From 84c9e750771e4f7dd90076c8cc382e4e13674eda Mon Sep 17 00:00:00 2001 From: Akshay Adhikari Date: Apr 02 2018 08:03:07 +0000 Subject: Issue 49585 - Add py3 support to password test suite : part-2 Description: Added py3 support by explicitly changing strings to bytes. https://pagure.io/389-ds-base/issue/49585 Reviewed by: spichugi --- diff --git a/dirsrvtests/tests/suites/password/pwdPolicy_syntax_test.py b/dirsrvtests/tests/suites/password/pwdPolicy_syntax_test.py index 5737303..1104ced 100644 --- a/dirsrvtests/tests/suites/password/pwdPolicy_syntax_test.py +++ b/dirsrvtests/tests/suites/password/pwdPolicy_syntax_test.py @@ -10,6 +10,7 @@ import logging import pytest from lib389.tasks import * +from lib389.utils import * from lib389.topologies import topology_st from lib389._constants import DEFAULT_SUFFIX, PASSWORD, DN_DM @@ -89,7 +90,7 @@ def resetPasswd(inst): # Now set the password try: inst.modify_s(USER_DN, - [(ldap.MOD_REPLACE, 'userpassword', PASSWORD)]) + [(ldap.MOD_REPLACE, 'userpassword', ensure_bytes(PASSWORD))]) except ldap.LDAPError as e: log.fatal("Failed to reset user password: " + str(e)) assert False @@ -105,7 +106,7 @@ def tryPassword(inst, policy_attr, value, reset_value, pw_bad, pw_good, msg): setPolicy(inst, policy_attr, value) try: inst.modify_s(USER_DN, - [(ldap.MOD_REPLACE, 'userpassword', pw_bad)]) + [(ldap.MOD_REPLACE, 'userpassword', ensure_bytes(pw_bad))]) log.fatal('Invalid password was unexpectedly accepted (%s)' % (policy_attr)) assert False @@ -120,7 +121,7 @@ def tryPassword(inst, policy_attr, value, reset_value, pw_bad, pw_good, msg): # Change password that is allowed try: inst.modify_s(USER_DN, - [(ldap.MOD_REPLACE, 'userpassword', pw_good)]) + [(ldap.MOD_REPLACE, 'userpassword', ensure_bytes(pw_good))]) except ldap.LDAPError as e: log.fatal("Failed to change password: " + str(e)) assert False diff --git a/dirsrvtests/tests/suites/password/pwdPolicy_warning_test.py b/dirsrvtests/tests/suites/password/pwdPolicy_warning_test.py index 10775ff..e493d5d 100644 --- a/dirsrvtests/tests/suites/password/pwdPolicy_warning_test.py +++ b/dirsrvtests/tests/suites/password/pwdPolicy_warning_test.py @@ -14,13 +14,13 @@ from lib389.utils import * from lib389.topologies import topology_st from lib389._constants import (DEFAULT_SUFFIX, DN_CONFIG, PASSWORD, DN_DM, - HOST_STANDALONE, PORT_STANDALONE, SERVERID_STANDALONE) + HOST_STANDALONE, PORT_STANDALONE, SERVERID_STANDALONE) from dateutil.parser import parse as dt_parse import datetime CONFIG_ATTR = 'passwordSendExpiringTime' -USER_DN = 'uid=tuser,{:s}'.format(DEFAULT_SUFFIX) -USER_PASSWD = 'secret123' +USER_DN = 'uid=tuser,{}'.format(DEFAULT_SUFFIX) +USER_PASSWD = b'secret123' logging.getLogger(__name__).setLevel(logging.INFO) log = logging.getLogger(__name__) @@ -37,40 +37,28 @@ def global_policy(topology_st, request): 'passwordMaxAge': '', 'passwordWarning': '', CONFIG_ATTR: ''} - try: - log.info('Get the default values') - entry = topology_st.standalone.getEntry(DN_CONFIG, ldap.SCOPE_BASE, - '(objectClass=*)', attrs.keys()) - for key in attrs.keys(): - attrs[key] = entry.getValue(key) - - log.info('Set the new values') - topology_st.standalone.modify_s(DN_CONFIG, [ - (ldap.MOD_REPLACE, 'passwordExp', 'on'), - (ldap.MOD_REPLACE, 'passwordMaxAge', '172800'), - (ldap.MOD_REPLACE, 'passwordWarning', '86400'), - (ldap.MOD_REPLACE, CONFIG_ATTR, 'on')]) + log.info('Get the default values') + entry = topology_st.standalone.getEntry(DN_CONFIG, ldap.SCOPE_BASE, + '(objectClass=*)', attrs.keys()) - except ldap.LDAPError as ex: - log.error("Failed to set global password policy, error:{:s}" \ - .format(ex.message['desc'])) - raise ex + for key in attrs.keys(): + attrs[key] = entry.getValue(key) + log.info('Set the new