sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-11 05:18:09 +03:00
Code

s4:dsdb/tests: let password_lockout.py verify more fields in _readd_user()

Browse Source 
The results differ depending on Kerberos or NTLMSSP usage
and the lockOutObservationWindow.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Stefan Metzmacher 2016-02-05 08:37:53 +01:00 committed by Andrew Bartlett
parent 4b35d540fa
commit ca874c200e
1 changed files with 53 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

65
source4/dsdb/tests/python/password_lockout.py
View File

@ -298,12 +298,20 @@ userAccountControl: %d
time.sleep(0.01) time.sleep(0.01)
return res return res
def _readd_user(self, creds): def _readd_user(self, creds, lockOutObservationWindow=0):
username = creds.get_username() username = creds.get_username()
userpass = creds.get_password() userpass = creds.get_password()
userdn = "cn=%s,cn=users,%s" % (username, self.base_dn) userdn = "cn=%s,cn=users,%s" % (username, self.base_dn)
# (Re)adds the test user "testuser" with no password atm use_kerberos = creds.get_kerberos_state()
if use_kerberos == MUST_USE_KERBEROS:
lastlogon_relation = 'greater'
else:
if lockOutObservationWindow == 0:
lastlogon_relation = 'greater'
else:
lastlogon_relation = 'equal'
delete_force(self.ldb, userdn) delete_force(self.ldb, userdn)
self.ldb.add({ self.ldb.add({
"dn": userdn, "dn": userdn,
@ -369,6 +377,7 @@ userPassword: thatsAcomplPASS2
dsdb.UF_PASSWD_NOTREQD, dsdb.UF_PASSWD_NOTREQD,
msDSUserAccountControlComputed= msDSUserAccountControlComputed=
dsdb.UF_PASSWORD_EXPIRED) dsdb.UF_PASSWORD_EXPIRED)
badPwdCount = int(res[0]["badPwdCount"][0])
badPasswordTime = int(res[0]["badPasswordTime"][0]) badPasswordTime = int(res[0]["badPasswordTime"][0])
# Sets the initial user password with a "special" password change # Sets the initial user password with a "special" password change
@ -384,7 +393,7 @@ userPassword: """ + userpass + """
""") """)
res = self._check_account(userdn, res = self._check_account(userdn,
badPwdCount=1, badPwdCount=badPwdCount,
badPasswordTime=badPasswordTime, badPasswordTime=badPasswordTime,
lastLogon=0, lastLogon=0,
lastLogonTimestamp=('absent', None), lastLogonTimestamp=('absent', None),
@ -398,7 +407,22 @@ userPassword: """ + userpass + """
self.ldb.enable_account("(sAMAccountName=%s)" % username) self.ldb.enable_account("(sAMAccountName=%s)" % username)
res = self._check_account(userdn, res = self._check_account(userdn,
badPwdCount=1, badPwdCount=badPwdCount,
badPasswordTime=badPasswordTime,
lastLogon=0,
lastLogonTimestamp=('absent', None),
userAccountControl=
dsdb.UF_NORMAL_ACCOUNT,
msDSUserAccountControlComputed=0)
if lockOutObservationWindow != 0:
time.sleep(lockOutObservationWindow + 1)
effective_bad_password_count = 0
else:
effective_bad_password_count = badPwdCount
res = self._check_account(userdn,
badPwdCount=badPwdCount,
effective_bad_password_count=effective_bad_password_count,
badPasswordTime=badPasswordTime, badPasswordTime=badPasswordTime,
lastLogon=0, lastLogon=0,
lastLogonTimestamp=('absent', None), lastLogonTimestamp=('absent', None),
@ -406,23 +430,40 @@ userPassword: """ + userpass + """
dsdb.UF_NORMAL_ACCOUNT, dsdb.UF_NORMAL_ACCOUNT,
msDSUserAccountControlComputed=0) msDSUserAccountControlComputed=0)
# Open a second LDB connection with the user credentials. Use the
# command line credentials for informations like the domain, the realm
# and the workstation.
ldb = SamDB(url=host_url, credentials=creds, lp=lp) ldb = SamDB(url=host_url, credentials=creds, lp=lp)
if lockOutObservationWindow == 0:
badPwdCount = 0
effective_bad_password_count = 0
if use_kerberos == MUST_USE_KERBEROS:
badPwdCount = 0
effective_bad_password_count = 0
res = self._check_account(userdn, res = self._check_account(userdn,
badPwdCount=0, badPwdCount=badPwdCount,
effective_bad_password_count=effective_bad_password_count,
badPasswordTime=badPasswordTime, badPasswordTime=badPasswordTime,
lastLogon=('greater', 0), lastLogon=(lastlogon_relation, 0),
lastLogonTimestamp=('greater', 0), lastLogonTimestamp=('greater', badPasswordTime),
userAccountControl= userAccountControl=
dsdb.UF_NORMAL_ACCOUNT, dsdb.UF_NORMAL_ACCOUNT,
msDSUserAccountControlComputed=0) msDSUserAccountControlComputed=0)
lastLogon = int(res[0]["lastLogon"][0]) lastLogon = int(res[0]["lastLogon"][0])
self.assertGreater(lastLogon, badPasswordTime) lastLogonTimestamp = int(res[0]["lastLogonTimestamp"][0])
if lastlogon_relation == 'greater':
self.assertGreater(lastLogon, badPasswordTime)
self.assertGreaterEqual(lastLogon, lastLogonTimestamp)
res = self._check_account(userdn,
badPwdCount=badPwdCount,
effective_bad_password_count=effective_bad_password_count,
badPasswordTime=badPasswordTime,
lastLogon=lastLogon,
lastLogonTimestamp=lastLogonTimestamp,
userAccountControl=
dsdb.UF_NORMAL_ACCOUNT,
msDSUserAccountControlComputed=0)
return ldb return ldb
def assertLoginFailure(self, url, creds, lp, errno=ERR_INVALID_CREDENTIALS): def assertLoginFailure(self, url, creds, lp, errno=ERR_INVALID_CREDENTIALS):