From eca2ca79bcb4b8ef8d97053868ec0a8da0c25423 Mon Sep 17 00:00:00 2001
From: Sankar Ramalingam <sramling@redhat.com>
Date: Thu, 13 Apr 2017 00:40:27 +0530
Subject: [PATCH] Ticket 48050 - Add account policy tests to plugins test suite

Description: Verify if user account is inactivated when
accountInactivityLimit is exceeded. Added test cases for various
possibilities of stateattrname, altstateattrname and
alwaysrecordlogin attributes. All review comments incorporated

https://pagure.io/389-ds-base/issue/48050

Reviewed by: ?
---
 dirsrvtests/tests/suites/plugins/accpol_test.py | 935 +++++++++++++++++++++---
 1 file changed, 816 insertions(+), 119 deletions(-)

diff --git a/dirsrvtests/tests/suites/plugins/accpol_test.py b/dirsrvtests/tests/suites/plugins/accpol_test.py
index 595ea27..5475f11 100644
--- a/dirsrvtests/tests/suites/plugins/accpol_test.py
+++ b/dirsrvtests/tests/suites/plugins/accpol_test.py
@@ -10,222 +10,919 @@ import pytest
 from lib389.tasks import *
 from lib389.utils import *
 from lib389.topologies import topology_st
+from lib389.idm.user import UserAccounts
 
-LOCAL_CONFIG = 'cn=AccountPolicy1,ou=people,dc=example,dc=com'
-TEMPLT_COS = 'cn=TempltCoS,ou=people,dc=example,dc=com'
-DEFN_COS = 'cn=DefnCoS,ou=people,dc=example,dc=com'
+LOCL_CONF = 'cn=AccountPolicy1,ou=people,dc=example,dc=com'
+TEMPL_COS = 'cn=TempltCoS,ou=people,dc=example,dc=com'
+DEFIN_COS = 'cn=DefnCoS,ou=people,dc=example,dc=com'
 ACCPOL_DN = "cn={},{}".format(PLUGIN_ACCT_POLICY, DN_PLUGIN)
-CONFIG_DN = "cn=config,{}".format(ACCPOL_DN)
-INACT_VAL = 15
-USER_PW = 'Secret1234'
+ACCP_CONF = "{},{}".format(DN_CONFIG, ACCPOL_DN)
+USER_PASW = 'Secret1234'
+INVL_PASW = 'Invalid234'
 
 
 @pytest.fixture(scope="module")
-def accpolicy_local(topology_st):
-    """Configure local account policy plugin for ou=people subtree and restart the server"""
+def accpol_global(topology_st, request):
+    """Configure Global account policy plugin and restart the server"""
 
-    log.info('Enabling account policy plugin and restarting the server')
+    log.info('Configuring Global account policy plugin, pwpolicy attributes and restarting the server')
+    topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
     try:
         topology_st.standalone.plugins.enable(name=PLUGIN_ACCT_POLICY)
-        topology_st.standalone.modify_s(ACCPOL_DN, [(ldap.MOD_REPLACE, 'nsslapd-pluginarg0', CONFIG_DN)])
-        topology_st.standalone.modify_s(CONFIG_DN, [(ldap.MOD_REPLACE, 'alwaysrecordlogin', 'yes')])
-        topology_st.standalone.modify_s(CONFIG_DN, [(ldap.MOD_REPLACE, 'stateattrname', 'lastLoginTime')])
-        topology_st.standalone.modify_s(CONFIG_DN, [(ldap.MOD_REPLACE, 'altstateattrname', 'createTimestamp')])
-        topology_st.standalone.modify_s(CONFIG_DN, [(ldap.MOD_REPLACE, 'specattrname', 'acctPolicySubentry')])
-        topology_st.standalone.modify_s(CONFIG_DN, [(ldap.MOD_REPLACE, 'limitattrname', 'accountInactivityLimit')])
+        topology_st.standalone.modify_s(ACCPOL_DN, [(ldap.MOD_REPLACE, 'nsslapd-pluginarg0', ACCP_CONF)])
+        topology_st.standalone.modify_s(ACCP_CONF, [(ldap.MOD_REPLACE, 'alwaysrecordlogin', 'yes')])
+        topology_st.standalone.modify_s(ACCP_CONF, [(ldap.MOD_REPLACE, 'stateattrname', 'lastLoginTime')])
+        topology_st.standalone.modify_s(ACCP_CONF, [(ldap.MOD_REPLACE, 'altstateattrname', 'createTimestamp')])
+        topology_st.standalone.modify_s(ACCP_CONF, [(ldap.MOD_REPLACE, 'specattrname', 'acctPolicySubentry')])
+        topology_st.standalone.modify_s(ACCP_CONF, [(ldap.MOD_REPLACE, 'limitattrname', 'accountInactivityLimit')])
+        topology_st.standalone.modify_s(ACCP_CONF, [(ldap.MOD_REPLACE, 'accountInactivityLimit', '12')])
+        topology_st.standalone.config.set('passwordexp', 'on')
+        topology_st.standalone.config.set('passwordmaxage', '300')
+        topology_st.standalone.config.set('passwordwarning', '1')
+        topology_st.standalone.config.set('passwordlockout', 'on')
+        topology_st.standalone.config.set('passwordlockoutduration', '10')
+        topology_st.standalone.config.set('passwordmaxfailure', '3')
+        topology_st.standalone.config.set('passwordunlock', 'on')
     except ldap.LDAPError as e:
-        log.error('Failed to modify account policy plugin attrs')
-        raise
+        log.error('Failed to enable Global Account Policy Plugin and Password policy attributes')
+        raise e
+    topology_st.standalone.restart(timeout=10)
+
+    def fin():
+        log.info('Disabling Global accpolicy plugin and removing pwpolicy attrs')
+        topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
+        try:
+            topology_st.standalone.plugins.disable(name=PLUGIN_ACCT_POLICY)
+            topology_st.standalone.config.set('passwordexp', 'off')
+            topology_st.standalone.config.set('passwordlockout', 'off')
+        except ldap.LDAPError as e:
+            log.error('Failed to disable Global accpolicy plugin, {}'.format(e.message['desc']))
+            assert False
+        topology_st.standalone.restart(timeout=10)
+
+    request.addfinalizer(fin)
+
+
+@pytest.fixture(scope="module")
+def accpol_local(topology_st, accpol_global, request):
+    """Configure Local account policy plugin for ou=people subtree and restart the server"""
 
     log.info('Adding Local account policy plugin configuration entries')
+    topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
     try:
-        topology_st.standalone.add_s(Entry((LOCAL_CONFIG, {
+        topology_st.standalone.modify_s(ACCP_CONF, [(ldap.MOD_DELETE, 'accountInactivityLimit', None)])
+        topology_st.standalone.config.set('passwordmaxage', '300')
+        topology_st.standalone.add_s(Entry((LOCL_CONF, {
             'objectclass': ['top', 'ldapsubentry', 'extensibleObject', 'accountpolicy'],
-            'accountInactivityLimit': '15'})))
-        topology_st.standalone.add_s(Entry((TEMPLT_COS, {
+            'accountInactivityLimit': '10'})))
+        topology_st.standalone.add_s(Entry((TEMPL_COS, {
             'objectclass': ['top', 'ldapsubentry', 'extensibleObject', 'cosTemplate'],
-            'acctPolicySubentry': LOCAL_CONFIG})))
-        topology_st.standalone.add_s(Entry((DEFN_COS, {
+            'acctPolicySubentry': LOCL_CONF})))
+        topology_st.standalone.add_s(Entry((DEFIN_COS, {
             'objectclass': ['top', 'ldapsubentry', 'cosSuperDefinition', 'cosPointerDefinition'],
-            'cosTemplateDn': TEMPLT_COS,
+            'cosTemplateDn': TEMPL_COS,
             'cosAttribute': 'acctPolicySubentry default operational-default'})))
     except ldap.LDAPError as e:
-        log.error('Failed to add entry ({}, {}, {}):'.format(LOCAL_CONFIG, TEMPLT_COS, DEFN_COS))
-        raise
+        log.error('Failed to configure Local account policy plugin')
+        log.error('Failed to add entry {}, {}, {}:'.format(LOCL_CONF, TEMPL_COS, DEFIN_COS))
+        raise e
     topology_st.standalone.restart(timeout=10)
 