values') + topology_st.standalone.config.replace_many(('passwordExp', 'on'), + ('passwordMaxAge', '172800'), + ('passwordWarning', '86400'), + (CONFIG_ATTR, 'on')) def fin(): """Resets the defaults""" - try: - log.info('Reset the defaults') - for key in attrs.keys(): - topology_st.standalone.modify_s(DN_CONFIG, [ - (ldap.MOD_REPLACE, key, attrs[key])]) - except ldap.LDAPError as ex: - log.error("Failed to set defaults, error:{:s}".format(ex.message['desc'])) - raise ex + log.info('Reset the defaults') + for key in attrs.keys(): + topology_st.standalone.modify_s(DN_CONFIG, [ + (ldap.MOD_REPLACE, key, ensure_bytes(attrs[key]))]) request.addfinalizer(fin) - # A short sleep is required after the modifying password policy or cn=config time.sleep(0.5) @@ -86,40 +74,30 @@ def global_policy_default(topology_st, request): 'passwordMaxAge': '', 'passwordWarning': '', CONFIG_ATTR: ''} - try: - log.info('Get the default values') - entry = topology_st.standalone.getEntry(DN_CONFIG, ldap.SCOPE_BASE, - '(objectClass=*)', attrs.keys()) - for key in attrs.keys(): - attrs[key] = entry.getValue(key) - - log.info('Set the new values') - topology_st.standalone.modify_s(DN_CONFIG, [ - (ldap.MOD_REPLACE, 'passwordExp', 'on'), - (ldap.MOD_REPLACE, 'passwordMaxAge', '8640000'), - (ldap.MOD_REPLACE, 'passwordWarning', '86400'), - (ldap.MOD_REPLACE, CONFIG_ATTR, 'off')]) - except ldap.LDAPError as ex: - log.error("Failed to set global password policy, error:{:s}" \ - .format(ex.message['desc'])) - raise ex + + log.info('Get the default values') + entry = topology_st.standalone.getEntry(DN_CONFIG, ldap.SCOPE_BASE, + '(objectClass=*)', attrs.keys()) + for key in attrs.keys(): + attrs[key] = entry.getValue(key) + + log.info('Set the new values') + topology_st.standalone.modify_s(DN_CONFIG, [ + (ldap.MOD_REPLACE, 'passwordExp', b'on'), + (ldap.MOD_REPLACE, 'passwordMaxAge', b'8640000'), + (ldap.MOD_REPLACE, 'passwordWarning', b'86400'), + (ldap.MOD_REPLACE, CONFIG_ATTR, b'off')]) def fin(): """Resets the defaults""" log.info('Reset the defaults') - try: - for key in attrs.keys(): - topology_st.standalone.modify_s(DN_CONFIG, [ - (ldap.MOD_REPLACE, key, attrs[key]) - ]) - except ldap.LDAPError as ex: - log.error("Failed to reset defaults, error:{:s}" \ - .format(ex.message['desc'])) - raise ex + for key in attrs.keys(): + topology_st.standalone.modify_s(DN_CONFIG, [ + (ldap.MOD_REPLACE, key, ensure_bytes(attrs[key])) + ]) request.addfinalizer(fin) - # A short sleep is required after modifying password policy or cn=config time.sleep(0.5) @@ -128,29 +106,21 @@ def global_policy_default(topology_st, request): def add_user(topology_st, request): """Adds a user for binding""" - user_data = {'objectClass': 'top person inetOrgPerson'.split(), - 'uid': 'tuser', - 'cn': 'test user', - 'sn': 'user', + user_data = {'objectClass': b'top person inetOrgPerson'.split(), + 'uid': b'tuser', + 'cn': b'test user', + 'sn': b'user', 'userPassword': USER_PASSWD} log.info('Add the user') - try: - topology_st.standalone.add_s(Entry((USER_DN, user_data))) - except ldap.LDAPError as ex: - log.error("Failed to add user, error:{:s}".format(ex.message['desc'])) - raise ex + + topology_st.standalone.add_s(Entry((USER_DN, user_data))) def fin(): """Removes the user entry""" log.info('Remove the user entry') - try: - topology_st.standalone.delete_s(USER_DN) - except ldap.LDAPError as ex: - log.error("Failed to remove user, error:{:s}" \ - .format(ex.message['desc'])) - raise ex + topology_st.standalone.delete_s(USER_DN) request.addfinalizer(fin) @@ -159,18 +129,13 @@ def add_user(topology_st, request): def local_policy(topology_st, add_user): """Sets fine grained policy for user entry""" - log.info("Setting fine grained policy for user ({:s})".format(USER_DN)) - try: - subprocess.call(['%s/ns-newpwpolicy.pl' % topology_st.standalone.get_sbin_dir(), - '-D', DN_DM, - '-w', PASSWORD, '-h', HOST_STANDALONE, - '-p', str(PORT_STANDALONE), '-U', USER_DN, - '-Z', SERVERID_STANDALONE]) - except subprocess.CalledProcessError as ex: - log.error("Failed to set fine grained policy, error:{:s}" \ - .format(str(ex))) - raise ex + log.info("Setting fine grained policy for user ({})".format(USER_DN)) + subprocess.call(['%s/ns-newpwpolicy.pl' % topology_st.standalone.get_sbin_dir(), + '-D', DN_DM, + '-w', PASSWORD, '-h', HOST_STANDALONE, + '-p', str(PORT_STANDALONE), '-U', USER_DN, + '-Z', SERVERID_STANDALONE]) # A short sleep is required after modifying password policy time.sleep(0.5) @@ -182,20 +147,11 @@ def get_password_warning(topology_st): result_id = '' log.info('Bind with the user and request the password expiry warning time') - try: - result_id = topology_st.standalone.simple_bind(USER_DN, USER_PASSWD, - serverctrls=[PasswordPolicyControl()]) - res_type, res_data, res_msgid, res_ctrls = \ - topology_st.standalone.result3(result_id) - - # This exception will be thrown when the user's password has expired - except ldap.INVALID_CREDENTIALS as ex: - raise ex - except ldap.LDAPError as ex: - log.error("Failed to get password expiry warning time, error:{:s}" \ - .format(ex.message['desc'])) - raise ex + result_id = topology_st.standalone.simple_bind(USER_DN, USER_PASSWD, + serverctrls=[PasswordPolicyControl()]) + res_type, res_data, res_msgid, res_ctrls = \ + topology_st.standalone.result3(result_id) # Return the control return res_ctrls @@ -203,14 +159,8 @@ def get_password_warning(topology_st): def set_conf_attr(topology_st, attr, val): """Sets the value of a given attribute under cn=config""" - log.info("Setting {:s} to {:s}".format(attr, val)) - try: - topology_st.standalone.modify_s(DN_CONFIG, [(ldap.MOD_REPLACE, attr, val)]) - except ldap.LDAPError as ex: - log.error("Failed to set {:s} to {:s} error:{:s}" \ - .format(attr, val, ex.message['desc'])) - raise ex - + log.info("Setting {} to {}".format(attr, val)) + topology_st.standalone.modify_s(DN_CONFIG, [(ldap.MOD_REPLACE, attr, ensure_bytes(val))]) # A short sleep is required after modifying cn=config time.sleep(0.5) @@ -220,15 +170,9 @@ def get_conf_attr(topology_st, attr): attribute under cn=config entry """ - try: - entry = topology_st.standalone.getEntry(DN_CONFIG, ldap.SCOPE_BASE, - '(objectClass=*)', [attr]) - val = entry.getValue(attr) - except ldap.LDAPError as ex: - log.error("Failed to get the value of {:s}, error:{:s}" \ - .format(attr, ex.message['desc'])) - raise ex - + entry = topology_st.standalone.getEntry(DN_CONFIG, ldap.SCOPE_BASE, + '(objectClass=*)', [attr]) + val = entry.getValue(attr) # Return the value if no exeception is raised return val @@ -265,7 +209,7 @@ def test_different_values(topology_st, value): log.info('Now check the value is unchanged') assert get_conf_attr(topology_st, CONFIG_ATTR) == defval - log.info("Invalid value {:s} was rejected correctly".format(value)) + log.info("Invalid value {} was rejected correctly".format(value)) else: log.info('A valid value is being tested') set_conf_attr(topology_st, CONFIG_ATTR, value) @@ -273,7 +217,53 @@ def test_different_values(topology_st, value): log.info('Now check that the value has been changed') assert get_conf_attr(topology_st, CONFIG_ATTR) == value - log.info("{:s} is now set to {:s}".format(CONFIG_ATTR, value)) + log.info("{} is now set to {}".format(CONFIG_ATTR, value)) + + log.info('Set passwordSendExpiringTime back to the default value') + set_conf_attr(topology_st, CONFIG_ATTR, defval) + + +@pytest.mark.parametrize("value", (' ', 'junk123', 'on', 'off')) +def