JezK
Edit File: ldap_spn.py
# Unix SMB/CIFS implementation. # # Copyright 2021 (C) Catalyst IT Ltd # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. import sys import os import pprint import re from samba.samdb import SamDB from samba.auth import system_session import ldb from samba.sd_utils import SDUtils from samba.credentials import DONT_USE_KERBEROS, Credentials from samba.gensec import FEATURE_SEAL from samba.tests.subunitrun import SubunitOptions, TestProgram from samba.tests import TestCase, ldb_err from samba.tests import DynamicTestCase import samba.getopt as options import optparse from samba.colour import c_RED, c_GREEN, c_DARK_YELLOW from samba.dsdb import ( UF_SERVER_TRUST_ACCOUNT, UF_TRUSTED_FOR_DELEGATION, ) SPN_GUID = 'f3a64788-5306-11d1-a9c5-0000f80367c1' RELEVANT_ATTRS = {'dNSHostName', 'servicePrincipalName', 'sAMAccountName', 'dn'} ok = True bad = False report = 'report' operr = ldb.ERR_OPERATIONS_ERROR denied = ldb.ERR_INSUFFICIENT_ACCESS_RIGHTS constraint = ldb.ERR_CONSTRAINT_VIOLATION exists = ldb.ERR_ENTRY_ALREADY_EXISTS add = ldb.FLAG_MOD_ADD replace = ldb.FLAG_MOD_REPLACE delete = ldb.FLAG_MOD_DELETE try: breakpoint except NameError: # for python <= 3.6 def breakpoint(): import pdb pdb.set_trace() def init(): # This needs to happen before the class definition, and we put it # in a function to keep the namespace clean. global LP, CREDS, SERVER, REALM, COLOUR_TEXT, subunitopts, FILTER parser = optparse.OptionParser( "python3 ldap_spn.py <server> [options]") sambaopts = options.SambaOptions(parser) parser.add_option_group(sambaopts) # use command line creds if available credopts = options.CredentialsOptions(parser) parser.add_option_group(credopts) subunitopts = SubunitOptions(parser) parser.add_option_group(subunitopts) parser.add_option('--colour', action="store_true", help="use colour text", default=sys.stdout.isatty()) parser.add_option('--filter', help="only run tests matching this regex") opts, args = parser.parse_args() if len(args) != 1: parser.print_usage() sys.exit(1) LP = sambaopts.get_loadparm() CREDS = credopts.get_credentials(LP) SERVER = args[0] REALM = CREDS.get_realm() COLOUR_TEXT = opts.colour FILTER = opts.filter init() def colour_text(x, state=None): if not COLOUR_TEXT: return x if state == 'error': return c_RED(x) if state == 'pass': return c_GREEN(x) return c_DARK_YELLOW(x) def get_samdb(creds=None): if creds is None: creds = CREDS session = system_session() else: session = None return SamDB(url=f"ldap://{SERVER}", lp=LP, session_info=session, credentials=creds) def add_unpriv_user(samdb, ou, username, writeable_objects=None, password="samba123@"): creds = Credentials() creds.set_username(username) creds.set_password(password) creds.set_domain(CREDS.get_domain()) creds.set_realm(CREDS.get_realm()) creds.set_workstation(CREDS.get_workstation()) creds.set_gensec_features(CREDS.get_gensec_features() | FEATURE_SEAL) creds.set_kerberos_state(DONT_USE_KERBEROS) dnstr = f"CN={username},{ou}" # like, WTF, samdb.newuser(), this is what you make us do. short_ou = ou.split(',', 1)[0] samdb.newuser(username, password, userou=short_ou) if writeable_objects: sd_utils = SDUtils(samdb) sid = sd_utils.get_object_sid(dnstr) for obj in writeable_objects: mod = f"(OA;CI;WP;{ SPN_GUID };;{ sid })" sd_utils.dacl_add_ace(obj, mod) unpriv_samdb = get_samdb(creds=creds) return