+    def fin():
+        log.info('Disabling Local accpolicy plugin and removing pwpolicy attrs')
+        topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
+        try:
+            topology_st.standalone.plugins.disable(name=PLUGIN_ACCT_POLICY)
+            topology_st.standalone.delete_s(LOCL_CONF)
+            topology_st.standalone.delete_s(TEMPL_COS)
+            topology_st.standalone.delete_s(DEFIN_COS)
+        except ldap.LDAPError as e:
+            log.error('Failed to disable Local accpolicy plugin, {}'.format(e.message['desc']))
+            assert False
+        topology_st.standalone.restart(timeout=10)
+
+    request.addfinalizer(fin)
+
+
+def pwacc_lock(topology_st, suffix, subtree, userid, nousrs):
+    """Lockout user account by attempting invalid password binds"""
+
+    log.info('Lockout user account by attempting invalid password binds')
+    while (nousrs > 0):
+        usrrdn = '{}{}'.format(userid, nousrs)
+        userdn = 'uid={},{},{}'.format(usrrdn, subtree, suffix)
+        for i in range(3):
+            with pytest.raises(ldap.INVALID_CREDENTIALS):
+                topology_st.standalone.simple_bind_s(userdn, INVL_PASW)
+                log.error('No invalid credentials error for User {}'.format(userdn))
+        with pytest.raises(ldap.CONSTRAINT_VIOLATION):
+            topology_st.standalone.simple_bind_s(userdn, USER_PASW)
+            log.error('User {} is not locked, expected error 19'.format(userdn))
+        nousrs = nousrs - 1
+
+
+def userpw_reset(topology_st, suffix, subtree, userid, nousrs, bindusr, bindpw, newpasw):
+    """Reset user password"""
+
+    while (nousrs > 0):
+        usrrdn = '{}{}'.format(userid, nousrs)
+        userdn = 'uid={},{},{}'.format(usrrdn, subtree, suffix)
+        log.info('Reset user password for user-{}'.format(userdn))
+        if (bindusr == "DirMgr"):
+            topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
+            try:
+                topology_st.standalone.modify_s(userdn, [(ldap.MOD_REPLACE, 'userPassword', newpasw)])
+            except ldap.LDAPError as e:
+                log.error('Unable to reset userPassword for user-{}'.format(userdn))
+                raise e
+        elif (bindusr == "RegUsr"):
+            topology_st.standalone.simple_bind_s(userdn, bindpw)
+            try:
+                topology_st.standalone.modify_s(userdn, [(ldap.MOD_REPLACE, 'userPassword', newpasw)])
+            except ldap.LDAPError as e:
+                log.error('Unable to reset userPassword for user-{}'.format(userdn))
+                raise e
+        nousrs = nousrs - 1
+
+
+def nsact_inact(topology_st, suffix, subtree, userid, nousrs, action):
+    """Activate/inactivate account using ns-activate.pl and ns-inactivate.pl"""
+
+    log.info('Activate/inactivate account using ns-activate.pl and ns-inactivate.pl')
+    while (nousrs > 0):
+        usrrdn = '{}{}'.format(userid, nousrs)
+        userdn = 'uid={},{},{}'.format(usrrdn, subtree, suffix)
+        if (action == "Act"):
+            log.info('Activate user {}'.format(userdn))
+            if topology_st.standalone.ds_paths.version < '1.3':
+                nsact = '{}/ns-activate.pl'.format(inst_dir)
+                nsact_cmd = [nsact, '-D', DN_DM, '-w', PASSWORD, '-I', userdn]
+            else:
+                nsact = '{}/ns-activate.pl'.format(topology_st.standalone.ds_paths.sbin_dir)
+                nsact_cmd = [nsact, '-Z', SERVERID_STANDALONE, '-D', DN_DM, '-w', PASSWORD, '-I', userdn]
+        elif (action == "Inact"):
+            log.info('Inactivate user {}'.format(userdn))
+            if topology_st.standalone.ds_paths.version < '1.3':
+                inact = '{}/ns-inactivate.pl'.format(inst_dir)
+                inact_cmd = [inact, '-D', DN_DM, '-w', PASSWORD, '-I', userdn]
+            else:
+                inact = '{}/ns-inactivate.pl'.format(topology_st.standalone.ds_paths.sbin_dir)
+                inact_cmd = [inact, '-Z', SERVERID_STANDALONE, '-D', DN_DM, '-w', PASSWORD, '-I', userdn]
+        nousrs = nousrs - 1
+
+
+def modify_attr(topology_st, base_dn, attr_name, attr_val):
+    """Modify attribute value for a given DN"""
+
+    log.info('Modify attribute value for a given DN')
+    topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
+    try:
+        topology_st.standalone.modify_s(base_dn, [(ldap.MOD_REPLACE, attr_name, attr_val)])
+    except ldap.LDAPError as e:
+        log.error('Failed to replace lastLoginTime attribute for user-{} {}'.format(userdn, e.message['desc']))
+        assert False
+
+
+def check_attr(topology_st, suffix, subtree, userid, nousrs, attr_name):
+    """Check ModifyTimeStamp attribute present for user"""
+
+    log.info('Check ModifyTimeStamp attribute present for user')
+    topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
+    while (nousrs > 0):
+        usrrdn = '{}{}'.format(userid, nousrs)
+        userdn = 'uid={},{},{}'.format(usrrdn, subtree, suffix)
+        try:
+            topology_st.standalone.search_s(userdn, ldap.SCOPE_BASE, attr_name)
+        except ldap.LDAPError as e:
+            log.error('ModifyTimeStamp attribute is not present for user-{} {}'.format(userdn, e.message['desc']))
+            assert False
+        nousrs = nousrs - 1
+
+
+def add_time_attr(topology_st, suffix, subtree, userid, nousrs, attr_name):
+    """Enable account by replacing lastLoginTime/createTimeStamp/ModifyTimeStamp attribute"""
+
+    new_attr_val = time.strftime("%Y%m%d%H%M%S", time.gmtime()) + 'Z'
+    log.info('Enable account by replacing lastLoginTime/createTimeStamp/ModifyTimeStamp attribute')
+    topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
+    while (nousrs > 0):
+        usrrdn = '{}{}'.format(userid, nousrs)
+        userdn = 'uid={},{},{}'.format(usrrdn, subtree, suffix)
+        try:
+            topology_st.standalone.modify_s(userdn, [(ldap.MOD_REPLACE, attr_name, new_attr_val)])
+        except ldap.LDAPError as e:
+            log.error('Failed to add/replace {} attribute to-{}, for user-{}'.format(attr_name, new_attr_val, userdn))
+            raise e
+        nousrs = nousrs - 1
+
 
