From 83972d19e778bd65261ab2cf8411209af40cea3a Mon Sep 17 00:00:00 2001 From: Anuj Borah Date: Nov 12 2019 11:33:51 +0000 Subject: Issue: 48055 - CI test - automember_plugin(part2) Bug Description: CI test - automember_plugin(part2) Relates: https://pagure.io/389-ds-base/issue/48055 Author: aborah Reviewed by: ??? --- diff --git a/dirsrvtests/tests/suites/automember_plugin/basic_test.py b/dirsrvtests/tests/suites/automember_plugin/basic_test.py index 1fd34f5..624ab25 100644 --- a/dirsrvtests/tests/suites/automember_plugin/basic_test.py +++ b/dirsrvtests/tests/suites/automember_plugin/basic_test.py @@ -11,6 +11,8 @@ Will test AutoMememer Plugin with AotoMember Task and Retro Changelog """ import os +import ldap +import pytest from lib389.topologies import topology_m1 as topo from lib389.idm.organizationalunit import OrganizationalUnits from lib389.idm.domain import Domain @@ -20,9 +22,10 @@ from lib389.plugins import AutoMembershipPlugin, AutoMembershipDefinitions, \ from lib389.backend import Backends from lib389.config import Config from lib389._constants import DEFAULT_SUFFIX -import ldap -import pytest +from lib389.idm.user import UserAccounts from lib389.idm.group import Groups, Group, UniqueGroup, nsAdminGroups, nsAdminGroup +from lib389.utils import ds_is_older + pytestmark = pytest.mark.tier1 @@ -34,7 +37,7 @@ REPMANDN = "cn=ReplManager" CACHE_SIZE = '-1' CACHEMEM_SIZE = '10485760' AUTO_MEM_SCOPE_TEST = "ou=Employees,{}".format(TEST_BASE) -AUTO_MEM_SCOPE_BASE = "ou=Employees,{}".format(BASE_SUFF) +AUTO_MEM_SCOPE_BASE = f'ou=Employees,{BASE_SUFF}' def add_base_entries(topo): @@ -72,6 +75,11 @@ def add_user(topo, user_id, suffix, uid_no, gid_no, role_usr): """ Will create entries with nsAdminGroup objectclass """ + objectclasses = ['top', 'person', 'posixaccount', 'inetuser', + 'nsMemberOf', 'nsAccount', 'nsAdminGroup'] + if ds_is_older('1.4.0'): + objectclasses.remove('nsAccount') + user = nsAdminGroups(topo.ms["master1"], suffix, rdn=None).create(properties={ 'cn': user_id, 'sn': user_id, @@ -80,8 +88,7 @@ def add_user(topo, user_id, suffix, uid_no, gid_no, role_usr): 'loginShell': '/bin/bash', 'uidNumber': uid_no, 'gidNumber': gid_no, - 'objectclass': ['top', 'person', 'posixaccount', 'inetuser', - 'nsMemberOf', 'nsAccount', 'nsAdminGroup'], + 'objectclass': objectclasses, 'nsAdminGroupName': role_usr, 'seeAlso': 'uid={},{}'.format(user_id, suffix), 'entrydn': 'uid={},{}'.format(user_id, suffix) @@ -612,7 +619,7 @@ def test_add_regular_expressions_for_user_groups_and_check_for_member_attribute_ 2. Should success """ test_id = "autoMembers_12" - default_group = "cn=SuffDef1,ou=userGroups,{}".format(BASE_SUFF) + default_group = f'cn=SuffDef1,ou=userGroups,{BASE_SUFF}' user = add_user(topo, "User_{}".format(test_id), AUTO_MEM_SCOPE_BASE, "19", "0", "HR") assert check_groups(topo, default_group, user.dn, "member") assert len(nsAdminGroup(topo.ms["master1"], user.dn).get_attr_vals_utf8('memberOf')) == 5 @@ -633,7 +640,7 @@ def test_users_with_gid_nos_matching_the_inclusive_regular_expression(topo, _cre 3. Should success """ test_id = "autoMembers_13" - managers_grp = "cn=Managers,ou=userGroups,{}".format(BASE_SUFF) + managers_grp = f'cn=Managers,ou=userGroups,{BASE_SUFF}' user1 = add_user(topo, "User_{}".format(test_id), AUTO_MEM_SCOPE_BASE, "9788", "9789", "VPEngg") user2 = add_user(topo, "SecondUser_{}".format(test_id), AUTO_MEM_SCOPE_BASE, "9392", "9393", "VPEngg") @@ -657,7 +664,7 @@ def test_users_with_manager_role_matching_inclusive_regular_expression(topo, _cr 3. Should success """ test_id = "autoMembers_14" - managers_grp = "cn=Managers,ou=userGroups,{}".format(BASE_SUFF) + managers_grp = f'cn=Managers,ou=userGroups,{BASE_SUFF}' user1 = add_user(topo, "User_{}".format(test_id), AUTO_MEM_SCOPE_BASE, "561", "562", "Manager") user2 = add_user(topo, "SecondUser_{}".format(test_id), AUTO_MEM_SCOPE_BASE, "562", "563", "Manager") @@ -681,7 +688,7 @@ def test_users_with_matching_gidrole_for_inclusive_regular_expression(topo, _cre 3. Should success """ test_id = "autoMembers_15" - managers_grp = "cn=Managers,ou=userGroups,{}".format(BASE_SUFF) + managers_grp = f'cn=Managers,ou=userGroups,{BASE_SUFF}' user1 = add_user(topo, "User_{}".format(test_id), AUTO_MEM_SCOPE_BASE, "9288", "9289", "Manager") user2 = add_user(topo, "SecondUser_{}".format(test_id), @@ -706,8 +713,8 @@ def test_users_with_gid_nos_matching_the_exclusive_regular_expression(topo, _cre 3. Should success """ test_id = "autoMembers_16" - managers_grp = "cn=Managers,ou=userGroups,{}".format(BASE_SUFF) - default_group = "cn=SuffDef1,ou=userGroups,{}".format(BASE_SUFF) + managers_grp = f'cn=Managers,ou=userGroups,{BASE_SUFF}' + default_group = f'cn=SuffDef1,ou=userGroups,{BASE_SUFF}' user = add_user(topo, "User_{}".format(test_id), AUTO_MEM_SCOPE_BASE, "6788", "6789", "Manager") with pytest.raises(AssertionError): assert check_groups(topo, managers_grp, user.dn, "member") @@ -730,8 +737,8 @@ def test_users_junior_role_matching_the_exclusive_regular_expression(topo, _crea 3. Should success """ test_id = "autoMembers_17" - managers_grp = "cn=Managers,ou=userGroups,{}".format(BASE_SUFF) - default_group = "cn=SuffDef1,ou=userGroups,{}".format(BASE_SUFF) + managers_grp = f'cn=Managers,ou=userGroups,{BASE_SUFF}' + default_group = f'cn=SuffDef1,ou=userGroups,{BASE_SUFF}' user = add_user(topo, "User_{}".format(test_id), AUTO_MEM_SCOPE_BASE, "562", "563", "Junior") with pytest.raises(AssertionError): assert check_groups(topo, managers_grp, user.dn, "member") @@ -754,8 +761,8 @@ def test_users_with_matching_gid_role_for_the_exclusive_regex_expression(topo, _ 3. Should success """ test_id = "autoMembers_18" - managers_grp = "cn=Managers,ou=userGroups,{}".format(BASE_SUFF) - default_group = "cn=SuffDef1,ou=userGroups,{}".format(BASE_SUFF) + managers_grp = f'cn=Managers,ou=userGroups,{BASE_SUFF}' + default_group = f'cn=SuffDef1,ou=userGroups,{BASE_SUFF}' user = add_user(topo, "User_{}".format(test_id), AUTO_MEM_SCOPE_BASE, "6788", "6789", "Junior") with pytest.raises(AssertionError): assert check_groups(topo, managers_grp, user.dn, "member") @@ -764,6 +771,499 @@ def test_users_with_matching_gid_role_for_the_exclusive_regex_expression(topo, _ user.delete() +def test_the_inclusive_and_exclusive_regular_expression(topo, _create_all_entries): + """ + Users with not matching gid nos and Role for + the Inclusive and Exclusive regular expression + :id: 4ff6a312-e7ff-11e8-baf0-8c16451d917b + :setup: Instance with replication + :steps: + 1. Create Users with not matching gid nos and Role for + the Inclusive and Exclusive regular