unpriv_samdb class LdapSpnTestBase(TestCase): _disabled = False @classmethod def setUpDynamicTestCases(cls): if getattr(cls, '_disabled', False): return for doc, *rows in cls.cases: if FILTER: if not re.search(FILTER, doc): continue name = re.sub(r'\W+', '_', doc) cls.generate_dynamic_test("test_spn", name, rows, doc) def setup_objects(self, rows): objects = set(r[0] for r in rows) for name in objects: if ':' in name: objtype, name = name.split(':', 1) else: objtype = 'dc' getattr(self, f'add_{objtype}')(name) def setup_users(self, rows): # When you are adding an SPN that aliases (or would be aliased # by) another SPN on another object, you need to have write # permission on that other object too. # # To test this negatively and positively, we need to have # users with various combinations of write permission, which # means fiddling with SDs on the objects. # # The syntax is: # '' : user with no special permissions # '*' : admin user # 'A' : user can write to A only # 'A,C' : user can write to A and C # 'C,A' : same, but makes another user self.userdbs = { '*': self.samdb } permissions = set(r[2] for r in rows) for p in permissions: if p == '*': continue if p == '': user = 'nobody' writeable_objects = None else: user = 'writes_' + p.replace(",", '_') writeable_objects = [self.objects[x][0] for x in p.split(',')] self.userdbs[p] = add_unpriv_user(self.samdb, self.ou, user, writeable_objects) def _test_spn_with_args(self, rows, doc): cdoc = colour_text(doc) edoc = colour_text(doc, 'error') pdoc = colour_text(doc, 'pass') if COLOUR_TEXT: sys.stderr.flush() print('\n', c_DARK_YELLOW('#' * 10), f'starting «{cdoc}»\n') sys.stdout.flush() self.samdb = get_samdb() self.base_dn = self.samdb.get_default_basedn() self.short_id = self.id().rsplit('.', 1)[1][:63] self.objects = {} self.ou = f"OU={ self.short_id },{ self.base_dn }" self.addCleanup(self.samdb.delete, self.ou, ["tree_delete:1"]) self.samdb.create_ou(self.ou) self.setup_objects(rows) self.setup_users(rows) for i, row in enumerate(rows): if len(row) == 5: obj, data, rights, expected, op = row else: obj, data, rights, expected = row op = ldb.FLAG_MOD_REPLACE # We use this DB with possibly restricted rights for this row samdb = self.userdbs[rights] if ':' in obj: objtype, obj = obj.split(':', 1) else: objtype = 'dc' dn, dnsname = self.objects[obj] m = {"dn": dn} if isinstance(data, dict): m.update(data) else: m['servicePrincipalName'] = data # for python's sake (and our sanity) we try to ensure we # have consistent canonical case in our attributes keys = set(m.keys()) if not keys.issubset(RELEVANT_ATTRS): raise ValueError(f"unexpected attr {keys - RELEVANT_ATTRS}. " "Casefold typo?") for k in ('dNSHostName', 'servicePrincipalName'): if isinstance(m.get(k), str): m[k] = m[k].format(dnsname=f"x.{REALM}") elif isinstance(m.get(k), list): m[k] = [x.format(dnsname=f"x.