コード例 #1
0
def test_access_from_certain_network_only_ip(topo, add_user, aci_of_user):
    """
    User can access the data when connecting from certain network only as per the ACI.

    :id: 4ec38296-7ac5-11e8-9816-8c16451d917b
    :customerscenario: True
    :setup: Standalone Server
    :steps:
        1. Add test entry
        2. Add ACI
        3. User should follow ACI role
    :expectedresults:
        1. Entry should be added
        2. Operation should  succeed
        3. Operation should  succeed
    """
    # Turn access log buffering off to make less time consuming
    topo.standalone.config.set('nsslapd-accesslog-logbuffering', 'off')

    # Find the ip from ds logs , as we need to know the exact ip used by ds to run the instances.
    # Wait till Access Log is generated
    topo.standalone.restart()

    hostname = socket.gethostname()
    IP = socket.gethostbyname(hostname)

    # Add ACI
    domain = Domain(topo.standalone, DEFAULT_SUFFIX)
    domain.add(
        "aci",
        f'(target = "ldap:///{IP_OU_KEY}")(targetattr=\"*\")(version 3.0; aci "IP aci"; '
        f'allow(all)userdn = "ldap:///{NETSCAPEIP_KEY}" and (ip = "127.0.0.1" or ip = "::1" or ip = "{IP}") ;)'
    )

    # create a new connection for the test
    conn = UserAccount(topo.standalone, NETSCAPEIP_KEY).bind(PW_DM)
    # Perform Operation
    org = OrganizationalUnit(conn, IP_OU_KEY)
    org.replace("seeAlso", "cn=1")

    # remove the aci
    domain.ensure_removed(
        "aci",
        f'(target = "ldap:///{IP_OU_KEY}")(targetattr=\"*\")(version 3.0; aci '
        f'"IP aci"; allow(all)userdn = "ldap:///{NETSCAPEIP_KEY}" and '
        f'(ip = "127.0.0.1" or ip = "::1" or ip = "{IP}") ;)')
    # Now add aci with new ip
    domain.add(
        "aci",
        f'(target = "ldap:///{IP_OU_KEY}")(targetattr="*")(version 3.0; aci "IP aci"; '
        f'allow(all)userdn = "ldap:///{NETSCAPEIP_KEY}" and ip = "100.1.1.1" ;)'
    )

    # After changing  the ip user cant access data
    with pytest.raises(ldap.INSUFFICIENT_ACCESS):
        org.replace("seeAlso", "cn=1")
コード例 #2
0
def test_connection_from_an_unauthorized_network(topo, add_user, aci_of_user):
    """
    User cannot access the data when connectin from an unauthorized network as per the ACI.

    :id: 52d1ecce-7ac5-11e8-9ad9-8c16451d917b
    :customerscenario: True
    :setup: Standalone Server
    :steps:
        1. Add test entry
        2. Add ACI
        3. User should follow ACI role
    :expectedresults:
        1. Entry should be added
        2. Operation should  succeed
        3. Operation should  succeed
    """
    old_hostname = socket.gethostname()
    socket.sethostname('localhost')
    hostname = socket.gethostname()

    # Add ACI
    domain = Domain(topo.standalone, DEFAULT_SUFFIX)
    domain.add("aci", f'(target = "ldap:///{IP_OU_KEY}")'
                      f'(targetattr="*")(version 3.0; aci "IP aci"; '
                      f'allow(all) userdn = "ldap:///{NETSCAPEIP_KEY}" '
                      f'and (ip != "127.0.0.1" and ip != "::1") ;)')

    # create a new connection for the test
    new_uri = topo.standalone.ldapuri.replace(old_hostname, hostname)
    topo.standalone.ldapuri = new_uri
    conn = UserAccount(topo.standalone, NETSCAPEIP_KEY).bind(PW_DM)

    # Perform Operation
    topo.standalone.config.set('nsslapd-errorlog-level', '128')
    org = OrganizationalUnit(conn, IP_OU_KEY)
    with pytest.raises(ldap.INSUFFICIENT_ACCESS):
        org.replace("seeAlso", "cn=1")

