From e8b7a3e0d79977e06f9d4ceeb9dda1672c9c63fe Mon Sep 17 00:00:00 2001
From: Sankar Ramalingam <sramling@redhat.com>
Date: Fri, 10 Mar 2017 22:07:00 +0530
Subject: [PATCH] Ticket 48050 - Add account policy tests to plugins test suite

Description: Verify if user account is inactivated when
accountInactivityLimit is exceeded. Added test cases for
various possibilities of stateattrname, altstateattrname
and alwaysrecordlogin attributes.

https://pagure.io/389-ds-base/issue/48050

Reviewed by: ?
---
 dirsrvtests/tests/suites/plugins/accpol_test.py | 1025 +++++++++++++++++++++--
 1 file changed, 944 insertions(+), 81 deletions(-)

diff --git a/dirsrvtests/tests/suites/plugins/accpol_test.py b/dirsrvtests/tests/suites/plugins/accpol_test.py
index 1dbf505..47554a9 100644
--- a/dirsrvtests/tests/suites/plugins/accpol_test.py
+++ b/dirsrvtests/tests/suites/plugins/accpol_test.py
@@ -7,69 +7,345 @@
 # --- END COPYRIGHT BLOCK ---
 #
 import pytest
+from lib389.paths import Paths
 from lib389.tasks import *
 from lib389.utils import *
 from lib389.topologies import topology_st
 
-LOCAL_CONFIG = 'cn=AccountPolicy1,ou=people,dc=example,dc=com'
-TEMPLT_COS = 'cn=TempltCoS,ou=people,dc=example,dc=com'
-DEFN_COS = 'cn=DefnCoS,ou=people,dc=example,dc=com'
+LOCL_CONF = 'cn=AccountPolicy1,ou=people,dc=example,dc=com'
+TEMPL_COS = 'cn=TempltCoS,ou=people,dc=example,dc=com'
+DEFIN_COS = 'cn=DefnCoS,ou=people,dc=example,dc=com'
 ACCPOL_DN = "cn={},{}".format(PLUGIN_ACCT_POLICY, DN_PLUGIN)
-CONFIG_DN = "cn=config,{}".format(ACCPOL_DN)
-INACT_VAL = 15
-USER_PW = 'Secret1234'
+ACCP_CONF = "cn=config,{}".format(ACCPOL_DN)
+BASE_CONF = "cn=config"
+INACT_VAL = 10
+USER_PASW = 'Secret1234'
+INVL_PASW = 'Invalid234'
 
 
 @pytest.fixture(scope="module")
-def accpolicy_local(topology_st):
+def accpol_disable(topology_st):
+    """Disable account policy plugin and restart the server"""
+
+    log.info('Disable account policy plugin and restart the server')
+    topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
+    try:
+        topology_st.standalone.plugins.disable(name=PLUGIN_ACCT_POLICY)
+    except ldap.LDAPError as e:
+        log.error('Failed to disable Account policy plugin')
+    try:
+        topology_st.standalone.modify_s(BASE_CONF, [(ldap.MOD_REPLACE, 'passwordexp', 'off')])
+    except ldap.LDAPError as e:
+        log.error('Failed to turn off passwordexp')
+    try:
+        topology_st.standalone.modify_s(BASE_CONF, [(ldap.MOD_REPLACE, 'passwordlockout', 'off')])
+    except ldap.LDAPError as e:
+        log.error('Failed to disable password lockout')
+    try:
+        topology_st.standalone.delete_s(LOCL_CONF)
+    except ldap.LDAPError as e:
+        log.error('Failed to delete config entry-{}'.format(LOCL_CONF))
+    try:
+        topology_st.standalone.delete_s(TEMPL_COS)
+    except ldap.LDAPError as e:
+        log.error('Failed to delete config entry-{}'.format(TEMPL_COS))
+    try:
+        topology_st.standalone.delete_s(DEFIN_COS)
+    except ldap.LDAPError as e:
+        log.error('Failed to delete config entry-{}'.format(DEFIN_COS))
+        log.error('Failed to delete Account policy plugin config entries')
+        print e
+    topology_st.standalone.restart(timeout=10)
+
+
+@pytest.fixture(scope="module")
+def accpol_global(topology_st, accpol_disable):
+    """Configure Global account policy plugin and restart the server"""
+
+    log.info('Enabling account policy plugin and restarting the server')
+    topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
+    try:
+        topology_st.standalone.plugins.enable(name=PLUGIN_ACCT_POLICY)
+        topology_st.standalone.modify_s(ACCPOL_DN, [(ldap.MOD_REPLACE, 'nsslapd-pluginarg0', ACCP_CONF)])
+        topology_st.standalone.modify_s(ACCP_CONF, [(ldap.MOD_REPLACE, 'alwaysrecordlogin', 'yes')])
+        topology_st.standalone.modify_s(ACCP_CONF, [(ldap.MOD_REPLACE, 'stateattrname', 'lastLoginTime')])
+        topology_st.standalone.modify_s(ACCP_CONF, [(ldap.MOD_REPLACE, 'altstateattrname', 'createTimestamp')])
+        topology_st.standalone.modify_s(ACCP_CONF, [(ldap.MOD_REPLACE, 'specattrname', 'acctPolicySubentry')])
+        topology_st.standalone.modify_s(ACCP_CONF, [(ldap.MOD_REPLACE, 'limitattrname', 'accountInactivityLimit')])
+        topology_st.standalone.modify_s(ACCP_CONF, [(ldap.MOD_REPLACE, 'accountInactivityLimit', '12')])
+        topology_st.standalone.modify_s(BASE_CONF, [(ldap.MOD_REPLACE, 'passwordexp', 'on')])
+        topology_st.standalone.modify_s(BASE_CONF, [(ldap.MOD_REPLACE, 'passwordmaxage', '300')])
+        topology_st.standalone.modify_s(BASE_CONF, [(ldap.MOD_REPLACE, 'passwordlockout', 'on')])
+        topology_st.standalone.modify_s(BASE_CONF, [(ldap.MOD_REPLACE, 'passwordlockoutduration', '10')])
+        topology_st.standalone.modify_s(BASE_CONF, [(ldap.MOD_REPLACE, 'passwordmaxfailure', '3')])
+        topology_st.standalone.modify_s(BASE_CONF, [(ldap.MOD_REPLACE, 'passwordunlock', 'on')])
+    except ldap.LDAPError as e:
+        log.error('Failed to modify account policy plugin attrs')
+        raise
+    topology_st.standalone.restart(timeout=10)
+
+
+@pytest.fixture(scope="module")
+def accpol_local(topology_st, accpol_disable):
     """Configure local account policy plugin for ou=people subtree and restart the server"""
 
     log.info('Enabling account policy plugin and restarting the server')
+    topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
     try:
         topology_st.standalone.plugins.enable(name=PLUGIN_ACCT_POLICY)
-        topology_st.standalone.modify_s(ACCPOL_DN, [(ldap.MOD_REPLACE, 'nsslapd-pluginarg0', CONFIG_DN)])
-        topology_st.standalone.modify_s(CONFIG_DN, [(ldap.MOD_REPLACE, 'alwaysrecordlogin', 'yes')])
-        topology_st.standalone.modify_s(CONFIG_DN, [(ldap.MOD_REPLACE, 'stateattrname', 'lastLoginTime')])
-        topology_st.standalone.modify_s(CONFIG_DN, [(ldap.MOD_REPLACE, 'altstateattrname', 'createTimestamp')])
-        topology_st.standalone.modify_s(CONFIG_DN, [(ldap.MOD_REPLACE, 'specattrname', 'acctPolicySubentry')])
-        topology_st.standalone.modify_s(CONFIG_DN, [(ldap.MOD_REPLACE, 'limitattrname', 'accountInactivityLimit')])
+        topology_st.standalone.modify_s(ACCPOL_DN, [(ldap.MOD_REPLACE, 'nsslapd-pluginarg0', ACCP_CONF)])
+        topology_st.standalone.modify_s(ACCP_CONF, [(ldap.MOD_REPLACE, 'alwaysrecordlogin', 'yes')])
+        topology_st.standalone.modify_s(ACCP_CONF, [(ldap.MOD_REPLACE, 'stateattrname', 'lastLoginTime')])
+        topology_st.standalone.modify_s(ACCP_CONF, [(ldap.MOD_REPLACE, 'altstateattrname', 'createTimestamp')])
+        topology_st.standalone.modify_s(ACCP_CONF, [(ldap.MOD_REPLACE, 'specattrname', 'acctPolicySubentry')])
+        topology_st.standalone.modify_s(ACCP_CONF, [(ldap.MOD_REPLACE, 'limitattrname', 'accountInactivityLimit')])
     except ldap.LDAPError as e:
         log.error('Failed to modify account policy plugin attrs')
         raise
 