test_different_values(topology_st, value): + """Try to set passwordSendExpiringTime attribute + to various values both valid and invalid + + :id: 3e6d79fb-b4c8-4860-897e-5b207815a75d + :setup: Standalone instance + :steps: + 1. Try to set passwordSendExpiringTime to 'on' and 'off' + under cn=config entry + 2. Try to set passwordSendExpiringTime to ' ' and 'junk123' + under cn=config entry + 3. Run the search command to check the + value of passwordSendExpiringTime attribute + :expectedresults: + 1. Valid values should be accepted and saved + 2. Should be rejected with an OPERATIONS_ERROR + 3. The attribute should be changed for valid values + and unchanged for invalid + """ + + log.info('Get the default value') + defval = get_conf_attr(topology_st, CONFIG_ATTR) + + if value not in ('on', 'off'): + log.info('An invalid value is being tested') + with pytest.raises(ldap.OPERATIONS_ERROR): + set_conf_attr(topology_st, CONFIG_ATTR, value) + + log.info('Now check the value is unchanged') + assert get_conf_attr(topology_st, CONFIG_ATTR) == defval + + log.info("Invalid value {} was rejected correctly".format(value)) + else: + log.info('A valid value is being tested') + set_conf_attr(topology_st, CONFIG_ATTR, value) + + log.info('Now check that the value has been changed') + assert str(get_conf_attr(topology_st, CONFIG_ATTR), 'utf-8') == value + + log.info("{} is now set to {}".format(CONFIG_ATTR, value)) log.info('Set passwordSendExpiringTime back to the default value') set_conf_attr(topology_st, CONFIG_ATTR, defval) @@ -301,20 +291,20 @@ def test_expiry_time(topology_st, global_policy, add_user): """ res_ctrls = None - try: - log.info('Get the password expiry warning time') - log.info("Binding with ({:s}) and requesting the password expiry warning time" \ - .format(USER_DN)) - res_ctrls = get_password_warning(topology_st) - log.info('Check whether the time is returned') - assert res_ctrls + log.info('Get the password expiry warning time') + log.info("Binding with ({}) and requesting the password expiry warning time" \ + .format(USER_DN)) + res_ctrls = get_password_warning(topology_st) + + log.info('Check whether the time is returned') + assert res_ctrls + + log.info("user's password will expire in {:d} seconds" \ + .format(res_ctrls[0].timeBeforeExpiration)) - log.info("user's password will expire in {:d} seconds" \ - .format(res_ctrls[0].timeBeforeExpiration)) - finally: - log.info("Rebinding as DM") - topology_st.standalone.simple_bind_s(DN_DM, PASSWORD) + log.info("Rebinding as DM") + topology_st.standalone.simple_bind_s(DN_DM, PASSWORD) @pytest.mark.parametrize("attr,val", [(CONFIG_ATTR, 'off'), @@ -344,24 +334,23 @@ def test_password_warning(topology_st, global_policy, add_user, attr, val): 4. Bind should be successful """ - try: - log.info('Set configuration parameter') - set_conf_attr(topology_st, attr, val) + log.info('Set configuration parameter') + set_conf_attr(topology_st, attr, val) - log.info("Binding with ({:s}) and requesting password expiry warning time" \ - .format(USER_DN)) - res_ctrls = get_password_warning(topology_st) + log.info("Binding with ({}) and requesting password expiry warning time" \ + .format(USER_DN)) + res_ctrls = get_password_warning(topology_st) + + log.info('Check the state of the control') + if not res_ctrls: + log.info("Password Expiry warning time is not returned as {} is set to {}" \ + .format(attr, val)) + else: + log.info("({}) password will expire in {:d} seconds" \ + .format(USER_DN, res_ctrls[0].timeBeforeExpiration)) - log.info('Check the state of the control') - if not res_ctrls: - log.info("Password Expiry warning time is not returned as {:s} is set to {:s}" \ - .format(attr, val)) - else: - log.info("({:s}) password will expire in {:d} seconds" \ - .format(USER_DN, res_ctrls[0].timeBeforeExpiration)) - finally: - log.info("Rebinding as DM") - topology_st.standalone.simple_bind_s(DN_DM, PASSWORD) + log.info("Rebinding as DM") + topology_st.standalone.simple_bind_s(DN_DM, PASSWORD) def test_with_different_password_states(topology_st, global_policy, add_user): @@ -396,40 +385,38 @@ def test_with_different_password_states(topology_st, global_policy, add_user): log.info("Expire user's password by changing" \ "passwordExpirationTime timestamp") old_ts = topology_st.standalone.search_s(USER_DN, ldap.SCOPE_SUBTREE, - '(objectClass=*)', ['passwordExpirationTime'])[0].getValue('passwordExpirationTime') - log.info("Old passwordExpirationTime: {:s}".format(old_ts)) + '(objectClass=*)', ['passwordExpirationTime'])[0].getValue( + 'passwordExpirationTime') + log.info("Old passwordExpirationTime: {}".format(old_ts)) new_ts = (dt_parse(old_ts) - datetime.timedelta(31)).strftime('%Y%m%d%H%M%SZ') - log.info("New passwordExpirationTime: {:s}".format(new_ts)) - topology_st.standalone.modify_s(USER_DN, [(ldap.MOD_REPLACE, 'passwordExpirationTime', new_ts)]) + log.info("New passwordExpirationTime: {}".format(new_ts)) + topology_st.standalone.modify_s(USER_DN, [(ldap.MOD_REPLACE, 'passwordExpirationTime', ensure_bytes(new_ts))]) - try: - log.info("Attempting to bind with user {:s} and retrive the password" \ - " expiry warning time".format(USER_DN)) - with pytest.raises(ldap.INVALID_CREDENTIALS) as ex: - res_ctrls = get_password_warning(topology_st) + log.info("Attempting to bind with user {} and retrive the password" \ + " expiry warning time".format(USER_DN)) + with pytest.raises(ldap.INVALID_CREDENTIALS) as ex: + res_ctrls = get_password_warning(topology_st) - log.info("Bind Failed, error: {:s}".format(str(ex))) + log.info("Bind Failed, error: {}".format(str(ex))) - finally: - log.info("Rebinding as DM") - topology_st.standalone.simple_bind_s(DN_DM, PASSWORD) + log.info("Rebinding as DM") + topology_st.standalone.simple_bind_s(DN_DM, PASSWORD) log.info("Reverting back user's passwordExpirationTime") - topology_st.standalone.modify_s(USER_DN, [(ldap.MOD_REPLACE, 'passwordExpirationTime', old_ts)]) + topology_st.standalone.modify_s(USER_DN, [(ldap.MOD_REPLACE, 'passwordExpirationTime', ensure_bytes(old_ts))]) - try: - log.info("Rebinding with {:s} and retrieving the password" \ - " expiry warning time".format(USER_DN)) - res_ctrls = get_password_warning(topology_st) + log.info("Rebinding with {} and retrieving the password" \ + " expiry warning time".format(USER_DN)) + res_ctrls = get_password_warning(topology_st) - log.info('Check that the control is returned') - assert res_ctrls + log.info('Check that the control is returned') + assert res_ctrls - log.info("user's password will expire in {:d} seconds" \ - .format(res_ctrls[0].timeBeforeExpiration)) - finally: - log.info("Rebinding as DM") - topology_st.standalone.simple_bind_s(DN_DM, PASSWORD) + log.info("user's password will expire in {:d} seconds" \ + .format(res_ctrls[0].timeBeforeExpiration)) + + log.info("Rebinding as DM") + topology_st.standalone.simple_bind_s(DN_DM, PASSWORD) def test_default_behavior(topology_st, global_policy_default, add_user): @@ -453,17 +440,16 @@ def test_default_behavior(topology_st, global_policy_default, add_user): """ res_ctrls = None - try: - log.info("Binding with {:s} and requesting the password expiry warning time" \ - .format(USER_DN)) - res_ctrls = get_password_warning(topology_st) - log.info('Check that no control is returned') - assert not res_ctrls + log.info("Binding with {} and requesting the password expiry warning time" \ + .format(USER_DN)) + res_ctrls = get_password_warning(topology_st) - finally: - log.info("Rebinding as