permission plugin: Ignore unparseable ACIs

When manipulating a permission for an entry that has an ACI
that the parser cannot process, skip this ACI instead of
failing.

Add a test that manipulates permission in cn=accounts,
where there are complex ipaAllowedOperation-based ACIs.

Workaround for: https://fedorahosted.org/freeipa/ticket/4376

Reviewed-By: Martin Kosek <mkosek@redhat.com>

1 files changed, 52 insertions, 0 deletions

diff --git a/ipatests/test_xmlrpc/test_permission_plugin.py b/ipatests/test_xmlrpc/test_permission_plugin.py
index 46e0f1f0e..bf902c367 100644
--- a/ipatests/test_xmlrpc/test_permission_plugin.py
+++ b/ipatests/test_xmlrpc/test_permission_plugin.py
@@ -3966,3 +3966,55 @@ class test_permission_filters(Declarative):
             'allow (write) groupdn = "ldap:///%s";)' % permission1_dn,
         ),
     ]
+
+
+class test_permission_in_accounts(Declarative):
+    """Test managing a permission in cn=accounts"""
+
+    tests = [
+        dict(
+            desc='Create %r in cn=accounts' % permission1,
+            command=(
+                'permission_add', [permission1], dict(
+                    ipapermlocation=DN('cn=accounts', api.env.basedn),
+                    ipapermright=u'add',
+                    attrs=[u'cn'],
+                )
+            ),
+            expected=dict(
+                value=permission1,
+                summary=u'Added permission "%s"' % permission1,
+                result=dict(
+                    dn=permission1_dn,
+                    cn=[permission1],
+                    objectclass=objectclasses.permission,
+                    attrs=[u'cn'],
+                    ipapermright=[u'add'],
+                    ipapermbindruletype=[u'permission'],
+                    ipapermissiontype=[u'SYSTEM', u'V2'],
+                    ipapermlocation=[DN('cn=accounts', api.env.basedn)],
+                ),
+            ),
+        ),
+
+        verify_permission_aci(
+            permission1, DN('cn=accounts', api.env.basedn),
+            '(targetattr = "cn")' +
+            '(version 3.0;acl "permission:%s";' % permission1 +
+            'allow (add) groupdn = "ldap:///%s";)' % permission1_dn,
+        ),
+
+        dict(
+            desc='Delete %r' % permission1,
+            command=(
+                'permission_del', [permission1], {}
+            ),
+            expected=dict(
+                result=dict(failed=[]),
+                value=[permission1],
+                summary=u'Deleted permission "%s"' % permission1,
+            )
+        ),
+
+        verify_permission_aci_missing(permission1, api.env.basedn),
+    ]