    # Remove the ACI
    domain.ensure_removed('aci', domain.get_attr_vals('aci')[-1])
    # Add new ACI
    domain.add('aci', f'(target = "ldap:///{IP_OU_KEY}")(targetattr="*")'
                      f'(version 3.0; aci "IP aci"; allow(all) '
                      f'userdn = "ldap:///{NETSCAPEIP_KEY}" and (ip = "127.0.0.1" or ip = "::1") ;)')
    time.sleep(1)

    # now user can access data
    org.replace("seeAlso", "cn=1")
コード例 #3
0
def test_connectin_from_an_unauthorized_network(topo, add_user, aci_of_user):
    """
    User cannot access the data when connectin from an unauthorized network as per the ACI.

    :id:52d1ecce-7ac5-11e8-9ad9-8c16451d917b
    :setup: Standalone Server
    :steps:
        1. Add test entry
        2. Add ACI
        3. User should follow ACI role
    :expectedresults:
        1. Entry should be added
        2. Operation should  succeed
        3. Operation should  succeed
    """
    # Find the ip from ds logs , as we need to know the exact ip used by ds to run the instances.
    ip_ip = topo.standalone.ds_access_log.match(
        '.* connection from ')[0].split()[-1]
    # Add ACI
    domain = Domain(topo.standalone, DEFAULT_SUFFIX)
    domain.add(
        "aci", f'(target = "ldap:///{IP_OU_KEY}")'
        f'(targetattr=*)(version 3.0; aci "IP aci"; '
        f'allow(all) userdn = "ldap:///{NETSCAPEIP_KEY}" '
        f'and ip != "{ip_ip}" ;)')

    # create a new connection for the test
    conn = UserAccount(topo.standalone, NETSCAPEIP_KEY).bind(PW_DM)
    # Perform Operation
    org = OrganizationalUnit(conn, IP_OU_KEY)
    with pytest.raises(ldap.INSUFFICIENT_ACCESS):
        org.replace("seeAlso", "cn=1")
    # Remove the ACI
    domain.ensure_removed('aci', domain.get_attr_vals('aci')[-1])
    # Add new ACI
    domain.add(
        'aci', f'(target = "ldap:///{IP_OU_KEY}")(targetattr=*)'
        f'(version 3.0; aci "IP aci"; allow(all) '
        f'userdn = "ldap:///{NETSCAPEIP_KEY}" and ip = "{ip_ip}" ;)')

    # now user can access data
    org.replace("seeAlso", "cn=1")
コード例 #4
0
def test_timeofday_keyword(topo, add_user, aci_of_user):
    """
    User NOWORKER_KEY can access the data as per the ACI after removing
    ACI it cant.

    :id: 681dd58e-7ac5-11e8-bed1-8c16451d917b
    :customerscenario: True
    :setup: Standalone Server
    :steps:
        1. Add test entry
        2. Add ACI
        3. User should follow ACI role
    :expectedresults:
        1. Entry should be added
        2. Operation should  succeed
        3. Operation should  succeed
    """
    now = time.strftime("%c")
    now_1 = "".join(now.split()[3].split(":"))[:4]
    # Add ACI
    domain = Domain(topo.standalone, DEFAULT_SUFFIX)
    domain.add(
        "aci", f'(target = "ldap:///{TIMEOFDAY_OU_KEY}")'
        f'(targetattr="*")(version 3.0; aci "Timeofday aci"; '
        f'allow(all) userdn = "ldap:///{NOWORKER_KEY}" '
        f'and timeofday = \'{now_1}\' ;)')

    # Create a new connection for this test.
    conn = UserAccount(topo.standalone, NOWORKER_KEY).bind(PW_DM)
    # Perform Operation
    org = OrganizationalUnit(conn, TIMEOFDAY_OU_KEY)
    org.replace("seeAlso", "cn=1")
    # Remove ACI
    aci = domain.get_attr_vals_utf8('aci')[-1]
    domain.ensure_removed('aci', aci)
    assert aci not in domain.get_attr_vals_utf8('aci')
    # after removing the ACI user cannot access the data
    time.sleep(1)
    with pytest.raises(ldap.INSUFFICIENT_ACCESS):
        org.replace("seeAlso", "cn=1")