     log.info('Adding Local account policy plugin configuration entries')
     try:
-        topology_st.standalone.add_s(Entry((LOCAL_CONFIG, {
+        topology_st.standalone.add_s(Entry((LOCL_CONF, {
             'objectclass': ['top', 'ldapsubentry', 'extensibleObject', 'accountpolicy'],
-            'accountInactivityLimit': '15'})))
-        topology_st.standalone.add_s(Entry((TEMPLT_COS, {
+            'accountInactivityLimit': '10'})))
+        topology_st.standalone.add_s(Entry((TEMPL_COS, {
             'objectclass': ['top', 'ldapsubentry', 'extensibleObject', 'cosTemplate'],
-            'acctPolicySubentry': LOCAL_CONFIG})))
-        topology_st.standalone.add_s(Entry((DEFN_COS, {
+            'acctPolicySubentry': LOCL_CONF})))
+        topology_st.standalone.add_s(Entry((DEFIN_COS, {
             'objectclass': ['top', 'ldapsubentry', 'cosSuperDefinition', 'cosPointerDefinition'],
-            'cosTemplateDn': TEMPLT_COS,
+            'cosTemplateDn': TEMPL_COS,
             'cosAttribute': 'acctPolicySubentry default operational-default'})))
     except ldap.LDAPError as e:
-        log.error('Failed to add entry ({}, {}, {}):'.format(LOCAL_CONFIG, TEMPLT_COS, DEFN_COS))
+        log.error('Failed to add entry ({}, {}, {}):'.format(LOCL_CONF, TEMPL_COS, DEFIN_COS))
         raise
     topology_st.standalone.restart(timeout=10)
 
 
-def add_users(topology_st, suffix, subtre, userid, nousrs):
-    """Add users to default test instance with given suffix, subtre, userid and nousrs"""
+def add_crtime_stamp(topology_st, suffix, subtre, userid, nousrs):
+    """Enable account by replacing createTimeStamp attribute"""
+
+    NewCrtimeStamp = time.strftime("%Y%m%d%H%M%S") + 'Z'
+    log.info('Enable account by replacing createTimeStamp attribute')
+    topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
+    while (nousrs > 0):
+        usrrdn = '{}{}'.format(userid, nousrs)
+        userdn = 'uid={},{},{}'.format(usrrdn, subtre, suffix)
+        try:
+            topology_st.standalone.modify_s(userdn, [(ldap.MOD_REPLACE, 'createTimeStamp', NewCrtimeStamp)])
+        except ldap.LDAPError as e:
+            log.error('Failed to replace createTimeStamp attribute for user-{}'.format(userdn))
+            raise
+        nousrs = nousrs - 1
+
+
+def pwacc_lock(topology_st, suffix, subtre, userid, nousrs):
+    """Lockout user account by attempting invalid password binds"""
+
+    log.info('Lockout user account by attempting invalid password binds')
+    while (nousrs > 0):
+        usrrdn = '{}{}'.format(userid, nousrs)
+        userdn = 'uid={},{},{}'.format(usrrdn, subtre, suffix)
+        try:
+            topology_st.standalone.simple_bind_s(userdn, INVL_PASW)
+        except ldap.LDAPError as e:
+            log.error('1-Invalid bind completed for user-{}'.format(userdn))
+        try:
+            topology_st.standalone.simple_bind_s(userdn, INVL_PASW)
+        except ldap.LDAPError as e:
+            log.error('2-Invalid bind completed for user-{}'.format(userdn))
+        try:
+            topology_st.standalone.simple_bind_s(userdn, INVL_PASW)
+        except ldap.LDAPError as e:
+            log.error('3-Invalid bind completed for user-{}'.format(userdn))
+        try:
+            topology_st.standalone.simple_bind_s(userdn, USER_PASW)
+        except ldap.LDAPError as e:
+            log.error('Account lockout of user-{}, {}'.format(userdn, e.message['desc']))
+        nousrs = nousrs - 1
+
+
+def userpw_reset(topology_st, suffix, subtre, userid, nousrs, newpasw, bindusr, bindupw):
+    """Reset user password"""
+
+    while (nousrs > 0):
+        usrrdn = '{}{}'.format(userid, nousrs)
+        userdn = 'uid={},{},{}'.format(usrrdn, subtre, suffix)
+        log.info('Reset user password for user-{}'.format(userdn))
+        if (bindusr == "DirMgr"):
+            topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
+            try:
+                topology_st.standalone.modify_s(userdn, [(ldap.MOD_REPLACE, 'userPassword', newpasw)])
+            except ldap.LDAPError as e:
+                log.error('Unable to reset userPassword for user-{}, {}'.format(userdn, e.message['desc']))
+        elif (bindusr == "RegUsr"):
+            topology_st.standalone.simple_bind_s(userdn, bindupw)
+            try:
+                topology_st.standalone.modify_s(userdn, [(ldap.MOD_REPLACE, 'userPassword', newpasw)])
+            except ldap.LDAPError as e:
+                log.error('Unable to reset userPassword for user-{}, {}'.format(userdn, e.message['desc']))
+        nousrs = nousrs - 1
+
+
+def pwexp_account(topology_st, suffix, subtre, userid, nousrs, userpw, chpwexp):
+    """Check if password expired for user account"""
+
+    log.info('Check if password expired for user account')
+    while (nousrs > 0):
+        usrrdn = '{}{}'.format(userid, nousrs)
+        userdn = 'uid={},{},{}'.format(usrrdn, subtre, suffix)
+        log.info('Check if password expired for user-{}'.format(userdn))
+        if (chpwexp == "YesExpired"):
+            try:
+                topology_st.standalone.simple_bind_s(userdn, userpw)
+            except ldap.LDAPError as e:
+                log.error('User authentication failed for user-{},{}'.format(userdn, e.message['desc']))
+        elif (chpwexp == "NotExpired"):
+            try:
+                topology_st.standalone.simple_bind_s(userdn, userpw)
+            except ldap.LDAPError as e:
+                log.error('User authentication failed for user-{},{}'.format(userdn, e.message['desc']))
+                raise
+        nousrs = nousrs - 1
+
+
+def del_crtime_stamp(topology_st, suffix, subtre, userid, nousrs):
+    """Delete createTimeStamp attribute from user account"""
 