DM") - topology_st.standalone.simple_bind_s(DN_DM, PASSWORD) + log.info('Check that no control is returned') + assert not res_ctrls + + log.info("Rebinding as DM") + topology_st.standalone.simple_bind_s(DN_DM, PASSWORD) def test_when_maxage_and_warning_are_the_same(topology_st, global_policy_default, add_user): @@ -492,28 +478,27 @@ def test_when_maxage_and_warning_are_the_same(topology_st, global_policy_default """ log.info('Set the new values') - topology_st.standalone.modify_s(DN_CONFIG, [ - (ldap.MOD_REPLACE, 'passwordMaxAge', '86400')]) + topology_st.standalone.config.set('passwordMaxAge', '86400') res_ctrls = None - try: - log.info("First change user's password to reset its password expiration time") - topology_st.standalone.simple_bind_s(USER_DN, USER_PASSWD) - - topology_st.standalone.modify_s(USER_DN, [(ldap.MOD_REPLACE, - 'userPassword', USER_PASSWD)]) - log.info("Binding with {:s} and requesting the password expiry warning time" \ - .format(USER_DN)) - res_ctrls = get_password_warning(topology_st) - log.info('Check that control is returned even' - 'if passwordSendExpiringTime is set to off') - assert res_ctrls + log.info("First change user's password to reset its password expiration time") + topology_st.standalone.simple_bind_s(USER_DN, USER_PASSWD) + + topology_st.standalone.modify_s(USER_DN, [(ldap.MOD_REPLACE, + 'userPassword', ensure_bytes(USER_PASSWD))]) + log.info("Binding with {} and requesting the password expiry warning time" \ + .format(USER_DN)) + res_ctrls = get_password_warning(topology_st) + + log.info('Check that control is returned even' + 'if passwordSendExpiringTime is set to off') + assert res_ctrls - log.info("user's password will expire in {:d} seconds" \ - .format(res_ctrls[0].timeBeforeExpiration)) - finally: - log.info("Rebinding as DM") - topology_st.standalone.simple_bind_s(DN_DM, PASSWORD) + log.info("user's password will expire in {:d} seconds" \ + .format(res_ctrls[0].timeBeforeExpiration)) + + log.info("Rebinding as DM") + topology_st.standalone.simple_bind_s(DN_DM, PASSWORD) def test_with_local_policy(topology_st, global_policy, local_policy): @@ -538,18 +523,18 @@ def test_with_local_policy(topology_st, global_policy, local_policy): """ res_ctrls = None - try: - log.info("Attempting to get password expiry warning time for" \ - " user {:s}".format(USER_DN)) - res_ctrls = get_password_warning(topology_st) - log.info('Check that the control is not returned') - assert not res_ctrls + log.info("Attempting to get password expiry warning time for" \ + " user {}".format(USER_DN)) + res_ctrls = get_password_warning(topology_st) + + log.info('Check that the control is not returned') + assert not res_ctrls + + log.info("Password expiry warning time is not returned") - log.info("Password expiry warning time is not returned") - finally: - log.info("Rebinding as DM") - topology_st.standalone.simple_bind_s(DN_DM, PASSWORD) + log.info("Rebinding as DM") + topology_st.standalone.simple_bind_s(DN_DM, PASSWORD) if __name__ == '__main__': diff --git a/dirsrvtests/tests/suites/password/pwp_history_test.py b/dirsrvtests/tests/suites/password/pwp_history_test.py index f391646..459f9b5 100644 --- a/dirsrvtests/tests/suites/password/pwp_history_test.py +++ b/dirsrvtests/tests/suites/password/pwp_history_test.py @@ -55,15 +55,10 @@ def test_basic(topology_st): # Configure password history policy and add a test user # try: - topology_st.standalone.modify_s("cn=config", - [(ldap.MOD_REPLACE, - 'passwordHistory', 'on'), - (ldap.MOD_REPLACE, - 'passwordInHistory', '3'), - (ldap.MOD_REPLACE, - 'passwordChange', 'on'), - (ldap.MOD_REPLACE, - 'passwordStorageScheme', 'CLEAR')]) + topology_st.standalone.config.replace_many(('passwordHistory', 'on'), + ('passwordInHistory', '3'), + ('passwordChange', 