1 """
2 Test cases for ldaptor.protocols.ldap.svcbindproxy module.
3 """
4
5 from twisted.trial import unittest
6 from twisted.internet import reactor
7 from ldaptor.protocols.ldap import svcbindproxy, ldaperrors
8 from ldaptor.protocols import pureldap, pureber
9 from ldaptor import ldapfilter, testutil
10
12 berdecoder = pureldap.LDAPBERDecoderContext_TopLevel(
13 inherit=pureldap.LDAPBERDecoderContext_LDAPMessage(
14 fallback=pureldap.LDAPBERDecoderContext(fallback=pureber.BERDecoderContext()),
15 inherit=pureldap.LDAPBERDecoderContext(fallback=pureber.BERDecoderContext())))
16
17 - def createServer(self, services, fallback=None, responses=[]):
28
30 server = self.createServer(
31 services=['svc1',
32 'svc2',
33 'svc3',
34 ],
35 fallback=False,
36 responses=[
37 [ pureldap.LDAPSearchResultDone(ldaperrors.Success.resultCode) ],
38 [ pureldap.LDAPSearchResultDone(ldaperrors.Success.resultCode) ],
39 [ pureldap.LDAPSearchResultDone(ldaperrors.Success.resultCode) ],
40 ])
41 server.dataReceived(str(pureldap.LDAPMessage(pureldap.LDAPBindRequest(dn='cn=jack,dc=example,dc=com', auth='s3krit'), id=4)))
42 reactor.iterate()
43 client = server.client
44
45 client.assertSent(
46 pureldap.LDAPSearchRequest(baseObject='dc=example,dc=com',
47 derefAliases=0,
48 sizeLimit=0,
49 timeLimit=0,
50 typesOnly=0,
51 filter=ldapfilter.parseFilter('(&'
52 +'(objectClass=serviceSecurityObject)'
53 +'(owner=cn=jack,dc=example,dc=com)'
54 +'(cn=svc1)'
55 +('(|(!(validFrom=*))(validFrom<=%s))' % server.now)
56 +('(|(!(validUntil=*))(validUntil>=%s))' % server.now)
57 +')'),
58 attributes=('1.1',)),
59 pureldap.LDAPSearchRequest(baseObject='dc=example,dc=com',
60 derefAliases=0,
61 sizeLimit=0,
62 timeLimit=0,
63 typesOnly=0,
64 filter=ldapfilter.parseFilter('(&'
65 +'(objectClass=serviceSecurityObject)'
66 +'(owner=cn=jack,dc=example,dc=com)'
67 +'(cn=svc2)'
68 +('(|(!(validFrom=*))(validFrom<=%s))' % server.now)
69 +('(|(!(validUntil=*))(validUntil>=%s))' % server.now)
70 +')'),
71 attributes=('1.1',)),
72 pureldap.LDAPSearchRequest(baseObject='dc=example,dc=com',
73 derefAliases=0,
74 sizeLimit=0,
75 timeLimit=0,
76 typesOnly=0,
77 filter=ldapfilter.parseFilter('(&'
78 +'(objectClass=serviceSecurityObject)'
79 +'(owner=cn=jack,dc=example,dc=com)'
80 +'(cn=svc3)'
81 +('(|(!(validFrom=*))(validFrom<=%s))' % server.now)
82 +('(|(!(validUntil=*))(validUntil>=%s))' % server.now)
83 +')'),
84 attributes=('1.1',)),
85 )
86 self.assertEquals(server.transport.value(),
87 str(pureldap.LDAPMessage(pureldap.LDAPBindResponse(resultCode=ldaperrors.LDAPInvalidCredentials.resultCode), id=4)))
88
90 server = self.createServer(
91 services=['svc1',
92 'svc2',
93 'svc3',
94 ],
95 fallback=True,
96 responses=[
97 [ pureldap.LDAPSearchResultDone(ldaperrors.Success.resultCode) ],