-    log.info('add_users: Pass all of these as parameteres suffix, subtre, userid and nousrs')
+    log.info('Delete createTimeStamp attribute from user account')
     topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
     while (nousrs > 0):
         usrrdn = '{}{}'.format(userid, nousrs)
         userdn = 'uid={},{},{}'.format(usrrdn, subtre, suffix)
         try:
+            topology_st.standalone.modify_s(userdn, [(ldap.MOD_DELETE, 'createTimeStamp', None)])
+        except ldap.LDAPError as e:
+            log.error('Failed to delete createTimeStamp attribute for user-{}'.format(userdn))
+            raise
+        nousrs = nousrs - 1
+
+
+def nsact_inact(topology_st, suffix, subtre, userid, nousrs, action):
+    """Activate/inactivate account using ns-activate.pl and ns-inactivate.pl"""
+
+    log.info('Activate/inactivate account using ns-activate.pl and ns-inactivate.pl')
+    ds_paths = Paths(serverid=topology_st.standalone.serverid,
+                     instance=topology_st.standalone)
+    while (nousrs > 0):
+        usrrdn = '{}{}'.format(userid, nousrs)
+        userdn = 'uid={},{},{}'.format(usrrdn, subtre, suffix)
+        if (action == "Act"):
+            log.info('Activate user {}'.format(userdn))
+            if ds_paths.version < '1.3':
+                nsact = '{}/ns-activate.pl'.format(inst_dir)
+                nsact_cmd = [nsact, '-D', DN_DM, '-w', PASSWORD, '-I', userdn]
+            else:
+                nsact = '{}/ns-activate.pl'.format(ds_paths.sbin_dir)
+                nsact_cmd = [nsact, '-Z', SERVERID_STANDALONE, '-D', DN_DM, '-w', PASSWORD, '-I', userdn]
+        elif (action == "Inact"):
+            log.info('Inactivate user {}'.format(userdn))
+            if ds_paths.version < '1.3':
+                inact = '{}/ns-inactivate.pl'.format(inst_dir)
+                inact_cmd = [inact, '-D', DN_DM, '-w', PASSWORD, '-I', userdn]
+            else:
+                inact = '{}/ns-inactivate.pl'.format(ds_paths.sbin_dir)
+                inact_cmd = [inact, '-Z', SERVERID_STANDALONE, '-D', DN_DM, '-w', PASSWORD, '-I', userdn]
+        nousrs = nousrs - 1
+
+
+def modify_attr(topology_st, base_dn, attr_name, attr_val):
+    """Modify attribute value for Config entries"""
+
+    log.info('Modify attribute value for Config entries')
+    topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
+    try:
+        topology_st.standalone.modify_s(base_dn, [(ldap.MOD_REPLACE, attr_name, attr_val)])
+    except ldap.LDAPError as e:
+        log.error('Failed to replace lastLoginTime attribute for user-{}'.format(userdn))
+
+
+def add_last_login(topology_st, suffix, subtre, userid, nousrs):
+    """Enable account by replacing lastLoginTime attribute"""
+
+    NewLastLogin = time.strftime("%Y%m%d%H%M%S") + 'Z'
+    log.info('Enable account by replacing lastLoginTime attribute')
+    topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
+    while (nousrs > 0):
+        usrrdn = '{}{}'.format(userid, nousrs)
+        userdn = 'uid={},{},{}'.format(usrrdn, subtre, suffix)
+        try:
+            topology_st.standalone.modify_s(userdn, [(ldap.MOD_REPLACE, 'lastLoginTime', NewLastLogin)])
+        except ldap.LDAPError as e:
+            log.error('Failed to replace lastLoginTime attribute for user-{}'.format(userdn))
+            raise
+        nousrs = nousrs - 1
+
+
+def del_last_login(topology_st, suffix, subtre, userid, nousrs):
+    """Delete lastLoginTime attribute from user account"""
+
+    log.info('Delete lastLoginTime attribute from user account')
+    topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
+    while (nousrs > 0):
+        usrrdn = '{}{}'.format(userid, nousrs)
+        userdn = 'uid={},{},{}'.format(usrrdn, subtre, suffix)
+        try:
+            topology_st.standalone.modify_s(userdn, [(ldap.MOD_DELETE, 'lastLoginTime', None)])
+        except ldap.LDAPError as e:
+            log.error('Failed to delete lastLoginTime attribute for user-{}'.format(userdn))
+            raise
+        nousrs = nousrs - 1
+
+
+def add_groups(topology_st, suffix, subtre, grupid, nogrps):
+    """Add groups to default test instance with given suffix, subtre, grupid and nogrps"""
+
+    log.info('add_groups: Pass all of these as parameters suffix, subtre, grupid and nogrps')
+    topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
+    while (nogrps > 0):
+        grprdn = '{}{}'.format(grupid, nogrps)
+        grupdn = 'cn={},{},{}'.format(grprdn, subtre, suffix)
+        try:
+            topology_st.standalone.add_s(Entry((grupdn, {
+                'objectclass': 'top',
+                'objectclass': 'groupOfNames',
+                'cn': grprdn})))
+        except ldap.LDAPError as e:
+            log.error('Failed to add {} group: error {}'.format(grupdn, e.message['desc']))
+            raise
+        nogrps = nogrps - 1
+
+
+def del_groups(topology_st, suffix, subtre, grupid, nogrps):
+    """Delete groups from default test instance with given suffix, subtre, grupid and nogrps"""
+
+    log.info('del_groups: Pass all of these as parameters suffix, subtre, grupid and nogrps')
+    topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
+    while (nogrps > 0):
+        grprdn = '{}{}'.format(grupid, nogrps)
+        grupdn = 'cn={},{},{}'.format(grprdn, subtre, suffix)
+        try:
+            topology_st.standalone.delete_s(grupdn)
+        except ldap.LDAPError as e:
+            log.error('Failed to delete {} group: error {}'.format(grupdn, e.message['desc']))
+            raise
+        nogrps = nogrps - 1
+
+
+def add_users(topology_st, suffix, subtre, userid, nousrs, ulimit):
+    """Add users to default test instance with given suffix, subtre, userid and nousrs"""
+
+    log.info('add_users: Pass all of these as parameters suffix, subtre, userid and nousrs')
+    topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
+    while (nousrs > ulimit):
+        usrrdn = '{}{}'.format(userid, nousrs)
+        userdn = 'uid={},{},{}'.format(usrrdn, subtre, suffix)
+        try:
             topology_st.standalone.add_s(Entry((userdn, {
                 'objectclass': 'top person'.split(),
                 'objectclass': 'inetorgperson',
                 'cn': usrrdn,
                 'sn': usrrdn,
-                'userpassword': USER_PW,
+                'userpassword': USER_PASW,
                 'mail': '{}@redhat.com'.format(usrrdn)})))
         except ldap.LDAPError as e:
             log.error('Failed to add {} user: error {}'.format(userdn, e.message['desc']))
@@ -80,7 +356,7 @@ def add_users(topology_st, suffix, subtre, userid, nousrs):
 def del_users(topology_st, suffix, subtre, userid, nousrs):
     """Delete users from default test instance with given suffix, subtre, userid and nousrs"""
 
-    log.info('del_users: Pass all of these as parameteres suffix, subtre, userid and nousrs')
+    log.info('del_users: Pass all of these as parameters suffix, subtre, userid and nousrs')
     topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
     while (nousrs > 0):
         usrrdn = '{}{}'.format(userid, nousrs)
@@ -93,7 +369,7 @@ def del_users(topology_st, suffix, subtre, userid, nousrs):
         nousrs = nousrs - 1
 
 
-def account_status(topology_st, suffix, subtre, userid, nousrs, ulimit, tochck):
+def account_status(topology_st, suffix, subtre, userid, nousrs, ulimit, tochck, userpw):
     """Check account status for the given suffix, subtre, userid and nousrs"""
 
     while (nousrs > ulimit):
@@ -101,78 +377,629 @@ def account_status(topology_st, suffix, subtre, userid, nousrs, ulimit, tochck):
         userdn = 'uid={},{},{}'.format(usrrdn, subtre, suffix)
         if (tochck == "Enabled"):
             try:
-                topology_st.standalone.simple_bind_s(userdn, USER_PW)
+                topology_st.standalone.simple_bind_s(userdn, userpw)
             except ldap.LDAPError as e:
                 log.error('User {} is inactivated, expected 0 : error {}'.format(userdn, e.message['desc']))
                 raise
+        elif (tochck == "PwdExpired"):
+            try:
+                topology_st.standalone.simple_bind_s(userdn, userpw)
+            except ldap.LDAPError as e:
+                log.error('Checking user-{}, error-{}'.format(userdn, e.message['desc']))
         elif (tochck == "Disabled"):
             with pytest.raises(ldap.CONSTRAINT_VIOLATION):
-                topology_st.standalone.simple_bind_s(userdn, USER_PW)
+                topology_st.standalone.simple_bind_s(userdn, userpw)
                 log.error('User {} is not inactivated, expected error 19'.format(userdn))
         nousrs = nousrs - 1
 
 
-def test_actNinact_local(topology_st, accpolicy_local):
+def test_glact_inact(topology_st, accpol_global):
     """Verify if user account is inactivated when accountInactivityLimit is exceeded. User is created in the default suffix.
 
