path: root/ipatests/test_xmlrpc/test_range_plugin.py

# Authors:
#    Alexander Bokovoy <abokovoy@redhat.com>
#
# Copyright (C) 2012  Red Hat
# see file 'COPYING' for use and warranty information
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.

"""
Test the `ipalib/plugins/idrange.py` module, and XML-RPC in general.
"""

from ipalib import api, errors, _
from ipatests.util import assert_equal, Fuzzy
from xmlrpc_test import Declarative, fuzzy_digits, fuzzy_uuid
from ipatests.test_xmlrpc import objectclasses
from ipapython.dn import *

import ldap, ldap.sasl, ldap.modlist

testrange1 = u'testrange1'
testrange1_base_id = 900000
testrange1_size = 99999
testrange1_base_rid = 10000
testrange1_secondary_base_rid = 200000

testrange2 = u'testrange2'
testrange2_base_id = 100
testrange2_size = 50
testrange2_base_rid = 100
testrange2_secondary_base_rid = 1000

testrange3 = u'testrange3'
testrange3_base_id = 200
testrange3_size = 50
testrange3_base_rid = 70
testrange3_secondary_base_rid = 1100

testrange4 = u'testrange4'
testrange4_base_id = 300
testrange4_size = 50
testrange4_base_rid = 200
testrange4_secondary_base_rid = 1030

testrange5 = u'testrange5'
testrange5_base_id = 400
testrange5_size = 50
testrange5_base_rid = 1020
testrange5_secondary_base_rid = 1200

testrange6 = u'testrange6'
testrange6_base_id = 130
testrange6_size = 50
testrange6_base_rid = 500
testrange6_secondary_base_rid = 1300

testrange7 = u'testrange7'
testrange7_base_id = 600
testrange7_size = 50
testrange7_base_rid = 600
testrange7_secondary_base_rid = 649

testrange8 = u'testrange8'
testrange8_base_id = 700
testrange8_size = 50
testrange8_base_rid = 700

testrange9 = u'testrange9'
testrange9_base_id = 800
testrange9_size = 50
testrange9_base_rid = 800

testrange10 = u'testrange10'
testrange10_base_id = 900
testrange10_size = 50
testrange10_base_rid = 900

testrange9_dn = "cn={name},cn=ranges,cn=etc,{basedn}".format(name=testrange9,
                                                      basedn=api.env.basedn)

testrange9_add = dict(
    objectClass=["ipaIDrange", "ipatrustedaddomainrange"],
    ipaBaseID="{base_id}".format(base_id=testrange9_base_id),
    ipaBaseRID="{base_rid}".format(base_rid=testrange9_base_rid),
    ipaIDRangeSize="{size}".format(size=testrange9_size),
    ipaNTTrustedDomainSID="S-1-5-21-259319770-2312917334-591429603",
    )

testrange10_dn = "cn={name},cn=ranges,cn=etc,{basedn}".format(name=testrange10,
                                                       basedn=api.env.basedn)

testrange10_add = dict(
    objectClass=["ipaIDrange", "ipatrustedaddomainrange"],
    ipaBaseID="{base_id}".format(base_id=testrange10_base_id),
    ipaBaseRID="{base_rid}".format(base_rid=testrange10_base_rid),
    ipaIDRangeSize="{size}".format(size=testrange10_size),
    ipaNTTrustedDomainSID="S-1-5-21-2997650941-1802118864-3094776726",
    )

testtrust = u'testtrust'
testtrust_dn = "cn=testtrust,cn=trusts,{basedn}".format(basedn=api.env.basedn)

testtrust_add = dict(
    objectClass=["ipaNTTrustedDomain", "ipaIDobject", "top"],
    ipaNTFlatName='TESTTRUST',
    ipaNTTrustedDomainSID='S-1-5-21-2997650941-1802118864-3094776726',
    ipaNTSIDBlacklistIncoming='S-1-0',
    ipaNTTrustPartner='testtrust.mock',
    ipaNTTrustType='2',
    ipaNTTrustDirection='3',
    ipaNTTrustAttributes='8',
    )

user1 = u'tuser1'
user1_uid = 900000
group1 = u'group1'
group1_gid = 900100


class test_range(Declarative):

    def __init__(self):
        super(test_range, self).__init__()
        self.connection = None

    @classmethod
    def connect_ldap(self):
        self.connection = ldap.initialize('ldap://{host}'
                                     .format(host=api.env.host))

        auth = ldap.sasl.gssapi("")
        self.connection.sasl_interactive_bind_s('', auth)

    @classmethod
    def add_entry(self, dn, mods):
        ldif = ldap.modlist.addModlist(mods)
        self.connection.add_s(dn, ldif)

