log.info('Delete the previous access logs for the next test')

      topo.deleteAccessLogs()

  @pytest.mark.bz1732053

  @pytest.mark.ds50510

  def test_etime_at_border_of_second(topology_st):

              log.error('It remains invalid or weird etime: %s' % invalid_etime[i])

      assert not invalid_etime

  if __name__ == '__main__':

      # Run isolated

      # -s for DEBUG mode

  from lib389.tasks import *

  from lib389.topologies import topology_st

  from lib389.idm.user import UserAccounts, TEST_USER_PROPERTIES

  pytestmark = pytest.mark.tier1

      # Allow the unhashed password to be written to audit log

      topology_st.standalone.config.set('nsslapd-auditlog-logging-hide-unhashed-pw', 'off')

      # Set new password, and check the audit log

      user.reset_password('mypassword')

  #

  import pytest

  import time

  from lib389.tasks import *

  from lib389.topologies import topology_st

  from lib389.idm.user import UserAccounts, TEST_USER_PROPERTIES

  from lib389.idm.organizationalunit import OrganizationalUnits

  pytestmark = pytest.mark.tier1

      #

      user.set('userpassword', 'password1')

      user.rebind('password1')

      user.set('userpassword', 'password2')

      user.rebind('password2')

      user.set('userpassword', 'password3')

      user.rebind('password3')

      user.set('userpassword', 'password4')

      user.rebind('password4')

      #

      # Check that we only have 3 passwords stored in history

      try:

          user.set('userpassword', 'password1')

          log.fatal('Incorrectly able to to set password to previous password1.')

          assert False

      except ldap.CONSTRAINT_VIOLATION:

          log.info('Password change correctly rejected')

      try:

          user.set('userpassword', 'password2')

          log.fatal('Incorrectly able to to set password to previous password2.')

          assert False

      except ldap.CONSTRAINT_VIOLATION:

          log.info('Password change correctly rejected')

      try:

          user.set('userpassword', 'password3')

          log.fatal('Incorrectly able to to set password to previous password3.')

          assert False

      except ldap.CONSTRAINT_VIOLATION:

          log.info('Password change correctly rejected')

      #

      # Reset password by Directory Manager(admin reset)

      #

      user.set('userpassword', 'password-reset')

      time.sleep(1)

          user.rebind('password-reset')

          user.set('userpassword', 'password4')

          log.fatal('Incorrectly able to to set password to previous password4.')

          assert False

      except ldap.CONSTRAINT_VIOLATION:

          log.info('Password change correctly rejected')

          #

          # Test passwordInHistory to 0

          #

          try:

              topology_st.standalone.config.replace('passwordInHistory', '0')

              log.info('Configured passwordInHistory to 0.')

          except ldap.LDAPError as e:

              log.fatal('Failed to configure password policy (passwordInHistory to 0): ' + str(e))

              assert False

          # Verify the older passwords in the entry (passwordhistory) are ignored

          user.rebind('password-reset')

          user.set('userpassword', 'password4')

          try:

              user.set('userpassword', 'password4')

              log.fatal('Incorrectly able to to set password to current password4.')

              assert False

          except ldap.CONSTRAINT_VIOLATION:

              log.info('Password change correctly rejected')

      # Set the history count back to a positive value and make sure things still work

      # as expected

      #

      try:

          topology_st.standalone.config.replace('passwordInHistory', '2')

          log.info('Configured passwordInHistory to 2.')

          user.rebind('password5')

          user.set('userpassword', 'password5')

          log.fatal('Incorrectly able to to set password to current password5.')

          assert False

      except ldap.CONSTRAINT_VIOLATION:

          log.info('Password change correctly rejected')

          user.set('userpassword', 'password1')

      except ldap.LDAPError as e:

          log.fatal('Failed to attempt to change password: ' + str(e))

          assert False

      # Done

  from lib389.tasks import *

  from lib389.utils import *

  from lib389.topologies import topology_st

  from lib389._constants import (PLUGIN_ACCT_POLICY, DN_PLUGIN, DN_DM, PASSWORD, DEFAULT_SUFFIX,