-    :ID: 470f480c-da55-47ee-9095-5ff50a6d5be1
-    :feature: Account Policy Plugin
-    :setup: Standalone instance, Local account policy plugin configuration,
-            accountInactivityLimit set to 15, Inactivate account by Account policy plugin
-    :steps: 1. Configure account policy plugin with accpol_local for ou=people subtree
-            2. Set accountInactivityLimit to 15
+    :Feature: Account Policy Plugin
+
+    :Setup: Standalone instance, Local account policy plugin configuration,
+            accountInactivityLimit set to 12, Inactivate account by Account policy plugin
+
+    :Steps: 1. Configure account policy plugin with accpol_local for ou=people subtree
+            2. Set accountInactivityLimit to 12
+            3. Add few users to ou=people subtre in the default suffix
+            4. Wait for 11 secs and run ldapsearch as normal user(3&2) to check if its not inactivated, expected 0.
+            5. Wait for 2 more secs or till accountInactivityLimit is exceeded
+            6. Run ldapsearch as normal user(1) and check if its inactivated, expected error 19.
+            7. Sleep for +11 secs to check if accounts(3&2) accessed at step4 are inactivated now
+
+    :Assert: Should return error code 19
+    """
+
+    suffix = DEFAULT_SUFFIX
+    subtre = "ou=groups"
+    userid = "glinactusr"
+    userpw = USER_PASW
+    nousrs = 3
+    log.info('AccountInactivityLimit set to 12. Account will be inactivated if not accessed in 12 secs')
+    add_users(topology_st, suffix, subtre, userid, nousrs, 0)
+    log.info('Sleep for 10 secs to check if account is not inactivated, expected value 0')
+    time.sleep(10)
+    log.info('Account should not be inactivated since AccountInactivityLimit not exceeded')
+    account_status(topology_st, suffix, subtre, userid, 3, 2, "Enabled", userpw)
+    log.info('Sleep for 3 more secs to check if account is inactivated')
+    time.sleep(3)
+    account_status(topology_st, suffix, subtre, userid, 2, 0, "Disabled", userpw)
+    log.info('Sleep +10 secs to check if account {}3 is inactivated'.format(userid))
+    time.sleep(10)
+    account_status(topology_st, suffix, subtre, userid, 3, 2, "Disabled", userpw)
+    del_users(topology_st, suffix, subtre, userid, nousrs)
+
+
+def test_glremv_lastlogin(topology_st, accpol_global):
+    """Verify if user account is inactivated by createTimeStamp, if lastLoginTime attribute is missing.
+
+    :Feature: Account Policy Plugin
+
+    :Setup: Standalone instance, Local account policy plugin configuration,
+            accountInactivityLimit set to 12, Inactivate account by Account policy plugin
+
+    :Steps: 1. Configure account policy plugin with accpol_local for ou=people subtree
+            2. Set accountInactivityLimit to 12
             3. Add few users to ou=people subtre in the default suffix
-            4. Wait for 14 secs and run ldapsearch as normal user to check if its not inactivated, expected 0.
+            4. Wait for 6 secs and run ldapsearch as normal user to check if its not inactivated, expected 0.
+            5. Remove the lastLoginTime attribute from the user
+            6. Wait for 7 secs to check if account is inactivated based on createTimeStamp value
+            7. Run ldapsearch as normal user and check if its inactivated, expected error 19.
+            8. Replace the lastLoginTime attribute and check if account is activated
+            9. Run ldapsearch as normal user, expected 0.
+
+    :Assert: Should return error code 19
+    """
+
+    suffix = DEFAULT_SUFFIX
+    subtre = "ou=people"
+    userid = "nologtimeusr"
+    userpw = USER_PASW
+    nousrs = 1
+    log.info('AccountInactivityLimit set to 12. Account will be inactivated if not accessed in 12 secs')
+    add_users(topology_st, suffix, subtre, userid, nousrs, 0)
+    log.info('Sleep for 6 secs to check if account is not inactivated, expected value 0')
+    time.sleep(6)
+    log.info('Account should not be inactivated since AccountInactivityLimit not exceeded')
+    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Enabled", userpw)
+    del_last_login(topology_st, suffix, subtre, userid, nousrs)
+    log.info('Sleep for 7 more secs to check if account is inactivated')
+    time.sleep(7)
+    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Disabled", userpw)
+    add_last_login(topology_st, suffix, subtre, userid, nousrs)
+    log.info('Check if account is activated, expected 0')
+    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Enabled", userpw)
+    del_users(topology_st, suffix, subtre, userid, nousrs)
+
+
+def test_glact_login(topology_st, accpol_global):
+    """Verify if user account can be activated by replacing the lastLoginTime attribute.
+
+    :Feature: Account Policy Plugin
+
+    :Setup: Standalone instance, Local account policy plugin configuration,
+            accountInactivityLimit set to 12, Inactivate account by Account policy plugin
+
+    :Steps: 1. Configure Global account policy plugin
+            2. Set accountInactivityLimit to 12
+            3. Add few users to ou=groups subtre in the default suffix
+            4. Wait for 13 secs and check if account is inactivated
+            5. Run ldapsearch as normal user, expected error 19.
+            6. Replace the lastLoginTime attribute and check if account is activated
+            7. Run ldapsearch as normal user, expected 0.
+
+    :Assert: Should return success once the user is activated
+    """
+
+    suffix = DEFAULT_SUFFIX
+    subtre = "ou=groups"
+    userid = "glactusr"
+    userpw = USER_PASW
+    nousrs = 3
+    log.info('AccountInactivityLimit set to 12. Account will be inactivated if not accessed in 12 secs')
+    add_users(topology_st, suffix, subtre, userid, nousrs, 0)
+    log.info('Sleep for 13 secs to check if account is inactivated, expected error 19')
+    time.sleep(13)
+    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Disabled", userpw)
+    add_last_login(topology_st, suffix, subtre, userid, nousrs)
+    log.info('Check if account is activated, expected 0')
+    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Enabled", userpw)
+    del_users(topology_st, suffix, subtre, userid, nousrs)
+
+
+def test_glinact_limit(topology_st, accpol_global):
+    """Verify if user account can be activated by replacing the lastLoginTime attribute.
+
+    :Feature: Account Policy Plugin
+
+    :Setup: Standalone instance, Local account policy plugin configuration,
+            accountInactivityLimit set to 12, Inactivate account by Account policy plugin
+
+    :Steps: 1. Configure Global account policy plugin
+            2. Set accountInactivityLimit to 12 secs
+            3. Add few users to ou=groups subtre in the default suffix
+            4. Wait for 10 secs and check if account is not inactivated, expected 0
+            5. Modify AccountInactivityLimit to 20 secs
+            6. Wait for +18 secs and check if account is not inactivated, expected 0
+            7. Wait for +21 secs and check if account is inactivated, error 19
+            8. Modify accountInactivityLimit to 2 sec
+            9. Add few users to ou=groups subtre in the default suffix
+            10. Wait for 2 secs and check if account is inactivated, error 19
+            11. Modify accountInactivityLimit to 120 secs
+            12. Add few users to ou=groups subtre in the default suffix
+            13. Wait for 90 secs and check if account is not inactivated, expected 0
+            14. Wait for +31 secs and check if account is not inactivated, expected 0
+            15. Wait for +91 secs and check if account is inactivated, error 19
+            16. Replace the lastLoginTime attribute and check if account is activated
+            17. Modify accountInactivityLimit to 12 secs, which is the default
+            18. Run ldapsearch as normal user, expected 0.
+
+    :Assert: Should return success once the user is activated
+    """
+
+    suffix = DEFAULT_SUFFIX
+    subtre = "ou=groups"
+    userid = "inactestusr"
+    userpw = USER_PASW
+    nousrs = 3
+    log.info('AccountInactivityLimit set to 12. Account will be inactivated if not accessed in 12 secs')
+    add_users(topology_st, suffix, subtre, userid, nousrs, 2)
+    log.info('Sleep for 9 secs to check if account is not inactivated, expected 0')
+    time.sleep(9)
+    account_status(topology_st, suffix, subtre, userid, nousrs, 2, "Enabled", userpw)
+    modify_attr(topology_st, ACCP_CONF, 'accountInactivityLimit', '20')
+    time.sleep(18)
+    account_status(topology_st, suffix, subtre, userid, nousrs, 2, "Enabled", userpw)
+    time.sleep(21)
+    account_status(topology_st, suffix, subtre, userid, nousrs, 2, "Disabled", userpw)
+    modify_attr(topology_st, ACCP_CONF, 'accountInactivityLimit', '1')
+    add_users(topology_st, suffix, subtre, userid, 2, 1)
+    time.sleep(2)
+    account_status(topology_st, suffix, subtre, userid, 2, 1, "Disabled", userpw)
+    modify_attr(topology_st, ACCP_CONF, 'accountInactivityLimit', '120')
+    add_users(topology_st, suffix, subtre, userid, 1, 0)
+    time.sleep(90)
+    account_status(topology_st, suffix, subtre, userid, 1, 0, "Enabled", userpw)
+    time.sleep(31)
+    account_status(topology_st, suffix, subtre, userid, 1, 0, "Enabled", userpw)
+    time.sleep(121)
+    account_status(topology_st, suffix, subtre, userid, 1, 0, "Disabled", userpw)
+    add_last_login(topology_st, suffix, subtre, userid, nousrs)
+    log.info('Check if account is activated, expected 0')
+    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Enabled", userpw)
+    modify_attr(topology_st, ACCP_CONF, 'accountInactivityLimit', '12')
+    del_users(topology_st, suffix, subtre, userid, nousrs)
+
+
+def test_glnologin_attr(topology_st, accpol_global):
+    """Verify if user account can be inactivated based on createTimeStamp attribute, no lastLoginTime attribute present
+
+    :Feature: Account Policy Plugin
+
+    :Setup: Standalone instance, Local account policy plugin configuration,
+            accountInactivityLimit set to 12, Inactivate account by Account policy plugin
+
+    :Steps: 1. Configure Global account policy plugin with createTimestamp as stateattrname
+            2. Set accountInactivityLimit to 12 secs
+            3. Add few users to ou=groups subtre in the default suffix
+            4. Wait for 10 secs and check if account is not inactivated, expected 0
+            5. Modify AccountInactivityLimit to 20 secs
+            6. Wait for +9 secs and check if account is not inactivated, expected 0
+            7. Wait for +2 secs and check if account is inactivated, error 19
+            8. Modify accountInactivityLimit to 2 secs
+            9. Add few users to ou=groups subtre in the default suffix
+            10. Wait for 3 secs and check if account is inactivated, error 19
+            11. Modify accountInactivityLimit to 120 secs
+            12. Add few users to ou=groups subtre in the default suffix
+            13. Wait for 90 secs and check if account is not inactivated, expected 0
+            14. Wait for +29 secs and check if account is not inactivated, expected 0
+            15. Wait for +2 secs and check if account is inactivated, error 19
+            16. Replace the lastLoginTime attribute and check if account is activated
+            17. Modify accountInactivityLimit to 12 secs, which is the default
+            18. Run ldapsearch as normal user, expected 0.
+
+    :Assert: Should return success once the user is activated
+    """
+
+    suffix = DEFAULT_SUFFIX
+    subtre = "ou=groups"
+    userid = "nologinusr"
+    userpw = USER_PASW
+    nousrs = 3
+    log.info('AccountInactivityLimit set to 12. Account will be inactivated if not accessed in 12 secs')
+    log.info('Set attribute StateAttrName to createTimestamp')
+    modify_attr(topology_st, ACCP_CONF, 'stateattrname', 'createTimestamp')
+    topology_st.standalone.restart(timeout=10)
+    add_users(topology_st, suffix, subtre, userid, nousrs, 2)
+    log.info('Sleep for 9 secs to check if account is not inactivated, expected 0')
+    time.sleep(9)
+    account_status(topology_st, suffix, subtre, userid, nousrs, 2, "Enabled", userpw)
+    modify_attr(topology_st, ACCP_CONF, 'accountInactivityLimit', '20')
+    time.sleep(9)
+    account_status(topology_st, suffix, subtre, userid, nousrs, 2, "Enabled", userpw)
+    time.sleep(3)
+    account_status(topology_st, suffix, subtre, userid, nousrs, 2, "Disabled", userpw)
+    modify_attr(topology_st, ACCP_CONF, 'accountInactivityLimit', '3')
+    add_users(topology_st, suffix, subtre, userid, 2, 1)
+    time.sleep(2)
+    account_status(topology_st, suffix, subtre, userid, 2, 1, "Enabled", userpw)
+    time.sleep(2)
+    account_status(topology_st, suffix, subtre, userid, 2, 1, "Disabled", userpw)
+    modify_attr(topology_st, ACCP_CONF, 'accountInactivityLimit', '120')
+    add_users(topology_st, suffix, subtre, userid, 1, 0)
+    time.sleep(90)
+    account_status(topology_st, suffix, subtre, userid, 1, 0, "Enabled", userpw)
+    time.sleep(29)
+    account_status(topology_st, suffix, subtre, userid, 1, 0, "Enabled", userpw)
+    time.sleep(2)
+    account_status(topology_st, suffix, subtre, userid, 1, 0, "Disabled", userpw)
+    modify_attr(topology_st, ACCP_CONF, 'accountInactivityLimit', '12')
+    log.info('Set attribute StateAttrName to lastLoginTime, the default')
+    modify_attr(topology_st, ACCP_CONF, 'stateattrname', 'lastLoginTime')
+    topology_st.standalone.restart(timeout=10)
+    add_last_login(topology_st, suffix, subtre, userid, nousrs)
+    log.info('Check if account is activated, expected 0')
+    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Enabled", userpw)
+    del_users(topology_st, suffix, subtre, userid, nousrs)
+
+
+def test_glnoalt_stattr(topology_st, accpol_global):
+    """Verify if user account can be inactivated based on lastLoginTime attribute, altstateattrname set to 1.1
+
+    :Feature: Account Policy Plugin
+
+    :Setup: Standalone instance, Local account policy plugin configuration,
+            accountInactivityLimit set to 12, Inactivate account by Account policy plugin
+
+    :Steps: 1. Configure Global account policy plugin with altstateattrname to 1.1
+            2. Set accountInactivityLimit to 12 secs
+            3. Add few users to ou=groups subtre in the default suffix
+            4. Wait for 13 secs and check if account is inactivated, expected error 19
+            5. Remove lastLoginTime attribute from the user entry
+            6. Run ldapsearch as normal user, expected 0. no lastLoginTime attribute present
+            7. Wait for 13 secs and check if account is inactivated, expected error 19
+
+    :Assert: Should return success once the user is activated
+    """
+
+    suffix = DEFAULT_SUFFIX
+    subtre = "ou=groups"
+    userid = "nologinusr"
+    userpw = USER_PASW
