mirror of
https://git.openldap.org/openldap/openldap.git
synced 2026-01-07 15:41:24 -05:00
add ACI test
This commit is contained in:
Pierangelo Masarati
parent
c365b701cb
commit
9e9137cb74
6 changed files with 367 additions and 1 deletions
67
tests/data/aci.out
Normal file
67
tests/data/aci.out
Normal file
|
|
@ -0,0 +1,67 @@
|
|||
# Searching "dc=example,dc=com" (should fail)...
|
||||
# Searching "dc=example,dc=com" (should succeed with no results)...
|
||||
# Searching "dc=example,dc=com" as "cn=Bjorn Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com" (should succeed)...
|
||||
dn: dc=example,dc=com
|
||||
objectClass: top
|
||||
objectClass: organization
|
||||
objectClass: domainRelatedObject
|
||||
objectClass: dcObject
|
||||
dc: example
|
||||
l: Anytown, Michigan
|
||||
st: Michigan
|
||||
o: Example, Inc.
|
||||
o: EX
|
||||
o: Ex.
|
||||
description: The Example, Inc. at Anytown
|
||||
postalAddress: Example, Inc. $ 535 W. William St. $ Anytown, MI 48109 $ US
|
||||
telephoneNumber: +1 313 555 1817
|
||||
associatedDomain: example.com
|
||||
|
||||
# Searching "ou=Groups,dc=example,dc=com" as "cn=John Doe,ou=Information Technology Division,ou=People,dc=example,dc=com" (should succeed)...
|
||||
dn: cn=All Staff,ou=Groups,dc=example,dc=com
|
||||
member: cn=Manager,dc=example,dc=com
|
||||
member: cn=Barbara Jensen,ou=Information Technology Division,ou=People,dc=exam
|
||||
ple,dc=com
|
||||
member: cn=Jane Doe,ou=Alumni Association,ou=People,dc=example,dc=com
|
||||
member: cn=John Doe,ou=Information Technology Division,ou=People,dc=example,dc
|
||||
=com
|
||||
member: cn=Mark Elliot,ou=Alumni Association,ou=People,dc=example,dc=com
|
||||
member: cn=James A Jones 1,ou=Alumni Association,ou=People,dc=example,dc=com
|
||||
member: cn=James A Jones 2,ou=Information Technology Division,ou=People,dc=exa
|
||||
mple,dc=com
|
||||
member: cn=Jennifer Smith,ou=Alumni Association,ou=People,dc=example,dc=com
|
||||
member: cn=Dorothy Stevens,ou=Alumni Association,ou=People,dc=example,dc=com
|
||||
member: cn=Ursula Hampster,ou=Alumni Association,ou=People,dc=example,dc=com
|
||||
member: cn=Bjorn Jensen,ou=Information Technology Division,ou=People,dc=exampl
|
||||
e,dc=com
|
||||
owner: cn=Manager,dc=example,dc=com
|
||||
cn: All Staff
|
||||
description: Everyone in the sample data
|
||||
objectClass: groupOfNames
|
||||
|
||||
dn: cn=Alumni Assoc Staff,ou=Groups,dc=example,dc=com
|
||||
member: cn=Manager,dc=example,dc=com
|
||||
member: cn=Dorothy Stevens,ou=Alumni Association,ou=People,dc=example,dc=com
|
||||
member: cn=James A Jones 1,ou=Alumni Association,ou=People,dc=example,dc=com
|
||||
member: cn=Jane Doe,ou=Alumni Association,ou=People,dc=example,dc=com
|
||||
member: cn=Jennifer Smith,ou=Alumni Association,ou=People,dc=example,dc=com
|
||||
member: cn=Mark Elliot,ou=Alumni Association,ou=People,dc=example,dc=com
|
||||
member: cn=Ursula Hampster,ou=Alumni Association,ou=People,dc=example,dc=com
|
||||
owner: cn=Manager,dc=example,dc=com
|
||||
description: All Alumni Assoc Staff
|
||||
cn: Alumni Assoc Staff
|
||||
objectClass: groupOfNames
|
||||
|
||||
dn: cn=ITD Staff,ou=Groups,dc=example,dc=com
|
||||
owner: cn=Manager,dc=example,dc=com
|
||||
