from lib389.plugins import ClassOfServicePlugin

  from lib389.cos import CosIndirectDefinitions, CosTemplates, CosTemplate

  from lib389.idm.user import UserAccounts, TEST_USER_PROPERTIES

  from lib389._constants import DEFAULT_SUFFIX

              ],

      })

      ou_temp = ous.create(properties={'ou': 'templates'})

      cos_temps = OUCosTemplates(topology_st.standalone, ou_temp.dn)

  from lib389.schema import Schema

  from lib389.idm.domain import Domain

  from lib389.idm.user import UserAccount, UserAccounts, TEST_USER_PROPERTIES

  from lib389.topologies import topology_m2

  from lib389._constants import SUFFIX, DN_SCHEMA, DN_DM, DEFAULT_SUFFIX, PASSWORD

      ACI_BODY = ACI_TARGET_TO + ACI_TARGET_FROM + ACI_ALLOW + ACI_SUBJECT

      # topology_m2.ms["master1"].modify_s(SUFFIX, mod)

      topology_m2.ms["master1"].log.info("Add a DENY aci under %s " % PROD_EXCEPT_DN)

      prod_except.set('aci', ACI_BODY, mod_type)

      """

      m1 = topology_m2.ms["master1"]

      m1.log.info("\n\n######## INITIALIZATION ########\n")

      # DIT for production/except

      m1.log.info("Add {}".format(PROD_EXCEPT_DN))

      o_roles_prod.create(properties={'cn': EXCEPT_CN, 'description': "production except DIT"})

      # enable acl error logging

      old_dn = "%s,%s" % (old_rdn, STAGING_DN)

      new_rdn = old_rdn

      new_superior = PRODUCTION_DN

      #

      # Try to rename without the appropriate ACI  => INSUFFICIENT_ACCESS

  from lib389._controls import SSSRequestControl

  from lib389.idm.user import UserAccounts

  from lib389.backend import Backends

  from lib389._mapped_object import DSLdapObject

      ACI_SUBJECT = '(userdn = "ldap:///anyone");)'

      ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT

      o_1.create(properties={

          'o': NEW_SUFFIX_1_NAME,

          'aci': ACI_BODY,

      mt = be_2.get_mapping_tree()

      mt.set_parent(NEW_SUFFIX_1)

      ou_2.create(properties={

          'ou': NEW_SUFFIX_2_NAME

      })

  from lib389 import Entry

  from lib389._constants import *

  from lib389.topologies import topology_st

  logging.getLogger(__name__).setLevel(logging.INFO)

  log = logging.getLogger(__name__)

                                               'userPassword': PASSWORD})))

          log.info('Adding an aci for the bind user')

          BN_ACI = '(targetattr="*")(version 3.0; acl "pwp test"; allow (all) userdn="ldap:///%s";)' % BN

          ou_people = ous.get('people')

          ou_people.add('aci', BN_ACI)

      except ldap.LDAPError as e:

      def fin():

          log.info('Deleting user {}'.format(BN))

          topology_st.standalone.delete_s(BN)

          ou_people = ous.get('people')

          ou_people.remove('aci', BN_ACI)

      log.info('Add pwdpolicysubentry attribute to {}'.format(OU_PEOPLE))

      try:

          ou_people = ous.get('people')

          ou_people.set('pwdpolicysubentry', PWP_CONTAINER_PEOPLE)

      except ldap.LDAPError as e:

  from lib389.idm.user import UserAccounts

  from lib389.utils import ldap, os, logging, ensure_bytes

  from lib389.topologies import topology_st as topo

  DEBUGGING = os.getenv("DEBUGGING", default=False)

  if DEBUGGING:

  from lib389.dseldif import DSEldif

  from lib389.idm.user import UserAccounts, UserAccount

  from lib389.idm.group import Groups

  from lib389.idm.domain import Domain

  from lib389.topologies import create_topology, topology_i2 as topo

      groups = Groups(inst, DEFAULT_SUFFIX)

      group = groups.create(properties={'cn': 'group'})

      branch1 = ous.create(properties={'ou': 'branch1'})

      branch2 = ous.create(properties={'ou': 'branch2'})

      # Configure plugin

      ############################################################################

      # Add our org units

      ou_people = ous.create(properties={'ou': 'managed_people'})

      ou_groups = ous.create(properties={'ou': 'managed_groups'})

  from lib389.idm.nscontainer import nsContainers

  from lib389.idm.user import UserAccounts

  from lib389.idm.group import Groups

  from lib389.replica import ReplicationManager

  from lib389.agreement import Agreements

  from lib389.plugins import MemberOfPlugin

          M2 = topology_m2.ms["master2"]

          repl = ReplicationManager(SUFFIX)

          ou_people = ous.create(properties={'ou': 'managed_people'})

          ou_groups = ous.create(properties={'ou': 'managed_groups'})

  from lib389.topologies import topology_m2 as topo_m2, TopologyMain, topology_m3 as topo_m3

  from lib389._constants import *

  from . import get_repl_entries

  from lib389.idm.user import UserAccount

  from lib389.replica import Replicas, ReplicationManager

  from lib389.changelog import Changelog5

      :id: a3e17698-9eb4-41e0-b537-8724b9915fa6

      :setup: Two masters replication setup

      :steps:

