1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-27 03:21:53 +03:00
Commit Graph

201 Commits

Author SHA1 Message Date
Andrew Bartlett
9e1a8dc8b7 dsdb-tests: Remove pointless creation of ldaptestou
This is not used in this test, and is not removed by the test either.

Andrew Bartlett

Change-Id: I34366d469a1ebed04c3cea5a7f206cb0bf433e03
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-04-02 17:12:46 +02:00
Nadezhda Ivanova
8a50509021 s4-dsdb: instanceType NC_HEAD is only allowed combined with WRITE for an originating add operation
As described in MS-ATDS 3.1.1.5.2.8.

Signed-off-by: Nadezhda Ivanova <nivanova@symas.com>
Reviewed-by:   Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Nadezhda Ivanova <nivanova@samba.org>
Autobuild-Date(master): Sun Nov  3 16:17:30 CET 2013 on sn-devel-104
2013-11-03 16:17:30 +01:00
Nadezhda Ivanova
daefca2a1a s4-dsacl: Fixed incorrect handling of privileges in sec_access_check_ds
Restore and backup privileges are not relevant to ldap
access checks, and the TakeOwnership privilege should
grant write_owner right

Signed-off-by: Nadezhda Ivanova <nivanova@symas.com>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-10-25 09:45:57 +13:00
Nadezhda Ivanova
13a10d4314 s4-samldb: Do not allow deletion of objects with RID < 1000
According to [MS-SAMR] 3.1.5.7 Delete Pattern we should not allow deletion
of security objects with RID < 1000. This patch will prevent deletion of
well-known accounts and groups.

Signed-off-by: Nadezhda Ivanova <nivanova@symas.com>
Reviewed-by:   Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Nadezhda Ivanova <nivanova@samba.org>
Autobuild-Date(master): Mon Oct 14 13:31:50 CEST 2013 on sn-devel-104
2013-10-14 13:31:50 +02:00
Stefan Metzmacher
da7ef12b43 dsdb/tests/ldap: fix test_distinguished_name against w2k8r2
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-10-10 08:35:30 +02:00
Stefan Metzmacher
ca173923a3 dsdb/tests/ldap: fix test_ldapServiceName against w2k8r2
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10193

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-10-10 08:35:10 +02:00
Andrew Bartlett
68f8f4ec4d dsdb-tests ldap.py: Add test for usn behaviour on certain changes
This probes when the usn is updated, and when it is not.

Andrew Bartlett

Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Wed Jun 12 11:54:01 CEST 2013 on sn-devel-104
2013-06-12 11:54:01 +02:00
Andrew Bartlett
51298d33dd dsdb-tests ldap.py: Fix quoting of print statements
While python didn't mind (oddly) it really confused my editor.

Andrew Bartlett

Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-06-12 10:02:08 +02:00
Matthias Dieter Wallnöfer
7f760ed84b s4:samldb LDB module - MS-SAMR 3.1.1.8.10 "userAccountControl"
"UF_LOCKOUT" and "UF_PASSWORD_EXPIRED" are never stored but rather are
used for special semantics.
"UF_LOCKOUT" performs an account lockout and "UF_PASSWORD_EXPIRED"
forces password expiration.

Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon Jun 10 07:32:35 CEST 2013 on sn-devel-104
2013-06-10 07:32:35 +02:00
Matthias Dieter Wallnöfer
1a6eac2c37 s4:samldb LDB module - permit "userAccountControl" modifications without acct. type
Obviously this defaults to UF_NORMAL_ACCOUNT. Some background can be found in
MS-SAMR section 3.1.1.8.10.

Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Jun  5 03:26:25 CEST 2013 on sn-devel-104
2013-06-05 03:26:25 +02:00
Matthias Dieter Wallnöfer
62ee2a5caf s4:samldb LDB module - "userAccountControl" = 0 means UF_NORMAL_ACCOUNT on add
Windows Server 2008 has changed semantics in comparison to Server 2003.

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-06-05 01:36:23 +02:00
Matthias Dieter Wallnöfer
1a7e181fb8 s4:dsdb python tests - set the executable flag
Reviewed-by: Matthieu Patou <mat@samba.org>

Autobuild-User(master): Matthias Dieter Wallnöfer <mdw@samba.org>
Autobuild-Date(master): Fri May 17 15:11:29 CEST 2013 on sn-devel-104
2013-05-17 15:11:29 +02:00
Stefan Metzmacher
cd5cb843b4 tests/sec_descriptor: the default owner behavior depends on domainControllerFunctionality (bug #9481)
Not on the domainFunctionality.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-27 20:14:20 +11:00
Matthieu Patou
e1ab7b6804 Tests: rewrite ldap_schema to specify attributes
Signed-off-by: Matthieu Patou <mat@matws.net>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-21 08:21:20 +01:00
Andrew Bartlett
065c0ec162 dsdb: Add test for modification of two attributes, one permitted, one denied (bug #9554 - CVE-2013-0172)
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit 8bafe08715)