expression + 2. It will be filtered with gidNumber(5788), uidNumber(5789) + and nsAdminGroupName(HRManager) + 3. It will a match for default_groups(5) but not for managers_grp + :expected results: + 1. Should success + 2. Should success + 3. Should success + """ + testid = "autoMembers_19" + auto_mem_scope = f'ou=Employees,{BASE_SUFF}' + managers_grp = f'cn=Managers,ou=userGroups,{BASE_SUFF}' + default_group = f'cn=SuffDef1,ou=userGroups,{BASE_SUFF}' + user = add_user(topo, "User_{}".format(testid), auto_mem_scope, "5788", "5789", "HRManager") + with pytest.raises(AssertionError): + assert check_groups(topo, managers_grp, user.dn, "member") + check_groups(topo, default_group, user.dn, "member") + assert len(nsAdminGroup(topo.ms["master1"], user.dn).get_attr_vals_utf8('memberOf')) == 5 + user.delete() + + +def test_users_with_gid_no_matching_the_inclusive_regular_expression(topo, _create_all_entries): + """ + Gid nos matching the Inclusive regular expression + :id: 4ff6cf4a-e7ff-11e8-84ce-8c16451d917b + :setup: Instance with replication + :steps: + 1. Create Users with gid nos matching the Inclusive regular expression + 2. It will be filtered with gidNumber(1188, 1191), uidNumber(1189, 1192) + and nsAdminGroupName(CEO) + 3. Inclusive regular expression will make user member of contract_grp + :expected results: + 1. Should success + 2. Should success + 3. Should success + """ + testid = "autoMembers_20" + auto_mem_scope = f'ou=Employees,{BASE_SUFF}' + contract_grp = f'cn=Contractors,ou=userGroups,{BASE_SUFF}' + user1 = add_user(topo, "User_{}".format(testid), auto_mem_scope, "1188", "1189", "CEO") + user2 = add_user(topo, "SecondUser_{}".format(testid), auto_mem_scope, "1191", "1192", "CEO") + for user_dn in [user1.dn, user2.dn]: + assert check_groups(topo, contract_grp, user_dn, "member") + assert len(nsAdminGroup(topo.ms["master1"], user1.dn).get_attr_vals_utf8('memberOf')) == 1 + for user in nsAdminGroups(topo.ms["master1"], auto_mem_scope, rdn=None).list(): + user.delete() + + +def test_contractor_role_matching_the_inclusive_regular_expression(topo, _create_all_entries): + """ + Contractor role matching the Inclusive regular expression + :id: 4ff6f9ca-e7ff-11e8-99c1-8c16451d917b + :setup: Instance with replication + :steps: + 1. Create users with Contractor role matching the Inclusive regular expression + 2. It will be filtered with gidNumber(1161, ), uidNumber(1162, 1163) + and nsAdminGroupName(Contractor) + 3. It will a match for contract_grp + :expected results: + 1. Should success + 2. Should success + 3. Should success + """ + testid = "autoMembers_21" + auto_mem_scope = f'ou=Employees,{BASE_SUFF}' + contract_grp = f'cn=Contractors,ou=userGroups,{BASE_SUFF}' + user1 = add_user(topo, "User_{}".format(testid), auto_mem_scope, "1161", "1162", "Contractor") + user2 = add_user(topo, "SecondUser_{}".format(testid), auto_mem_scope, + "1162", "1163", "Contractor") + for user_dn in [user1.dn, user2.dn]: + assert check_groups(topo, contract_grp, user_dn, "member") + assert len(nsAdminGroup(topo.ms["master1"], user1.dn).get_attr_vals_utf8('memberOf')) == 1 + for user in nsAdminGroups(topo.ms["master1"], auto_mem_scope, rdn=None).list(): + user.delete() + + +def test_matching_gid_nos_and_role_for_the_inclusive_regular_expression(topo, _create_all_entries): + """ + Matching gid nos and Role for the Inclusive regular expression + :id: 4ff71ce8-e7ff-11e8-b69b-8c16451d917b + :setup: Instance with replication + :steps: + 1. Create users with matching gid nos and Role for the Inclusive regular expression + 2. It will be filtered with gidNumber(5288, 5291), uidNumber(5289, 5292) + and nsAdminGroupName(Contractor) + 3. It will a match for contract_grp + :expected results: + 1. Should success + 2. Should success + 3. Should success + """ + testid = "autoMembers_22" + auto_mem_scope = f'ou=Employees,{BASE_SUFF}' + contract_grp = f'cn=Contractors,ou=userGroups,{BASE_SUFF}' + user1 = add_user(topo, "User_{}".format(testid), auto_mem_scope, "5288", "5289", "Contractor") + user2 = add_user(topo, "SecondUser_{}".format(testid), auto_mem_scope, + "5291", "5292", "Contractor") + for user_dn in [user1.dn, user2.dn]: + assert check_groups(topo, contract_grp, user_dn, "member") + assert len(nsAdminGroup(topo.ms["master1"], user1.dn).get_attr_vals_utf8('memberOf')) == 1 + for user in nsAdminGroups(topo.ms["master1"], auto_mem_scope, rdn=None).list(): + user.delete() + + +def test_with_gid_nos_matching_the_exclusive_regular_expression(topo, _create_all_entries): + """ + Gid nos matching the Exclusive regular expression + :id: 4ff74222-e7ff-11e8-a6ce-8c16451d917b + :setup: Instance with replication + :steps: + 1. Create users with gid nos matching the Exclusive regular expression + 2. It will be filtered with gidNumber(2788), uidNumber(2789) + and nsAdminGroupName(Contractor) + 3. It will not match for contract_grp(Exclusive regular expression) + :expected results: + 1. Should success + 2. Should success + 3. Should success + """ + testid = "autoMembers_23" + auto_mem_scope = f'ou=Employees,{BASE_SUFF}' + contract_grp = f'cn=Contractors,ou=userGroups,{BASE_SUFF}' + default_group = f'cn=SuffDef1,ou=userGroups,{BASE_SUFF}' + user = add_user(topo, "User_{}".format(testid), auto_mem_scope, "2788", "2789", "Contractor") + with pytest.raises(AssertionError): + assert check_groups(topo, contract_grp, user.dn, "member") + check_groups(topo, default_group, user.dn, "member") + assert len(nsAdminGroup(topo.ms["master1"], user.dn).get_attr_vals_utf8('memberOf')) == 5 + user.delete() + + +def test_employee_role_matching_the_exclusive_regular_expression(topo, _create_all_entries): + """ + Employee role matching the Exclusive regular expression + :id: 4ff76e64-e7ff-11e8-b9a5-8c16451d917b + :setup: Instance with replication + :steps: + 1. Create user with Junior role matching the Exclusive regular expression + 2. It will be filtered with gidNumber(1110), uidNumber(1111) + and nsAdminGroupName(Employee) + 3. It will not match for contract_grp(Exclusive regular expression) + :expected results: + 1. Should success + 2. Should success + 3. Should success + """ + testid = "autoMembers_24" + auto_mem_scope = f'ou=Employees,{BASE_SUFF}' + contract_grp = f'cn=Contractors,ou=userGroups,{BASE_SUFF}' + default_group = f'cn=SuffDef1,ou=userGroups,{BASE_SUFF}' + user = add_user(topo, "User_{}".format(testid), auto_mem_scope, "1110", "1111", "Employee") + with pytest.raises(AssertionError): + assert check_groups(topo, contract_grp, user.dn, "member") + check_groups(topo, default_group, user.dn, "member") + assert