'on'), + ('passwordStorageScheme', 'CLEAR')) log.info('Configured password policy.') except ldap.LDAPError as e: log.fatal('Failed to configure password policy: ' + str(e)) @@ -93,7 +88,7 @@ def test_basic(topology_st): # Attempt to change password to the same password try: topology_st.standalone.modify_s(USER_DN, [(ldap.MOD_REPLACE, - 'userpassword', 'password')]) + 'userpassword', b'password')]) log.info('Incorrectly able to to set password to existing password.') assert False except ldap.CONSTRAINT_VIOLATION: @@ -109,7 +104,7 @@ def test_basic(topology_st): # password1 try: topology_st.standalone.modify_s(USER_DN, [(ldap.MOD_REPLACE, - 'userpassword', 'password1')]) + 'userpassword', b'password1')]) except ldap.LDAPError as e: log.fatal('Failed to change password: ' + str(e)) assert False @@ -123,7 +118,7 @@ def test_basic(topology_st): # password2 try: topology_st.standalone.modify_s(USER_DN, [(ldap.MOD_REPLACE, - 'userpassword', 'password2')]) + 'userpassword', b'password2')]) except ldap.LDAPError as e: log.fatal('Failed to change password: ' + str(e)) assert False @@ -137,7 +132,7 @@ def test_basic(topology_st): # password3 try: topology_st.standalone.modify_s(USER_DN, [(ldap.MOD_REPLACE, - 'userpassword', 'password3')]) + 'userpassword', b'password3')]) except ldap.LDAPError as e: log.fatal('Failed to change password: ' + str(e)) assert False @@ -151,7 +146,7 @@ def test_basic(topology_st): # password4 try: topology_st.standalone.modify_s(USER_DN, [(ldap.MOD_REPLACE, - 'userpassword', 'password4')]) + 'userpassword', b'password4')]) except ldap.LDAPError as e: log.fatal('Failed to change password: ' + str(e)) assert False @@ -185,7 +180,7 @@ def test_basic(topology_st): # try: topology_st.standalone.modify_s(USER_DN, [(ldap.MOD_REPLACE, - 'userpassword', 'password1')]) + 'userpassword', b'password1')]) log.info('Incorrectly able to to set password to previous password1.') assert False except ldap.CONSTRAINT_VIOLATION: @@ -197,7 +192,7 @@ def test_basic(topology_st): try: topology_st.standalone.modify_s(USER_DN, [(ldap.MOD_REPLACE, - 'userpassword', 'password2')]) + 'userpassword', b'password2')]) log.info('Incorrectly able to to set password to previous password2.') assert False except ldap.CONSTRAINT_VIOLATION: @@ -207,7 +202,7 @@ def test_basic(topology_st): assert False try: topology_st.standalone.modify_s(USER_DN, [(ldap.MOD_REPLACE, - 'userpassword', 'password3')]) + 'userpassword', b'password3')]) log.info('Incorrectly able to to set password to previous password3.') assert False except ldap.CONSTRAINT_VIOLATION: @@ -228,7 +223,7 @@ def test_basic(topology_st): try: topology_st.standalone.modify_s(USER_DN, [(ldap.MOD_REPLACE, 'userpassword', - 'password-reset')]) + b'password-reset')]) except ldap.LDAPError as e: log.fatal('Failed to attempt to reset password: ' + str(e)) assert False @@ -244,7 +239,7 @@ def test_basic(topology_st): try: topology_st.standalone.modify_s(USER_DN, [(ldap.MOD_REPLACE, - 'userpassword', 'password4')]) + 'userpassword', b'password4')]) log.info('Incorrectly able to to set password to previous password4.') assert False except ldap.CONSTRAINT_VIOLATION: diff --git a/dirsrvtests/tests/suites/password/regression_test.py b/dirsrvtests/tests/suites/password/regression_test.py index 8e83bdf..bb54ea3 100644 --- a/dirsrvtests/tests/suites/password/regression_test.py +++ b/dirsrvtests/tests/suites/password/regression_test.py @@ -11,6 +11,7 @@ from lib389._constants import SUFFIX, PASSWORD, DN_DM from lib389.idm.user import UserAccounts from lib389.utils import ldap, os, logging, ensure_bytes from lib389.topologies import topology_st as topo +from lib389.idm.organisationalunit import OrganisationalUnits DEBUGGING = os.getenv("DEBUGGING", default=False) if