-def add_users(topology_st, suffix, subtre, userid, nousrs):
-    """Add users to default test instance with given suffix, subtre, userid and nousrs"""
+def modusr_attr(topology_st, suffix, subtree, userid, nousrs, attr_name, attr_value):
+    """Enable account by replacing cn attribute value, value of modifyTimeStamp changed"""
 
-    log.info('add_users: Pass all of these as parameteres suffix, subtre, userid and nousrs')
+    log.info('Enable account by replacing cn attribute value, value of modifyTimeStamp changed')
     topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
     while (nousrs > 0):
         usrrdn = '{}{}'.format(userid, nousrs)
-        userdn = 'uid={},{},{}'.format(usrrdn, subtre, suffix)
+        userdn = 'uid={},{},{}'.format(usrrdn, subtree, suffix)
         try:
-            topology_st.standalone.add_s(Entry((userdn, {
-                'objectclass': 'top person'.split(),
-                'objectclass': 'inetorgperson',
-                'cn': usrrdn,
-                'sn': usrrdn,
-                'userpassword': USER_PW,
-                'mail': '{}@redhat.com'.format(usrrdn)})))
+            topology_st.standalone.modify_s(userdn, [(ldap.MOD_REPLACE, attr_name, attr_value)])
         except ldap.LDAPError as e:
-            log.error('Failed to add {} user: error {}'.format(userdn, e.message['desc']))
-            raise
+            log.error('Failed to add/replace {} attribute to-{}, for user-{}'.format(attr_name, attr_value, userdn))
+            raise e
         nousrs = nousrs - 1
 
 
-def del_users(topology_st, suffix, subtre, userid, nousrs):
-    """Delete users from default test instance with given suffix, subtre, userid and nousrs"""
+def del_time_attr(topology_st, suffix, subtree, userid, nousrs, attr_name):
+    """Delete lastLoginTime/createTimeStamp/ModifyTimeStamp attribute from user account"""
 
-    log.info('del_users: Pass all of these as parameteres suffix, subtre, userid and nousrs')
+    log.info('Delete lastLoginTime/createTimeStamp/ModifyTimeStamp attribute from user account')
     topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
     while (nousrs > 0):
         usrrdn = '{}{}'.format(userid, nousrs)
-        userdn = 'uid={},{},{}'.format(usrrdn, subtre, suffix)
+        userdn = 'uid={},{},{}'.format(usrrdn, subtree, suffix)
         try:
-            topology_st.standalone.delete_s(userdn)
+            topology_st.standalone.modify_s(userdn, [(ldap.MOD_DELETE, attr_name, None)])
         except ldap.LDAPError as e:
-            log.error('Failed to delete {} user: error {}'.format(userdn, e.message['desc']))
-            raise
+            log.error('Failed to delete {} attribute for user-{}'.format(attr_name, userdn))
+            raise e
+        nousrs = nousrs - 1
+
+
+def add_users(topology_st, suffix, subtree, userid, nousrs, ulimit):
+    """Add users to default test instance with given suffix, subtree, userid and nousrs"""
+
+    log.info('add_users: Pass all of these as parameters suffix, subtree, userid and nousrs')
+    users = UserAccounts(topology_st.standalone, suffix, rdn=subtree)
+    while (nousrs > ulimit):
+        usrrdn = '{}{}'.format(userid, nousrs)
+        user_properties = {
+            'uid': usrrdn,
+            'cn': usrrdn,
+            'sn': usrrdn,
+            'uidNumber': '1001',
+            'gidNumber': '2001',
+            'userpassword': USER_PASW,
+            'homeDirectory': '/home/{}'.format(usrrdn)}
+        users.create(properties=user_properties)
+        nousrs = nousrs - 1
+
+
+def del_users(topology_st, suffix, subtree, userid, nousrs):
+    """Delete users from default test instance with given suffix, subtree, userid and nousrs"""
+
+    log.info('del_users: Pass all of these as parameters suffix, subtree, userid and nousrs')
+    topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
+    users = UserAccounts(topology_st.standalone, suffix, rdn=subtree)
+    while (nousrs > 0):
+        usrrdn = '{}{}'.format(userid, nousrs)
+        userdn = users.get(usrrdn)
+        userdn.delete()
         nousrs = nousrs - 1
 
 
-def account_status(topology_st, suffix, subtre, userid, nousrs, ulimit, tochck):
-    """Check account status for the given suffix, subtre, userid and nousrs"""
+def account_status(topology_st, suffix, subtree, userid, nousrs, ulimit, tochck):
+    """Check account status for the given suffix, subtree, userid and nousrs"""
 
     while (nousrs > ulimit):
         usrrdn = '{}{}'.format(userid, nousrs)
-        userdn = 'uid={},{},{}'.format(usrrdn, subtre, suffix)
+        userdn = 'uid={},{},{}'.format(usrrdn, subtree, suffix)
         if (tochck == "Enabled"):
             try:
-                topology_st.standalone.simple_bind_s(userdn, USER_PW)
+                topology_st.standalone.simple_bind_s(userdn, USER_PASW)
             except ldap.LDAPError as e:
-                log.error('User {} is inactivated, expected 0 : error {}'.format(userdn, e.message['desc']))
-                raise
+                log.error('User {} failed to login, expected 0'.format(userdn))
+                raise e
+        elif (tochck == "Expired"):
+            with pytest.raises(ldap.INVALID_CREDENTIALS):
+                topology_st.standalone.simple_bind_s(userdn, USER_PASW)
+                log.error('User {} password not expired , expected error 19'.format(userdn))
         elif (tochck == "Disabled"):
             with pytest.raises(ldap.CONSTRAINT_VIOLATION):
-                topology_st.standalone.simple_bind_s(userdn, USER_PW)
+                topology_st.standalone.simple_bind_s(userdn, USER_PASW)
                 log.error('User {} is not inactivated, expected error 19'.format(userdn))
         nousrs = nousrs - 1
 