description: All ITD Staff
|
||||
cn: ITD Staff
|
||||
objectClass: groupOfUniqueNames
|
||||
uniqueMember: cn=Manager,dc=example,dc=com
|
||||
uniqueMember: cn=Bjorn Jensen,ou=Information Technology Division,ou=People,dc=
|
||||
example,dc=com
|
||||
uniqueMember: cn=James A Jones 2,ou=Information Technology Division,ou=People,
|
||||
dc=example,dc=com
|
||||
uniqueMember: cn=John Doe,ou=Information Technology Division,ou=People,dc=exam
|
||||
ple,dc=com
|
||||
|
||||
57
tests/data/slapd-aci.conf
Normal file
57
tests/data/slapd-aci.conf
Normal file
|
|
@ -0,0 +1,57 @@
|
|||
# stand-alone slapd config -- for testing (with indexing)
|
||||
# $OpenLDAP$
|
||||
## This work is part of OpenLDAP Software <http://www.openldap.org/>.
|
||||
##
|
||||
## Copyright 1998-2005 The OpenLDAP Foundation.
|
||||
## All rights reserved.
|
||||
##
|
||||
## Redistribution and use in source and binary forms, with or without
|
||||
## modification, are permitted only as authorized by the OpenLDAP
|
||||
## Public License.
|
||||
##
|
||||
## A copy of this license is available in the file LICENSE in the
|
||||
## top-level directory of the distribution or, alternatively, at
|
||||
## <http://www.OpenLDAP.org/license.html>.
|
||||
|
||||
include ./schema/core.schema
|
||||
include ./schema/cosine.schema
|
||||
include ./schema/inetorgperson.schema
|
||||
include ./schema/openldap.schema
|
||||
include ./schema/nis.schema
|
||||
include ./testdata/test.schema
|
||||
|
||||
#
|
||||
pidfile ./testrun/slapd.1.pid
|
||||
argsfile ./testrun/slapd.1.args
|
||||
|
||||
#mod#modulepath ../servers/slapd/back-@BACKEND@/
|
||||
#mod#moduleload back_@BACKEND@.la
|
||||
#monitormod#modulepath ../servers/slapd/back-monitor/
|
||||
#monitormod#moduleload back_monitor.la
|
||||
|
||||
#######################################################################
|
||||
# database definitions
|
||||
#######################################################################
|
||||
|
||||
access to dn=""
|
||||
by * read
|
||||
access to dn="cn=Subschema"
|
||||
by * read
|
||||
|
||||
database @BACKEND@
|
||||
suffix "dc=example,dc=com"
|
||||
directory ./testrun/db.1.a
|
||||
rootdn "cn=Manager,dc=example,dc=com"
|
||||
rootpw secret
|
||||
#bdb#index objectClass eq
|
||||
#bdb#index cn,sn,uid pres,eq,sub
|
||||
#hdb#index objectClass eq
|
||||
#hdb#index cn,sn,uid pres,eq,sub
|
||||
#ldbm#index objectClass eq
|
||||
#ldbm#index cn,sn,uid pres,eq,sub
|
||||
|
||||
access to dn.subtree="dc=example,dc=com"
|
||||
by aci write
|
||||
|
||||
#monitor#database monitor
|
||||
|
||||
|
|
@ -47,10 +47,11 @@ AC_syncprov=syncprov@BUILD_SYNCPROV@
|
|||
AC_WITH_SASL=@WITH_SASL@
|
||||
AC_WITH_TLS=@WITH_TLS@
|
||||
AC_WITH_MODULES_ENABLED=@WITH_MODULES_ENABLED@
|
||||
AC_ACI_ENABLED=aci@SLAPD_ACI_ENABLED@
|
||||
|
||||
export AC_bdb AC_hdb AC_ldap AC_ldbm AC_meta AC_monitor AC_relay AC_sql
|
||||
export AC_glue AC_pcache AC_ppolicy AC_refint AC_retcode AC_rwm AC_unique AC_syncprov
|
||||
export AC_translucent AC_WITH_SASL AC_WITH_TLS AC_WITH_MODULES_ENABLED
|
||||
export AC_translucent AC_WITH_SASL AC_WITH_TLS AC_WITH_MODULES_ENABLED AC_ACI_ENABLED
|
||||
|
||||
if test ! -x ../servers/slapd/slapd ; then
|
||||
echo "Could not locate slapd(8)"