DEBUGGING: @@ -25,10 +26,10 @@ user_data = {'cn': 'CNpwtest1', 'sn': 'SNpwtest1', 'uid': 'UIDpwtest1', 'mail': TEST_PASSWORDS = list(user_data.values()) # Add substring/token values of "CNpwtest1" TEST_PASSWORDS += ['CNpwtest1ZZZZ', 'ZZZZZCNpwtest1', - 'ZCNpwtest1', 'CNpwtest1Z', 'ZCNpwtest1Z', - 'ZZCNpwtest1', 'CNpwtest1ZZ', 'ZZCNpwtest1ZZ', - 'ZZZCNpwtest1', 'CNpwtest1ZZZ', 'ZZZCNpwtest1ZZZ', - 'ZZZZZZCNpwtest1ZZZZZZZZ'] + 'ZCNpwtest1', 'CNpwtest1Z', 'ZCNpwtest1Z', + 'ZZCNpwtest1', 'CNpwtest1ZZ', 'ZZCNpwtest1ZZ', + 'ZZZCNpwtest1', 'CNpwtest1ZZZ', 'ZZZCNpwtest1ZZZ', + 'ZZZZZZCNpwtest1ZZZZZZZZ'] TEST_PASSWORDS2 = ( 'CN12pwtest31', 'SN3pwtest231', 'UID1pwtest123', 'MAIL2pwtest12@redhat.com', '2GN1pwtest123', 'People123') @@ -45,13 +46,14 @@ def passw_policy(topo, request): topo.standalone.config.set('nsslapd-pwpolicy-local', 'on') subtree = 'ou=people,{}'.format(SUFFIX) + print(subtree) log.info('Configure subtree password policy for {}'.format(subtree)) - topo.standalone.subtreePwdPolicy(subtree, {'passwordchange': ensure_bytes('on'), - 'passwordCheckSyntax': ensure_bytes('on'), - 'passwordLockout': ensure_bytes('on'), - 'passwordResetFailureCount': ensure_bytes('3'), - 'passwordLockoutDuration': ensure_bytes('3'), - 'passwordMaxFailure': ensure_bytes('2')}) + topo.standalone.subtreePwdPolicy(subtree, {'passwordchange': b'on', + 'passwordCheckSyntax': b'on', + 'passwordLockout': b'on', + 'passwordResetFailureCount': b'3', + 'passwordLockoutDuration': b'3', + 'passwordMaxFailure': b'2'}) time.sleep(1) def fin(): @@ -104,7 +106,7 @@ def test_pwp_local_unlock(topo, passw_policy, test_user): test_user.bind(PASSWORD) log.info('Test passwordUnlock default - user should be able to reset password after lockout') - for i in range(0,2): + for i in range(0, 2): try: test_user.bind("bad-password") except ldap.INVALID_CREDENTIALS: @@ -114,7 +116,6 @@ def test_pwp_local_unlock(topo, passw_policy, test_user): log.fatal("Got unexpected failure: " + atr(e)) raise e - log.info('Verify account is locked') with pytest.raises(ldap.CONSTRAINT_VIOLATION): test_user.bind(PASSWORD) @@ -149,7 +150,7 @@ def test_trivial_passw_check(topo, passw_policy, test_user, user_pasw): try: log.info('Replace userPassword attribute with {}'.format(user_pasw)) with pytest.raises(ldap.CONSTRAINT_VIOLATION) as excinfo: - conn.modify_s(test_user.dn, [(ldap.MOD_REPLACE, 'userPassword', user_pasw)]) + conn.modify_s(test_user.dn, [(ldap.MOD_REPLACE, 'userPassword', ensure_bytes(user_pasw))]) log.fatal('Failed: Userpassword with {} is accepted'.format(user_pasw)) assert 'password based off of user entry' in str(excinfo.value) finally: @@ -180,7 +181,7 @@ def test_global_vs_local(topo, passw_policy, test_user, user_pasw): log.info('Replace userPassword attribute with {}'.format(user_pasw)) try: try: - conn.modify_s(test_user.dn, [(ldap.MOD_REPLACE, 'userPassword', user_pasw)]) + conn.modify_s(test_user.dn, [(ldap.MOD_REPLACE, 'userPassword', ensure_bytes(user_pasw))]) except ldap.LDAPError as e: log.fatal('Failed to replace userPassword: error {}'.format(e.message['desc'])) raise e diff --git a/src/lib389/lib389/__init__.py b/src/lib389/lib389/__init__.py index 34a3580..315516f 100644 --- a/src/lib389/lib389/__init__.py +++ b/src/lib389/lib389/__init__.py @@ -2597,10 +2597,10 @@ class DirSrv(SimpleLDAPObject, object): """input is dict of attr/vals""" mods = [] for (attr, val) in six.iteritems(pwdpolicy): - mods.append((ldap.MOD_REPLACE, attr, str(val))) + mods.append((ldap.MOD_REPLACE, attr, ensure_bytes(val))) if pwdargs: for (attr, val) in six.iteritems(pwdargs): - mods.append((ldap.MOD_REPLACE, attr, str(val))) + mods.append((ldap.MOD_REPLACE, attr, ensure_bytes(val))) self.modify_s(dn, mods) # Moved to config