{REALM}") for x in m[k]] msg = ldb.Message.from_dict(samdb, m, op) if expected is bad: try: samdb.modify(msg) except ldb.LdbError as e: print(f"row {i+1} of '{pdoc}' failed as expected with " f"{ldb_err(e)}\n") continue self.fail(f"row {i+1}: " f"{rights} {pprint.pformat(m)} on {objtype} {obj} " f"should fail ({edoc})") elif expected is ok: try: samdb.modify(msg) except ldb.LdbError as e: self.fail(f"row {i+1} of {edoc} failed with {ldb_err(e)}:\n" f"{rights} {pprint.pformat(m)} on {objtype} {obj}") elif expected is report: try: self.samdb.modify(msg) print(f"row {i+1} " f"of '{cdoc}' {colour_text('SUCCEEDED', 'pass')}:\n" f"{pprint.pformat(m)} on {obj}") except ldb.LdbError as e: print(f"row {i+1} " f"of '{cdoc}' {colour_text('FAILED', 'error')} " f"with {ldb_err(e)}:\n{pprint.pformat(m)} on {obj}") elif expected is breakpoint: try: breakpoint() samdb.modify(msg) except ldb.LdbError as e: print(f"row {i+1} of '{pdoc}' FAILED with {ldb_err(e)}\n") else: # an ldb error number try: samdb.modify(msg) except ldb.LdbError as e: if e.args[0] == expected: continue self.fail(f"row {i+1} of '{edoc}' " f"should have failed with {ldb_err(expected)}:\n" f"not {ldb_err(e)}:\n" f"{rights} {pprint.pformat(m)} on {objtype} {obj}") self.fail(f"row {i+1} of '{edoc}' " f"should have failed with {ldb_err(expected)}:\n" f"{rights} {pprint.pformat(m)} on {objtype} {obj}") def add_dc(self, name): dn = f"CN={name},OU=Domain Controllers,{self.base_dn}" dnsname = f"{name}.{REALM}".lower() self.samdb.add({ "dn": dn, "objectclass": "computer", "userAccountControl": str(UF_SERVER_TRUST_ACCOUNT | UF_TRUSTED_FOR_DELEGATION), "dnsHostName": dnsname, "carLicense": self.id() }) self.addCleanup(self.remove_object, name) self.objects[name] = (dn, dnsname) def add_user(self, name): dn = f"CN={name},{self.ou}" self.samdb.add({ "dn": dn, "name": name, "samAccountName": name, "objectclass": "user", "carLicense": self.id() }) self.addCleanup(self.remove_object, name) self.objects[name] = (dn, None) def remove_object(self, name): dn, dnsname = self.objects.pop(name) self.samdb.delete(dn) @DynamicTestCase class LdapSpnTest(LdapSpnTestBase): """Make sure we can't add clashing servicePrincipalNames. This would be possible using sPNMappings aliases — for example, if the mapping maps host/ to cifs/, we should not be able to add different addresses for each. """ # default sPNMappings: host=alerter, appmgmt, cisvc, clipsrv, # browser, dhcp, dnscache, replicator, eventlog, eventsystem, # policyagent, oakley, dmserver, dns, mcsvc, fax, msiserver, ias, # messenger, netlogon, netman, netdde, netddedsm, nmagent, # plugplay, protectedstorage, rasman, rpclocator, rpc, rpcss, # remoteaccess, rsvp, samss, scardsvr, scesrv, seclogon, scm, # dcom, cifs, spooler, snmp, schedule, tapisrv, trksvr, trkwks, # ups, time, wins, www, http, w3svc, iisadmin, msdtc # # I think in practice this is rarely if ever changed or added to. cases = [ ("add one as admin", ('A', 'host/{dnsname}', '*', ok), ), ("add one as rightful user", ('A', 'host/{dnsname}', 'A', ok), ), ("attempt to add one as nobody", ('A', 'host/{dnsname}', '', denied), ), ("add and replace as admin", ('A', 'host/{dnsname}', '*', ok), ('A', 'host/x.{dnsname}', '*', ok), ), ("replace as rightful user", ('A', 'host/{dnsname}', 'A', ok), ('A', 'host/x.{dnsname}', 'A', ok), ), ("attempt to replace one as nobody", ('A', 'host/{dnsname}', '*', ok), ('A', 'host/x.{dnsname}', '', denied), ), ("add second as admin", ('A', 'host/{dnsname}', '*', ok), ('A', 'host/x.{dnsname}', '*', ok, add), ), ("add second as rightful user", ('A', 'host/{dnsname}', 'A', ok), ('A', 'host/x.{dnsname}', 'A', ok, add), ), ("attempt to add second as nobody", ('A', 'host/{dnsname}', '*', ok), ('A', 'host/x.