|
||||
|
|
|
|||
|
|
@ -53,6 +53,7 @@ sed -e "s/@BACKEND@/${BACKEND}/" \
|
|||
-e "s/^#${MON}#//" \
|
||||
-e "s/^#${MONMOD}#//" \
|
||||
-e "s/^#${SASL}#//" \
|
||||
-e "s/^#${ACI}#//" \
|
||||
-e "s;@URI1@;${URI1};" \
|
||||
-e "s;@URI2@;${URI2};" \
|
||||
-e "s;@URI3@;${URI3};" \
|
||||
|
|
|
|||
|
|
@ -32,6 +32,7 @@ SYNCPROV=${AC_syncprov-syncprovno}
|
|||
WITH_SASL=${AC_WITH_SASL-no}
|
||||
USE_SASL=${SLAPD_USE_SASL-no}
|
||||
WITHTLS=${AC_WITHTLS-yes}
|
||||
ACI=${AC_ACI_ENABLED-acino}
|
||||
|
||||
DATADIR=./testdata
|
||||
PROGDIR=./progs
|
||||
|
|
@ -95,6 +96,7 @@ TRANSLUCENTREMOTECONF=$DATADIR/slapd-translucent-remote.conf
|
|||
METACONF=$DATADIR/slapd-meta.conf
|
||||
METACONF2=$DATADIR/slapd-meta2.conf
|
||||
GLUELDAPCONF=$DATADIR/slapd-glue-ldap.conf
|
||||
ACICONF=$DATADIR/slapd-aci.conf
|
||||
|
||||
CONF1=$TESTDIR/slapd.1.conf
|
||||
CONF2=$TESTDIR/slapd.2.conf
|
||||
|
|
@ -274,6 +276,7 @@ METAOUT=$DATADIR/meta.out
|
|||
METACONCURRENCYOUT=$DATADIR/metaconcurrency.out
|
||||
MANAGEOUT=$DATADIR/manage.out
|
||||
SUBTREERENAMEOUT=$DATADIR/subtree-rename.out
|
||||
ACIOUT=$DATADIR/aci.out
|
||||
|
||||
# Just in case we linked the binaries dynamically
|
||||
LD_LIBRARY_PATH=`pwd`/../libraries:${LD_LIBRARY_PATH} export LD_LIBRARY_PATH
|
||||
|
|
|
|||
237
tests/scripts/test041-aci
Executable file
237
tests/scripts/test041-aci
Executable file
|
|
@ -0,0 +1,237 @@
|
|||
#! /bin/sh
|
||||
# $OpenLDAP$
|
||||
## This work is part of OpenLDAP Software <http://www.openldap.org/>.
|
||||
##
|
||||
## Copyright 1998-2005 The OpenLDAP Foundation.
|
||||
## All rights reserved.
|
||||
##
|
||||
## Redistribution and use in source and binary forms, with or without
|
||||
## modification, are permitted only as authorized by the OpenLDAP
|
||||
## Public License.
|
||||
##
|
||||
## A copy of this license is available in the file LICENSE in the
|
||||
## top-level directory of the distribution or, alternatively, at
|
||||
## <http://www.OpenLDAP.org/license.html>.
|
||||
|
||||
case "$BACKEND" in
|
||||
bdb|hdb|ldbm)
|
||||
;;
|
||||
*)
|
||||
echo "Test does not support $BACKEND backend"
|
||||
exit 0
|
||||
esac
|
||||
|
||||
echo "running defines.sh"
|
||||
. $SRCDIR/scripts/defines.sh
|
||||
|