+    nousrs = 3
+    log.info('Set attribute altStateAttrName to 1.1')
+    modify_attr(topology_st, ACCP_CONF, 'altstateattrname', '1.1')
+    topology_st.standalone.restart(timeout=10)
+    add_users(topology_st, suffix, subtre, userid, nousrs, 0)
+    log.info('Sleep for 13 secs to check if account is not inactivated, expected 0')
+    time.sleep(13)
+    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Enabled", userpw)
+    time.sleep(13)
+    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Disabled", userpw)
+    del_last_login(topology_st, suffix, subtre, userid, nousrs)
+    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Enabled", userpw)
+    modify_attr(topology_st, ACCP_CONF, 'altstateattrname', 'createTimestamp')
+    topology_st.standalone.restart(timeout=10)
+    add_last_login(topology_st, suffix, subtre, userid, nousrs)
+    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Enabled", userpw)
+    del_users(topology_st, suffix, subtre, userid, nousrs)
+
+
+def test_glattr_modtime(topology_st, accpol_global):
+    """Verify if user account can be inactivated based on modifyTimeStamp attribute
+
+    :Feature: Account Policy Plugin
+
+    :Setup: Standalone instance, Local account policy plugin configuration,
+            accountInactivityLimit set to 12, Inactivate account by Account policy plugin
+
+    :Steps: 1. Configure Global account policy plugin with altstateattrname to modifyTimestamp
+            2. Set accountInactivityLimit to 12 secs
+            3. Add few users to ou=groups subtre in the default suffix
+            4. Wait for 13 secs and check if account is not inactivated, expected 0 
+            5. Wait for 13 secs and check if account is inactivated, expected error 19
+            6. Remove lastLoginTime attribute from the user entry
+            7. Check if account is inactivated, expected error 19
+
+    :Assert: Should return success once the user is activated
+    """
+
+    suffix = DEFAULT_SUFFIX
+    subtre = "ou=groups"
+    userid = "modtimeusr"
+    userpw = USER_PASW
+    nousrs = 3
+    log.info('Set attribute altStateAttrName to modifyTimestamp')
+    modify_attr(topology_st, ACCP_CONF, 'altstateattrname', 'modifyTimestamp')
+    topology_st.standalone.restart(timeout=10)
+    add_users(topology_st, suffix, subtre, userid, nousrs, 0)
+    log.info('Sleep for 13 secs to check if account is inactivated, expected 0')
+    time.sleep(13)
+    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Disabled", userpw)
+    modify_attr(topology_st, ACCP_CONF, 'altstateattrname', 'createTimestamp')
+    topology_st.standalone.restart(timeout=10)
+    add_last_login(topology_st, suffix, subtre, userid, nousrs)
+    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Enabled", userpw)
+    del_users(topology_st, suffix, subtre, userid, nousrs)
+
+
+def test_glnoalt_nologin(topology_st, accpol_global):
+    """Verify if account policy plugin works if we set altstateattrname set to 1.1 and alwaysrecordlogin to NO
+
+    :Feature: Account Policy Plugin
+
+    :Setup: Standalone instance, Local account policy plugin configuration,
+            accountInactivityLimit set to 12, Inactivate account by Account policy plugin
+
+    :Steps: 1. Configure Global account policy plugin with altstateattrname to 1.1
+            2. Set alwaysrecordlogin to NO. Set accountInactivityLimit to 12 secs
+            3. Add few users to ou=groups subtre in the default suffix
+            4. Wait for 13 secs and check if account is not inactivated, expected 0
+            5. Check for lastLoginTime attribute, it should not present
+            6. Wait for 3 secs and check if account is not inactivated, expected 0
+            7. Run ldapsearch as normal user, expected 0. no lastLoginTime attribute present
+            8. Set altstateattrname to createTimeStamp
+            9. Check if user account is inactivated based on createTimeStamp attribute.
+            10. Account should be inactivated, expected error 19
+
+    :Assert: Should return success once the user is activated
+    """
+
+    suffix = DEFAULT_SUFFIX
+    subtre = "ou=groups"
+    userid = "norecrodlogusr"
+    userpw = USER_PASW
+    nousrs = 3
+    log.info('Set attribute altStateAttrName to 1.1')
+    modify_attr(topology_st, ACCP_CONF, 'altstateattrname', '1.1')
+    log.info('Set attribute alwaysrecordlogin to No')
+    modify_attr(topology_st, ACCP_CONF, 'alwaysrecordlogin', 'no')
+    topology_st.standalone.restart(timeout=10)
+    add_users(topology_st, suffix, subtre, userid, nousrs, 0)
+    log.info('Sleep for 13 secs to check if account is not inactivated, expected 0')
+    time.sleep(13)
+    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Enabled", userpw)
+    time.sleep(3)
+    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Enabled", userpw)
+    log.info('Set attribute altStateAttrName to createTimestamp')
+    modify_attr(topology_st, ACCP_CONF, 'altstateattrname', 'createTimestamp')
+    topology_st.standalone.restart(timeout=10)
+    time.sleep(2)
+    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Disabled", userpw)
+    log.info('Reset the default attribute values')
+    modify_attr(topology_st, ACCP_CONF, 'alwaysrecordlogin', 'yes')
+    topology_st.standalone.restart(timeout=10)
+    add_last_login(topology_st, suffix, subtre, userid, nousrs)
+    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Enabled", userpw)
+    del_users(topology_st, suffix, subtre, userid, nousrs)
+
+
+def test_glinact_nsact(topology_st, accpol_global):
+    """Verify if user account can be activated using ns-activate.pl script.
+
+    :Feature: Account Policy Plugin
+
+    :Setup: Standalone instance, Local account policy plugin configuration,
+            accountInactivityLimit set to 12, Inactivate account by Account policy plugin
+
+    :Steps: 1. Configure Global account policy plugin
+            2. Set accountInactivityLimit to 12
+            3. Add few users to ou=groups subtre in the default suffix
+            4. Wait for 3 secs and inactivate user using ns-inactivate.pl
+            5. Wait for +10 secs and check if account is inactivated
+            6. Run ldapsearch as normal user, expected error 19.
+            7. Activate user using ns-activate.pl script
+            8. Check if account is activated, expected error 19
+            9. Replace the lastLoginTime attribute and check if account is activated
+            10. Run ldapsearch as normal user, expected 0.
+
+    :Assert: Should return success once the user is activated
+    """
+
+    suffix = DEFAULT_SUFFIX
+    subtre = "ou=groups"
+    userid = "nsactusr"
+    userpw = USER_PASW
+    nousrs = 1
+    log.info('AccountInactivityLimit set to 12. Account will be inactivated if not accessed in 12 secs')
+    add_users(topology_st, suffix, subtre, userid, nousrs, 0)
+    log.info('Sleep for 3 secs to check if account is not inactivated, expected value 0')
+    time.sleep(3)
+    nsact_inact(topology_st, suffix, subtre, userid, nousrs, "Inact")
+    log.info('Sleep for 10 secs to check if account is inactivated, expected value 0')
+    time.sleep(10)
+    nsact_inact(topology_st, suffix, subtre, userid, nousrs, "Act")
+    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Disabled", userpw)
+    add_last_login(topology_st, suffix, subtre, userid, nousrs)
+    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Enabled", userpw)
+    del_users(topology_st, suffix, subtre, userid, nousrs)
+
+
+def test_glinact_acclock(topology_st, accpol_global):
+    """Verify if user account is activated when account is unlocked by passwordlockoutduration.
+
+    :Feature: Account Policy Plugin
+
+    :Setup: Standalone instance, Local account policy plugin configuration,
+            accountInactivityLimit set to 12, Inactivate account by Account policy plugin
+
+    :Steps: 1. Configure Global account policy plugin
+            2. Set accountInactivityLimit to 12
+            3. Add few users to ou=groups subtre in the default suffix
+            4. Wait for 3 secs and attempt invalid binds for user 
+            5. Wait for +10 secs and check if account is inactivated
+            6. Run ldapsearch as normal user, expected error 19.
+            7. Wait for passwordlockoutduration and check if account is active
+            8. Check if account is activated, expected error 19
+            9. Replace the lastLoginTime attribute and check if account is activated
+            10. Run ldapsearch as normal user, expected 0.
+
+    :Assert: Should return success once the user is activated
+    """
+
+    suffix = DEFAULT_SUFFIX
+    subtre = "ou=groups"
+    userid = "pwlockusr"
+    userpw = USER_PASW
+    nousrs = 1
+    log.info('AccountInactivityLimit set to 12. Account will be inactivated if not accessed in 12 secs')
+    add_users(topology_st, suffix, subtre, userid, nousrs, 0)
+    log.info('Sleep for 3 secs and try invalid binds to lockout the user')
+    time.sleep(3)
+    pwacc_lock(topology_st, suffix, subtre, userid, nousrs)
+    log.info('Sleep for 10 secs to check if account is inactivated, expected value 19')
+    time.sleep(10)
+    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Disabled", userpw)
+    log.info('Add lastLoginTime to activate the user account')
+    add_last_login(topology_st, suffix, subtre, userid, nousrs)
+    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Enabled", userpw)
+    log.info(
+        'Checking if account is unlocked after passwordlockoutduration, but inactivated after accountInactivityLimit')
+    pwacc_lock(topology_st, suffix, subtre, userid, nousrs)
+    log.info('Account is expected to be unlocked after 10 secs of passwordlockoutduration')
+    log.info('Sleep for 10 secs to check if account is not inactivated, expected value 0')
+    time.sleep(10)
+    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Enabled", userpw)
+    log.info('Sleep 13s and check if account inactivated based on accountInactivityLimit, expected 19')
+    time.sleep(13)
+    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Disabled", userpw)
+    del_users(topology_st, suffix, subtre, userid, nousrs)
+
+
+def test_glnact_pwexp(topology_st, accpol_global):
+    """Verify if user account is activated when password is reset after password is expired
+
+    :Feature: Account Policy Plugin
+
+    :Setup: Standalone instance, Local account policy plugin configuration,
+            accountInactivityLimit set to 12, Inactivate account by Account policy plugin
+
+    :Steps: 1. Configure Global account policy plugin
+            2. Set accountInactivityLimit to 12
+            3. Add few users to ou=groups subtre in the default suffix
+            4. Set passwordmaxage to 9 secs 
+            5. Wait for secs to check if password is expired for the users
+            6. Run ldapsearch as normal user, expected error 19.
+            7. Reset the password once the password is expired
+            8. Wait for +4 secs to check if account is inactivated by plugin
+            9. Run ldapsearch as normal user, expected error 19.
+            10. Replace the lastLoginTime attribute and check if account is activated
+            11. Run ldapsearch as normal user, expected 0.
+
+    :Assert: Should return success once the user is activated
+    """
+
+    suffix = DEFAULT_SUFFIX
+    subtre = "ou=groups"
+    userid = "pwexpusr"
+    userpw = USER_PASW
+    usr1pw = "NwRst123"
+    nousrs = 1
+    try:
+        topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
+        topology_st.standalone.modify_s(BASE_CONF, [(ldap.MOD_REPLACE, 'passwordmaxage', '9')])
+    except ldap.LDAPError as e:
+        log.error('Failed to change the value of passwordmaxage to 9')
+    log.info('AccountInactivityLimit set to 12. Account will be inactivated if not accessed in 12 secs')
+    log.info('Passwordmaxage is set to 9. Password will expire in 9 secs')
+    add_users(topology_st, suffix, subtre, userid, nousrs, 0)
+    log.info('Sleep for 9 secs and check if password expired')
+    time.sleep(9)
+    pwexp_account(topology_st, suffix, subtre, userid, nousrs, userpw, "YesExpired")
+    time.sleep(4)
+    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "PwdExpired", userpw)
+    log.info('Add lastLoginTime to activate the user account')
+    add_last_login(topology_st, suffix, subtre, userid, nousrs)
+    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "PwdExpired", userpw)
+    userpw_reset(topology_st, suffix, subtre, userid, nousrs, usr1pw, "DirMgr", PASSWORD)
+    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Enabled", usr1pw)
+    time.sleep(7)
+    userpw_reset(topology_st, suffix, subtre, userid, nousrs, userpw, "DirMgr", PASSWORD)
+    log.info('Sleep for 6 secs and check if account is inactivated, expected error 19')
+    time.sleep(6)
+    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Disabled", userpw)
+    add_last_login(topology_st, suffix, subtre, userid, nousrs)
+    pwexp_account(topology_st, suffix, subtre, userid, nousrs, userpw, "NotExpired")
+    time.sleep(4)
+    pwexp_account(topology_st, suffix, subtre, userid, nousrs, userpw, "YesExpired")
+    userpw_reset(topology_st, suffix, subtre, userid, nousrs, userpw, "DirMgr", PASSWORD)
+    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Enabled", userpw)
+    try:
+        topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
+        topology_st.standalone.modify_s(BASE_CONF, [(ldap.MOD_REPLACE, 'passwordmaxage', '30')])
+    except ldap.LDAPError as e:
+        log.error('Failed to change the value of passwordmaxage to 30')
+    del_users(topology_st, suffix, subtre, userid, nousrs)
+
+
+def test_locact_inact(topology_st, accpol_local):
+    """Verify if user account is inactivated when accountInactivityLimit is exceeded. User is created in the default suffix.
+
+    :Feature: Account Policy Plugin
+
+    :Setup: Standalone instance, Local account policy plugin configuration,
+            accountInactivityLimit set to 10, Inactivate account by Account policy plugin
+
+    :Steps: 1. Configure account policy plugin with accpol_local for ou=people subtree
+            2. Set accountInactivityLimit to 10
+            3. Add few users to ou=people subtre in the default suffix
+            4. Wait for 9 secs and run ldapsearch as normal user to check if its not inactivated, expected 0.
             5. Wait for 2 secs or till accountInactivityLimit is exceeded
             6. Run ldapsearch as normal user and check if its inactivated, expected error 19.
-            7. Sleep for +14 secs to check if accounts accessed at step4 are inactivated now
-    :assert: Should return error code 19
+            7. Sleep for +9 secs to check if accounts accessed at step4 are inactivated now
+
+    :Assert: Should return error code 19
     """
 