{dnsname}', '', denied, add), ), ("add the same one twice, simple duplicate error", ('A', 'host/{dnsname}', '*', ok), ('A', 'host/{dnsname}', '*', bad, add), ), ("simple duplicate attributes, as non-admin", ('A', 'host/{dnsname}', '*', ok), ('A', 'host/{dnsname}', 'A', bad, add), ), ("add the same one twice, identical duplicate", ('A', 'host/{dnsname}', '*', ok), ('A', 'host/{dnsname}', '*', bad, add), ), ("add a conflict, host first, as nobody", ('A', 'host/z.{dnsname}', '*', ok), ('B', 'cifs/z.{dnsname}', '', denied), ), ("add a conflict, service first, as nobody", ('A', 'cifs/{dnsname}', '*', ok), ('B', 'host/{dnsname}', '', denied), ), ("three way conflict, host first, as admin", ('A', 'host/z.{dnsname}', '*', ok), ('B', 'cifs/z.{dnsname}', '*', ok), ('C', 'www/z.{dnsname}', '*', ok), ), ("three way conflict, host first, with sufficient rights", ('A', 'host/z.{dnsname}', 'A', ok), ('B', 'cifs/z.{dnsname}', 'B,A', ok), ('C', 'www/z.{dnsname}', 'C,A', ok), ), ("three way conflict, host first, adding duplicate", ('A', 'host/z.{dnsname}', 'A', ok), ('B', 'cifs/z.{dnsname}', 'B,A', ok), ('C', 'cifs/z.{dnsname}', 'C,A', bad), ), ("three way conflict, host first, adding duplicate, full rights", ('A', 'host/z.{dnsname}', 'A', ok), ('B', 'cifs/z.{dnsname}', 'B,A', ok), ('C', 'cifs/z.{dnsname}', 'C,B,A', bad), ), ("three way conflict, host first, with other write rights", ('A', 'host/z.{dnsname}', '*', ok), ('B', 'cifs/z.{dnsname}', 'A,B', ok), ('C', 'cifs/z.{dnsname}', 'A,B', bad), ), ("three way conflict, host first, as nobody", ('A', 'host/z.{dnsname}', '*', ok), ('B', 'cifs/z.{dnsname}', '*', ok), ('C', 'www/z.{dnsname}', '', denied), ), ("three way conflict, services first, as admin", ('A', 'cifs/{dnsname}', '*', ok), ('B', 'www/{dnsname}', '*', ok), ('C', 'host/{dnsname}', '*', constraint), ), ("three way conflict, services first, with service write rights", ('A', 'cifs/{dnsname}', '*', ok), ('B', 'www/{dnsname}', '*', ok), ('C', 'host/{dnsname}', 'A,B', bad), ), ("three way conflict, service first, as nobody", ('A', 'cifs/{dnsname}', '*', ok), ('B', 'www/{dnsname}', '*', ok), ('C', 'host/{dnsname}', '', denied), ), ("replace host before specific", ('A', 'host/{dnsname}', '*', ok), ('A', 'cifs/{dnsname}', '*', ok), ), ("replace host after specific, as nobody", ('A', 'cifs/{dnsname}', '*', ok), ('A', 'host/{dnsname}', '', denied), ), ("non-conflict host before specific", ('A', 'host/{dnsname}', '*', ok), ('A', 'cifs/{dnsname}', '*', ok, add), ), ("non-conflict host after specific", ('A', 'cifs/{dnsname}', '*', ok), ('A', 'host/{dnsname}', '*', ok, add), ), ("non-conflict host before specific, non-admin", ('A', 'host/{dnsname}', 'A', ok), ('A', 'cifs/{dnsname}', 'A', ok, add), ), ("non-conflict host after specific, as nobody", ('A', 'cifs/{dnsname}', '*', ok), ('A', 'host/{dnsname}', '', denied, add), ), ("add a conflict, host first on user, as admin", ('user:C', 'host/{dnsname}', '*', ok), ('B', 'cifs/{dnsname}', '*', ok), ), ("add a conflict, host first on user, host rights", ('user:C', 'host/{dnsname}', '*', ok), ('B', 'cifs/{dnsname}', 'C', denied), ), ("add a conflict, host first on user, both rights", ('user:C', 'host/{dnsname}', '*', ok), ('B', 'cifs/{dnsname}', 'B,C', ok), ), ("add a conflict, host first both on user", ('user:C', 'host/{dnsname}', '*', ok), ('user:D', 'www/{dnsname}', '*', ok), ), ("add a conflict, host first both on user, host rights", ('user:C', 'host/{dnsname}', '*', ok), ('user:D', 'www/{dnsname}', 'C', denied), ), ("add a conflict, host first both on user, both rights", ('user:C', 'host/{dnsname}', '*', ok), ('user:D', 'www/{dnsname}', 'C,D', ok), ), ("add a conflict, host first both on user, as nobody", ('user:C', 'host/{dnsname}', '*', ok), ('user:D', 'www/{dnsname}', '', denied), ), ("add a conflict, host first, with both write rights", ('A', 'host/z.