dirsrvtests/tests/suites/acctpolicy_plugin/accpol_test.py | 223 +++++++++-----
1 file changed, 153 insertions(+), 70 deletions(-)
New commits:
commit b032f7194cdc7ba4ba7e534925d7e13c43ca6594
Author: Sankar Ramalingam <sramling(a)redhat.com>
Date: Wed Jan 4 17:59:20 2017 +0530
Ticket 48050 - Refactor acctpolicy_plugin suite
Description: Add 3 test cases, fix docstrings and add pytest.raises.
https://fedorahosted.org/389/ticket/48050
Reviewed by: spichugi
Signed-off-by: Simon Pichugin <spichugi(a)redhat.com>
diff --git a/dirsrvtests/tests/suites/acctpolicy_plugin/accpol_test.py
b/dirsrvtests/tests/suites/acctpolicy_plugin/accpol_test.py
index a005f3f..3cf93b0 100644
--- a/dirsrvtests/tests/suites/acctpolicy_plugin/accpol_test.py
+++ b/dirsrvtests/tests/suites/acctpolicy_plugin/accpol_test.py
@@ -20,21 +20,13 @@ TEMPLT_COS = 'cn=TempltCoS,ou=people,dc=example,dc=com'
DEFN_COS = 'cn=DefnCoS,ou=people,dc=example,dc=com'
ACCPOL_DN = "cn={},{}".format(PLUGIN_ACCT_POLICY, DN_PLUGIN)
CONFIG_DN = "cn=config,{}".format(ACCPOL_DN)
-SUBTREE = 'ou=people'
-SUFFIX = DEFAULT_SUFFIX
-USR_NAME = 'testusr'
-NOF_USERS = 5
INACT_VAL = 15
-USR_RDN = '{}'.format(USR_NAME)
-USR_DN = 'uid={},{},{}'.format(USR_RDN, SUBTREE, SUFFIX)
USER_PW = 'Secret1234'
@pytest.fixture(scope="module")
def accpolicy_local(topology_st):
- """Configure account policy plugin based
- on LDIF file and restart the server.
- """
+ """Configure local account policy plugin for ou=people subtree and
restart the server"""
log.info('Enabling account policy plugin and restarting the server')
try:
@@ -46,10 +38,10 @@ def accpolicy_local(topology_st):
topology_st.standalone.modify_s(CONFIG_DN, [(ldap.MOD_REPLACE,
'specattrname', 'acctPolicySubentry')])
topology_st.standalone.modify_s(CONFIG_DN, [(ldap.MOD_REPLACE,
'limitattrname', 'accountInactivityLimit')])
except ldap.LDAPError as e:
- log.error("Failed to modify account policy plugin attrs attrs")
+ log.error('Failed to modify account policy plugin attrs')
raise
- log.info("Adding Local account policy plugin configuration entries")
+ log.info('Adding Local account policy plugin configuration entries')
try:
topology_st.standalone.add_s(Entry((LOCAL_CONFIG, {
'objectclass': ['top', 'ldapsubentry',
'extensibleObject', 'accountpolicy'],
@@ -67,92 +59,183 @@ def accpolicy_local(topology_st):
topology_st.standalone.restart(timeout=10)
-(a)pytest.fixture(scope="module")
-def users(topology_st, request):
- """Add users to the given SUFFIX and SUBTREE."""