98 [ pureldap.LDAPSearchResultDone(ldaperrors.Success.resultCode) ],
99 [ pureldap.LDAPSearchResultDone(ldaperrors.Success.resultCode) ],
100 [ pureldap.LDAPBindResponse(resultCode=ldaperrors.Success.resultCode) ],
101 ])
102 server.dataReceived(str(pureldap.LDAPMessage(pureldap.LDAPBindRequest(dn='cn=jack,dc=example,dc=com', auth='s3krit'), id=4)))
103 reactor.iterate()
104 client = server.client
105
106 client.assertSent(
107 pureldap.LDAPSearchRequest(baseObject='dc=example,dc=com',
108 derefAliases=0,
109 sizeLimit=0,
110 timeLimit=0,
111 typesOnly=0,
112 filter=ldapfilter.parseFilter('(&'
113 +'(objectClass=serviceSecurityObject)'
114 +'(owner=cn=jack,dc=example,dc=com)'
115 +'(cn=svc1)'
116 +('(|(!(validFrom=*))(validFrom<=%s))' % server.now)
117 +('(|(!(validUntil=*))(validUntil>=%s))' % server.now)
118 +')'),
119 attributes=('1.1',)),
120 pureldap.LDAPSearchRequest(baseObject='dc=example,dc=com',
121 derefAliases=0,
122 sizeLimit=0,
123 timeLimit=0,
124 typesOnly=0,
125 filter=ldapfilter.parseFilter('(&'
126 +'(objectClass=serviceSecurityObject)'
127 +'(owner=cn=jack,dc=example,dc=com)'
128 +'(cn=svc2)'
129 +('(|(!(validFrom=*))(validFrom<=%s))' % server.now)
130 +('(|(!(validUntil=*))(validUntil>=%s))' % server.now)
131 +')'),
132 attributes=('1.1',)),
133 pureldap.LDAPSearchRequest(baseObject='dc=example,dc=com',
134 derefAliases=0,
135 sizeLimit=0,
136 timeLimit=0,
137 typesOnly=0,
138 filter=ldapfilter.parseFilter('(&'
139 +'(objectClass=serviceSecurityObject)'
140 +'(owner=cn=jack,dc=example,dc=com)'
141 +'(cn=svc3)'
142 +('(|(!(validFrom=*))(validFrom<=%s))' % server.now)
143 +('(|(!(validUntil=*))(validUntil>=%s))' % server.now)
144 +')'),
145 attributes=('1.1',)),
146 pureldap.LDAPBindRequest(dn='cn=jack,dc=example,dc=com', auth='s3krit'))
147 self.assertEquals(server.transport.value(),
148 str(pureldap.LDAPMessage(pureldap.LDAPBindResponse(resultCode=ldaperrors.Success.resultCode), id=4)))
149
151 server = self.createServer(
152 services=['svc1',
153 'svc2',
154 'svc3',
155 ],
156 fallback=True,
157 responses=[
158 [ pureldap.LDAPSearchResultDone(ldaperrors.Success.resultCode) ],
159 [ pureldap.LDAPSearchResultDone(ldaperrors.Success.resultCode) ],
160 [ pureldap.LDAPSearchResultDone(ldaperrors.Success.resultCode) ],
161 [ pureldap.LDAPBindResponse(resultCode=ldaperrors.LDAPInvalidCredentials.resultCode),
162 ],
163 ])
164 server.dataReceived(str(pureldap.LDAPMessage(pureldap.LDAPBindRequest(dn='cn=jack,dc=example,dc=com', auth='wrong-s3krit'), id=4)))
165 reactor.iterate()
166 client = server.client
167
168 client.assertSent(
169 pureldap.LDAPSearchRequest(baseObject='dc=example,dc=com',
170 derefAliases=0,
171 sizeLimit=0,
172 timeLimit=0,
173 typesOnly=0,
174 filter=ldapfilter.parseFilter('(&'