     suffix = DEFAULT_SUFFIX
     subtre = "ou=people"
     userid = "inactusr"
-    userpw = USER_PW
+    userpw = USER_PASW
     nousrs = 3
-    log.info('AccountInactivityLimit set to 15. Account will be inactivated if not accessed in 15 secs')
-    add_users(topology_st, suffix, subtre, userid, nousrs)
-    log.info('Sleeping for 14 secs to check account is not inactivated, expected value 0')
-    time.sleep(14)
+    log.info('AccountInactivityLimit set to 10. Account will be inactivated if not accessed in 10 secs')
+    add_users(topology_st, suffix, subtre, userid, nousrs, 0)
+    log.info('Sleep for 9 secs to check if account is not inactivated, expected value 0')
+    time.sleep(9)
     log.info('Account should not be inactivated since AccountInactivityLimit not exceeded')
-    account_status(topology_st, suffix, subtre, userid, 3, 2, "Enabled")
-    log.info('Sleeping for 2 more secs to check if account is inactivated')
+    account_status(topology_st, suffix, subtre, userid, 3, 2, "Enabled", userpw)
+    log.info('Sleep for 2 more secs to check if account is inactivated')
     time.sleep(2)
-    account_status(topology_st, suffix, subtre, userid, 2, 0, "Disabled")
-    log.info('Sleeping +14 secs to check if account {}3 is inactivated'.format(userid))
-    time.sleep(14)
-    account_status(topology_st, suffix, subtre, userid, 3, 2, "Disabled")
+    account_status(topology_st, suffix, subtre, userid, 2, 0, "Disabled", userpw)
+    log.info('Sleep +9 secs to check if account {}3 is inactivated'.format(userid))
+    time.sleep(9)
+    account_status(topology_st, suffix, subtre, userid, 3, 2, "Disabled", userpw)
     del_users(topology_st, suffix, subtre, userid, nousrs)
 