 
-def test_actNinact_local(topology_st, accpolicy_local):
-    """Verify if user account is inactivated when accountInactivityLimit is exceeded. User is created in the default suffix.
+def test_glact_inact(topology_st, accpol_global):
+    """Verify if user account is inactivated when accountInactivityLimit is exceeded.
+
+    :ID: 342af084-0ad0-442f-b6f6-5a8b8e5e4c28
+    :feature: Account Policy Plugin
+    :setup: Standalone instance, Global account policy plugin configuration,
+            set accountInactivityLimit to few secs.
+    :steps: 1. Add few users to ou=people subtree in the default suffix
+            2. Check if users are active just before it reaches accountInactivityLimit.
+            3. User accounts should not be inactivated, expected 0
+            4. Check if users are inactivated when accountInactivityLimit is exceeded.
+            5. User accounts should be inactivated, expected error 19.
+    :assert: Should return error code 19
+    """
+
+    suffix = DEFAULT_SUFFIX
+    subtree = "ou=people"
+    userid = "glinactusr"
+    nousrs = 3
+    log.info('AccountInactivityLimit set to 12. Account will be inactivated if not accessed in 12 secs')
+    add_users(topology_st, suffix, subtree, userid, nousrs, 0)
+    log.info('Sleep for 10 secs to check if account is not inactivated, expected value 0')
+    time.sleep(10)
+    log.info('Account should not be inactivated since AccountInactivityLimit not exceeded')
+    account_status(topology_st, suffix, subtree, userid, 3, 2, "Enabled")
+    log.info('Sleep for 3 more secs to check if account is inactivated')
+    time.sleep(3)
+    account_status(topology_st, suffix, subtree, userid, 2, 0, "Disabled")
+    log.info('Sleep +10 secs to check if account {}3 is inactivated'.format(userid))
+    time.sleep(10)
+    account_status(topology_st, suffix, subtree, userid, 3, 2, "Disabled")
+    del_users(topology_st, suffix, subtree, userid, nousrs)
+
+
+def test_glremv_lastlogin(topology_st, accpol_global):
+    """Verify if user account is inactivated by createTimeStamp, if lastLoginTime attribute is missing.
 