175 +'(objectClass=serviceSecurityObject)'
176 +'(owner=cn=jack,dc=example,dc=com)'
177 +'(cn=svc1)'
178 +('(|(!(validFrom=*))(validFrom<=%s))' % server.now)
179 +('(|(!(validUntil=*))(validUntil>=%s))' % server.now)
180 +')'),
181 attributes=('1.1',)),
182 pureldap.LDAPSearchRequest(baseObject='dc=example,dc=com',
183 derefAliases=0,
184 sizeLimit=0,
185 timeLimit=0,
186 typesOnly=0,
187 filter=ldapfilter.parseFilter('(&'
188 +'(objectClass=serviceSecurityObject)'
189 +'(owner=cn=jack,dc=example,dc=com)'
190 +'(cn=svc2)'
191 +('(|(!(validFrom=*))(validFrom<=%s))' % server.now)
192 +('(|(!(validUntil=*))(validUntil>=%s))' % server.now)
193 +')'),
194 attributes=('1.1',)),
195 pureldap.LDAPSearchRequest(baseObject='dc=example,dc=com',
196 derefAliases=0,
197 sizeLimit=0,
198 timeLimit=0,
199 typesOnly=0,
200 filter=ldapfilter.parseFilter('(&'
201 +'(objectClass=serviceSecurityObject)'
202 +'(owner=cn=jack,dc=example,dc=com)'
203 +'(cn=svc3)'
204 +('(|(!(validFrom=*))(validFrom<=%s))' % server.now)
205 +('(|(!(validUntil=*))(validUntil>=%s))' % server.now)
206 +')'),
207 attributes=('1.1',)),
208 pureldap.LDAPBindRequest(dn='cn=jack,dc=example,dc=com', auth='wrong-s3krit'))
209 self.assertEquals(server.transport.value(),
210 str(pureldap.LDAPMessage(pureldap.LDAPBindResponse(resultCode=ldaperrors.LDAPInvalidCredentials.resultCode), id=4)))
211
212
214 server = self.createServer(
215 services=['svc1',
216 'svc2',
217 'svc3',
218 ],
219 fallback=True,
220 responses=[
221
222
223 [ pureldap.LDAPSearchResultEntry(r'cn=svc1+owner=cn\=jack\,dc\=example\,dc\=com,dc=example,dc=com',
224 attributes=[]),
225 pureldap.LDAPSearchResultDone(ldaperrors.Success.resultCode) ],
226 [ pureldap.LDAPBindResponse(resultCode=ldaperrors.Success.resultCode) ],
227 ])
228
229 server.dataReceived(str(pureldap.LDAPMessage(pureldap.LDAPBindRequest(dn='cn=jack,dc=example,dc=com', auth='secret'), id=4)))
230 reactor.iterate()
231 client = server.client
232
233 client.assertSent(
234 pureldap.LDAPSearchRequest(baseObject='dc=example,dc=com',
235 derefAliases=0,
236 sizeLimit=0,
237 timeLimit=0,
238 typesOnly=0,
239 filter=ldapfilter.parseFilter('(&'
240 +'(objectClass=serviceSecurityObject)'
241 +'(owner=cn=jack,dc=example,dc=com)'
242 +'(cn=svc1)'
243 +('(|(!(validFrom=*))(validFrom<=%s))' % server.now)
244 +('(|(!(validUntil=*))(validUntil>=%s))' % server.now)
245 +')'),
246 attributes=('1.1',)),
247 pureldap.LDAPBindRequest(dn=r'cn=svc1+owner=cn\=jack\,dc\=example\,dc\=com,dc=example,dc=com', auth='secret'),
248 )
249 self.assertEquals(server.transport.value(),
250 str(pureldap.LDAPMessage(pureldap.LDAPBindResponse(resultCode=ldaperrors.Success.resultCode,
251 matchedDN='cn=jack,dc=example,dc=com'), id=4)))
252
254 server = self.createServer(
255 services=['svc1',