 
-def test_noinact_local(topology_st, accpolicy_local):
+def test_locinact_modrdn(topology_st, accpol_local):
     """Verify if user account is inactivated when moved from ou=groups to ou=people subtree.
 
-    :ID: 235e3f00-db20-4166-9cfd-77e7c08cabdf
-    :feature: Account Policy Plugin
-    :setup: Standalone instance, Local account policy plugin configuration,
-            accountInactivityLimit set to 15, Inactivate account by Account policy plugin
-    :steps: 1. Add few users to ou=groups subtre in the default suffix, plugin configured to ou=people subtree only.
-            2. Wait for 16 secs and run ldapsearch as normal user to check account is active, expected 0.
-            3. Move users from ou=groups to ou=people subtree
-            4. Sleep for 16 secs and check if entries are inactivated
-    :assert: Should return error code 0 and 19
+    :Feature: Account Policy Plugin
+
+    :Setup: Standalone instance, Local account policy plugin configuration,
+            accountInactivityLimit set to 10, Inactivate account by Account policy plugin
+
+    :Steps: 1. Add few users to ou=groups subtre in the default suffix
+            2. Plugin configured to ou=people subtree only.
+            3. Wait for 9 secs and run ldapsearch as normal user to check if account is active, expected 0.
+            4. Move users from ou=groups to ou=people subtree
+            5. Sleep for 9 secs and check if entries are inactivated
+
+    :Assert: Should return error code 0 and 19
     """
 