-    :ID: 470f480c-da55-47ee-9095-5ff50a6d5be1
+    :ID: 8ded5d8e-ed93-4c22-9c8e-78c479189f84
+    :feature: Account Policy Plugin
+    :setup: Standalone instance, Global account policy plugin configuration,
+            set accountInactivityLimit to few secs.
+    :steps: 1. Add few users to ou=people subtree in the default suffix
+            2. Wait for few secs and bind as user to create lastLoginTime attribute.
+            3. Remove the lastLoginTime attribute from the user.
+            4. Wait till accountInactivityLimit exceeded based on createTimeStamp value
+            5. Check if users are inactivated, expected error 19.
+            6. Replace lastLoginTime attribute and check if account is activated
+            7. User should be activated based on lastLoginTime attribute, expected 0
+    :assert: Should return error code 19
+    """
+
+    suffix = DEFAULT_SUFFIX
+    subtree = "ou=people"
+    userid = "nologtimeusr"
+    nousrs = 1
+    log.info('AccountInactivityLimit set to 12. Account will be inactivated if not accessed in 12 secs')
+    add_users(topology_st, suffix, subtree, userid, nousrs, 0)
+    log.info('Sleep for 6 secs to check if account is not inactivated, expected value 0')
+    time.sleep(6)
+    log.info('Account should not be inactivated since AccountInactivityLimit not exceeded')
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Enabled")
+    del_time_attr(topology_st, suffix, subtree, userid, nousrs, 'lastLoginTime')
+    log.info('Sleep for 7 more secs to check if account is inactivated')
+    time.sleep(7)
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Disabled")
+    add_time_attr(topology_st, suffix, subtree, userid, nousrs, 'lastLoginTime')
+    log.info('Check if account is activated, expected 0')
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Enabled")
+    del_users(topology_st, suffix, subtree, userid, nousrs)
+
+
+def test_glact_login(topology_st, accpol_global):
+    """Verify if user account can be activated by replacing the lastLoginTime attribute.
+
+    :ID: f89897cc-c13e-4824-af08-3dd1039bab3c
+    :feature: Account Policy Plugin
+    :setup: Standalone instance, Global account policy plugin configuration,
+            set accountInactivityLimit to few secs.
+    :steps: 1. Add few users to ou=groups subtree in the default suffix
+            2. Wait till accountInactivityLimit exceeded
+            3. Run ldapsearch as normal user, expected error 19.
+            4. Replace the lastLoginTime attribute and check if account is activated
+            5. Run ldapsearch as normal user, expected 0.
+    :assert: Should return success once the user is activated
+    """
+
+    suffix = DEFAULT_SUFFIX
+    subtree = "ou=groups"
+    userid = "glactusr"
+    nousrs = 3
+    log.info('AccountInactivityLimit set to 12. Account will be inactivated if not accessed in 12 secs')
+    add_users(topology_st, suffix, subtree, userid, nousrs, 0)
+    log.info('Sleep for 13 secs to check if account is inactivated, expected error 19')
+    time.sleep(13)
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Disabled")
+    add_time_attr(topology_st, suffix, subtree, userid, nousrs, 'lastLoginTime')
+    log.info('Check if account is activated, expected 0')
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Enabled")
+    del_users(topology_st, suffix, subtree, userid, nousrs)
+
+
+def test_glinact_limit(topology_st, accpol_global):
+    """Verify if account policy plugin functions well when changing accountInactivityLimit value.
+
+    :ID: 7fbc373f-a3d7-4774-8d34-89b057c5e74b
+    :feature: Account Policy Plugin
+    :setup: Standalone instance, Global account policy plugin configuration,
+            set accountInactivityLimit to few secs.
+    :steps: 1. Add few users to ou=groups subtree in the default suffix
+            2. Check if users are active just before reaching accountInactivityLimit
+            3. Modify AccountInactivityLimit to a bigger value
+            4. Wait for additional few secs, but check users before it reaches accountInactivityLimit
+            5. Wait till accountInactivityLimit exceeded and check users, expected error 19
+            6. Modify accountInactivityLimit to use the min value.
+            7. Add few users to ou=groups subtree in the default suffix
+            8. Wait till it reaches accountInactivityLimit and check users, expected error 19
+            9. Modify accountInactivityLimit to 10 times(120 secs) bigger than the initial value.
+            10. Add few users to ou=groups subtree in the default suffix
+            11. Wait for 90 secs and check if account is not inactivated, expected 0
+            12. Wait for +31 secs and check if account is not inactivated, expected 0
+            13. Wait for +121 secs and check if account is inactivated, error 19
+            14. Replace the lastLoginTime attribute and check if account is activated
+            15. Modify accountInactivityLimit to 12 secs, which is the default
+            16. Run ldapsearch as normal user, expected 0.
+    :assert: Should return success once the user is activated
+    """
+
+    suffix = DEFAULT_SUFFIX
+    subtree = "ou=groups"
+    userid = "inactestusr"
+    nousrs = 3
+    log.info('AccountInactivityLimit set to 12. Account will be inactivated if not accessed in 12 secs')
+    add_users(topology_st, suffix, subtree, userid, nousrs, 2)
+    log.info('Sleep for 9 secs to check if account is not inactivated, expected 0')
+    time.sleep(9)
+    account_status(topology_st, suffix, subtree, userid, nousrs, 2, "Enabled")
+    modify_attr(topology_st, ACCP_CONF, 'accountInactivityLimit', '20')
+    time.sleep(18)
+    account_status(topology_st, suffix, subtree, userid, nousrs, 2, "Enabled")
+    time.sleep(21)
+    account_status(topology_st, suffix, subtree, userid, nousrs, 2, "Disabled")
+    modify_attr(topology_st, ACCP_CONF, 'accountInactivityLimit', '1')
+    add_users(topology_st, suffix, subtree, userid, 2, 1)
+    time.sleep(2)
+    account_status(topology_st, suffix, subtree, userid, 2, 1, "Disabled")
+    modify_attr(topology_st, ACCP_CONF, 'accountInactivityLimit', '120')
+    add_users(topology_st, suffix, subtree, userid, 1, 0)
+    time.sleep(90)
+    account_status(topology_st, suffix, subtree, userid, 1, 0, "Enabled")
+    time.sleep(31)
+    account_status(topology_st, suffix, subtree, userid, 1, 0, "Enabled")
+    time.sleep(121)
+    account_status(topology_st, suffix, subtree, userid, 1, 0, "Disabled")
+    add_time_attr(topology_st, suffix, subtree, userid, nousrs, 'lastLoginTime')
+    log.info('Check if account is activated, expected 0')
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Enabled")
+    modify_attr(topology_st, ACCP_CONF, 'accountInactivityLimit', '12')
+    del_users(topology_st, suffix, subtree, userid, nousrs)
+
+
+def test_glnologin_attr(topology_st, accpol_global):
+    """Verify if user account is inactivated based on createTimeStamp attribute, no lastLoginTime attribute present
+
+    :ID: 3032f670-705d-4f69-96f5-d75445cffcfb
     :feature: Account Policy Plugin
     :setup: Standalone instance, Local account policy plugin configuration,
-            accountInactivityLimit set to 15, Inactivate account by Account policy plugin
-    :steps: 1. Configure account policy plugin with accpol_local for ou=people subtree
-            2. Set accountInactivityLimit to 15
-            3. Add few users to ou=people subtre in the default suffix
-            4. Wait for 14 secs and run ldapsearch as normal user to check if its not inactivated, expected 0.
-            5. Wait for 2 secs or till accountInactivityLimit is exceeded
-            6. Run ldapsearch as normal user and check if its inactivated, expected error 19.
-            7. Sleep for +14 secs to check if accounts accessed at step4 are inactivated now
-    :expectedresults: Should return error code 19
+            set accountInactivityLimit to few secs.
+    :steps: 1. Configure Global account policy plugin with createTimestamp as stateattrname
+            2. lastLoginTime attribute will not be effective.
+            3. Add few users to ou=groups subtree in the default suffix
+            4. Wait for 10 secs and check if account is not inactivated, expected 0
+            5. Modify AccountInactivityLimit to 20 secs
+            6. Wait for +9 secs and check if account is not inactivated, expected 0
+            7. Wait for +2 secs and check if account is inactivated, error 19
+            8. Modify accountInactivityLimit to 2 secs
+            9. Add few users to ou=groups subtree in the default suffix