                                 DN_CONFIG, SERVERID_STANDALONE)

      """Configure Global account policy plugin and restart the server"""

      log.info('Configuring Global account policy plugin, pwpolicy attributes and restarting the server')

      try:

          topology_st.standalone.config.set('passwordexp', 'on')

          topology_st.standalone.config.set('passwordmaxage', '400')

          topology_st.standalone.config.set('passwordwarning', '1')

      def fin():

          log.info('Disabling Global accpolicy plugin and removing pwpolicy attrs')

          try:

              topology_st.standalone.config.set('passwordexp', 'off')

              topology_st.standalone.config.set('passwordlockout', 'off')

          except ldap.LDAPError as e:

      """Configure Local account policy plugin for ou=people subtree and restart the server"""

      log.info('Adding Local account policy plugin configuration entries')

      try:

          topology_st.standalone.config.set('passwordmaxage', '400')

              'cosTemplateDn': TEMPL_COS,

      except ldap.LDAPError as e:

          log.error('Failed to configure Local account policy plugin')

          log.error('Failed to add entry {}, {}, {}:'.format(LOCL_CONF, TEMPL_COS, DEFIN_COS))

      def fin():

          log.info('Disabling Local accpolicy plugin and removing pwpolicy attrs')

          try:

              topology_st.standalone.plugins.disable(name=PLUGIN_ACCT_POLICY)

          except ldap.LDAPError as e:

              log.error('Failed to disable Local accpolicy plugin, {}'.format(e.message['desc']))

              assert False

      while (nousrs > 0):

          usrrdn = '{}{}'.format(userid, nousrs)

          userdn = 'uid={},{},{}'.format(usrrdn, subtree, suffix)

          for i in range(3):

              with pytest.raises(ldap.INVALID_CREDENTIALS):

                  log.error('No invalid credentials error for User {}'.format(userdn))

          with pytest.raises(ldap.CONSTRAINT_VIOLATION):

              log.error('User {} is not locked, expected error 19'.format(userdn))

          nousrs = nousrs - 1

          time.sleep(1)

      while (nousrs > 0):

          usrrdn = '{}{}'.format(userid, nousrs)

          userdn = 'uid={},{},{}'.format(usrrdn, subtree, suffix)

          log.info('Reset user password for user-{}'.format(userdn))

          if (bindusr == "DirMgr"):

              try:

              except ldap.LDAPError as e:

                  log.error('Unable to reset userPassword for user-{}'.format(userdn))

                  raise e

          elif (bindusr == "RegUsr"):

              try:

              except ldap.LDAPError as e:

                  log.error('Unable to reset userPassword for user-{}'.format(userdn))

                  raise e

      """Modify attribute value for a given DN"""

      log.info('Modify attribute value for a given DN')

      try:

      except ldap.LDAPError as e:

          log.error('Failed to replace lastLoginTime attribute for user-{} {}'.format(userdn, e.message['desc']))

          assert False

      """Check ModifyTimeStamp attribute present for user"""

      log.info('Check ModifyTimeStamp attribute present for user')

      while (nousrs > 0):

          usrrdn = '{}{}'.format(userid, nousrs)

          userdn = 'uid={},{},{}'.format(usrrdn, subtree, suffix)

          try:

          except ldap.LDAPError as e:

              log.error('ModifyTimeStamp attribute is not present for user-{} {}'.format(userdn, e.message['desc']))

              assert False

      new_attr_val = time.strftime("%Y%m%d%H%M%S", time.gmtime()) + 'Z'

      log.info('Enable account by replacing lastLoginTime/createTimeStamp/ModifyTimeStamp attribute')

      while (nousrs > 0):

          usrrdn = '{}{}'.format(userid, nousrs)

          userdn = 'uid={},{},{}'.format(usrrdn, subtree, suffix)

          try:

          except ldap.LDAPError as e:

              log.error('Failed to add/replace {} attribute to-{}, for user-{}'.format(attr_name, new_attr_val, userdn))

              raise e

      """Enable account by replacing cn attribute value, value of modifyTimeStamp changed"""