+def add_users(topology_st, suffix, subtre, userid, nousrs):
+ """Add users to default test instance with given suffix, subtre,
userid and nousrs"""
- log.info('Adding {} {} users to {} SUBTREE {} SUFFIX'.format(NOF_USERS,
USR_NAME, SUBTREE, SUFFIX))
- for NUM in range(1, NOF_USERS):
- USR_RDN = '{}{}'.format(USR_NAME, NUM)
- USR_DN = 'uid={},{},{}'.format(USR_RDN, SUBTREE, SUFFIX)
+ log.info('add_users: Pass all of these as parameteres suffix, subtre, userid and
nousrs')
+ topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
+ while (nousrs > 0):
+ usrrdn = '{}{}'.format(userid, nousrs)
+ userdn = 'uid={},{},{}'.format(usrrdn, subtre, suffix)
try:
- topology_st.standalone.add_s(Entry((USR_DN, {
+ topology_st.standalone.add_s(Entry((userdn, {
'objectclass': 'top person'.split(),
'objectclass': 'inetorgperson',
- 'cn': USR_RDN,
- 'sn': USR_RDN,
- 'userpassword': 'Secret1234',
- 'mail': '{}(a)redhat.com'.format(USR_RDN)})))
+ 'cn': usrrdn,
+ 'sn': usrrdn,
+ 'userpassword': USER_PW,
+ 'mail': '{}(a)redhat.com'.format(usrrdn)})))
except ldap.LDAPError as e:
- log.error('Failed to add {} user: error {}'.format(USR_DN,
e.message['desc']))
+ log.error('Failed to add {} user: error {}'.format(userdn,
e.message['desc']))
raise
+ nousrs = nousrs - 1
- def fin():
- log.info('Deleting {} {} users from {} {}'.format(NOF_USERS, USR_NAME,
SUBTREE, SUFFIX))
- topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
- for NUM in range(1, NOF_USERS):
- USR_RDN = '{}{}'.format(USR_NAME, NUM)
- USR_DN = 'uid={},{},{}'.format(USR_RDN, SUBTREE, SUFFIX)
+
+def del_users(topology_st, suffix, subtre, userid, nousrs):
+ """Delete users from default test instance with given suffix, subtre,
userid and nousrs"""
+
+ log.info('del_users: Pass all of these as parameteres suffix, subtre, userid and
nousrs')
+ topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
+ while (nousrs > 0):
+ usrrdn = '{}{}'.format(userid, nousrs)
+ userdn = 'uid={},{},{}'.format(usrrdn, subtre, suffix)
+ try:
+ topology_st.standalone.delete_s(userdn)
+ except ldap.LDAPError as e:
+ log.error('Failed to delete {} user: error {}'.format(userdn,
e.message['desc']))
+ raise
+ nousrs = nousrs - 1
+
+
+def account_status(topology_st, suffix, subtre, userid, nousrs, ulimit, tochck):
+ """Check account status for the given suffix, subtre, userid and
nousrs"""
+
+ while (nousrs > ulimit):
+ usrrdn = '{}{}'.format(userid, nousrs)
+ userdn = 'uid={},{},{}'.format(usrrdn, subtre, suffix)
+ if (tochck == "Enabled"):
try:
- topology_st.standalone.delete_s(USR_DN)
+ topology_st.standalone.simple_bind_s(userdn, USER_PW)
except ldap.LDAPError as e:
- log.error('Failed to delete {} :error- {}'.format(USR_DN,
e.message['desc']))
+ log.error('User {} is inactivated, expected 0 : error
{}'.format(userdn, e.message['desc']))
raise
-
- request.addfinalizer(fin)
+ elif (tochck == "Disabled"):
+ with pytest.raises(ldap.CONSTRAINT_VIOLATION):
+ topology_st.standalone.simple_bind_s(userdn, USER_PW)
+ log.error('User {} is not inactivated, expected error
19'.format(userdn))
+ nousrs = nousrs - 1
-def test_inact_plugin(topology_st, accpolicy_local, users):
- """Verify if user account is inactivated when accountInactivityLimit
is exceeded.
- User is created in the default SUFFIX.
+def test_actNinact_local(topology_st, accpolicy_local):
+ """Verify if user account is inactivated when accountInactivityLimit
is exceeded. User is created in the default suffix.
:Feature: Account Policy Plugin
:Setup: Standalone instance, Local account policy plugin configuration,
accountInactivityLimit set to 15, Inactivate account by Account policy
plugin
- :Steps: 1. Configure account policy plugin with accpol_local for ou=people SUBTREE
- 2. Set accountInactivityLimit to 15
- 3. Add few users to ou=people SUBTREE in the default SUFFIX
- 4. Wait for 12 secs and run ldapsearch as normal user to check if its not
inactivated, expected 0.