    @classmethod
    def setUpClass(self):
        super(test_range, self).setUpClass()

        self.tearDownClass()

        try:
            self.connect_ldap()

            self.add_entry(testrange9_dn, testrange9_add)
            self.add_entry(testrange10_dn, testrange10_add)
            self.add_entry(testtrust_dn, testtrust_add)

        except ldap.ALREADY_EXISTS:
            pass

        finally:
            if self.connection is not None:
                self.connection.unbind_s()

    @classmethod
    def tearDownClass(self):

        try:
            self.connect_ldap()
            self.connection.delete_s(testrange9_dn)
            self.connection.delete_s(testrange10_dn)
            self.connection.delete_s(testtrust_dn)

        except ldap.NO_SUCH_OBJECT:
            pass

        finally:
            if self.connection is not None:
                self.connection.unbind_s()

    cleanup_commands = [
        ('idrange_del', [testrange1, testrange2, testrange3, testrange4,
                         testrange5, testrange6, testrange7, testrange8],
                        {'continue': True}),
        ('user_del', [user1], {}),
        ('group_del', [group1], {}),
    ]

    tests = [
        dict(
            desc='Create ID range %r' % (testrange1),
            command=('idrange_add', [testrange1],
                      dict(ipabaseid=testrange1_base_id, ipaidrangesize=testrange1_size,
                           ipabaserid=testrange1_base_rid, ipasecondarybaserid=testrange1_secondary_base_rid)),
            expected=dict(
                result=dict(
                    dn=DN(('cn',testrange1),('cn','ranges'),('cn','etc'),
                          api.env.basedn),
                    cn=[testrange1],
                    objectclass=[u'ipaIDrange', u'ipadomainidrange'],
                    ipabaseid=[unicode(testrange1_base_id)],
                    ipabaserid=[unicode(testrange1_base_rid)],
                    ipasecondarybaserid=[unicode(testrange1_secondary_base_rid)],
                    ipaidrangesize=[unicode(testrange1_size)],
                    iparangetype=[u'local domain range'],
                ),
                value=testrange1,
                summary=u'Added ID range "%s"' % (testrange1),
            ),
        ),

        dict(
            desc='Retrieve ID range %r' % (testrange1),
            command=('idrange_show', [testrange1], dict()),
            expected=dict(
                result=dict(
                    dn=DN(('cn',testrange1),('cn','ranges'),('cn','etc'),
                          api.env.basedn),
                    cn=[testrange1],
                    ipabaseid=[unicode(testrange1_base_id)],
                    ipabaserid=[unicode(testrange1_base_rid)],
                    ipasecondarybaserid=[unicode(testrange1_secondary_base_rid)],
                    ipaidrangesize=[unicode(testrange1_size)],
                    iparangetype=[u'local domain range'],
                ),
                value=testrange1,
                summary=None,
            ),
        ),


        dict(
            desc='Create user %r in ID range %r' % (user1, testrange1),
            command=(
                'user_add', [user1], dict(givenname=u'Test', sn=u'User1',
                                          uidnumber=user1_uid)
            ),
            expected=dict(
                value=user1,
                summary=u'Added user "%s"' % user1,
                result=dict(
                    gecos=[u'Test User1'],
                    givenname=[u'Test'],
                    homedirectory=[u'/home/tuser1'],
                    krbprincipalname=[u'tuser1@' + api.env.realm],
                    loginshell=[u'/bin/sh'],
                    objectclass=objectclasses.user,
                    sn=[u'User1'],
                    uid=[user1],
                    uidnumber=[unicode(user1_uid)],
                    gidnumber=[unicode(user1_uid)],
                    displayname=[u'Test User1'],
                    cn=[u'Test User1'],
                    initials=[u'TU'],
                    mail=[u'%s@%s' % (user1, api.env.domain)],
                    ipauniqueid=[fuzzy_uuid],
                    krbpwdpolicyreference=[DN(('cn','global_policy'),('cn',api.env.realm),
                                              ('cn','kerberos'),api.env.basedn)],
                    mepmanagedentry=[DN(('cn',user1),('cn','groups'),('cn','accounts'),
                                        api.env.basedn)],
                    memberof_group=[u'ipausers'],
                    has_keytab=False,
                    has_password=False,
                    dn=DN(('uid',user1),('cn','users'),('cn','accounts'), api.env.basedn)
                ),
            ),
        ),