      log.info('Enable account by replacing cn attribute value, value of modifyTimeStamp changed')

      while (nousrs > 0):

          usrrdn = '{}{}'.format(userid, nousrs)

          userdn = 'uid={},{},{}'.format(usrrdn, subtree, suffix)

          try:

          except ldap.LDAPError as e:

              log.error('Failed to add/replace {} attribute to-{}, for user-{}'.format(attr_name, attr_value, userdn))

              raise e

      """Delete lastLoginTime/createTimeStamp/ModifyTimeStamp attribute from user account"""

      log.info('Delete lastLoginTime/createTimeStamp/ModifyTimeStamp attribute from user account')

      while (nousrs > 0):

          usrrdn = '{}{}'.format(userid, nousrs)

          userdn = 'uid={},{},{}'.format(usrrdn, subtree, suffix)

          try:

          except ldap.LDAPError as e:

              log.error('Failed to delete {} attribute for user-{}'.format(attr_name, userdn))

              raise e

      """Delete users from default test instance with given suffix, subtree, userid and nousrs"""

      log.info('del_users: Pass all of these as parameters suffix, subtree, userid and nousrs')

      users = UserAccounts(topology_st.standalone, suffix, rdn=subtree)

      while (nousrs > 0):

          usrrdn = '{}{}'.format(userid, nousrs)

      while (nousrs > ulimit):

          usrrdn = '{}{}'.format(userid, nousrs)

          userdn = 'uid={},{},{}'.format(usrrdn, subtree, suffix)

          if (tochck == "Enabled"):

              try:

              except ldap.LDAPError as e:

                  log.error('User {} failed to login, expected 0'.format(userdn))

                  raise e

          elif (tochck == "Expired"):

              with pytest.raises(ldap.INVALID_CREDENTIALS):

                  log.error('User {} password not expired , expected error 49'.format(userdn))

          elif (tochck == "Disabled"):

              with pytest.raises(ldap.CONSTRAINT_VIOLATION):

                  log.error('User {} is not inactivated, expected error 19'.format(userdn))

          nousrs = nousrs - 1

          time.sleep(1)

      nousrs = 3

      log.info('AccountInactivityLimit set to 12. Account will be inactivated if not accessed in 12 secs')

      add_users(topology_st, suffix, subtree, userid, nousrs, 0)

      log.info('Sleep for 10 secs to check if account is not inactivated, expected value 0')

      time.sleep(10)

      log.info('Account should not be inactivated since AccountInactivityLimit not exceeded')

      account_status(topology_st, suffix, subtree, userid, 3, 2, "Enabled")

      log.info('Sleep for 3 more secs to check if account is inactivated')

      time.sleep(3)

      account_status(topology_st, suffix, subtree, userid, 2, 0, "Disabled")

      log.info('Sleep +10 secs to check if account {}3 is inactivated'.format(userid))

      time.sleep(10)

      account_status(topology_st, suffix, subtree, userid, 3, 2, "Disabled")

      subtree = "ou=groups"

      userid = "pwexpusr"

      nousrs = 1

      try:

          topology_st.standalone.config.set('passwordmaxage', '9')

      except ldap.LDAPError as e:

      account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Enabled")

      # Reset maxage

      try:

          topology_st.standalone.config.set('passwordmaxage', '400')

      except ldap.LDAPError as e:

      time.sleep(11)

      account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Enabled")

      log.info('Moving users from ou=groups to ou=people subtree')

      try:

      except ldap.LDAPError as e:

          log.error('Failed to move user uid=nolockusr1 from ou=groups to ou=people')

          raise e

      time.sleep(11)

      account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Disabled")

      log.info('Moving users from ou=people to ou=groups subtree')

      try:

      except ldap.LDAPError as e:

          raise e

      log.info('Sleep for +2 secs and check users from both ou=people and ou=groups subtree')

      time.sleep(2)

      m1 = topology_with_tls.ms['master1']

      m2 = topology_with_tls.ms['master2']

      test_passw = 'm2Test199'

      _enable_changelog_encryption(m1, encryption)