summaryrefslogtreecommitdiff
path: root/source4/dsdb/tests/python
AgeCommit message (Collapse)AuthorFilesLines
2022-05-05tests/passwords: Add tests for password history with simple bindsJoseph Sutton1-8/+243
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-05-05tests/passwords: Remove unused importsJoseph Sutton1-2/+0
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-05-05selftest: Rework password_lockout_base.py to allow logon_basics test to be ↵Andrew Bartlett2-17/+31
run in ad_dc_no_ntlm We need to ensure that even if NTLM is disabled, that the test can still bootstrap and fail normally. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2022-04-13s4:dsdb:tests: Also pass tests if asserted identity is presentAndreas Schneider1-17/+96
We should make sure that we use NTLMSSP or Kerberos consistently for the tests and don't mix them. We're also much stricter and symmetric_difference() to check if the sets are actually the same. Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Andreas Schneider <asn@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org>
2022-03-18tests/sam: Ensure that Protected Users group cannot be deletedJoseph Sutton1-0/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-03-18tests/passwords: Test that LDAP password changes work for Protected UsersJoseph Sutton1-0/+77
We want to disable SAMR password changes for Protected Users, but need to ensure that other methods of changing the password still work. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-03-18tests/password_lockout: Test NTLM and SAMR password changes with Protected UsersJoseph Sutton1-0/+277
Test that NTLM and SAMR password changes cannot be used for Protected Users, and that lockouts are not triggered for attempting to use them. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-03-17selftest: Cope with LM hash not being stored in the tombstone_reanimation testAndrew Bartlett1-2/+2
The removal of LM hash storage changes the expected metadata. We do not need to track these values exactly to prove the behaviour here. This is not due to the changes in password_hash directly, which in update_final_msg() sets DSDB_FLAG_INTERNAL_FORCE_META_DATA to force a push out of the removed attribute to the replication state. However at the stage of a subsequent LDAP Delete there is no longer a lmPwdHistory nor dBCSPwd attribute, in the directory, so there is no subsequent version bump to remove them when building a tombstone. Samba's behaviour is different to that seen by Metze on windows 2022, where he sees dBCSPwd removed (for the no LM store case) but lmPwdHistory kept. We in Samba choose to differ, not storing an ambiguous LM hsitory (of "" values likely), so allowing any version for these two attributes is the sensible choice. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-03-10rodc: Add tests for simple BIND alongside NTLMSSP bindsGarming Sam1-22/+37
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13879 Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-10dsdb/tests: add test_login_basics_simple()Stefan Metzmacher1-7/+19
This demonstrates that 'old password allowed period' also applies to LDAP simple binds and not only to GSS-SPNEGO/NTLMSSP binds. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13879 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15001 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-10dsdb/tests: prepare BasePasswordTestCase for simple bind testsStefan Metzmacher1-3/+17
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13879 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-10dsdb/tests: introduce assertLoginSuccessStefan Metzmacher2-5/+15
This makes it possible to catch failures with knownfail entries. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13879 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-10dsdb/tests: make use of assertLoginFailure helperStefan Metzmacher1-6/+1
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13879 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-10dsdb/tests: let all BasePasswordTestCase tests provide self.host_url[_ldaps]Stefan Metzmacher3-7/+9
This will make further changes easier. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13879 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-10dsdb/tests: passwords.py don't need to import BasePasswordTestCaseStefan Metzmacher1-1/+0
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13879 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-03-06s4:kdc: redirect pre-authentication failures to an RWDCStefan Metzmacher1-2/+1
The most important case is that we still have a previous password cached at the RODC and the inbound replication hasn't wiped the cache yet and we also haven't triggered a new replication yet. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14865 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-11-30selftest: Check received LDB error code when STRICT_CHECKING=0Joseph Sutton1-1/+1
We were instead only checking the expected error. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-11-25CVE-2021-3670 tests/krb5/test_ldap.py: Add test for LDAP timeoutsJoseph Sutton1-0/+63
We allow a timeout of 2x over to avoid this being a flapping test. Samba is not very accurate on the timeout, which is not otherwise an issue but makes this test fail sometimes. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14694 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-11-09CVE-2020-25722 selftest: Add test for duplicate servicePrincipalNames on an ↵Joseph Sutton1-0/+21