- 5. Wait for 3 secs or till accountInactivityLimit is exceeded
- 6. Run ldapsearch as normal user and check if its inactivated, expected error 19.
+ :Steps: 1. Configure account policy plugin with accpol_local for ou=people subtree
+ 2. Set accountInactivityLimit to 15
+ 3. Add few users to ou=people subtre in the default suffix
+ 4. Wait for 14 secs and run ldapsearch as normal user to check if its not
inactivated, expected 0.
+ 5. Wait for 2 secs or till accountInactivityLimit is exceeded
+ 6. Run ldapsearch as normal user and check if its inactivated, expected error
19.
+ 7. Sleep for +14 secs to check if accounts accessed at step4 are inactivated
now
:Assert: Should return error code 19
"""
- log.info("AccountInactivityLimit set to 15. Account will be inactivated if not
accessed in 15 secs")
- log.info("Sleeping for 12 secs to check if account is not inactivated, expected
value 0")
- time.sleep(12)
- for NUM in range(2, NOF_USERS):
- USR_RDN = '{}{}'.format(USR_NAME, NUM)
- USR_DN = 'uid={},{},{}'.format(USR_RDN, SUBTREE, SUFFIX)
- try:
- topology_st.standalone.simple_bind_s(USR_DN, USER_PW)
- except ldap.LDAPError as e:
- log.error('Checking if {} is inactivated: error {}'.format(USR_DN,
e.message['desc']))
- raise
+ suffix = DEFAULT_SUFFIX
+ subtre = "ou=people"
+ userid = "inactusr"
+ userpw = USER_PW
+ nousrs = 3
+ log.info('AccountInactivityLimit set to 15. Account will be inactivated if not
accessed in 15 secs')
+ add_users(topology_st, suffix, subtre, userid, nousrs)
+ log.info('Sleeping for 14 secs to check account is not inactivated, expected
value 0')
+ time.sleep(14)
+ log.info('Account should not be inactivated since AccountInactivityLimit not
exceeded')
+ account_status(topology_st, suffix, subtre, userid, 3, 2, "Enabled")
+ log.info('Sleeping for 2 more secs to check if account is inactivated')
+ time.sleep(2)
+ account_status(topology_st, suffix, subtre, userid, 2, 0, "Disabled")
+ log.info('Sleeping +14 secs to check if account {}3 is
inactivated'.format(userid))
+ time.sleep(14)
+ account_status(topology_st, suffix, subtre, userid, 3, 2, "Disabled")
+ del_users(topology_st, suffix, subtre, userid, nousrs)
+
+
+def test_noinact_local(topology_st, accpolicy_local):
+ """Verify if user account is inactivated when moved from ou=groups to
ou=people subtree.
+
+ :Feature: Account Policy Plugin
+
+ :Setup: Standalone instance, Local account policy plugin configuration,
+ accountInactivityLimit set to 15, Inactivate account by Account policy
plugin
+
+ :Steps: 1. Add few users to ou=groups subtre in the default suffix, plugin configured
to ou=people subtree only.
+ 2. Wait for 16 secs and run ldapsearch as normal user to check account is
active, expected 0.