||||
if test "$ACI" = "acino" ; then
|
||||
echo "ACI not enabled; skipping..."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
mkdir -p $TESTDIR $DBDIR1
|
||||
|
||||
echo "Running slapadd to build slapd database..."
|
||||
. $CONFFILTER $BACKEND $MONITORDB < $ACICONF > $CONF1
|
||||
$SLAPADD -f $CONF1 -l $LDIFORDERED
|
||||
RC=$?
|
||||
if test $RC != 0 ; then
|
||||
echo "slapadd failed ($RC)!"
|
||||
exit $RC
|
||||
fi
|
||||
|
||||
echo "Starting slapd on TCP/IP port $PORT1..."
|
||||
$SLAPD -f $CONF1 -h $URI1 -d $LVL $TIMING > $LOG1 2>&1 &
|
||||
PID=$!
|
||||
if test $WAIT != 0 ; then
|
||||
echo PID $PID
|
||||
read foo
|
||||
fi
|
||||
KILLPIDS="$PID"
|
||||
|
||||
echo "Testing slapd ACI access control..."
|
||||
for i in 0 1 2 3 4 5; do
|
||||
$LDAPSEARCH -s base -b "$MONITOR" -h $LOCALHOST -p $PORT1 \
|
||||
'objectclass=*' > /dev/null 2>&1
|
||||
RC=$?
|
||||
if test $RC = 0 ; then
|
||||
break
|
||||
fi
|
||||
echo "Waiting 5 seconds for slapd to start..."
|
||||
sleep 5
|
||||
done
|
||||
|
||||
if test $RC != 0 ; then
|
||||
echo "ldapsearch failed ($RC)!"
|
||||
test $KILLSERVERS != no && kill -HUP $KILLPIDS
|
||||
exit $RC
|
||||
fi
|
||||
|
||||
cat /dev/null > $SEARCHOUT
|
||||
cat /dev/null > $TESTOUT
|
||||
|
||||
# Search must fail
|
||||
BASEDN="dc=example,dc=com"
|
||||
echo "Searching \"$BASEDN\" (should fail)..."
|
||||
echo "# Searching \"$BASEDN\" (should fail)..." >> $SEARCHOUT
|
||||
$LDAPSEARCH -s base -b "$BASEDN" -h $LOCALHOST -p $PORT1 \
|
||||
'(objectclass=*)' >> $SEARCHOUT 2>> $TESTOUT
|
||||
RC=$?
|
||||
if test $RC != 32 ; then
|
||||
echo "ldapsearch should have failed ($RC)!"
|
||||
test $KILLSERVERS != no && kill -HUP $KILLPIDS
|
||||
exit $RC
|
||||
fi
|
||||
|
||||
# Bind must fail
|
||||
BINDDN="cn=Barbara Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com"
|
||||
BINDPW=bjensen
|
||||
echo "Testing ldapwhoami as ${BINDDN} (should fail)..."
|
||||
$LDAPWHOAMI -h $LOCALHOST -p $PORT1 -D "$BINDDN" -w $BINDPW
|
||||
RC=$?
|
||||
if test $RC = 0 ; then
|
||||
echo "ldapwhoami should have failed!"
|
||||
test $KILLSERVERS != no && kill -HUP $KILLPIDS
|
||||
exit $RC
|
||||
fi
|
||||
|
||||
# Populate ACIs
|
||||
echo "Writing ACIs as \"$MANAGERDN\"..."
