndreas Schneider1-2/+2
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2022-06-26dsdb: Allow password history and password changes without an NT hashAndrew Bartlett1-4/+1
We now allow this to be via the ENCTYPE_AES256_CTS_HMAC_SHA1_96 hash instead which allows us to decouple Samba from the unsalted NT hash for organisations that are willing to take this step (for user accounts). (History checking is limited to the last three passwords only, as ntPwdHistory is limited to NT hash values, and the PrimaryKerberosCtr4 package only stores three sets of keys.) Since we don't store a salt per-key, but only a single salt, the check will fail for a previous password if the account was renamed prior to a newer password being set. Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2021-11-09CVE-2020-25722 selftest: Catch possible errors in ↵Andrew Bartlett1-11/+19
PasswordSettingsTestCase.test_pso_none_applied() This allows future patches to restrict changing the account type without triggering an error. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2020-02-07pytests: heed assertEquals deprecation warning en-masseDouglas Bagnall1-8/+8
TestCase.assertEquals() is an alias for TestCase.assertEqual() and has been deprecated since Python 2.7. When we run our tests with in python developer mode (`PYTHONDEVMODE=1 make test`) we get 580 DeprecationWarnings about this. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2018-12-14PY3: change shebang to python3 in source4/dsdb dirJoe Guo1-1/+1
Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Noel Power <npower@samba.org>
2018-09-21python tests: fix format() strings for Python 2.6Douglas Bagnall1-1/+1
Python 2.6 wants "{0}".format(x), not "{}".format(x). Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-08-17Refactor for PEP8 warning E501 line too longTim Beale1-3/+8
Add a wrapper function to avoid long lines. This also helps a little to manage/contain the complexity of the code. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-17Fix PEP8 warning E501 line too longTim Beale1-23/+30
Mostly involves splitting up long strings or comments so that they span multiple lines. Some place-holder variables have been added in a few places to avoid exceeding 80 chars. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-17Fix PEP8 warning W503 line break before binary operatorTim Beale1-2/+2
Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-17Fix PEP8 warning E302 expected 2 blank linesTim Beale1-0/+1
Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-17Fix PEP8 warning F401 'blah' imported but unusedTim Beale1-4/+1
Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-17Fix PEP8 warning E225 missing whitespace around operatorTim Beale1-5/+5
Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-17Fix PEP8 warning F841 local variable 'blah' is assigned to but never usedTim Beale1-1/+0
Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-17Fix PEP8 warning E201/202/203 array/dict whitespaceTim Beale1-1/+1
Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-08-17Fix PEP8 warning E711 comparison to NoneTim Beale1-1/+1
Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-07-13s4/dsdb/tests/python: base64.b64encode returns bytesNoel Power1-3/+3
adjust to unicode for py2/py3 compat needed as part of changes to ensure samba4.ldap.password_settings will work with PY3 Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Andreas Schneider <asn@samba.org> Signed-off-by: Joe Guo <joeg@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2018-06-20tests: Increase minPwdAge used for PSO testsTim Beale1-3/+3
The PSO minPwdAge test was using a 1 second timeout. While this seemed to work fine most of the time, we did see a rackspace failure that was presumably due to the test taking longer than 1-second to execute (which resulted in the password not being correctly rejected). This patch increases the minPwdAge used, to try to avoid this problem happening. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-05-30selftest: Make create_test_ou() return a ldb.DnAndrew Bartlett1-2/+2
Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2018-05-30tests: Fix intermittent error in PSO testTim Beale1-0/+3
Deleting a group fails if the primaryGroupID of a user is set to that of the group. This can happen in the PSO tests, as we don't clear the primaryGroupID before cleaning up. Normally it seems to work OK, but this is relying purely on the subtree delete order. Update the test to clear the primaryGroupID before the tearDown is called, to make things more robust. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13448 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2018-05-23tests: Add tests for domain pwdHistoryLengthTim Beale1-0/+62
This is not related to PSOs at all, but there's a minor discrepancy between Windows and Samba password-history-length behaviour that I noticed during PSO testing. When the pwdHistoryLength changes from zero to non-zero, Windows includes the user's current password as invalid immediately, whereas Samba only includes it as invalid *after* it next changes. It's a fairly obscure corner-case, and we might not care enough about it to fix it. However, I've added a test case to highlight the difference and marked it as a known-fail for now. I also added a general pwdHistoryLength test case to show that the basics work (this didn't seem to be tested anywhere else). Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2018-05-23tests: Extend PSO tests to cover password-history/length/complexityTim Beale1-5/+0
Unhobble the PSO test cases so that they not only check the msDS-ResultantPSO constructed attribute, but also that the corresponding PSO's password-history, minimum password length, and complexity settings are actually used. The tests now fail once more, as actually using the PSO's settings isn't implemented yet. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2018-05-11tests: Add tests for Password Settings ObjectsTim Beale1-0/+802
a.k.a Fine-Grained Password Policies These tests currently all run and pass gainst Windows, but fail against Samba. (Actually, the permissions test case passes against Samba, presumably because it's enforced by the Schema permissions). Two helper classes have been added: - PasswordSettings: creates a PSO object and tracks its values. - TestUser: creates a user and tracks its password history This allows other existing tests (e.g. password_lockout, password_hash) to easily be extended to also cover PSOs. Most test cases use assert_PSO_applied(), which asserts: - the correct msDS-ResultantPSO attribute is returned - the PSO's min-password-length, complexity, and password-history settings are correctly enforced (this has been temporarily been hobbled until the basic constructed-attribute support is working). Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-13 23:13:20 +0000