        dict(
            desc='Create group %r in ID range %r' % (group1, testrange1),
            command=(
                'group_add', [group1], dict(description=u'Test desc 1',
                                            gidnumber=group1_gid)
            ),
            expected=dict(
                value=group1,
                summary=u'Added group "%s"' % group1,
                result=dict(
                    cn=[group1],
                    description=[u'Test desc 1'],
                    gidnumber=[unicode(group1_gid)],
                    objectclass=objectclasses.group + [u'posixgroup'],
                    ipauniqueid=[fuzzy_uuid],
                    dn=DN(('cn',group1),('cn','groups'),('cn','accounts'), api.env.basedn),
                ),
            ),
        ),


        dict(
            desc='Try to modify ID range %r to get out bounds object #1' % (testrange1),
            command=('idrange_mod', [testrange1], dict(ipabaseid=90001)),
            expected=errors.ValidationError(name='ipabaseid,ipaidrangesize',
                error=u'range modification leaving objects with ID out of the'
                      u' defined range is not allowed'),
        ),


        dict(
            desc='Try to modify ID range %r to get out bounds object #2' % (testrange1),
            command=('idrange_mod', [testrange1], dict(ipaidrangesize=100)),
            expected=errors.ValidationError(name='ipabaseid,ipaidrangesize',
                error=u'range modification leaving objects with ID out of the'
                      u' defined range is not allowed'),
        ),


        dict(
            desc='Try to modify ID range %r to get out bounds object #3' % (testrange1),
            command=('idrange_mod', [testrange1], dict(ipabaseid=100, ipaidrangesize=100)),
            expected=errors.ValidationError(name='ipabaseid,ipaidrangesize',
                error=u'range modification leaving objects with ID out of the'
                      u' defined range is not allowed'),
        ),


        dict(
            desc='Modify ID range %r' % (testrange1),
            command=('idrange_mod', [testrange1], dict(ipaidrangesize=90000)),
            expected=dict(
                result=dict(
                    cn=[testrange1],
                    ipabaseid=[unicode(testrange1_base_id)],
                    ipabaserid=[unicode(testrange1_base_rid)],
                    ipasecondarybaserid=[unicode(testrange1_secondary_base_rid)],
                    ipaidrangesize=[u'90000'],
                    iparangetype=[u'local domain range'],
                ),
                value=testrange1,
                summary=u'Modified ID range "%s"' % (testrange1),
            ),
        ),


        dict(
            desc='Try to delete ID range %r with active IDs inside it' % testrange1,
            command=('idrange_del', [testrange1], {}),
            expected=errors.ValidationError(name='ipabaseid,ipaidrangesize',
                error=u'range modification leaving objects with ID out of the'
                      u' defined range is not allowed'),
        ),


        dict(
            desc='Delete user %r' % user1,
            command=('user_del', [user1], {}),
            expected=dict(
                result=dict(failed=u''),
                value=user1,
                summary=u'Deleted user "%s"' % user1,
            ),
        ),


        dict(
            desc='Delete group %r' % group1,
            command=('group_del', [group1], {}),
            expected=dict(
                result=dict(failed=u''),
                value=group1,
                summary=u'Deleted group "%s"' % group1,
            ),
        ),


        dict(
            desc='Delete ID range %r' % testrange1,
            command=('idrange_del', [testrange1], {}),
            expected=dict(
                result=dict(failed=u''),
                value=testrange1,
                summary=u'Deleted ID range "%s"' % testrange1,
            ),
        ),

        dict(
            desc='Create ID range %r' % (testrange2),
            command=('idrange_add', [testrange2],
                      dict(ipabaseid=testrange2_base_id,
                          ipaidrangesize=testrange2_size,
                          ipabaserid=testrange2_base_rid,
                          ipasecondarybaserid=testrange2_secondary_base_rid)),
            expected=dict(
                result=dict(
                    dn=DN(('cn',testrange2),('cn','ranges'),('cn','etc'),
                          api.env.basedn),
                    cn=[testrange2],
                    objectclass=[u'ipaIDrange', u'ipadomainidrange'],
                    ipabaseid=[unicode(testrange2_base_id)],
                    ipabaserid=[unicode(testrange2_base_rid)],
                    ipasecondarybaserid=[unicode(testrange2_secondary_base_rid)],
                    ipaidrangesize=[unicode(testrange2_size)],
                    iparangetype=[u'local domain range'],
                ),
                value=testrange2,
                summary=u'Added ID range "%s"' % (testrange2),
            ),
        ),

        dict(
            desc='Try to modify ID range %r so that its rid ranges are overlapping themselves' % (testrange2),
            command=('idrange_mod', [testrange2],
                      dict(ipabaserid=(testrange2_base_rid*10))),
            expected=errors.ValidationError(
                name='ID Range setup', error='Primary RID range and secondary RID range cannot overlap'),
        ),

