From 58289c6cff18a2477646837cff30032b014fab61 Mon Sep 17 00:00:00 2001
From: Akshay Adhikari <aadhikar@aadhikar.pnq.csb>
Date: Thu, 1 Feb 2018 12:32:41 +0530
Subject: [PATCH] Issue 49278 - Add a new CI test case

Bug Description: GetEffectiveRights gives false-negative with ACIs containing targetfilter

Fix Description: Added tests cases that will check whether a user have entry-level-access
even where the access is conditional on a targetfilter.
An non-existing entry defined by objectclass has effective rights.

https://pagure.io/389-ds-base/issue/49278

Reviewed by: ?
---
 .../suites/get_effective_rights/acceptance_test.py | 124 +++++++++++++++++++++
 1 file changed, 124 insertions(+)
 create mode 100644 dirsrvtests/tests/suites/get_effective_rights/acceptance_test.py

diff --git a/dirsrvtests/tests/suites/get_effective_rights/acceptance_test.py b/dirsrvtests/tests/suites/get_effective_rights/acceptance_test.py
new file mode 100644
index 0000000..4938ee1
--- /dev/null
+++ b/dirsrvtests/tests/suites/get_effective_rights/acceptance_test.py
@@ -0,0 +1,124 @@
+import pytest
+import logging
+from ldap.controls import GetEffectiveRightsControl
+from lib389.idm.domain import Domain
+from lib389.idm.group import Groups
+from lib389.idm.user import UserAccounts, TEST_USER_PROPERTIES
+from lib389.topologies import topology_st as topo
+from lib389._constants import *
+from lib389.utils import *
+
+TEST_ENTRY_NAME = 'testuser'
+TEST_GROUP_NAME = 'group1'
+TEST_GROUP2_NAME = 'group2'
+
+DEBUGGING = os.getenv('DEBUGGING', default=False)
+if DEBUGGING:
+    logging.getLogger(__name__).setLevel(logging.DEBUG)
+else:
+    logging.getLogger(__name__).setLevel(logging.INFO)
+log = logging.getLogger(__name__)
+
+
+def test_group_aci_user_exists(topo):
+    """This test case adds the groupdn aci and check ger contains 'vadn'
+
+    :id:
+    :setup: Standalone instance
+    :steps:
+        1. Create a user and group.
+        2. Add the user as member into the group.
+        3. Apply the ACI which will give the group full rights.
+        4. Check entryLevelRights value for entries.
+        5. Check 'vadn' is in the entryLevelRights.
+    :expectedresults:
+        1. It should pass
+        2. It should pass
+        3. It should pass
+        4. It should pass
+        5. It should pass
+    """
+    log.info('Adding user {}'.format(TEST_ENTRY_NAME))
+    users = UserAccounts(topo.standalone, DEFAULT_SUFFIX, rdn=None)
+    test_user = users.create(properties=TEST_USER_PROPERTIES)
+    log.info('Adding group {}'.format(TEST_GROUP_NAME))
+    groups = Groups(topo.standalone, DEFAULT_SUFFIX, rdn=None)
+    group_properties = {
+        'cn': TEST_GROUP_NAME,
+        'description': 'testgroup'}
+    test_group = groups.create(properties=group_properties)
+    test_group.add_member(test_user.dn)
+    suffix = Domain(topo.standalone, DEFAULT_SUFFIX)
+    ACI_TARGET = '(targetattr="*")'
+    ACI_TARGET_FILTER = '(targetfilter ="(objectClass=*)")'
+    ACI_ALLOW = '(version 3.0; acl "give group1 full rights"; allow (all) '
+    ACI_SUBJECT = 'groupdn = "ldap:///{}";)'.format(test_group.dn)
+    ACI_BODY = ACI_TARGET + ACI_TARGET_FILTER + ACI_ALLOW + ACI_SUBJECT
+    log.info("Add an ACI granting add access to a user matching the groupdn")
+    suffix.add('aci', ACI_BODY)
+    request_ctrl = GetEffectiveRightsControl(criticality=True,
+                                             authzId=ensure_bytes("dn:{}".format(test_user.dn)))
+    entries = topo.standalone.search_ext('{}'.format(test_user.dn),
+                                         ldap.SCOPE_SUBTREE,
+                                         "objectclass=*",
+                                         serverctrls=[request_ctrl])
+
+    rtype, rdata, rmsgid, response_ctrl = topo.standalone.result3(entries)
+    for dn, attrs in rdata:
+        topo.standalone.log.info("dn: %s" % dn)
+        value = attrs['entryLevelRights'][0]
+        topo.standalone.log.info("########  entryLevelRights: %r" % value)
+        assert b'vadn' in value
+
+
+def test_group_aci_no_user(topo):
+    """This test case adds the groupdn aci and check ger contains 'vadn'
+
+    :id:
+    :setup: Standalone instance
+    :steps:
+        1. Create a group.
+        2. Apply the ACI which will give the group full rights.
+        3. Check entryLevelRights value for a non-existing entry.
+        4. Check 'vadn' is in the entryLevelRights.
+    :expectedresults:
+        1. It should pass
+        2. It should pass
+        3. It should pass
+        4. It should pass
+    """
+
+    log.info('Adding group {}'.format(TEST_GROUP2_NAME))
+    groups = Groups(topo.standalone, DEFAULT_SUFFIX, rdn=None)
+    group_properties = {
+        'cn': TEST_GROUP2_NAME,
+        'description': 'testgroup2'}
+    test_group = groups.create(properties=group_properties)
+    suffix = Domain(topo.standalone, DEFAULT_SUFFIX)
+    ACI_TARGET = '(targetattr="*")'
+    ACI_TARGET_FILTER = '(targetfilter ="(objectClass=person)")'
+    ACI_ALLOW = '(version 3.0; acl "allow all to target"; allow (all) '
+    ACI_SUBJECT = 'userdn = "ldap:///{}";)'.format(test_group.dn)
+    ACI_BODY = ACI_TARGET + ACI_TARGET_FILTER + ACI_ALLOW + ACI_SUBJECT
+    log.info("Add an ACI granting add access to a user matching the userdn")
+    suffix.add('aci', ACI_BODY)
+    request_ctrl = GetEffectiveRightsControl(criticality=True,
+                                             authzId=ensure_bytes("dn:{}".format(test_group.dn)))
+    entries = topo.standalone.search_ext(DEFAULT_SUFFIX,
+                                         ldap.SCOPE_SUBTREE,
+                                         "cn=sub_entry11",["sn@person:cn"],
+                                         serverctrls=[request_ctrl])
+
+    rtype, rdata, rmsgid, response_ctrl = topo.standalone.result3(entries)
+    for dn, attrs in rdata:
+        topo.standalone.log.info("dn: %s" % dn)
+        value = attrs['entryLevelRights'][0]
+        topo.standalone.log.info("########  entryLevelRights: %r" % value)
+        assert b'vadn' in value
+
+
+if __name__ == '__main__':
+    # Run isolated
+    # -s for DEBUG mode
+    CURRENT_FILE = os.path.realpath(__file__)
+    pytest.main('-s {}'.format(CURRENT_FILE))
-- 
1.8.3.1

