[389-commits] dirsrvtests/tests ldap/ldif

dirsrvtests/tests/tickets/ticket48354_test.py | 109 ++++++++++++++++++++++++++
ldap/ldif/template-baseacis.ldif.in | 2
2 files changed, 110 insertions(+), 1 deletion(-)

New commits:
commit 3c2cd48b7d2cb0579f7de6d460bcd0c9bb1157bd
Author: William Brown <firstyear@redhat.com>
Date: Tue Jun 21 11:11:52 2016 +1000

Ticket 48354 - Review of default ACI in the directory server

Bug Description: By default we provide a default ACI that allows reading of the
default ACI

Fix Description: Change the default, and add a test to detect regresion of this.

https://fedorahosted.org/389/ticket/48354

Author: wibrown

Review by: nhosoi (Thanks!)

diff --git a/dirsrvtests/tests/tickets/ticket48354_test.py b/dirsrvtests/tests/tickets/ticket48354_test.py
new file mode 100644
index 0000000..53e1316
--- /dev/null
+++ b/dirsrvtests/tests/tickets/ticket48354_test.py
@@ -0,0 +1,109 @@
+import os
+import sys
+import time
+import ldap
+import logging
+import pytest
+from lib389 import DirSrv, Entry, tools, tasks
+from lib389.tools import DirSrvTools
+from lib389._constants import *
+from lib389.properties import *
+from lib389.tasks import *
+from lib389.utils import *
+
+DEBUGGING = False
+
+if DEBUGGING:
+ logging.getLogger(__name__).setLevel(logging.DEBUG)
+else:
+ logging.getLogger(__name__).setLevel(logging.INFO)
+
+
+log = logging.getLogger(__name__)
+
+
+class TopologyStandalone(object):
+ """The DS Topology Class"""
+ def __init__(self, standalone):
+ """Init"""
+ standalone.open()
+ self.standalone = standalone
+
+
+@pytest.fixture(scope="module")
+def topology(request):
+ """Create DS Deployment"""
+
+ # Creating standalone instance ...
+ if DEBUGGING:
+ standalone = DirSrv(verbose=True)
+ else:
+ standalone = DirSrv(verbose=False)
+ args_instance[SER_HOST] = HOST_STANDALONE
+ args_instance[SER_PORT] = PORT_STANDALONE
+ args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
+ args_instance[SER_CREATION_SUFFIX] = DEFAULT_SUFFIX
+ args_standalone = args_instance.copy()
+ standalone.allocate(args_standalone)
+ instance_standalone = standalone.exists()
+ if instance_standalone:
+ standalone.delete()
+ standalone.create()
+ standalone.open()
+
+ def fin():
+ """If we are debugging just stop the instances, otherwise remove
+ them
+ """
+ if DEBUGGING:
+ standalone.stop(60)
+ else:
+ standalone.delete()
+
+ request.addfinalizer(fin)
+
+ # Clear out the tmp dir
+ standalone.clearTmpDir(__file__)
+
+ return TopologyStandalone(standalone)
+
+
+def _attr_present(conn, name):
+ results = conn.search_s(DEFAULT_SUFFIX, ldap.SCOPE_SUBTREE, '(%s=*)' % name, [name,])
+ if DEBUGGING:
+ print(results)
+ if len(results) > 0:
+ return True
+ return False
+
+def test_ticket48354(topology):
+ """
+ Test that we cannot view ACIs, userPassword, or certain other attributes as anonymous.
+ """
+
+ if DEBUGGING:
+ # Add debugging steps(if any)...
+ pass
+
+ # Do an anonymous bind
+ conn = ldap.initialize("ldap://%s:%s" % (HOST_STANDALONE, PORT_STANDALONE))
+ conn.simple_bind_s()
+
+ # Make sure that we cannot see:
+ # * userPassword
+ assert(not _attr_present(conn, 'userPassword'))
+ # * aci
+ assert(not _attr_present(conn, 'aci'))
+ # * anything else?
+
+ conn.unbind_s()
+
+ log.info('Test PASSED')
+
+
+if __name__ == '__main__':
+ # Run isolated
+ # -s for DEBUG mode
+ CURRENT_FILE = os.path.realpath(__file__)
+ pytest.main("-s %s" % CURRENT_FILE)
+
diff --git a/ldap/ldif/template-baseacis.ldif.in b/ldap/ldif/template-baseacis.ldif.in
index 089fb1f..4575921 100644
--- a/ldap/ldif/template-baseacis.ldif.in
+++ b/ldap/ldif/template-baseacis.ldif.in
@@ -1,5 +1,5 @@
dn: %ds_suffix%
changetype: modify
add: aci
-aci: (targetattr!="userPassword")(version 3.0; acl "Enable anonymous access"; allow (read, search, compare) userdn="ldap:///anyone";)
+aci: (targetattr!="userPassword || aci")(version 3.0; acl "Enable anonymous access"; allow (read, search, compare) userdn="ldap:///anyone";)
aci: (targetattr="carLicense || description || displayName || facsimileTelephoneNumber || homePhone || homePostalAddress || initials || jpegPhoto || labeledURI || mail || mobile || pager || photo || postOfficeBox || postalAddress || postalCode || preferredDeliveryMethod || preferredLanguage || registeredAddress || roomNumber || secretary || seeAlso || st || street || telephoneNumber || telexNumber || title || userCertificate || userPassword || userSMIMECertificate || x500UniqueIdentifier")(version 3.0; acl "Enable self write for common attributes"; allow (write) userdn="ldap:///self";)

_______________________________________________
389-commits mailing list -- 389-commits@lists.fedoraproject.org
To unsubscribe send an email to 389-commits-leave@lists.fedoraproject.org