+ 3. Move users from ou=groups to ou=people subtree
+ 4. Sleep for 16 secs and check if entries are inactivated
- USR_DN = 'uid={}1,{},{}'.format(USR_NAME, SUBTREE, SUFFIX)
- log.info("Sleeping for 4 more secs to check if {} is inactivated, expected error
19".format(USR_DN))
- time.sleep(4)
- with pytest.raises(ldap.CONSTRAINT_VIOLATION) as e:
- topology_st.standalone.simple_bind_s(USR_DN, USER_PW)
+ :Assert: Should return error code 0 and 19
+ """
- USR_DN = 'uid={}2,{},{}'.format(USR_NAME, SUBTREE, SUFFIX)
- log.info("Checking if {} is not inactivated, expected value
0".format(USR_DN))
+ suffix = DEFAULT_SUFFIX
+ subtre = "ou=groups"
+ userid = "nolockusr"
+ userpw = USER_PW
+ nousrs = 1
+ log.info('Account should not be inactivated since the subtree is not
configured')
+ add_users(topology_st, suffix, subtre, userid, nousrs)
+ log.info('Sleeping for 16 secs to check if account is not inactivated, expected
value 0')
+ time.sleep(16)
+ account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Enabled")
+ log.info('Moving users from ou=groups to ou=people subtree')
try:
- topology_st.standalone.simple_bind_s(USR_DN, USER_PW)
+ topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
+
topology_st.standalone.rename_s('uid=nolockusr1,ou=groups,dc=example,dc=com',
'uid=nolockusr1',
+ 'ou=people,dc=example,dc=com')
+ except ldap.LDAPError as e:
+ log.error('Failed to move user uid=nolockusr1 from ou=groups to
ou=people')
+ raise
+ subtre = "ou=people"
+ log.info('Then wait for 16 secs and check if entries are inactivated')
+ time.sleep(16)
+ account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Disabled")
+ del_users(topology_st, suffix, subtre, userid, nousrs)
+
+
+def test_inact_local(topology_st, accpolicy_local):
+ """Verify if user account is inactivated when users moved from
ou=people to ou=groups subtree.
+
+ :Feature: Account Policy Plugin
+
+ :Setup: Standalone instance, Local account policy plugin configuration,
+ accountInactivityLimit set to 15, Inactivate account by Account policy
plugin
+
+ :Steps: 1. Add few users to ou=people subtre in the default suffix
+ 2. Wait for 14 secs and run ldapsearch as normal user to check if its not
inactivated, expected 0.
+ 3. Move users from ou=people to ou=groups subtree
+ 4. Sleep for +2 secs and check if users are inactivated in ou=people subtree
+ 5. Check if users are not inactivated in ou=groups subtree
+
+ :Assert: Should return error code 0
+ """
+
+ suffix = DEFAULT_SUFFIX
+ subtre = "ou=people"
+ userid = "lockusr"
+ userpw = USER_PW
+ nousrs = 1
+ log.info('Account should be inactivated since the subtree is configured')
+ add_users(topology_st, suffix, subtre, userid, nousrs)
+ log.info('Sleeping for 16 secs to check if account is inactivated, expected value
19')
+ time.sleep(14)
+ account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Enabled")
+ log.info('Moving users from ou=people to ou=groups subtree')
+ try:
+ topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
+
topology_st.standalone.rename_s('uid=lockusr1,ou=people,dc=example,dc=com',
'uid=lockusr1',
+ 'ou=groups,dc=example,dc=com')
except ldap.LDAPError as e:
- log.error('Checking if {} is inactivated : error {}'.format(USR_DN,
e.message['desc']))
+ log.error('Failed to move user uid=lockusr1 from ou=groups to
ou=people')
raise
- time.sleep(12)
- for NUM in range(3, NOF_USERS):
- USR_RDN = '{}{}'.format(USR_NAME, NUM)
- USR_DN = 'uid={},{},{}'.format(USR_RDN, SUBTREE, SUFFIX)
- log.info("Checking if {} is inactivated, expected error
19".format(USR_DN))
- with pytest.raises(ldap.CONSTRAINT_VIOLATION) as e:
- topology_st.standalone.simple_bind_s(USR_DN, USER_PW)
+ log.info('Sleep for +2 secs and check users from both ou=people and ou=groups
subtree')
+ time.sleep(2)
+ subtre = "ou=groups"
+ account_status(topology_st, suffix, subtre, userid, 1, 0, "Enabled")
+ del_users(topology_st, suffix, subtre, userid, nousrs)
if __name__ == '__main__':