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue Jan 15 14:03:47 CET 2013 on sn-devel-104
2013-01-15 14:03:47 +01:00
Stefan Metzmacher
53b736444d s4:dsdb/tests/sec_descriptor: verify the search of a windows dc join keeps working
This is a regression test for bug #9470.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>

Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Mon Dec 10 15:41:12 CET 2012 on sn-devel-104
2012-12-10 15:41:11 +01:00
Stefan Metzmacher
e617a3fecb s4:dsdb/tests/sec_descriptor: verify the nTSecurityDescriptor and sd_flags interaction
This is a regression test for bug #9470.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2012-12-10 13:53:48 +01:00
Stefan Metzmacher
057c56ac24 s4:dsdb/tests: add SdAutoInheritTests
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>

Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Fri Nov 30 18:59:50 CET 2012 on sn-devel-104
2012-11-30 18:59:50 +01:00
Andrew Bartlett
01f52239dc s4-join: Import DNS zones in AD DC join 2012-06-25 00:26:41 +10:00
Matthieu Patou
763f9e8201 selftest: schema is not automatically reloaded now so if you modify it you have to reload it
Autobuild-User(master): Matthieu Patou <mat@samba.org>
Autobuild-Date(master): Sat Jun 23 10:48:13 CEST 2012 on sn-devel-104
2012-06-23 10:48:13 +02:00
Jelmer Vernooij
cbd660d013 samdb: Accept a list of member variables rather than a comma-separated string. 2012-06-21 18:05:33 +02:00
Matthias Dieter Wallnöfer
d4391f77bf s4:samldb LDB module - make sure to not add identical "servicePrincipalName"s more than once
The service principal names need to be case-insensitively unique, otherwise we
end up in a LDB ERR_ATTRIBUTE_OR_VALUE_EXISTS error.
This issue has been discovered on the technical mailing list (thread:
cannot rename windows xp machine in samba4) when trying to rename a AD
client workstation.
2012-05-04 08:25:36 +10:00
Matthias Dieter Wallnöfer
773304ec8b s4:samldb LDB module - implement "fSMORoleOwner" attribute protection
This is a very essential attribute since it references to various domain
master roles (PDC emulator, schema...) depending on which entry it has
been set. Incautious modifications can cause severe problems.

Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Mon Apr 30 02:04:24 CEST 2012 on sn-devel-104
2012-04-30 02:04:23 +02:00
Matthias Dieter Wallnöfer
d86e701b7c s4:ldap.py - re-introduce the "(dn=CN=ldaptestUSER3,CN=Users,DC=wallnoefer2,DC=local)" test
This syntax is not supported by Windows AD and should also be denied by
s4/LDB.

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Mon Mar 26 02:30:53 CEST 2012 on sn-devel-104
2012-03-26 02:30:53 +02:00
Matthias Dieter Wallnöfer
438971e214 LDB/s4 - do not use the "(dn=...)" syntax on filters anymore
Make it AD-compatible using "(distinguishedName=...)".

Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2012-03-26 00:57:29 +02:00
Matthias Dieter Wallnöfer
fa1c7615d0 s4:ldap.py - test the already mentioned structural object class sorting behaviour
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2012-03-26 00:57:29 +02:00
Andrew Bartlett
b596b9c045 s4-selftest: Avoid running kinit for each new connection
Kerberos is efficient when the credentials cache is set up once and
then reused.

Sadly this test creates a user, does a test and deletes the user, over
and over.

For this, using NTLM saves a little time, but we also stress the rest
of the DB, and should rework the test.

Andrew Bartlett

Autobuild-User: Andrew Bartlett <abartlet@samba.org>
Autobuild-Date: Mon Feb 20 00:49:56 CET 2012 on sn-devel-104
2012-02-20 00:49:56 +01:00
Amitay Isaacs
1f0298dd1b python: Change except: statement to except Exception:
This way we only catch true exceptions and keyboard interrupts
are not caught here.