{dnsname}', '*', ok), ('B', 'cifs/z.{dnsname}', 'A,B', ok), ), ("add a conflict, host first, second on user, as admin", ('A', 'host/{dnsname}', '*', ok), ('user:D', 'cifs/{dnsname}', '*', ok), ), ("add a conflict, host first, second on user, with rights", ('A', 'host/{dnsname}', '*', ok), ('user:D', 'cifs/{dnsname}', 'A,D', ok), ), ("nonsense SPNs, part 1, as admin", ('A', 'a-b-c/{dnsname}', '*', ok), ('A', 'rrrrrrrrrrrrr /{dnsname}', '*', ok), ), ("nonsense SPNs, part 1, as user", ('A', 'a-b-c/{dnsname}', 'A', ok), ('A', 'rrrrrrrrrrrrr /{dnsname}', 'A', ok), ), ("nonsense SPNs, part 1, as nobody", ('A', 'a-b-c/{dnsname}', '', denied), ('A', 'rrrrrrrrrrrrr /{dnsname}', '', denied), ), ("add a conflict, using port", ('A', 'dns/{dnsname}', '*', ok), ('B', 'dns/{dnsname}:53', '*', ok), ), ("add a conflict, using port, port first", ('user:C', 'dns/{dnsname}:53', '*', ok), ('user:D', 'dns/{dnsname}', '*', ok), ), ("three part spns", ('A', {'dNSHostName': '{dnsname}'}, '*', ok), ('A', 'cifs/{dnsname}/DomainDNSZones.{dnsname}', '*', ok), ('B', 'cifs/{dnsname}/DomainDNSZones.{dnsname}', '*', constraint), ('A', {'dNSHostName': 'y.{dnsname}'}, '*', ok), ('B', 'cifs/{dnsname}/DomainDNSZones.{dnsname}', '*', ok), ('B', 'cifs/y.{dnsname}/DomainDNSZones.{dnsname}', '*', constraint), ), ("three part nonsense spns", ('A', {'dNSHostName': 'bean'}, '*', ok), ('A', 'cifs/bean/DomainDNSZones.bean', '*', ok), ('B', 'cifs/bean/DomainDNSZones.bean', '*', constraint), ('A', {'dNSHostName': 'y.bean'}, '*', ok), ('B', 'cifs/bean/DomainDNSZones.bean', '*', ok), ('B', 'cifs/y.bean/DomainDNSZones.bean', '*', constraint), ('C', 'host/bean/bean', '*', ok), ), ("one part spns (no slashes)", ('A', '{dnsname}', '*', constraint), ('B', 'cifs', '*', constraint), ('B', 'cifs/', '*', ok), ('B', ' ', '*', constraint), ('user:C', 'host', '*', constraint), ), ("dodgy spns", # These tests pass on Windows. An SPN must have one or two # slashes, with at least one character before the first one, # UNLESS the first slash is followed by a good enough service # name (e.g. "/host/x.y" rather than "sdfsd/x.y"). ('A', '\\/{dnsname}', '*', ok), ('B', 'cifs/\\\\{dnsname}', '*', ok), ('B', r'cifs/\\\{dnsname}', '*', ok), ('B', r'cifs/\\\{dnsname}/', '*', ok), ('A', r'cīfs/\\\{dnsname}/', '*', constraint), # 'ī' maps to 'i' # on the next two, full-width solidus (U+FF0F) does not work # as '/'. ('A', 'cifs／sfic', '*', constraint, add), ('A', r'cifs／\\\{dnsname}', '*', constraint, add), ('B', '\n', '*', constraint), ('B', '\n/\n', '*', ok), ('B', '\n/\n/\n', '*', ok), ('B', '\n/\n/\n/\n', '*', constraint), ('B', ' /* and so on */ ', '*', ok, add), ('B', r'¯\_(ツ)_/¯', '*', ok, add), # ¯\_(ツ)_/¯ # つ is hiragana for katakana ツ, so the next one fails for # something analogous to casefold reasons. ('A', r'¯\_(つ)_/¯', '*', constraint), ('A', r'¯\_(㋡)_/¯', '*', constraint), # circled ツ ('B', '//', '*', constraint), # all can't be empty, ('B', ' //', '*', ok), # service can be space ('B', '/host/{dnsname}', '*', ok), # or empty if others aren't ('B', '/host/x.y.z', '*', ok), ('B', '/ /x.y.z', '*', ok), ('B', ' / / ', '*', ok), ('user:C', b'host/', '*', ok), ('user:C', ' /host', '*', ok), # service is ' ' (space) ('B', ' /host', '*', constraint), # already on C ('B', ' /HōST', '*', constraint), # ō equiv to O ('B', ' /ħØşt', '*', constraint), # maps to ' /host' ('B', ' /H0ST', '*', ok), # 0 is zero ('B', ' /НoST', '*', ok), # Cyrillic Н (~N) ('B', ' /host', '*', ok), # two space ('B', '\u00a0/host', '*', ok), # non-breaking space ('B', ' 2/HōST/⌷[ ][]¨(', '*', ok), ('B', ' (//)', '*', ok, add), ('B', ' ///', '*', constraint), ('B', r' /\//', '*', constraint), # escape doesn't help ('B', ' /\\//', '*', constraint), # double escape doesn't help ('B', r'\//', '*', ok), ('A', r'\\/\\/', '*', ok), ('B', '|//|', '*', ok, add), ('B', r'\/\/\\', '*', ok, add), ('A', ':', '*', constraint), ('A', ':/:', '*', ok), ('A', ':/:80', '*', ok), # port number syntax is not special ('A', ':/:( ツ', '*', ok), ('A', ':/:/:', '*', ok), ('B', b'cifs/\x11\xaa\xbb\xcc\\example.com', '*', ok), ('A', b':/\xcc\xcc\xcc\xcc', '*', ok), ('A', b':/b\x00/b/b/b', '*', ok), # string handlng truncates at \x00 ('A', b'a@b/a@b/a@b', '*', ok), ('A', b'a/a@b/a@b', '*', ok), ), ("empty part spns (consecutive slashes)", ('A', 'cifs//{dnsname}', '*', ok), ('B', 'cifs//{dnsname}', '*', bad), # should clash with line 1 ('B', 'cifs/zzzy.{dnsname}/', '*', ok), ('B', '/host/zzzy.{dnsname}', '*', ok), ), ("too many spn parts", ('A', 'cifs/{dnsname}/{dnsname}/{dnsname}', '*', bad), ('A', {'dNSHostName': 'y.{dnsname}'}, '*', ok), ('B', 'cifs/{dnsname}/{dnsname}/', '*', bad), ('B', 'cifs/y.{dnsname}/{dnsname}/toop', '*', bad), ('B', 'host/{dnsname}/a/b/c', '*', bad), ), ("add a conflict, host first, as admin", ('A', 'host/z.{dnsname}', '*', ok), ('B', 'cifs/z.{dnsname}', '*', ok), ), ("add a conflict, host first, with host write rights", ('A', 'host/z.{dnsname}', '*', ok), ('B', 'cifs/z.{dnsname}', 'A', denied), ), ("add a conflict, service first, with service write rights", ('A', 'cifs/{dnsname}', '*', ok), ('B', 'host/{dnsname}', 'A', denied), ), ("adding dNSHostName after cifs with no old dNSHostName", ('A', 'cifs/{dnsname}', '*', ok), ('A', {'dNSHostName': 'y.{dnsname}'}, '*', ok), ('B', 'cifs/{dnsname}', '*', constraint), ('B', 'cifs/y.{dnsname}', '*', ok), ('B', 'host/y.{dnsname}', '*', ok), ), ("changing dNSHostName after cifs", ('A', {'dNSHostName': '{dnsname}'}, '*', ok), ('A', 'cifs/{dnsname}', '*', ok), ('A', {'dNSHostName': 'y.{dnsname}'}, '*', ok), ('B', 'cifs/{dnsname}', '*', ok), ('B', 'cifs/y.{dnsname}', '*', bad), ('B', 'host/y.{dnsname}', '*', bad), ), ] @DynamicTestCase class LdapSpnSambaOnlyTest(LdapSpnTestBase): # We don't run these ones outside of selftest, where we are # probably testing against Windows and these are known failures. _disabled = 'SAMBA_SELFTEST' not in os.environ cases = [ ("add a conflict, host first, with service write rights", ('A', 'host/z.{dnsname}', '*', ok), ('B', 'cifs/z.