        dict(
            desc='Try to create ID range %r with overlapping rid range' % (testrange3),
            command=('idrange_add', [testrange3],
                      dict(ipabaseid=testrange3_base_id,
                          ipaidrangesize=testrange3_size,
                          ipabaserid=testrange3_base_rid,
                          ipasecondarybaserid=testrange3_secondary_base_rid)),
            expected=errors.DatabaseError(
                desc='Constraint violation', info='New primary rid range overlaps with existing primary rid range.'),
        ),

       dict(
            desc='Try to create ID range %r with overlapping secondary rid range' % (testrange4),
            command=('idrange_add', [testrange4],
                      dict(ipabaseid=testrange4_base_id,
                          ipaidrangesize=testrange4_size,
                          ipabaserid=testrange4_base_rid,
                          ipasecondarybaserid=testrange4_secondary_base_rid)),
            expected=errors.DatabaseError(
                desc='Constraint violation', info='New secondary rid range overlaps with existing secondary rid range.'),
        ),

        dict(
            desc='Try to create ID range %r with primary range overlapping secondary rid range' % (testrange5),
            command=('idrange_add', [testrange5],
                      dict(ipabaseid=testrange5_base_id,
                          ipaidrangesize=testrange5_size,
                          ipabaserid=testrange5_base_rid,
                          ipasecondarybaserid=testrange5_secondary_base_rid)),
            expected=errors.DatabaseError(
                desc='Constraint violation', info='New primary rid range overlaps with existing secondary rid range.'),
        ),

        dict(
            desc='Try to create ID range %r with overlapping id range' % (testrange6),
            command=('idrange_add', [testrange6],
                      dict(ipabaseid=testrange6_base_id,
                          ipaidrangesize=testrange6_size,
                          ipabaserid=testrange6_base_rid,
                          ipasecondarybaserid=testrange6_secondary_base_rid)),
            expected=errors.DatabaseError(
                desc='Constraint violation', info='New base range overlaps with existing base range.'),
        ),

        dict(
            desc='Try to create ID range %r with rid ranges overlapping themselves' % (testrange7),
            command=('idrange_add', [testrange7],
                      dict(ipabaseid=testrange7_base_id,
                          ipaidrangesize=testrange7_size,
                          ipabaserid=testrange7_base_rid,
                          ipasecondarybaserid=testrange7_secondary_base_rid)),
            expected=errors.ValidationError(
                name='ID Range setup', error='Primary RID range and secondary RID range cannot overlap'),
        ),

        dict(
            desc='Delete ID range %r' % testrange2,
            command=('idrange_del', [testrange2], {}),
            expected=dict(
                result=dict(failed=u''),
                value=testrange2,
                summary=u'Deleted ID range "%s"' % testrange2,
            ),
        ),

        dict(
            desc='Create ID range %r' % (testrange8),
            command=('idrange_add', [testrange8],
                      dict(ipabaseid=testrange8_base_id,
                          ipaidrangesize=testrange8_size)),
            expected=dict(
                result=dict(
                    dn=DN(('cn',testrange8),('cn','ranges'),('cn','etc'),
                          api.env.basedn),
                    cn=[testrange8],
                    objectclass=[u'ipaIDrange', u'ipadomainidrange'],
                    ipabaseid=[unicode(testrange8_base_id)],
                    ipaidrangesize=[unicode(testrange8_size)],
                    iparangetype=[u'local domain range'],
                ),
                value=testrange8,
                summary=u'Added ID range "%s"' % (testrange8),
            ),
        ),

        dict(
            desc='Try to modify ID range %r so it has only primary rid range set' % (testrange8),
            command=('idrange_mod', [testrange8],
                      dict(ipabaserid=testrange8_base_rid)),
            expected=errors.ValidationError(
                name='ID Range setup', error='Options secondary-rid-base and rid-base must be used together'),
        ),

        dict(
            desc='Delete ID range %r' % testrange8,
            command=('idrange_del', [testrange8], {}),
            expected=dict(
                result=dict(failed=u''),
                value=testrange8,
                summary=u'Deleted ID range "%s"' % testrange8,
            ),
        ),

        dict(
            desc='Delete non-active AD trusted range %r' % testrange9,
            command=('idrange_del', [testrange9], {}),
            expected=dict(
                result=dict(failed=u''),
                value=testrange9,
                summary=u'Deleted ID range "%s"' % testrange9,
            ),
        ),

        dict(
            desc='Try to delete active AD trusted range %r' % testrange10,
            command=('idrange_del', [testrange10], {}),
            expected=errors.DependentEntry(
                    label='Active Trust',
                    key=testrange10,
                    dependent=testtrust),
        ),

    ]