|
||||
$LDAPMODIFY -D "$MANAGERDN" -w $PASSWD -h $LOCALHOST -p $PORT1 \
|
||||
>> $TESTOUT 2>&1 << EOMODS0
|
||||
dn: dc=example,dc=com
|
||||
changetype: modify
|
||||
add: OpenLDAPaci
|
||||
OpenLDAPaci: 0#subtree#grant;d,c,s,r;[all]#group/groupOfUniqueNames/uniqueMe
|
||||
mber#cn=ITD Staff,ou=Groups,dc=example,dc=com
|
||||
OpenLDAPaci: 1#entry#grant;d;[all]#public#
|
||||
|
||||
dn: ou=People,dc=example,dc=com
|
||||
changetype: modify
|
||||
add: OpenLDAPaci
|
||||
OpenLDAPaci: 0#subtree#grant;x;userPassword#public#
|
||||
OpenLDAPaci: 1#subtree#grant;w;userPassword#self#
|
||||
OpenLDAPaci: 2#subtree#grant;w;userPassword#access-id#cn=Bjorn Jensen,ou=Inf
|
||||
ormation Technology Division,ou=People,dc=example,dc=com
|
||||
|
||||
dn: ou=Groups,dc=example,dc=com
|
||||
changetype: modify
|
||||
add: OpenLDAPaci
|
||||
OpenLDAPaci: 0#entry#grant;s;[all]#public#
|
||||
OpenLDAPaci: 1#children#grant;r;member;r;uniqueMember#access-id#cn=Bjorn Jen
|
||||
sen,ou=Information Technology Division,ou=People,dc=example,dc=com
|
||||
EOMODS0
|
||||
RC=$?
|
||||
if test $RC != 0 ; then
|
||||
echo "ldapmodify failed ($RC)!"
|
||||
test $KILLSERVERS != no && kill -HUP $KILLPIDS
|
||||
exit $RC
|
||||
fi
|
||||
|
||||
# Search must succeed with no results
|
||||
BASEDN="dc=example,dc=com"
|
||||
echo "Searching \"$BASEDN\" (should succeed with no results)..."
|
||||
echo "# Searching \"$BASEDN\" (should succeed with no results)..." >> $SEARCHOUT
|
||||
$LDAPSEARCH -s base -b "$BASEDN" -h $LOCALHOST -p $PORT1 \
|
||||
'(objectclass=*)' >> $SEARCHOUT 2>> $TESTOUT
|
||||
RC=$?
|
||||
if test $RC != 0 ; then
|
||||
echo "ldapsearch failed ($RC)!"
|
||||
echo "IGNORED"
|
||||
### TEMPORARILY DISABLED
|
||||
###test $KILLSERVERS != no && kill -HUP $KILLPIDS
|
||||
###exit $RC
|
||||
fi
|
||||
|
||||
BINDDN="cn=Barbara Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com"
|
||||
BINDPW=bjensen
|
||||
echo "Testing ldapwhoami as ${BINDDN}..."
|
||||
$LDAPWHOAMI -h $LOCALHOST -p $PORT1 -D "$BINDDN" -w $BINDPW
|
||||
RC=$?
|
||||
if test $RC != 0 ; then
|
||||
echo "ldapwhoami failed ($RC)!"
|
||||
test $KILLSERVERS != no && kill -HUP $KILLPIDS
|
||||
exit $RC
|
||||
fi
|
||||
|
||||
# Search must succeed
|
||||
BINDDN="cn=Bjorn Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com"
|
||||
BINDPW=bjorn
|
||||
BASEDN="dc=example,dc=com"
|
||||
echo "Searching \"$BASEDN\" as \"$BINDDN\" (should succeed)..."
|
||||
echo "# Searching \"$BASEDN\" as \"$BINDDN\" (should succeed)..." >> $SEARCHOUT
|
||||
$LDAPSEARCH -s base -b "$BASEDN" -h $LOCALHOST -p $PORT1 \
|
||||
-D "$BINDDN" -w "$BINDPW" \
|
||||
'(objectClass=*)' >> $SEARCHOUT 2>> $TESTOUT
|
||||
RC=$?