Autobuild-User: Amitay Isaacs <amitay@samba.org>
Autobuild-Date: Tue Jan 24 03:32:40 CET 2012 on sn-devel-104
2012-01-24 03:32:40 +01:00
Jelmer Vernooij
f625d362d7 Remove broken code - these lines use undefined symbols. 2011-11-14 15:49:36 +01:00
Andrew Tridgell
ba41389d3d test: fixed several tests to use samba.tests
this fixes error checking. Test failures were not being detected
otherwise

Pair-Programmed-With: Amitay Isaacs <amitay@gmail.com>
2011-11-10 14:24:21 +11:00
Matthieu Patou
2db221c384 s4-sites: Document, fix under optimal coding, use exceptions
Autobuild-User: Matthieu Patou <mat@samba.org>
Autobuild-Date: Wed Nov  2 22:35:00 CET 2011 on sn-devel-104
2011-11-02 22:35:00 +01:00
Matthieu Patou
37703892bd s4-selftest: add unit tests for sites's function in python 2011-11-02 13:37:18 +01:00
Matthias Dieter Wallnöfer
d95b4c9497 s4:ldap.py - fix up the dSHeuristics test to check for the right behaviour
Reviewed-by: abartlet
2011-10-27 18:52:29 +02:00
Matthias Dieter Wallnöfer
bb02aa5e00 s4:ldap.py - we test the creation of secrets already in the "systemOnly" testcase
Reviewed-by: abartlet
2011-10-27 18:52:29 +02:00
Matthias Dieter Wallnöfer
6fc55cb9f2 s4:ldap.py - enhance and fix up the object class test
Also address the problem described in bug #8486.

Reviewed-by: abartlet
2011-10-27 18:52:29 +02:00
Matthias Dieter Wallnöfer
c9ac028951 s4:ldap.py - fix up the UTF8 tests
Reviewed-by: abartlet
2011-10-27 18:52:28 +02:00
Matthias Dieter Wallnöfer
5875661cf2 s4:ldap.py - reactivate some assertions in "test_all"
There should always be one result on both s4 and Windows.

Reviewed-by: abartlet
2011-10-27 18:52:28 +02:00
Jelmer Vernooij
1417ea1eed Remove pointless exception catching in tests.
Autobuild-User: Jelmer Vernooij <jelmer@samba.org>
Autobuild-Date: Sun Oct  9 00:00:26 CEST 2011 on sn-devel-104
2011-10-09 00:00:25 +02:00
Andrew Tridgell
966b5d5de2 pyldb: fixed places where we try to concatenate a Dn with a string
you need to either use str(dn) or use %s in a format string
2011-09-19 10:57:03 +10:00
Andrew Tridgell
4577ee1f95 s4-dsdb: use get_config_basedn() in python tests
we can't just append CN=Configuration to the basedn, as that won't
give the right configuration DN for a subdomain of a forest

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2011-09-19 10:57:03 +10:00
Andrew Tridgell
4f421d0406 s4-acl: use dnsforest not dnsdomain for GC names 2011-08-25 07:39:39 +10:00
Andrew Tridgell
6ef36a0e6a s4-acl-test: use symbolic names for groupType
clearer than magic numbers
2011-08-09 11:56:23 +02:00
Matthias Dieter Wallnöfer
11937ce5e1 s4:sam.py - uncomment/enhance some account type tests
Reviewed-by: abartlet
2011-05-25 08:57:42 +02:00
Matthias Dieter Wallnöfer
4740473591 s4:sam.py - tests for "isCriticalSystemObject" attribute
Reviewed-by: abartlet
2011-05-25 08:57:29 +02:00
Matthias Dieter Wallnöfer
c72d32da6d s4:sam.py - unchanged "primaryGroupID" when account type remains the same
Enhance the testcase with a workstation example.

Reviewed-by: abartlet
2011-05-25 08:57:19 +02:00
Matthieu Patou
1b5c2d8e92 s4:sam.py - add tests to check that setting "userAccountValue" on usersdon't impact the "primaryGroupID" attribute
Notice: The domain administrators groups isn't referenced as "Domain Admins"
since this name could differ.

Signed-off-by: Matthias Dieter Wallnöfer <mdw@samba.org>

Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org>
Autobuild-Date: Sat May 21 19:19:57 CEST 2011 on sn-devel-104
2011-05-21 19:19:57 +02:00
Matthieu Patou
c2fa348831 s4-dsdb: add unit tests for dirsync control
Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-05-21 16:25:19 +04:00
Matthias Dieter Wallnöfer
3884fec3d5 s4:token_group.py python test - fix typos 2011-04-29 19:05:04 +02:00
Andrew Tridgell
5f771b301d ldb: fixed --paged option in ldb tools
we were sometimes using 'paged_result' and sometimes using 'paged_results'.
The latter seemed to be more common, so I changed the two places that
used the 'paged_result' string to 'paged_results'
2011-04-07 10:51:30 +10:00
Matthieu Patou
88d907189c pyldb: add more tests for control manipulation 2011-03-20 11:27:26 +01:00