256 'svc2',
257 'svc3',
258 ],
259 fallback=True,
260 responses=[
261
262
263 [ pureldap.LDAPSearchResultEntry(r'cn=svc1+owner=cn\=jack\,dc\=example\,dc\=com,dc=example,dc=com',
264 attributes=[]),
265 pureldap.LDAPSearchResultDone(ldaperrors.Success.resultCode) ],
266 [ pureldap.LDAPBindResponse(resultCode=ldaperrors.LDAPInvalidCredentials.resultCode) ],
267
268
269 [ pureldap.LDAPSearchResultDone(ldaperrors.Success.resultCode) ],
270
271
272 [ pureldap.LDAPSearchResultEntry(r'cn=svc3+owner=cn\=jack\,dc\=example\,dc\=com,dc=example,dc=com',
273 attributes=[]),
274 pureldap.LDAPSearchResultDone(ldaperrors.Success.resultCode) ],
275 [ pureldap.LDAPBindResponse(resultCode=ldaperrors.Success.resultCode) ],
276 ])
277
278 server.dataReceived(str(pureldap.LDAPMessage(pureldap.LDAPBindRequest(dn='cn=jack,dc=example,dc=com', auth='secret'), id=4)))
279 reactor.iterate()
280 client = server.client
281
282 client.assertSent(
283 pureldap.LDAPSearchRequest(baseObject='dc=example,dc=com',
284 derefAliases=0,
285 sizeLimit=0,
286 timeLimit=0,
287 typesOnly=0,
288 filter=ldapfilter.parseFilter('(&'
289 +'(objectClass=serviceSecurityObject)'
290 +'(owner=cn=jack,dc=example,dc=com)'
291 +'(cn=svc1)'
292 +('(|(!(validFrom=*))(validFrom<=%s))' % server.now)
293 +('(|(!(validUntil=*))(validUntil>=%s))' % server.now)
294 +')'),
295 attributes=('1.1',)),
296 pureldap.LDAPBindRequest(dn=r'cn=svc1+owner=cn\=jack\,dc\=example\,dc\=com,dc=example,dc=com', auth='secret'),
297 pureldap.LDAPSearchRequest(baseObject='dc=example,dc=com',
298 derefAliases=0,
299 sizeLimit=0,
300 timeLimit=0,
301 typesOnly=0,
302 filter=ldapfilter.parseFilter('(&'
303 +'(objectClass=serviceSecurityObject)'
304 +'(owner=cn=jack,dc=example,dc=com)'
305 +'(cn=svc2)'
306 +('(|(!(validFrom=*))(validFrom<=%s))' % server.now)
307 +('(|(!(validUntil=*))(validUntil>=%s))' % server.now)
308 +')'),
309 attributes=('1.1',)),
310 pureldap.LDAPSearchRequest(baseObject='dc=example,dc=com',
311 derefAliases=0,
312 sizeLimit=0,
313 timeLimit=0,
314 typesOnly=0,
315 filter=ldapfilter.parseFilter('(&'
316 +'(objectClass=serviceSecurityObject)'
317 +'(owner=cn=jack,dc=example,dc=com)'
318 +'(cn=svc3)'
319 +('(|(!(validFrom=*))(validFrom<=%s))' % server.now)
320 +('(|(!(validUntil=*))(validUntil>=%s))' % server.now)
321 +')'),
322 attributes=('1.1',)),
323 pureldap.LDAPBindRequest(dn='cn=svc3+owner=cn\=jack\,dc\=example\,dc\=com,dc=example,dc=com', auth='secret'),
324 )
325 self.assertEquals(server.transport.value(),
326 str(pureldap.LDAPMessage(pureldap.LDAPBindResponse(resultCode=ldaperrors.Success.resultCode,
327 matchedDN='cn=jack,dc=example,dc=com'), id=4)))
328
330 server = self.createServer(
331 services=['svc1',
332 'svc2',
333 'svc3',
334 ],
335 fallback=True,
336 responses=[