          2. Add 1 test user under OU=A

          3. Add same test user under OU=B

          4. Stop Replication

      repl = ReplicationManager(DEFAULT_SUFFIX)

      log.info("Add test entries - Add 3 OUs and 2 same users under 2 different OUs")

      OU_A = OUs.create(properties={

          'ou': 'A',

          'description': 'A',

  from lib389._constants import SUFFIX, DEFAULT_SUFFIX, ErrorLog

  from lib389.agreement import Agreements

  logging.getLogger(__name__).setLevel(logging.DEBUG)

  log = logging.getLogger(__name__)

      test_list = []

      log.info("Add 100 nested entries under replicated suffix on %s" % master1.serverid)

      for i in range(100):

          ou = ous.create(properties={

              'ou' : 'test_ou_%s' % i,

  from lib389._constants import DN_DM

  from lib389.cli_idm import account as cli_account

  from lib389.cli_idm import initialise as cli_init

  from lib389.cli_idm import group as cli_group

  from lib389.cli_idm import posixgroup as cli_posixgroup

  from lib389.cli_idm import user as cli_user

     user.rst

     group.rst

     domain.rst

     services.rst

  ====================

  Usage example

  ::

      # Don't forget that Services requires created rdn='ou=Services'

      from lib389.idm.services import ServiceAccounts

      services = ServiceAccounts(standalone, DEFAULT_SUFFIX)

      # Create the OU for them

  Module documentation

  -----------------------

     :members:

     :members:

  ::

      # Don't forget that Services requires created rdn='ou=Services'

      from lib389.idm.services import ServiceAccounts

      services = ServiceAccounts(standalone, DEFAULT_SUFFIX)

      # Create the OU for them

  # --- END COPYRIGHT BLOCK ---

  import argparse

  from lib389.cli_base import (

      populate_attr_arguments,

      _warn,

      )

  RDN = 'ou'

  # These are a generic specification, try not to tamper with them

      _generic_delete(inst, basedn, log.getChild('_generic_delete'), SINGULAR, dn)

  def create_parser(subparsers):

      subcommands = ou_parser.add_subparsers(help='action')

  from .sample import sampleentries

  from lib389.idm.domain import Domain

  from lib389.idm.group import UniqueGroups, UniqueGroup

  from lib389.plugins import WhoamiPlugin

              'aci' : '(targetattr ="*")(version 3.0;acl "Directory Administrators Group";allow (all) (groupdn = "ldap:///cn=Directory Administrators,{BASEDN}");)'.format(BASEDN=self._basedn)

              })

          # Create the OUs

          ous.create(properties = {

              'ou': 'Groups',

          })

  from .sample import sampleentries

  from lib389.idm.domain import Domain

  from lib389.idm.group import Groups

  from lib389.idm.posixgroup import PosixGroups

  from lib389.idm.user import nsUserAccounts

              })

          # Create our ous.

          ous.create(properties = {

              'ou': 'groups',

              'aci': [

  class nsContainer(DSLdapObject):

      """A single instance of a nsContainer. This is similar to OU

      :param instance: An instance

      :type instance: lib389.DirSrv

              'organization',

          ]

          self._filterattrs = [RDN]

          self._basedn = basedn

  RDN = 'cn'

      """A single instance of OrganizationalRole entry

      :param instance: An instance

      """

      def __init__(self, instance, dn=None):

          self._rdn_attribute = RDN

          self._must_attributes = MUST_ATTRIBUTES

          self._create_objectclasses = [

          self._protected = False

      """DSLdapObjects that represents OrganizationalRole entry

      :param instance: An instance

      """

      def __init__(self, instance, basedn):

          self._objectclasses = [

              'organizationalrole',

          ]

          self._filterattrs = [RDN]

          self._basedn = basedn

  ]

  RDN = 'ou'

      """A single instance of OrganizationalUnit entry

      :param instance: An instance

      """

      def __init__(self, instance, dn=None):

          self._rdn_attribute = RDN

          # Can I generate these from schema?

          self._must_attributes = MUST_ATTRIBUTES

          ]

          self._protected = False

      """DSLdapObjects that represents OrganizationalUnits entry

      :param instance: An instance

      """

      def __init__(self, instance, basedn):

          self._objectclasses = [

              'organizationalunit',

          ]

          self._filterattrs = [RDN]

          self._basedn = basedn

  from lib389.idm.group import Groups

  from lib389.idm.services import ServiceAccounts

  from lib389.agreement import Agreements

          """

          repl_group = self._create_service_group(from_instance)

          # Create our service account.

          ous.ensure_state(properties={

              'ou': 'Services'

          })

  from lib389.tasks import *

  from lib389.utils import *

  from lib389.idm.services import ServiceAccounts

  from lib389.topologies import topology_st as topology

      These are really useful in simple tests.

      """

      services = ServiceAccounts(topology.standalone, DEFAULT_SUFFIX)

      # Create the OU for them.

  from lib389.idm.user import UserAccount

  from lib389.idm.group import Group, UniqueGroup

  from lib389._constants import DEFAULT_SUFFIX

      ID each time. However, if it is provided with an existing ou/suffix it

      will fail to create a new ou and it will raise an LDAP error.

      """

      global test_ou_id

          'ou': ou,

      }

      ou.create(properties=properties)

      return ou