+            10. Wait for 3 secs and check if account is inactivated, error 19
+            11. Modify accountInactivityLimit to 120 secs
+            12. Add few users to ou=groups subtree in the default suffix
+            13. Wait for 90 secs and check if account is not inactivated, expected 0
+            14. Wait for +29 secs and check if account is not inactivated, expected 0
+            15. Wait for +2 secs and check if account is inactivated, error 19
+            16. Replace the lastLoginTime attribute and check if account is activated
+            17. Modify accountInactivityLimit to 12 secs, which is the default
+            18. Run ldapsearch as normal user, expected 0.
+    :assert: Should return success once the user is activated
+    """
+
+    suffix = DEFAULT_SUFFIX
+    subtree = "ou=groups"
+    userid = "nologinusr"
+    nousrs = 3
+    log.info('AccountInactivityLimit set to 12. Account will be inactivated if not accessed in 12 secs')
+    log.info('Set attribute StateAttrName to createTimestamp, loginTime attr wont be considered')
+    modify_attr(topology_st, ACCP_CONF, 'stateattrname', 'createTimestamp')
+    topology_st.standalone.restart(timeout=10)
+    add_users(topology_st, suffix, subtree, userid, nousrs, 2)
+    log.info('Sleep for 9 secs to check if account is not inactivated, expected 0')
+    time.sleep(9)
+    account_status(topology_st, suffix, subtree, userid, nousrs, 2, "Enabled")
+    modify_attr(topology_st, ACCP_CONF, 'accountInactivityLimit', '20')
+    time.sleep(9)
+    account_status(topology_st, suffix, subtree, userid, nousrs, 2, "Enabled")
+    time.sleep(3)
+    account_status(topology_st, suffix, subtree, userid, nousrs, 2, "Disabled")
+    modify_attr(topology_st, ACCP_CONF, 'accountInactivityLimit', '3')
+    add_users(topology_st, suffix, subtree, userid, 2, 1)
+    time.sleep(2)
+    account_status(topology_st, suffix, subtree, userid, 2, 1, "Enabled")
+    time.sleep(2)
+    account_status(topology_st, suffix, subtree, userid, 2, 1, "Disabled")
+    modify_attr(topology_st, ACCP_CONF, 'accountInactivityLimit', '120')
+    add_users(topology_st, suffix, subtree, userid, 1, 0)
+    time.sleep(90)
+    account_status(topology_st, suffix, subtree, userid, 1, 0, "Enabled")
+    time.sleep(29)
+    account_status(topology_st, suffix, subtree, userid, 1, 0, "Enabled")
+    time.sleep(2)
+    account_status(topology_st, suffix, subtree, userid, 1, 0, "Disabled")
+    modify_attr(topology_st, ACCP_CONF, 'accountInactivityLimit', '12')
+    log.info('Set attribute StateAttrName to lastLoginTime, the default')
+    modify_attr(topology_st, ACCP_CONF, 'stateattrname', 'lastLoginTime')
+    topology_st.standalone.restart(timeout=10)
+    add_time_attr(topology_st, suffix, subtree, userid, nousrs, 'lastLoginTime')
+    log.info('Check if account is activated, expected 0')
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Enabled")
+    del_users(topology_st, suffix, subtree, userid, nousrs)
+
+
+def test_glnoalt_stattr(topology_st, accpol_global):
+    """Verify if user account can be inactivated based on lastLoginTime attribute, altstateattrname set to 1.1
+
+    :ID: 8dcc3540-578f-422a-bb44-28c2cf20dbcd
+    :feature: Account Policy Plugin
+    :setup: Standalone instance, Global account policy plugin configuration,
+            set accountInactivityLimit to few secs.
+    :steps: 1. Configure Global account policy plugin with altstateattrname to 1.1
+            2. Add few users to ou=groups subtree in the default suffix
+            3. Wait till it reaches accountInactivityLimit
+            4. Remove lastLoginTime attribute from the user entry
+            5. Run ldapsearch as normal user, expected 0. no lastLoginTime attribute present
+            6. Wait till it reaches accountInactivityLimit and check users, expected error 19
+    :assert: Should return success once the user is activated
+    """
+
+    suffix = DEFAULT_SUFFIX
+    subtree = "ou=groups"
+    userid = "nologinusr"
+    nousrs = 3
+    log.info('Set attribute altStateAttrName to 1.1')
+    modify_attr(topology_st, ACCP_CONF, 'altstateattrname', '1.1')
+    topology_st.standalone.restart(timeout=10)
+    add_users(topology_st, suffix, subtree, userid, nousrs, 0)
+    log.info('Sleep for 13 secs to check if account is not inactivated, expected 0')
+    time.sleep(13)
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Enabled")
+    log.info('lastLoginTime attribute is added from the above ldap bind by userdn')
+    time.sleep(13)
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Disabled")
+    del_time_attr(topology_st, suffix, subtree, userid, nousrs, 'lastLoginTime')
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Enabled")
+    modify_attr(topology_st, ACCP_CONF, 'altstateattrname', 'createTimestamp')
+    topology_st.standalone.restart(timeout=10)
+    add_time_attr(topology_st, suffix, subtree, userid, nousrs, 'lastLoginTime')
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Enabled")
+    del_users(topology_st, suffix, subtree, userid, nousrs)
+
+
+def test_glattr_modtime(topology_st, accpol_global):
+    """Verify if user account can be inactivated based on modifyTimeStamp attribute
+
+    :ID: 67380839-2966-45dc-848a-167a954153e1
+    :feature: Account Policy Plugin
+    :setup: Standalone instance, Global account policy plugin configuration,
+            set accountInactivityLimit to few secs.
+    :steps: 1. Configure Global account policy plugin with altstateattrname to modifyTimestamp
+            2. Add few users to ou=groups subtree in the default suffix
+            3. Wait till the accountInactivityLimit exceeded and check users, expected error 19
+            4. Modify cn attribute for user, ModifyTimeStamp is updated.
+            5. Check if user is activated based on ModifyTimeStamp attribute, expected 0
+            6. Change the plugin to use createTimeStamp and remove lastLoginTime attribute
+            7. Check if account is inactivated, expected error 19
+    :assert: Should return success once the user is activated
+    """
+
+    suffix = DEFAULT_SUFFIX
+    subtree = "ou=groups"
+    userid = "modtimeusr"
+    nousrs = 3
+    log.info('Set attribute altStateAttrName to modifyTimestamp')
+    modify_attr(topology_st, ACCP_CONF, 'altstateattrname', 'modifyTimestamp')
+    topology_st.standalone.restart(timeout=10)
+    add_users(topology_st, suffix, subtree, userid, nousrs, 0)
+    log.info('Sleep for 13 secs to check if account is inactivated, expected 0')
+    time.sleep(13)
+    check_attr(topology_st, suffix, subtree, userid, nousrs, "modifyTimeStamp=*")
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Disabled")
+    attr_name = "cn"
+    attr_value = "cnewusr"
+    modusr_attr(topology_st, suffix, subtree, userid, nousrs, attr_name, attr_value)
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Enabled")
+    modify_attr(topology_st, ACCP_CONF, 'altstateattrname', 'createTimestamp')
+    del_time_attr(topology_st, suffix, subtree, userid, nousrs, 'lastLoginTime')
+    topology_st.standalone.restart(timeout=10)
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Disabled")
+    add_time_attr(topology_st, suffix, subtree, userid, nousrs, 'lastLoginTime')
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Enabled")
+    del_users(topology_st, suffix, subtree, userid, nousrs)
+
+
+def test_glnoalt_nologin(topology_st, accpol_global):
+    """Verify if account policy plugin works if we set altstateattrname set to 1.1 and alwaysrecordlogin to NO
+
+    :ID: 49eda7db-84de-47ba-8f81-ac5e4de3a500
+    :feature: Account Policy Plugin
+    :setup: Standalone instance, Global account policy plugin configuration,
+            set accountInactivityLimit to few secs.
+    :steps: 1. Configure Global account policy plugin with altstateattrname to 1.1
+            2. Set alwaysrecordlogin to NO.
+            3. Add few users to ou=groups subtree in the default suffix
+            4. Wait till accountInactivityLimit exceeded and check users, expected 0
+            5. Check for lastLoginTime attribute, it should not be present
+            6. Wait for few more secs and check if account is not inactivated, expected 0
+            7. Run ldapsearch as normal user, expected 0. no lastLoginTime attribute present
+            8. Set altstateattrname to createTimeStamp
+            9. Check if user account is inactivated based on createTimeStamp attribute.
+            10. Account should be inactivated, expected error 19
+    :assert: Should return success once the user is activated
     """
 