add operation BUG: https://bugzilla.samba.org/show_bug.cgi?id=14564 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2021-11-09CVE-2020-25722 selftest: Adapt ldap.py tests to new objectClass restrictionsJoseph Sutton1-14/+22
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-11-09CVE-2020-25722: s4-acl: test Control Access Rights honor the Applies-to ↵Nadezhda Ivanova1-0/+17
attribute Validate Writes and Control Access Rights should only grant access if the object is of the type listed in the Right's appliesTo attribute. Tests to verify this behavior BUG: https://bugzilla.samba.org/show_bug.cgi?id=14832 Signed-off-by: Nadezhda Ivanova <nivanova@symas.com> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-11-09CVE-2020-25722 s4:dsdb:tests: Add missing self.fail() callsJoseph Sutton1-0/+32
Without these calls the tests could pass if an expected error did not occur. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14832 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> [abartlet@samba.org Included in backport as changing ACLs while ACL tests are not checking for unexpected success would be bad]
2021-11-09CVE-2020-25722 Add test for SPN deletion followed by additionJoseph Sutton1-0/+48
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14876 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> [abartlet@samba.org Removed transaction hooks, these do nothing over remote LDAP]
2021-11-09CVE-2020-25722 selftest/user_account_control: more work to cope with ↵Andrew Bartlett1-17/+29
UAC/objectclass defaults and lock This new restriction breaks a large number of assumptions in the tests, like that you can remove some UF_ flags, because it turns out doing so will make the 'computer' a 'user' again, and this will fail. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-11-09CVE-2020-25722 selftest/user_account_control: Allow a broader set of ↵Andrew Bartlett1-4/+8
possible errors This favors a test that confirms we got an error over getting exactly the right error, at least for now. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-11-09CVE-2020-25722 selftest: Allow self.assertRaisesLdbError() to take a list of ↵Andrew Bartlett1-0/+5
errors to match with BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-11-09CVE-2020-25722 selftest: adapt ldap.py/sam.py test_all tests to new default ↵Andrew Bartlett2-7/+10
computer behaviour Objects of objectclass computer are computers by default now and this changes the sAMAccountType and primaryGroupID as well as userAccountControl BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-11-09CVE-2020-25722 selftest: Adapt sam.py test to userAccountControl/objectclass ↵Andrew Bartlett1-3/+3
restrictions BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-11-09CVE-2020-25722 selftest: New objects of objectclass=computer are ↵Andrew Bartlett1-2/+2
workstations by default now BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-11-09CVE-2020-25722 selftest: Adjust sam.py ↵Andrew Bartlett1-1/+1
test_userAccountControl_computer_add_trust to new reality We now enforce that a trust account must be a user. These can not be added over LDAP anyway, and our C code in the RPC server gets this right in any case. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-11-09CVE-2020-25722 selftest: Split test_userAccountControl into unit testsAndrew Bartlett1-1/+20
The parts that create and delete a single object can be safely split out into an individual test. At this point the parts that fail against Windows 2019 are: error: __main__.SamTests.test_userAccountControl_computer_add_normal [ _ldb.LdbError: (53, 'LDAP error 53 LDAP_UNWILLING_TO_PERFORM - <0000052D: SvcErr: DSID-031A1236, problem 5003 (WILL_NOT_PERFORM), data 0\n> <>') error: __main__.SamTests.test_userAccountControl_computer_modify [ _ldb.LdbError: (53, 'LDAP error 53 LDAP_UNWILLING_TO_PERFORM - <0000052D: SvcErr: DSID-031A1236, problem 5003 (WILL_NOT_PERFORM), data 0\n> <>') error: __main__.SamTests.test_userAccountControl_user_add_0_uac [ _ldb.LdbError: (53, 'LDAP error 53 LDAP_UNWILLING_TO_PERFORM - <0000052D: SvcErr: DSID-031A1236, problem 5003 (WILL_NOT_PERFORM), data 0\n> <>') error: __main__.SamTests.test_userAccountControl_user_add_normal [ _ldb.LdbError: (53, 'LDAP error 53 LDAP_UNWILLING_TO_PERFORM - <0000052D: SvcErr: DSID-031A1236, problem 5003 (WILL_NOT_PERFORM), data 0\n> <>') error: __main__.SamTests.test_userAccountControl_user_modify [ _ldb.LdbError: (53, 'LDAP error 53 LDAP_UNWILLING_TO_PERFORM - <0000052D: SvcErr: DSID-031A1236, problem 5003 (WILL_NOT_PERFORM), data 0\n> <>') BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-11-09CVE-2020-25722 selftest: Adapt sam.py test_isCriticalSystemObject to new ↵Andrew Bartlett1-1/+35
UF_WORKSTATION_TRUST_ACCOUNT default Objects with objectclass computer now have UF_WORKSTATION_TRUST_ACCOUNT by default and so this test must adapt. The changes to this test passes against Windows 2019 except for the new behaviour around the UF_WORKSTATION_TRUST_ACCOUNT default. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-11-09CVE-2020-25722 selftest: Adapt selftest to restriction on swapping account typesAndrew Bartlett1-16/+38
This makes many of our tests pass again. We do not pass against Windows 2019 on all as this does not have this restriction at this time. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-11-09CVE-2020-25722 dsdb: Add tests for modifying objectClass, userAccountControl ↵Joseph Sutton1-0/+150