len(nsAdminGroup(topo.ms["master1"], user.dn).get_attr_vals_utf8('memberOf')) == 5 + user.delete() + + +def test_for_the_exclusive_regular_expression(topo, _create_all_entries): + """ + Matching gid nos and Role for the Exclusive regular expression + :id: 4ff79b64-e7ff-11e8-befd-8c16451d917b + :setup: Instance with replication + :steps: + 1. Create user with matching gid nos and Role for the Exclusive regular expression + 2. It will be filtered with gidNumber(9788), uidNumber(9789) + and nsAdminGroupName(Employee) + 3. It will not match for contract_grp(Exclusive regular expression) + 4. It will match for managers_grp(Inclusive regular expression) + :expected results: + 1. Should success + 2. Should success + 3. Should success + """ + testid = "autoMembers_25" + auto_mem_scope = f'ou=Employees,{BASE_SUFF}' + contract_grp = f'cn=Contractors,ou=userGroups,{BASE_SUFF}' + managers_grp = f'cn=Managers,ou=userGroups,{BASE_SUFF}' + user = add_user(topo, "User_{}".format(testid), auto_mem_scope, "9788", "9789", "Employee") + with pytest.raises(AssertionError): + assert check_groups(topo, contract_grp, user.dn, "member") + check_groups(topo, managers_grp, user.dn, "member") + assert len(nsAdminGroup(topo.ms["master1"], user.dn).get_attr_vals_utf8('memberOf')) == 1 + user.delete() + + +def test_gid_nos_and_role_for_the_inclusive_exclusive_regular_expression(topo, _create_all_entries): + """ + Matching gid nos and Role for the Inclusive and Exclusive regular expression + :id: 4ff7d160-e7ff-11e8-8fbc-8c16451d917b + :setup: Instance with replication + :steps: + 1. Create user with not matching gid nos and Role for + the Inclusive and Exclusive regular expression + 2. It will be filtered with gidNumber(5788), uidNumber(5789) + and nsAdminGroupName(Intern) + 3. It will not match for contract_grp(Exclusive regular expression) + 4. It will match for default_group(Inclusive regular expression) + :expected results: + 1. Should success + 2. Should success + 3. Should success + 4. Should success + """ + testid = "autoMembers_26" + auto_mem_scope = f'ou=Employees,{BASE_SUFF}' + contract_grp = f'cn=Contractors,ou=userGroups,{BASE_SUFF}' + default_group = f'cn=SuffDef1,ou=userGroups,{BASE_SUFF}' + user = add_user(topo, "User_{}".format(testid), auto_mem_scope, "5788", "5789", "Intern") + with pytest.raises(AssertionError): + assert check_groups(topo, contract_grp, user.dn, "member") + check_groups(topo, default_group, user.dn, "member") + assert len(nsAdminGroup(topo.ms["master1"], user.dn).get_attr_vals_utf8('memberOf')) == 5 + user.delete() + + +def test_contractors_group_no_member_uid_for_managers_group(topo, _create_all_entries): + """ + Matching gid nos and Role for the Inclusive and Exclusive regular expression + :id: 4ff7fdc0-e7ff-11e8-b15e-8c16451d917b + :setup: Instance with replication + :steps: + 1. Add user to go to Contractors group, no memberUid for Managers group + 2. It will be filtered with gidNumber(595), uidNumber(690) + and nsAdminGroupName(ContractHR) + 3. It will not match for contract_grp(Exclusive regular expression) + 4. It will match for contract_grp(Inclusive regular expression) + :expected results: + 1. Should success + 2. Should success + 3. Should success + 4. Should success + """ + testid = "autoMembers_27" + auto_mem_scope = f'ou=Employees,{BASE_SUFF}' + contract_grp = f'cn=Contractors,cn=subsuffGroups,{SUBSUFFIX}' + managers_grp = f'cn=Managers,cn=subsuffGroups,{SUBSUFFIX}' + user = add_user(topo, "User_{}".format(testid), auto_mem_scope, "595", "690", "ContractHR") + check_groups(topo, contract_grp, user.dn, "memberUid") + with pytest.raises(AssertionError): + assert check_groups(topo, managers_grp, user.dn, "memberUid") + user.delete() + + +def test_member_uid_attr_at_contractors_and_managers_group(topo, _create_all_entries): + """ + Match both inclusive regex rules, memberUid attr + :id: 4ff8275a-e7ff-11e8-a28b-8c16451d917b + :setup: Instance with replication + :steps: + 1. Add User to match both inclusive regex rules, memberUid attr + should be created at Contractors and Managers group + 2. It will be filtered with gidNumber(555), uidNumber(3663) + and nsAdminGroupName(ContractHR) + 3. It will match for contract_grp and managers_grp(Inclusive regular expression) + :expected results: + 1. Should success + 2. Should success + 3. Should success + """ + testid = "autoMembers_28" + auto_mem_scope = f'ou=Employees,{BASE_SUFF}' + contract_grp = f'cn=Contractors,cn=subsuffGroups,{SUBSUFFIX}' + managers_grp = f'cn=Managers,cn=subsuffGroups,{SUBSUFFIX}' + user = add_user(topo, "User_{}".format(testid), auto_mem_scope, "555", "3663", "ContractHR") + for group in [contract_grp, managers_grp]: + check_groups(topo, group, user.dn, "memberuid") + user.delete() + + +def test_inclusive_contractors_exclusive_regex_rules(topo, _create_all_entries): + """ + Match managers inclusive regex rules, Contractors exclusive regex rules + :id: 4ff85126-e7ff-11e8-8992-8c16451d917b + :setup: Instance with replication + :steps: + 1. Add User to match managers inclusive regex rules, Contractors exclusive regex rules + 2. It will be filtered with gidNumber(8195), uidNumber(2753) + and nsAdminGroupName(Employee) + 3. It will match for managers_grp(Inclusive regular expression) + 4. It will not match for contract_grp(Exclusive regular expression) + :expected results: + 1. Should success + 2. Should success + 3. Should success + 4. Should success + """ + testid = "autoMembers_29" + auto_mem_scope = f'ou=Employees,{BASE_SUFF}' + contract_grp = f'cn=Contractors,cn=subsuffGroups,{SUBSUFFIX}' + managers_grp = f'cn=Managers,cn=subsuffGroups,{SUBSUFFIX}' + user = add_user(topo, "User_{}".format(testid), auto_mem_scope, "8195", "2753", "Employee") + check_groups(topo, managers_grp, user.dn, "memberuid") + with pytest.raises(AssertionError): + assert check_groups(topo, contract_grp, user.dn, "memberuid") + user.delete() + + +def test_managers_contractors_exclusive_regex_rules(topo, _create_all_entries): + """ + Match both managers and contractors exclusive regex rules + :id: 4ff87bba-e7ff-11e8-99dc-8c16451d917b + :setup: Instance with replication + :steps: + 1. Add User to match both managers and contractors exclusive regex rules, + memberUid created in Default grp + 2. It will be filtered with gidNumber(999), uidNumber(400) + and nsAdminGroupName(Supervisor) + 3. It will match for default_group1 and default_group2(Inclusive regular expression) + :expected results: + 1. Should success + 2. Should success + 3. Should success + """ + testid = "autoMembers_30" + auto_mem_scope = f'ou=Employees,{BASE_SUFF}' + default_group1 = f'cn=SubDef1,{SUBSUFFIX}' + default_group2 = f'cn=SubDef2,{SUBSUFFIX}' + user = add_user(topo, "User_{}".format(testid), auto_mem_scope, "999", "400", "Supervisor") + for group in [default_group1, default_group2]: + assert check_groups(topo, group, user.dn, "memberuid") + user.delete() + + +def test_managers_contractors_exclusive_regex_rules_default_grp(topo, _create_all_entries): + """ + Match both managers and contractors exclusive regex rules + :id: 4ff89d84-e7ff-11e8-bc8c-8c16451d917b + :setup: Instance with replication + :steps: + 1. Add Users to match both managers and contractors exclusive regex rules, + memberUid created in Default grp + 2. It will be filtered with gidNumber(515), uidNumber(200) + and nsAdminGroupName(Junior) + 3. It will match for default_group1 and default_group2(Inclusive regular expression) + :expected results: + 1. Should success + 2. Should success + 3. Should success + """ + testid = "autoMembers_31" + auto_mem_scope = f'ou=Employees,{BASE_SUFF}' + default_group1 = f'cn=SubDef1,{SUBSUFFIX}' + default_group2 = f'cn=SubDef5,{SUBSUFFIX}' + user = add_user(topo, "User_{}".format(testid), auto_mem_scope, "515", "200", "Junior") + for group in [default_group1, default_group2]: + assert check_groups(topo, group, user.dn, "memberuid") + user.delete() + + +def test_managers_contractors_exclusive_regex_rules_member_uid(topo, _create_all_entries): + """ + Match both managers and contractors exclusive regex rules + :id: 4ff8be18-e7ff-11e8-94aa-8c16451d917b + :setup: Instance with replication + :steps: + 1. Add Users to match both managers and contractors exclusive regex rules, + memberUid created in Default grp + 2. It will be filtered with gidNumber(555), uidNumber(720) + and nsAdminGroupName(Employee) + 3. It will match for default_group1 and default_group2(Inclusive regular expression) + :expected results: + 1. Should success + 2. Should success + 3. Should success + """ + testid = "autoMembers_32" + auto_mem_scope = f'ou=Employees,{BASE_SUFF}' + default_group1 = f'cn=SubDef1,{SUBSUFFIX}' + default_group2 = f'cn=SubDef3,{SUBSUFFIX}' + user = add_user(topo, "User_{}".format(testid), auto_mem_scope, "555", "720", "Employee") + for group in [default_group1, default_group2]: + assert check_groups(topo, group, user.dn, "memberuid") + user.delete() + + +def test_managers_inclusive_regex_rule(topo, _create_all_entries): + """ + Match managers inclusive regex rule, and no + inclusive/exclusive Contractors regex rules + :id: 4ff8d862-e7ff-11e8-b688-8c16451d917b + :setup: Instance with replication + :steps: + 1. Add User to match managers inclusive regex rule, and no + inclusive/exclusive Contractors regex rules + 2. It will be filtered with gidNumber(545), uidNumber(3333) + and nsAdminGroupName(Supervisor) + 3. It will match for managers_grp(Inclusive regular expression) + 4. It will not match for contract_grp(Exclusive regular expression) + :expected results: + 1. Should success + 2. Should success + 3. Should success + 4. Should success + """ + testid = "autoMembers_33" + auto_mem_scope = f'ou=Employees,{BASE_SUFF}' + contract_grp = f'cn=Contractors,cn=subsuffGroups,{SUBSUFFIX}' + managers_grp = f'cn=Managers,cn=subsuffGroups,{SUBSUFFIX}' + user = add_user(topo, "User_{}".format(testid), auto_mem_scope, "545", "3333", "Supervisor") + check_groups(topo, managers_grp, user.dn, "memberuid") + with pytest.raises(AssertionError): + assert check_groups(topo, contract_grp, user.dn, "memberuid") + user.delete() + + +def test_contractors_rule_managers_regex_rules(topo, _create_all_entries): + """ + Match Contractors inclusive regex rule + and no inclusive/exclusive Managers regex rules + :id: 4ff8f2ca-e7ff-11e8-83b6-8c16451d917b + :setup: Instance with replication + :steps: + 1. Add User to match Contractors inclusive regex rule, + and no inclusive/exclusive Managers regex rules + 2. It will be filtered with gidNumber(8195), uidNumber(693) + and nsAdminGroupName(Temporary) + 3. It will match for contract_grp(Inclusive regular expression) + 4. It will not match for managers_grp(Exclusive regular expression) + :expected results: + 1. Should success + 2. Should success + 3. Should success + 4. Should success + """ + testid = "autoMembers_34" + auto_mem_scope = f'ou=Employees,{BASE_SUFF}' + contract_grp = f'cn=Contractors,cn=subsuffGroups,{SUBSUFFIX}' + managers_grp = f'cn=Managers,cn=subsuffGroups,{SUBSUFFIX}' + user = add_user(topo, "User_{}".format(testid), auto_mem_scope, "8195", "693", "Temporary") + check_groups(topo, contract_grp, user.dn, "memberuid") + with pytest.raises(AssertionError): + assert check_groups(topo, managers_grp, user.dn, "memberuid") + user.delete() + + +def test_reject_invalid_config_and_we_donot_deadlock_the_server(topo, _create_all_entries): + """ + Verify DS reject invalid config, and we don't deadlock the server + :id: 4ff90c38-e7ff-11e8-b72a-8c16451d917b + :setup: Instance with replication + :steps: + 1. Verify DS reject invalid config, + 2. This operation don't deadlock the server + :expected results: + 1. Should success + 2. Should success + """ + # Changing config area to dc=automembers,dc=com + instance = AutoMembershipPlugin(topo.ms["master1"]) + instance.replace("nsslapd-pluginConfigArea", BASE_SUFF) + topo.ms["master1"] .restart() + # Attempting to add invalid config... + automembers = AutoMembershipDefinitions(topo.ms["master1"], BASE_SUFF) + with pytest.raises(ldap.UNWILLING_TO_PERFORM): + automembers.create(properties={ + 'cn': 'userGroups', + "autoMemberScope": BASE_SUFF, + "autoMemberFilter": "objectclass=posixAccount", + "autoMemberDefaultGroup": f'cn=SuffDef1,ou=userGroups,{BASE_SUFF}', + "autoMemberGroupingAttr": "member: dn" + }) + # Verify server is still working + automembers = AutoMembershipRegexRules(topo.ms["master1"], + f'cn=userGroups,cn=Auto Membership Plugin,' + f'cn=plugins,cn=config') + with pytest.raises(ldap.ALREADY_EXISTS): + automembers.create(properties={ + 'cn': 'Managers', + 'description': f'Group placement for Managers', + 'autoMemberTargetGroup': [f'cn=Managers,ou=userGroups,{BASE_SUFF}'], + 'autoMemberInclusiveRegex': [ + "gidNumber=^9", + "nsAdminGroupName=^Manager", + ], + }) + + # Adding first user... + for uid in range(300, 302): + UserAccounts(topo.ms["master1"], BASE_SUFF, rdn=None).create_test_user(uid=uid, gid=uid) + # Adding this line code to remove the automembers plugin configuration. + instance.remove("nsslapd-pluginConfigArea", BASE_SUFF) + topo.ms["master1"] .restart() + + if __name__ == "__main__": CURRENT_FILE = os.path.realpath(__file__) pytest.main("-s -v %s" % CURRENT_FILE)