     suffix = DEFAULT_SUFFIX
-    subtre = "ou=people"
+    subtree = "ou=groups"
+    userid = "norecrodlogusr"
+    nousrs = 3
+    log.info('Set attribute altStateAttrName to 1.1')
+    modify_attr(topology_st, ACCP_CONF, 'altstateattrname', '1.1')
+    log.info('Set attribute alwaysrecordlogin to No')
+    modify_attr(topology_st, ACCP_CONF, 'alwaysrecordlogin', 'no')
+    topology_st.standalone.restart(timeout=10)
+    add_users(topology_st, suffix, subtree, userid, nousrs, 0)
+    log.info('Sleep for 13 secs to check if account is not inactivated, expected 0')
+    time.sleep(13)
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Enabled")
+    time.sleep(3)
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Enabled")
+    log.info('Set attribute altStateAttrName to createTimestamp')
+    modify_attr(topology_st, ACCP_CONF, 'altstateattrname', 'createTimestamp')
+    topology_st.standalone.restart(timeout=10)
+    time.sleep(2)
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Disabled")
+    log.info('Reset the default attribute values')
+    modify_attr(topology_st, ACCP_CONF, 'alwaysrecordlogin', 'yes')
+    topology_st.standalone.restart(timeout=10)
+    add_time_attr(topology_st, suffix, subtree, userid, nousrs, 'lastLoginTime')
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Enabled")
+    del_users(topology_st, suffix, subtree, userid, nousrs)
+
+
+def test_glinact_nsact(topology_st, accpol_global):
+    """Verify if user account can be activated using ns-activate.pl script.
+
+    :ID: 876a7a7c-0b3f-4cd2-9b45-1dc80846e334
+    :feature: Account Policy Plugin
+    :setup: Standalone instance, Global account policy plugin configuration,
+            set accountInactivityLimit to few secs.
+    :steps: 1. Configure Global account policy plugin
+            2. Add few users to ou=groups subtree in the default suffix
+            3. Wait for few secs and inactivate user using ns-inactivate.pl
+            4. Wait till accountInactivityLimit exceeded.
+            5. Run ldapsearch as normal user, expected error 19.
+            6. Activate user using ns-activate.pl script
+            7. Check if account is activated, expected error 19
+            8. Replace the lastLoginTime attribute and check if account is activated
+            9. Run ldapsearch as normal user, expected 0.
+    :assert: Should return success once the user is activated
+    """
+
+    suffix = DEFAULT_SUFFIX
+    subtree = "ou=groups"
+    userid = "nsactusr"
+    nousrs = 1
+    log.info('AccountInactivityLimit set to 12. Account will be inactivated if not accessed in 12 secs')
+    add_users(topology_st, suffix, subtree, userid, nousrs, 0)
+    log.info('Sleep for 3 secs to check if account is not inactivated, expected value 0')
+    time.sleep(3)
+    nsact_inact(topology_st, suffix, subtree, userid, nousrs, "Inact")
+    log.info('Sleep for 10 secs to check if account is inactivated, expected value 0')
+    time.sleep(10)
+    nsact_inact(topology_st, suffix, subtree, userid, nousrs, "Act")
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Disabled")
+    add_time_attr(topology_st, suffix, subtree, userid, nousrs, 'lastLoginTime')
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Enabled")
+    del_users(topology_st, suffix, subtree, userid, nousrs)
+
+
+def test_glinact_acclock(topology_st, accpol_global):
+    """Verify if user account is activated when account is unlocked by passwordlockoutduration.
+
+    :ID: 43601a61-065c-4c80-a7c2-e4f6ae17beb8
+    :feature: Account Policy Plugin
+    :setup: Standalone instance, Global account policy plugin configuration,
+            set accountInactivityLimit to few secs.
+    :steps: 1. Add few users to ou=groups subtree in the default suffix
+            2. Wait for few secs and attempt invalid binds for user
+            3. User account should be locked based on Account Lockout policy.
+            4. Wait till accountInactivityLimit exceeded and check users, expected error 19
+            5. Wait for passwordlockoutduration and check if account is active
+            6. Check if account is unlocked, expected error 19, since account is inactivated
+            7. Replace the lastLoginTime attribute and check users, expected 0
+    :assert: Should return success once the user is activated
+    """
+
+    suffix = DEFAULT_SUFFIX
+    subtree = "ou=groups"
+    userid = "pwlockusr"
+    nousrs = 1
+    log.info('AccountInactivityLimit set to 12. Account will be inactivated if not accessed in 12 secs')
+    add_users(topology_st, suffix, subtree, userid, nousrs, 0)
+    log.info('Sleep for 3 secs and try invalid binds to lockout the user')
+    time.sleep(3)
+    pwacc_lock(topology_st, suffix, subtree, userid, nousrs)
+    log.info('Sleep for 10 secs to check if account is inactivated, expected value 19')
+    time.sleep(10)
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Disabled")
+    log.info('Add lastLoginTime to activate the user account')
+    add_time_attr(topology_st, suffix, subtree, userid, nousrs, 'lastLoginTime')
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Enabled")
+    log.info(
+        'Checking if account is unlocked after passwordlockoutduration, but inactivated after accountInactivityLimit')
+    pwacc_lock(topology_st, suffix, subtree, userid, nousrs)
+    log.info('Account is expected to be unlocked after 10 secs of passwordlockoutduration')
+    log.info('Sleep for 10 secs to check if account is not inactivated, expected value 0')
+    time.sleep(10)
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Enabled")
+    log.info('Sleep 13s and check if account inactivated based on accountInactivityLimit, expected 19')
+    time.sleep(13)
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Disabled")
+    del_users(topology_st, suffix, subtree, userid, nousrs)
+
+
+def test_glnact_pwexp(topology_st, accpol_global):
+    """Verify if user account is activated when password is reset after password is expired
+
+    :ID:  3bb97992-101a-4e5a-b60a-4cc21adcc76e
+    :feature: Account Policy Plugin
+    :setup: Standalone instance, Global account policy plugin configuration,
+            set accountInactivityLimit to few secs.
+    :steps: 1. Add few users to ou=groups subtree in the default suffix
+            2. Set passwordmaxage to few secs
+            3. Wait for passwordmaxage to reach and check if password expired
+            4. Run ldapsearch as normal user, expected error 19.
+            5. Reset the password for user account
+            6. Wait till accountInactivityLimit exceeded and check users
+            7. Run ldapsearch as normal user, expected error 19.
+            8. Replace the lastLoginTime attribute and check if account is activated
+            9. Run ldapsearch as normal user, expected 0.
+    :assert: Should return success once the user is activated
+    """
+
+    suffix = DEFAULT_SUFFIX
+    subtree = "ou=groups"
+    userid = "pwexpusr"
+    nousrs = 1
+    topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
+    try:
+        topology_st.standalone.config.set('passwordmaxage', '9')
+    except ldap.LDAPError as e:
+        log.error('Failed to change the value of passwordmaxage to 9')
+        raise e
+    log.info('AccountInactivityLimit set to 12. Account will be inactivated if not accessed in 12 secs')
+    log.info('Passwordmaxage is set to 9. Password will expire in 9 secs')
+    add_users(topology_st, suffix, subtree, userid, nousrs, 0)
+    log.info('Sleep for 9 secs and check if password expired')
+    time.sleep(9)
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Expired")
+    time.sleep(4)
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Disabled")
+    log.info('Add lastLoginTime to activate the user account')
+    add_time_attr(topology_st, suffix, subtree, userid, nousrs, 'lastLoginTime')
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Expired")
+    userpw_reset(topology_st, suffix, subtree, userid, nousrs, "DirMgr", PASSWORD, USER_PASW)
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Enabled")
+    time.sleep(7)
+    userpw_reset(topology_st, suffix, subtree, userid, nousrs, "DirMgr", PASSWORD, USER_PASW)
+    log.info('Sleep for 6 secs and check if account is inactivated, expected error 19')
+    time.sleep(6)
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Disabled")
+    add_time_attr(topology_st, suffix, subtree, userid, nousrs, 'lastLoginTime')
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Enabled")
+    time.sleep(4)
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Expired")
+    userpw_reset(topology_st, suffix, subtree, userid, nousrs, "DirMgr", PASSWORD, USER_PASW)
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Enabled")
+    topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
+    try:
+        topology_st.standalone.config.set('passwordmaxage', '300')
+    except ldap.LDAPError as e:
+        log.error('Failed to change the value of passwordmaxage to 300')
+        raise e
+    del_users(topology_st, suffix, subtree, userid, nousrs)
+
+
+def test_locact_inact(topology_st, accpol_local):
+    """Verify if user account is inactivated when accountInactivityLimit is exceeded.
+
+    :ID: 02140e36-79eb-4d88-ba28-66478689289b
+    :feature: Account Policy Plugin
+    :setup: Standalone instance, ou=people subtree configured for Local account
+            policy plugin configuration, set accountInactivityLimit to few secs.
+    :steps: 1. Add few users to ou=people subtree in the default suffix
+            2. Wait for few secs before it reaches accountInactivityLimit and check users.
+            3. Run ldapsearch as normal user, expected 0
+            4. Wait till accountInactivityLimit is exceeded
+            5. Run ldapsearch as normal user and check if its inactivated, expected error 19.
+            6. Replace user's lastLoginTime attribute and check if its activated, expected 0
+    :assert: Should return error code 19
+    """
+
+    suffix = DEFAULT_SUFFIX
+    subtree = "ou=people"
     userid = "inactusr"
-    userpw = USER_PW
     nousrs = 3
-    log.info('AccountInactivityLimit set to 15. Account will be inactivated if not accessed in 15 secs')
-    add_users(topology_st, suffix, subtre, userid, nousrs)
-    log.info('Sleeping for 14 secs to check account is not inactivated, expected value 0')
-    time.sleep(14)
+    log.info('AccountInactivityLimit set to 10. Account will be inactivated if not accessed in 10 secs')
+    add_users(topology_st, suffix, subtree, userid, nousrs, 0)
+    log.info('Sleep for 9 secs to check if account is not inactivated, expected value 0')
+    time.sleep(9)
     log.info('Account should not be inactivated since AccountInactivityLimit not exceeded')
-    account_status(topology_st, suffix, subtre, userid, 3, 2, "Enabled")
-    log.info('Sleeping for 2 more secs to check if account is inactivated')
+    account_status(topology_st, suffix, subtree, userid, 3, 2, "Enabled")
+    log.info('Sleep for 2 more secs to check if account is inactivated')
     time.sleep(2)
-    account_status(topology_st, suffix, subtre, userid, 2, 0, "Disabled")
-    log.info('Sleeping +14 secs to check if account {}3 is inactivated'.format(userid))
-    time.sleep(14)
-    account_status(topology_st, suffix, subtre, userid, 3, 2, "Disabled")
-    del_users(topology_st, suffix, subtre, userid, nousrs)
+    account_status(topology_st, suffix, subtree, userid, 2, 0, "Disabled")
+    log.info('Sleep +9 secs to check if account {}3 is inactivated'.format(userid))
+    time.sleep(9)
+    account_status(topology_st, suffix, subtree, userid, 3, 2, "Disabled")
+    log.info('Add lastLoginTime attribute to all users and check if its activated')
+    add_time_attr(topology_st, suffix, subtree, userid, nousrs, 'lastLoginTime')
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Enabled")
+    del_users(topology_st, suffix, subtree, userid, nousrs)
 
