From f28b82c5cbe4f16ebb058766e0196562026682ef Mon Sep 17 00:00:00 2001 From: Sankar Ramalingam Date: Tue, 8 Aug 2017 15:52:15 +0530 Subject: [PATCH] Ticket #48081 - Add regression tests for pwpolicy Description: When troubleshooting TET test failures for RHEL-7.4, we found couple of issues related to PasswordCheckSyntax attribute. One of the issue is accepting trivial password and other one is rejecting Passwords similar to cn, sn and uid attributes. Automated both the bugs in this patch. https://pagure.io/389-ds-base/issue/48081 Reviewed by: ? --- .../tests/suites/password/regression_test.py | 127 +++++++++++++++++++++ 1 file changed, 127 insertions(+) create mode 100644 dirsrvtests/tests/suites/password/regression_test.py diff --git a/dirsrvtests/tests/suites/password/regression_test.py b/dirsrvtests/tests/suites/password/regression_test.py new file mode 100644 index 0000000..f493cec --- /dev/null +++ b/dirsrvtests/tests/suites/password/regression_test.py @@ -0,0 +1,127 @@ +# Copyright (C) 2017 Red Hat, Inc. +# All rights reserved. +# +# License: GPL (version 3 or any later version). +# See LICENSE for details. +# --- END COPYRIGHT BLOCK --- +# +import pytest +from lib389._constants import SUFFIX +from lib389.idm.user import UserAccounts +from lib389.utils import ldap, os, logging +from lib389.topologies import topology_st as topo + +DEBUGGING = os.getenv("DEBUGGING", default=False) +if DEBUGGING: + logging.getLogger(__name__).setLevel(logging.DEBUG) +else: + logging.getLogger(__name__).setLevel(logging.INFO) +log = logging.getLogger(__name__) + +USER_PASW = 'Secret123' + + +@pytest.fixture(scope="module") +def passw_policy(topo, request): + """Configure password policy with PasswordCheckSyntax attribute set to on""" + + log.info('Configure Pwpolicy with PasswordCheckSyntax set to on') + topo.standalone.config.set('PasswordExp', 'on') + topo.standalone.config.set('PasswordCheckSyntax', 'on') + + def fin(): + log.info('Reset pwpolicy configuration settings') + topo.standalone.config.set('PasswordExp', 'off') + topo.standalone.config.set('PasswordCheckSyntax', 'off') + topo.standalone.config.set('nsslapd-pwpolicy-local', 'off') + + request.addfinalizer(fin) + + +def _add_test_users(topo, uid_attr, sn_attr, cn_attr): + """Add test users using UserAccounts""" + + log.info('Adding user-uid={},ou=people,{}'.format(uid_attr, SUFFIX)) + users = UserAccounts(topo.standalone, SUFFIX, ) + user_properties = { + 'uid': uid_attr, + 'cn': cn_attr, + 'sn': sn_attr, + 'uidNumber': '1001', + 'gidNumber': '2001', + 'mail': '{}@redhat.com'.format(uid_attr), + 'userpassword': USER_PASW, + 'homeDirectory': '/home/{}'.format(uid_attr)} + tuser = users.create(properties=user_properties) + return tuser + + +@pytest.mark.parametrize("uid_attr, sn_attr, cn_attr, test_attr", + [('testuid1', 'testsn1', 'testcn1', 'testuid1'), ('testuid2', 'testsn2', 'testcn2', 'testsn2'), + ('testuid3', 'testsn3', 'testcn3', 'testcn3')]) +def test_trivial_passw_check(topo, passw_policy, uid_attr, sn_attr, cn_attr, test_attr): + """PasswordCheckSyntax attribute fails to validate cn, sn, uid and mail attributes + Please see: https://bugzilla.redhat.com/show_bug.cgi?id=1465600 + + :id: bf9fe1ef-56cb-46a3-a6f8-5530398a06dc + :feature: Password policy + :setup: Standalone instance + :steps: 1. Configure password policy with PasswordCheckSyntax set to on + 2. Add users with cn, sn, uid, mail and userPassword attributes + 3. Configure subtree password policy for ou=people subtree + 4. Replace userPassword with cn, sn and uid attribute values + 5. Check if trivial password is rejected with error 19 + :expectedresults: Server should reject if the password contains cn, sn and uid attribute values + """ + + log.info('Setting nsslapd-pwpolicy-local attribute to on') + topo.standalone.config.set('nsslapd-pwpolicy-local', 'on') + user = _add_test_users(topo, uid_attr, sn_attr, cn_attr) + log.info('Configuring subtree password policy for {},{}'.format('ou=People', SUFFIX)) + userdn = 'uid={},ou=people,{}'.format(uid_attr, SUFFIX) + topo.standalone.subtreePwdPolicy(userdn, {'passwordchange': 'on', 'passwordCheckSyntax': 'on'}) + + log.info('Replace userPassword attribute with {}'.format(test_attr)) + conn = user.bind(USER_PASW) + with pytest.raises(ldap.CONSTRAINT_VIOLATION) as excinfo: + conn.modify_s(userdn, [(ldap.MOD_REPLACE, 'userPassword', test_attr)]) + log.fatal('Failed: Userpassword with {} is accepted'.format(test_attr)) + assert 'password based off of user entry' in str(excinfo.value) + conn.unbind_s() + + +@pytest.mark.parametrize("uid_attr, sn_attr, cn_attr, test_attr", + [('test2uid1', 'test2sn1', 'test2cn1', 'Ntest2Uid321'), + ('test2uid2', 'test2sn2', 'test2cn2', 'MyTest1sn3'), + ('test2uid3', 'test2sn3', 'test2cn3', 'AtesT3cn321')]) +def test_cn_sn_like_passw(topo, passw_policy, uid_attr, sn_attr, cn_attr, test_attr): + """Passwords rejected if its similar to uid, cn, sn or mail attributes + Please see: https://bugzilla.redhat.com/show_bug.cgi?id=1468284 + + :id: dfd6cf5d-8bcd-4895-a691-a43ad9ec1be8 + :feature: Password policy + :setup: Standalone instance + :steps: 1. Configure password policy with PasswordCheckSyntax set to on + 2. Add users with cn, sn, uid, mail and userPassword attributes + 3. Replace userPassword similar to cn, sn and uid attribute values + 4. Check if passwords similar to cn, sn and uid are accepted + :expectedresults: Server should accept passwords similar to cn, sn and uid + """ + + user = _add_test_users(topo, uid_attr, sn_attr, cn_attr) + userdn = 'uid={},ou=people,{}'.format(uid_attr, SUFFIX) + conn = user.bind(USER_PASW) + log.info('Replace userPassword attribute with {}'.format(test_attr)) + try: + conn.modify_s(userdn, [(ldap.MOD_REPLACE, 'userPassword', test_attr)]) + except ldap.LDAPError as e: + log.fatal('Failed to replace userPassword: error {}'.format(e.message['desc'])) + raise e + conn.unbind_s() + + +if __name__ == '__main__': + # Run isolated + # -s for DEBUG mode + CURRENT_FILE = os.path.realpath(__file__) + pytest.main("-s {}".format(CURRENT_FILE)) -- 2.7.4