and sAMAccountName BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14889 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-11-09CVE-2020-25722 dsdb: Improve privileged and unprivileged tests for ↵Andrew Bartlett1-47/+125
objectclass/doller/UAC This helps ensure we cover off all the cases that matter for objectclass/trailing-doller/userAccountControl BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-11-09CVE-2020-25722 selftest: Catch errors from samdb.modify() in ↵Andrew Bartlett1-5/+26
user_account_control tests This will allow these to be listed in a knownfail shortly. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-11-09CVE-2020-25722 selftest: Catch possible errors in ↵Andrew Bartlett1-11/+19
PasswordSettingsTestCase.test_pso_none_applied() This allows future patches to restrict changing the account type without triggering an error. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-11-09CVE-2020-25722 selftest: Test combinations of account type and objectclass ↵Andrew Bartlett1-0/+165
for creating a user The idea here is to split out the restrictions seen on Windows 2019 at the schema level, as seen when acting as an administrator. These pass against Windows 2019 except for the account type swapping which is not wanted. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-11-09CVE-2020-25722 selftest: Extend priv_attrs test - work around ↵Andrew Bartlett1-15/+25
UF_NORMAL_ACCOUNT rules on Windows 2019 (requires |UF_PASSWD_NOTREQD or a password) - extend to also cover the sensitive UF_TRUSTED_FOR_DELEGATION BUG: https://bugzilla.samba.org/show_bug.cgi?id=14703 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14778 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14775 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-11-09CVE-2020-25722 dsdb: Tests for our known set of privileged attributesAndrew Bartlett1-0/+388
This, except for where we choose to disagree, does pass against Windows 2019. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14703 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14778 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14775 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-10-20selftest: Increase account lockout windows to make test more realiableJoseph Sutton1-2/+2
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14868 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2021-10-20pytest/rodc_rwdc: try to avoid race.Douglas Bagnall1-0/+4
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14868 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2021-10-04selftest: Use self.assertRaisesLdbError() in user_account_control.py testAndrew Bartlett1-63/+37
This changes most of the simple pattern with self.samdb.modify() to use the wrapper. Some other calls still need to be converted, while the complex decision tree tests should remain as-is for now. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Mon Oct 4 21:55:43 UTC 2021 on sn-devel-184
2021-10-04selftest: Move self.assertRaisesLdbError() to samba.tests.TestCaseAndrew Bartlett2-46/+0
This is easier to reason with regarding which cases should work and which cases should fail, avoiding issues where more success than expected would be OK because a self.fail() was missed in a try: block. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2021-09-15selftest: Update user_account_control tests to pass against Windows 2019Andrew Bartlett1-12/+102
This gets us closer to passing against Windows 2019, without making major changes to what was tested. More tests are needed, but it is important to get what was being tested tested again. Account types (eg UF_NORMAL_ACCOUNT, UF_WORKSTATION_TRUST_ACCOUNT) are now required on all objects, this can't be omitted any more. Also for UF_NORMAL_ACCOUNT for these accounts without a password set |UF_PASSWD_NOTREQD must be included. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Sep 15 08:49:11 UTC 2021 on sn-devel-184
2021-09-04python: Fix usage stringsJoseph Sutton6-6/+6
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2021-09-02selftest: Replace internal loop in test_uac_bits_set() using @DynamicTestClassAndrew Bartlett1-20/+25
This generates a single test per bit which is easier to debug. Elsewhere we use this pattern where we want to be able to put some cases in a knownfail, which is otherwise not possible. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-09-02selftest: Replace internal loop in test_uac_bits_add() using @DynamicTestClassAndrew Bartlett1-19/+35
This generates a single test per bit which is easier to debug. Elsewhere we use this pattern where we want to be able to put some cases in a knownfail, which is otherwise not possible. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-09-02selftest: Use @DynamicTestCase in user_account_control ↵Andrew Bartlett1-8/+11
test_uac_bits_unrelated_modify() This is a nice easy example of how the test generation code works, and it combined nicely with the earlier patch to return string names from the UF_ constants. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2021-09-02selftest: Use addCleanup rather than tearDown in user_account_control.pyAndrew Bartlett1-8/+2
self.addCleanup() is called regardless of the test failure or error status and so is more reliable, particularly during development. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-07 07:25:36 +0000