 
-def test_noinact_local(topology_st, accpolicy_local):
+def test_locinact_modrdn(topology_st, accpol_local):
     """Verify if user account is inactivated when moved from ou=groups to ou=people subtree.
 
-    :ID: 235e3f00-db20-4166-9cfd-77e7c08cabdf
+    :ID: 5f25bea3-fab0-4db4-b43d-2d47cc6e5ad1
     :feature: Account Policy Plugin
-    :setup: Standalone instance, Local account policy plugin configuration,
-            accountInactivityLimit set to 15, Inactivate account by Account policy plugin
-    :steps: 1. Add few users to ou=groups subtre in the default suffix, plugin configured to ou=people subtree only.
-            2. Wait for 16 secs and run ldapsearch as normal user to check account is active, expected 0.
-            3. Move users from ou=groups to ou=people subtree
-            4. Sleep for 16 secs and check if entries are inactivated
-    :expectedresults: Should return error code 0 and 19
+    :setup: Standalone instance, ou=people subtree configured for Local account
+            policy plugin configuration, set accountInactivityLimit to few secs.
+    :steps: 1. Add few users to ou=groups subtree in the default suffix
+            2. Plugin configured to ou=people subtree only.
+            3. Wait for few secs before it reaches accountInactivityLimit and check users.
+            4. Run ldapsearch as normal user, expected 0
+            5. Wait till accountInactivityLimit exceeded
+            6. Move users from ou=groups subtree to ou=people subtree
+            7. Check if users are inactivated, expected error 19
+    :assert: Should return error code 0 and 19
     """
 
     suffix = DEFAULT_SUFFIX
-    subtre = "ou=groups"
+    subtree = "ou=groups"
     userid = "nolockusr"
-    userpw = USER_PW
     nousrs = 1
     log.info('Account should not be inactivated since the subtree is not configured')
-    add_users(topology_st, suffix, subtre, userid, nousrs)
-    log.info('Sleeping for 16 secs to check if account is not inactivated, expected value 0')
-    time.sleep(16)
-    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Enabled")
+    add_users(topology_st, suffix, subtree, userid, nousrs, 0)
+    log.info('Sleep for 11 secs to check if account is not inactivated, expected value 0')
+    time.sleep(11)
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Enabled")
     log.info('Moving users from ou=groups to ou=people subtree')
+    topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
     try:
-        topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
         topology_st.standalone.rename_s('uid=nolockusr1,ou=groups,dc=example,dc=com', 'uid=nolockusr1',
                                         'ou=people,dc=example,dc=com')
     except ldap.LDAPError as e:
         log.error('Failed to move user uid=nolockusr1 from ou=groups to ou=people')
-        raise
-    subtre = "ou=people"
-    log.info('Then wait for 16 secs and check if entries are inactivated')
-    time.sleep(16)
-    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Disabled")
-    del_users(topology_st, suffix, subtre, userid, nousrs)
+        raise e
+    subtree = "ou=people"
+    log.info('Then wait for 11 secs and check if entries are inactivated')
+    time.sleep(11)
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Disabled")
+    add_time_attr(topology_st, suffix, subtree, userid, nousrs, 'lastLoginTime')
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Enabled")
+    del_users(topology_st, suffix, subtree, userid, nousrs)
 
 
-def test_inact_local(topology_st, accpolicy_local):
+def test_locact_modrdn(topology_st, accpol_local):
     """Verify if user account is inactivated when users moved from ou=people to ou=groups subtree.
 
-    :ID: ffccf0fd-b684-4462-87ef-1ec6d3e40574
+    :ID: e821cbae-bfc3-40d3-947d-b228c809987f
     :feature: Account Policy Plugin
-    :setup: Standalone instance, Local account policy plugin configuration,
-            accountInactivityLimit set to 15, Inactivate account by Account policy plugin
-    :steps: 1. Add few users to ou=people subtre in the default suffix
-            2. Wait for 14 secs and run ldapsearch as normal user to check if its not inactivated, expected 0.
+    :setup: Standalone instance, ou=people subtree configured for Local account
+            policy plugin configuration, set accountInactivityLimit to few secs.
+    :steps: 1. Add few users to ou=people subtree in the default suffix
+            2. Wait for few secs and check if users not inactivated, expected 0.
             3. Move users from ou=people to ou=groups subtree
-            4. Sleep for +2 secs and check if users are inactivated in ou=people subtree
-            5. Check if users are not inactivated in ou=groups subtree
-    :expectedresults: Should return error code 0
+            4. Wait till accountInactivityLimit is exceeded
+            5. Check if users are active in ou=groups subtree, expected 0
+    :assert: Should return error code 0
     """
 
     suffix = DEFAULT_SUFFIX
-    subtre = "ou=people"
+    subtree = "ou=people"
     userid = "lockusr"
-    userpw = USER_PW
     nousrs = 1
     log.info('Account should be inactivated since the subtree is configured')
-    add_users(topology_st, suffix, subtre, userid, nousrs)
-    log.info('Sleeping for 16 secs to check if account is inactivated, expected value 19')
-    time.sleep(14)
-    account_status(topology_st, suffix, subtre, userid, nousrs, 0, "Enabled")
+    add_users(topology_st, suffix, subtree, userid, nousrs, 0)
+    log.info('Sleep for 11 secs to check if account is inactivated, expected value 19')
+    time.sleep(11)
+    account_status(topology_st, suffix, subtree, userid, nousrs, 0, "Disabled")
     log.info('Moving users from ou=people to ou=groups subtree')
+    topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
     try:
-        topology_st.standalone.simple_bind_s(DN_DM, PASSWORD)
         topology_st.standalone.rename_s('uid=lockusr1,ou=people,dc=example,dc=com', 'uid=lockusr1',
                                         'ou=groups,dc=example,dc=com')
     except ldap.LDAPError as e:
         log.error('Failed to move user uid=lockusr1 from ou=groups to ou=people')
-        raise
+        raise e
     log.info('Sleep for +2 secs and check users from both ou=people and ou=groups subtree')
     time.sleep(2)
-    subtre = "ou=groups"
-    account_status(topology_st, suffix, subtre, userid, 1, 0, "Enabled")
-    del_users(topology_st, suffix, subtre, userid, nousrs)
+    subtree = "ou=groups"
+    account_status(topology_st, suffix, subtree, userid, 1, 0, "Enabled")
+    del_users(topology_st, suffix, subtree, userid, nousrs)
 
 
 if __name__ == '__main__':
-- 
2.7.4