     suffix = DEFAULT_SUFFIX
     subtre = "ou=groups"
     userid = "nolockusr"
-    userpw = USER_PW
+    userpw = USER_PASW
     nousrs = 1
     log.info('Account should not be inactivated since the subtree is not configured')
-    add_users(topology_st, suffix, subtre, userid, nousrs)
-    log.info('Sleeping for 16 secs to check if account is not inactivated, expected value 0')
-    time.sleep(16)
-    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Enabled")
+    add_users(topology_st, suffix, subtre, userid, nousrs, 0)
+    log.info('Sleep for 9 secs to check if account is not inactivated, expected value 0')
+    time.sleep(9)
+    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Enabled", userpw)
     log.info('Moving users from ou=groups to ou=people subtree')
     try:
         topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
@@ -182,37 +1009,39 @@ def test_noinact_local(topology_st, accpolicy_local):
         log.error('Failed to move user uid=nolockusr1 from ou=groups to ou=people')
         raise
     subtre = "ou=people"
-    log.info('Then wait for 16 secs and check if entries are inactivated')
-    time.sleep(16)
-    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Disabled")
+    log.info('Then wait for 11 secs and check if entries are inactivated')
+    time.sleep(11)
+    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Disabled", userpw)
     del_users(topology_st, suffix, subtre, userid, nousrs)
 
 
-def test_inact_local(topology_st, accpolicy_local):
+def test_locact_modrdn(topology_st, accpol_local):
     """Verify if user account is inactivated when users moved from ou=people to ou=groups subtree.
 
-    :ID: ffccf0fd-b684-4462-87ef-1ec6d3e40574
-    :feature: Account Policy Plugin
-    :setup: Standalone instance, Local account policy plugin configuration,
-            accountInactivityLimit set to 15, Inactivate account by Account policy plugin
-    :steps: 1. Add few users to ou=people subtre in the default suffix
-            2. Wait for 14 secs and run ldapsearch as normal user to check if its not inactivated, expected 0.
+    :Feature: Account Policy Plugin
+
+    :Setup: Standalone instance, Local account policy plugin configuration,
+            accountInactivityLimit set to 10, Inactivate account by Account policy plugin
+
+    :Steps: 1. Add few users to ou=people subtre in the default suffix
+            2. Wait for 9 secs and run ldapsearch as normal usr to check if its not inactivated, expected 0.
             3. Move users from ou=people to ou=groups subtree
             4. Sleep for +2 secs and check if users are inactivated in ou=people subtree
             5. Check if users are not inactivated in ou=groups subtree
-    :assert: Should return error code 0
+
+    :Assert: Should return error code 0
     """
 
     suffix = DEFAULT_SUFFIX
     subtre = "ou=people"
     userid = "lockusr"
-    userpw = USER_PW
+    userpw = USER_PASW
     nousrs = 1
     log.info('Account should be inactivated since the subtree is configured')
-    add_users(topology_st, suffix, subtre, userid, nousrs)
-    log.info('Sleeping for 16 secs to check if account is inactivated, expected value 19')
-    time.sleep(14)
-    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Enabled")
+    add_users(topology_st, suffix, subtre, userid, nousrs, 0)
+    log.info('Sleep for 9 secs to check if account is inactivated, expected value 19')
+    time.sleep(9)
+    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Enabled", userpw)
     log.info('Moving users from ou=people to ou=groups subtree')
     try:
         topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
@@ -224,7 +1053,41 @@ def test_inact_local(topology_st, accpolicy_local):
     log.info('Sleep for +2 secs and check users from both ou=people and ou=groups subtree')
     time.sleep(2)
     subtre = "ou=groups"
-    account_status(topology_st, suffix, subtre, userid, 1, 0, "Enabled")
+    account_status(topology_st, suffix, subtre, userid, 1, 0, "Enabled", userpw)
+    del_users(topology_st, suffix, subtre, userid, nousrs)
+
+
+def test_locact_login(topology_st, accpol_local):
+    """Verify if user account can be activated by replacing the lastLoginTime attribute.
+
+    :Feature: Account Policy Plugin
+
+    :Setup: Standalone instance, Local account policy plugin configuration,
+            accountInactivityLimit set to 10, Inactivate account by Account policy plugin
+
+    :Steps: 1. Configure account policy plugin with accpol_local for ou=people subtree
+            2. Set accountInactivityLimit to 10
+            3. Add few users to ou=people subtre in the default suffix
+            4. Wait for 11 secs and check if account is inactivated
+            5. Run ldapsearch as normal user, expected error 19.
+            6. Replace the lastLoginTime attribute and check if account is activated
+            7. Run ldapsearch as normal user, expected 0.
+
+    :Assert: Should return success once the user is activated
+    """
+
+    suffix = DEFAULT_SUFFIX
+    subtre = "ou=people"
+    userid = "newactusr"
+    userpw = USER_PASW
+    nousrs = 3
+    log.info('AccountInactivityLimit set to 10. Account will be inactivated if not accessed in 10 secs')
+    add_users(topology_st, suffix, subtre, userid, nousrs, 0)
+    log.info('Sleep for 11 secs to check if account is not inactivated, expected value 0')
+    time.sleep(11)
+    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Disabled", userpw)
+    add_last_login(topology_st, suffix, subtre, userid, 3)
+    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Enabled", userpw)
     del_users(topology_st, suffix, subtre, userid, nousrs)
 
 
-- 
2.7.4