|
||||
if test $RC != 0 ; then
|
||||
echo "ldapsearch failed ($RC)!"
|
||||
test $KILLSERVERS != no && kill -HUP $KILLPIDS
|
||||
exit $RC
|
||||
fi
|
||||
|
||||
# Passwd must succeed
|
||||
BINDDN="cn=Bjorn Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com"
|
||||
BINDPW=bjorn
|
||||
TGT="cn=John Doe,ou=Information Technology Division,ou=People,dc=example,dc=com"
|
||||
NEWPW=jdoe
|
||||
echo "Setting \"$TGT\" password..."
|
||||
$LDAPPASSWD -h $LOCALHOST -p $PORT1 \
|
||||
-w "$BINDPW" -s "$NEWPW" \
|
||||
-D "$BINDDN" "$TGT" >> $TESTOUT 2>&1
|
||||
RC=$?
|
||||
if test $RC != 0 ; then
|
||||
echo "ldappasswd failed ($RC)!"
|
||||
test $KILLSERVERS != no && kill -HUP $KILLPIDS
|
||||
exit $RC
|
||||
fi
|
||||
|
||||
# Re-change as self...
|
||||
echo "Changing self password..."
|
||||
BINDDN="$TGT"
|
||||
BINDPW=$NEWPW
|
||||
TGT="cn=John Doe,ou=Information Technology Division,ou=People,dc=example,dc=com"
|
||||
NEWPW=newcred
|
||||
$LDAPPASSWD -h $LOCALHOST -p $PORT1 \
|
||||
-w "$BINDPW" -s "$NEWPW" \
|
||||
-D "$BINDDN" "$TGT" >> $TESTOUT 2>&1
|
||||
RC=$?
|
||||
if test $RC != 0 ; then
|
||||
echo "ldappasswd failed ($RC)!"
|
||||
test $KILLSERVERS != no && kill -HUP $KILLPIDS
|
||||
exit $RC
|
||||
fi
|
||||
|
||||
# Searching groups
|
||||
BINDPW=$NEWPW
|
||||
BASEDN="ou=Groups,dc=example,dc=com"
|
||||
echo "Searching \"$BASEDN\" as \"$BINDDN\" (should succeed)..."
|
||||
echo "# Searching \"$BASEDN\" as \"$BINDDN\" (should succeed)..." >> $SEARCHOUT
|
||||
$LDAPSEARCH -s one -b "$BASEDN" -h $LOCALHOST -p $PORT1 \
|
||||
-D "$BINDDN" -w "$BINDPW" \
|
||||
'(objectClass=*)' >> $SEARCHOUT 2>> $TESTOUT
|
||||
RC=$?
|
||||
if test $RC != 0 ; then
|
||||
echo "ldapsearch failed ($RC)!"
|
||||
test $KILLSERVERS != no && kill -HUP $KILLPIDS
|
||||
exit $RC
|
||||
fi
|
||||
|
||||
test $KILLSERVERS != no && kill -HUP $KILLPIDS
|
||||
|
||||
LDIF=$ACIOUT
|
||||
|
||||
echo "Filtering ldapsearch results..."
|
||||
. $LDIFFILTER < $SEARCHOUT > $SEARCHFLT
|
||||
echo "Filtering original ldif used to create database..."
|
||||
. $LDIFFILTER < $LDIF > $LDIFFLT
|
||||
echo "Comparing filter output..."
|
||||
$CMP $SEARCHFLT $LDIFFLT > $CMPOUT
|
||||
|
||||
if test $? != 0 ; then
|
||||
echo "comparison failed - operations did not complete correctly"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo ">>>>> Test succeeded"
|
||||
exit 0
|
||||
Loading…
Reference in a new issue