{dnsname}', 'B', denied), ), ("add a conflict, service first, with host write rights", ('A', 'cifs/{dnsname}', '*', ok), ('B', 'host/{dnsname}', 'B', constraint), ), ("add a conflict, service first, as admin", ('A', 'cifs/{dnsname}', '*', ok), ('B', 'host/{dnsname}', '*', constraint), ), ("add a conflict, service first, with both write rights", ('A', 'cifs/{dnsname}', '*', ok), ('B', 'host/{dnsname}', 'A,B', constraint), ), ("add a conflict, host first both on user, service rights", ('user:C', 'host/{dnsname}', '*', ok), ('user:D', 'www/{dnsname}', 'D', denied), ), ("add a conflict, along with a re-added SPN", ('A', 'cifs/{dnsname}', '*', ok), ('B', 'cifs/heeble.example.net', 'B', ok), ('B', ['cifs/heeble.example.net', 'host/{dnsname}'], 'B', constraint), ), ("changing dNSHostName after host", ('A', {'dNSHostName': '{dnsname}'}, '*', ok), ('A', 'host/{dnsname}', '*', ok), ('A', {'dNSHostName': 'y.{dnsname}'}, '*', ok), ('B', 'cifs/{dnsname}', 'B', ok), # no clash with A ('B', 'cifs/y.{dnsname}', 'B', bad), # should clash with A ('B', 'host/y.{dnsname}', '*', bad), ), ("mystery dnsname clash, host first", ('user:C', 'host/heeble.example.net', '*', ok), ('user:D', 'www/heeble.example.net', '*', ok), ), ("mystery dnsname clash, www first", ('user:D', 'www/heeble.example.net', '*', ok), ('user:C', 'host/heeble.example.net', '*', constraint), ), ("replace as admin", ('A', 'cifs/{dnsname}', '*', ok), ('A', 'host/{dnsname}', '*', ok), ('A', 'cifs/{dnsname}', '*', ok), ), ("replace as non-admin with rights", ('A', 'cifs/{dnsname}', '*', ok), ('A', 'host/{dnsname}', 'A', ok), ('A', 'cifs/{dnsname}', 'A', ok), ), ("replace vial delete as non-admin with rights", ('A', 'cifs/{dnsname}', '*', ok), ('A', 'host/{dnsname}', 'A', ok), ('A', 'host/{dnsname}', 'A', ok, delete), ('A', 'cifs/{dnsname}', 'A', ok, add), ), ("replace as non-admin without rights", ('B', 'cifs/b', '*', ok), ('A', 'cifs/{dnsname}', '*', ok), ('A', 'host/{dnsname}', 'B', denied), ('A', 'cifs/{dnsname}', 'B', denied), ), ("replace as nobody", ('B', 'cifs/b', '*', ok), ('A', 'cifs/{dnsname}', '*', ok), ('A', 'host/{dnsname}', '', denied), ('A', 'cifs/{dnsname}', '', denied), ), ("accumulate and delete as admin", ('A', 'cifs/{dnsname}', '*', ok), ('A', 'host/{dnsname}', '*', ok, add), ('A', 'www/{dnsname}', '*', ok, add), ('A', 'www/...', '*', ok, add), ('A', 'host/...', '*', ok, add), ('A', 'www/{dnsname}', '*', ok, delete), ('A', 'host/{dnsname}', '*', ok, delete), ('A', 'host/{dnsname}', '*', ok, add), ('A', 'www/{dnsname}', '*', ok, add), ('A', 'host/...', '*', ok, delete), ), ("accumulate and delete with user rights", ('A', 'cifs/{dnsname}', '*', ok), ('A', 'host/{dnsname}', 'A', ok, add), ('A', 'www/{dnsname}', 'A', ok, add), ('A', 'www/...', 'A', ok, add), ('A', 'host/...', 'A', ok, add), ('A', 'www/{dnsname}', 'A', ok, delete), ('A', 'host/{dnsname}', 'A', ok, delete), ('A', 'host/{dnsname}', 'A', ok, add), ('A', 'www/{dnsname}', 'A', ok, add), ('A', 'host/...', 'A', ok, delete), ), ("three way conflict, host first, with partial write rights", ('A', 'host/z.{dnsname}', 'A', ok), ('B', 'cifs/z.{dnsname}', 'B', denied), ('C', 'www/z.{dnsname}', 'C', denied), ), ("three way conflict, host first, with partial write rights 2", ('A', 'host/z.{dnsname}', 'A', ok), ('B', 'cifs/z.{dnsname}', 'B', bad), ('C', 'www/z.