337
338
339 [ pureldap.LDAPSearchResultEntry(r'cn=svc1+owner=cn\=jack\,dc\=example\,dc\=com,dc=example,dc=com',
340 attributes=[]),
341 pureldap.LDAPSearchResultDone(ldaperrors.Success.resultCode) ],
342 [ pureldap.LDAPBindResponse(resultCode=ldaperrors.LDAPInvalidCredentials.resultCode) ],
343
344
345 [ pureldap.LDAPSearchResultDone(ldaperrors.Success.resultCode) ],
346
347
348 [ pureldap.LDAPSearchResultEntry(r'cn=svc3+owner=cn\=jack\,dc\=example\,dc\=com,dc=example,dc=com',
349 attributes=[]),
350 pureldap.LDAPSearchResultDone(ldaperrors.Success.resultCode) ],
351 [ pureldap.LDAPBindResponse(resultCode=ldaperrors.LDAPInvalidCredentials.resultCode) ],
352 [ pureldap.LDAPBindResponse(resultCode=ldaperrors.LDAPInvalidCredentials.resultCode) ],
353 ])
354
355 server.dataReceived(str(pureldap.LDAPMessage(pureldap.LDAPBindRequest(dn='cn=jack,dc=example,dc=com', auth='wrong-s3krit'), id=4)))
356 reactor.iterate()
357 client = server.client
358
359 client.assertSent(
360 pureldap.LDAPSearchRequest(baseObject='dc=example,dc=com',
361 derefAliases=0,
362 sizeLimit=0,
363 timeLimit=0,
364 typesOnly=0,
365 filter=ldapfilter.parseFilter('(&'
366 +'(objectClass=serviceSecurityObject)'
367 +'(owner=cn=jack,dc=example,dc=com)'
368 +'(cn=svc1)'
369 +('(|(!(validFrom=*))(validFrom<=%s))' % server.now)
370 +('(|(!(validUntil=*))(validUntil>=%s))' % server.now)
371 +')'),
372 attributes=('1.1',)),
373 pureldap.LDAPBindRequest(dn=r'cn=svc1+owner=cn\=jack\,dc\=example\,dc\=com,dc=example,dc=com', auth='wrong-s3krit'),
374 pureldap.LDAPSearchRequest(baseObject='dc=example,dc=com',
375 derefAliases=0,
376 sizeLimit=0,
377 timeLimit=0,
378 typesOnly=0,
379 filter=ldapfilter.parseFilter('(&'
380 +'(objectClass=serviceSecurityObject)'
381 +'(owner=cn=jack,dc=example,dc=com)'
382 +'(cn=svc2)'
383 +('(|(!(validFrom=*))(validFrom<=%s))' % server.now)
384 +('(|(!(validUntil=*))(validUntil>=%s))' % server.now)
385 +')'),
386 attributes=('1.1',)),
387 pureldap.LDAPSearchRequest(baseObject='dc=example,dc=com',
388 derefAliases=0,
389 sizeLimit=0,
390 timeLimit=0,
391 typesOnly=0,
392 filter=ldapfilter.parseFilter('(&'
393 +'(objectClass=serviceSecurityObject)'
394 +'(owner=cn=jack,dc=example,dc=com)'
395 +'(cn=svc3)'
396 +('(|(!(validFrom=*))(validFrom<=%s))' % server.now)
397 +('(|(!(validUntil=*))(validUntil>=%s))' % server.now)
398 +')'),
399 attributes=('1.1',)),
400 pureldap.LDAPBindRequest(dn='cn=svc3+owner=cn\=jack\,dc\=example\,dc\=com,dc=example,dc=com', auth='wrong-s3krit'),
401 pureldap.LDAPBindRequest(version=3, dn='cn=jack,dc=example,dc=com', auth='wrong-s3krit'),
402 )
403 self.assertEquals(server.transport.value(),
404 str(pureldap.LDAPMessage(pureldap.LDAPBindResponse(resultCode=ldaperrors.LDAPInvalidCredentials.resultCode), id=4)))
405