{dnsname}', 'C,A', ok), ), ("three way conflict sandwich, sufficient rights", ('B', 'host/{dnsname}', 'B', ok), ('A', 'cifs/{dnsname}', 'A,B', ok), # the replaces don't fail even though they appear to affect A # and B, because they are effectively no-ops, leaving # everything as it was before. ('A', 'cifs/{dnsname}', 'A', ok), ('B', 'host/{dnsname}', 'B', ok), ('C', 'www/{dnsname}', 'A,B,C', ok), ('C', 'www/{dnsname}', 'B,C', ok), # because B already has host/, C doesn't matter ('B', 'host/{dnsname}', 'A,B', ok), # removing host (via replace) frees others, needs B only ('B', 'ldap/{dnsname}', 'B', ok), ('C', 'www/{dnsname}', 'C', ok), ('A', 'cifs/{dnsname}', 'A', ok), # re-adding host is now impossible while A and C have {dnsname} spns ('B', 'host/{dnsname}', '*', bad), ('B', 'host/{dnsname}', 'A,B,C', bad), # so let's remove those... (not needing B rights) ('C', 'www/{dnsname}', 'C', ok, delete), ('A', 'cifs/{dnsname}', 'A', ok, delete), # and now we can add host/ again ('B', 'host/{dnsname}', 'B', ok), ('C', 'www/{dnsname}', 'B,C', ok, add), ('A', 'cifs/{dnsname}', 'A,B', ok), ), ("three way conflict, service first, with all write rights", ('A', 'cifs/{dnsname}', '*', ok), ('B', 'www/{dnsname}', 'A,B,C', ok), ('C', 'host/{dnsname}', 'A,B,C', bad), ), ("three way conflict, service first, just sufficient rights", ('A', 'cifs/{dnsname}', 'A', ok), ('B', 'www/{dnsname}', 'B', ok), ('C', 'host/{dnsname}', 'A,B,C', bad), ), ("three way conflict, service first, with host write rights", ('A', 'cifs/{dnsname}', '*', ok), ('B', 'www/{dnsname}', '*', ok), ('C', 'host/{dnsname}', 'C', bad), ), ("three way conflict, service first, with both write rights", ('A', 'cifs/{dnsname}', '*', ok), ('A', 'cifs/{dnsname}', '*', ok, delete), ('A', 'www/{dnsname}', 'A,B,C', ok), ('B', 'host/{dnsname}', 'A,B', bad), ('A', 'www/{dnsname}', 'A', ok, delete), ('B', 'host/{dnsname}', 'A,B', ok), ('C', 'cifs/{dnsname}', 'C', bad), ('C', 'cifs/{dnsname}', 'B,C', ok), ), ("three way conflict, services first, with partial rights", ('A', 'cifs/{dnsname}', 'A,C', ok), ('B', 'www/{dnsname}', '*', ok), ('C', 'host/{dnsname}', 'A,C', bad), ), ] @DynamicTestCase class LdapSpnAmbitiousTest(LdapSpnTestBase): _disabled = True cases = [ ("add a conflict with port, host first both on user", ('user:C', 'host/{dnsname}', '*', ok), ('user:D', 'www/{dnsname}:80', '*', bad), ), # see https://bugzilla.samba.org/show_bug.cgi?id=8929 ("add the same one twice, case-insensitive duplicate", ('A', 'host/{dnsname}', '*', ok), ('A', 'Host/{dnsname}', '*', bad, add), ), ("special SPN", # should fail because we don't have all the DSA infrastructure ('A', ("E3514235-4B06-11D1-AB04-00C04FC2DCD2/" "75b84f00-a81b-4a19-8ef2-8e483cccff11/" "{dnsname}"), '*', constraint) ), ("single part SPNs matching sAMAccountName", # setting them both together is allegedly a MacOS behaviour, # but all we get from Windows is a mysterious NO_SUCH_OBJECT. ('user:A', {'sAMAccountName': 'A', 'servicePrincipalName': 'A'}, '*', ldb.ERR_NO_SUCH_OBJECT), ('user:B', {'sAMAccountName': 'B'}, '*', ok), ('user:B', {'servicePrincipalName': 'B'}, '*', constraint), ('user:C', {'servicePrincipalName': 'C'}, '*', constraint), ('user:C', {'sAMAccountName': 'C'}, '*', ok), ), ("three part spns with dnsHostName", ('A', {'dNSHostName': '{dnsname}'}, '*', ok), ('A', 'cifs/{dnsname}/DomainDNSZones.{dnsname}', '*', ok), ('A', {'dNSHostName': 'y.{dnsname}'}, '*', ok), ('B', 'cifs/{dnsname}/DomainDNSZones.{dnsname}', '*', ok), ('B', 'cifs/y.{dnsname}/DomainDNSZones.{dnsname}', '*', constraint), ('C', 'host/{y.dnsname}/{y.dnsname}', '*', constraint), ('A', 'host/y.{dnsname}/{dnsname}', '*', constraint), ), ] def main(): TestProgram(module=__name__, opts=subunitopts) main()