From 656a6c93d2f737aa24f1ac1a51a8be16703ed57c Mon Sep 17 00:00:00 2001
From: Anuj Borah <aborah@redhat.com>
Date: Mar 12 2019 04:22:56 +0000
Subject: Issue: 50112 - Port ACI test suit from TET to python3(Search)


Port ACI test suit from TET to python3(Search)

https://pagure.io/389-ds-base/issue/50112

Reviewed by: William Brown, thierry bordaz

---

diff --git a/dirsrvtests/tests/suites/acl/search_real_part2_test.py b/dirsrvtests/tests/suites/acl/search_real_part2_test.py
new file mode 100644
index 0000000..9a211da
--- /dev/null
+++ b/dirsrvtests/tests/suites/acl/search_real_part2_test.py
@@ -0,0 +1,455 @@
+# --- BEGIN COPYRIGHT BLOCK ---
+# Copyright (C) 2019 Red Hat, Inc.
+# All rights reserved.
+#
+# License: GPL (version 3 or any later version).
+# See LICENSE for details.
+# --- END COPYRIGHT BLOCK ----
+
+import pytest, os, ldap
+from lib389._constants import DEFAULT_SUFFIX, PW_DM, ErrorLog
+from lib389.idm.user import UserAccount, UserAccounts
+from lib389.idm.account import Accounts
+from lib389.idm.organizationalunit import OrganizationalUnits
+from lib389.topologies import topology_st as topo
+from lib389.idm.domain import Domain
+
+
+CONTAINER_1_DELADD = "ou=Product Development,{}".format(DEFAULT_SUFFIX)
+CONTAINER_2_DELADD = "ou=Accounting,{}".format(DEFAULT_SUFFIX)
+USER_ANUJ = "uid=Anuj Borah,{}".format(CONTAINER_1_DELADD)
+USER_ANANDA = "uid=Ananda Borah,{}".format(CONTAINER_2_DELADD)
+
+
+@pytest.fixture(scope="function")
+def aci_of_user(request, topo):
+    aci_list = Domain(topo.standalone, DEFAULT_SUFFIX).get_attr_vals('aci')
+
+    def finofaci():
+        domain = Domain(topo.standalone, DEFAULT_SUFFIX)
+        domain.set('aci', None)
+        for i in aci_list:
+            domain.add("aci", i)
+
+    request.addfinalizer(finofaci)
+    
+
+@pytest.fixture(scope="module")
+def test_uer(request, topo):
+    topo.standalone.config.loglevel((ErrorLog.ACL_SUMMARY,))
+
+    ous = OrganizationalUnits(topo.standalone, DEFAULT_SUFFIX)
+    for i in ['Product Development', 'Accounting']:
+        ous.create(properties={'ou': i})
+
+    users = UserAccounts(topo.standalone, DEFAULT_SUFFIX, rdn='ou=Product Development')
+    users.create(properties={
+        'uid': 'Anuj Borah',
+        'cn': 'Anuj Borah',
+        'sn': 'user',
+        'uidNumber': '1000',
+        'gidNumber': '2000',
+        'homeDirectory': '/home/' + 'AnujBorah',
+        'userPassword': PW_DM
+    })
+
+    users = UserAccounts(topo.standalone, DEFAULT_SUFFIX, rdn='ou=Accounting')
+    users.create(properties={
+        'uid': 'Ananda Borah',
+        'cn': 'Ananda Borah',
+        'sn': 'user',
+        'uidNumber': '1000',
+        'gidNumber': '2000',
+        'homeDirectory': '/home/' + 'AnandaBorah',
+        'userPassword': PW_DM
+    })
+
+
+def test_deny_all_access_with__target_set_on_non_leaf(topo, test_uer, aci_of_user):
+    """Search Test 11 Deny all access with != target set on non-leaf
+    :id: f1c5d72a-6e11-11e8-aa9d-8c16451d917b
+    :setup: Standalone Instance
+    :steps:
+        1. Add Entry
+        2. Add ACI
+        3. Bind with test USER_ANUJ
+        4. Try search
+        5. Delete Entry,test USER_ANUJ, ACI
+    :expectedresults:
+        1. Operation should success
+        2. Operation should success
+        3. Operation should success
+        4. Operation should Fail
+        5. Operation should success
+    """
+    ACI_TARGET = "(target != ldap:///{})(targetattr=*)".format(CONTAINER_2_DELADD)
+    ACI_ALLOW = '(version 3.0; acl "Name of the ACI"; deny absolute (all)'
+    ACI_SUBJECT = 'userdn="ldap:///anyone";)'
+    ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+    Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
+    conn = UserAccount(topo.standalone, USER_ANANDA).bind(PW_DM)
+    # After binding with USER_ANANDA , aci will limit the search to itself
+    assert 1 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=*)'))
+    conn = UserAccount(topo.standalone, USER_ANUJ).bind(PW_DM)
+    # After binding with USER_ANUJ , aci will limit the search to itself
+    assert 1 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=*)'))
+    # After binding with root , the actual number of users will be given
+    assert 2 == len(Accounts(topo.standalone, DEFAULT_SUFFIX).filter('(cn=*)'))
+
+
+def test_deny_all_access_with__target_set_on_wildcard_non_leaf(
+    topo, test_uer, aci_of_user
+):
+    """Search Test 12 Deny all access with != target set on wildcard non-leaf
+    :id: 02f34640-6e12-11e8-a382-8c16451d917b
+    :setup: Standalone Instance
+    :steps:
+        1. Add Entry
+        2. Add ACI
+        3. Bind with test USER_ANUJ
+        4. Try search
+        5. Delete Entry,test USER_ANUJ, ACI
+    :expectedresults:
+        1. Operation should success
+        2. Operation should success
+        3. Operation should success
+        4. Operation should Fail
+        5. Operation should success
+    """
+    ACI_TARGET = "(target != ldap:///ou=Product*,{})(targetattr=*)".format(
+        DEFAULT_SUFFIX)
+    ACI_ALLOW = '(version 3.0; acl "Name of the ACI"; deny absolute (all)'
+    ACI_SUBJECT = 'userdn="ldap:///anyone";)'
+    ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+    Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
+    conn = UserAccount(topo.standalone, USER_ANANDA).bind(PW_DM)
+    # aci will limit the search to ou=Product it will block others
+    assert 1 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=*)'))
+    conn = UserAccount(topo.standalone, USER_ANUJ).bind(PW_DM)
+    # aci will limit the search to ou=Product it will block others
+    assert 1 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=*)'))
+    # with root , aci will give actual no of users , without any limit.
+    assert 2 == len(Accounts(topo.standalone, DEFAULT_SUFFIX).filter('(cn=*)'))
+
+
+def test_deny_all_access_with__target_set_on_wildcard_leaf(
+    topo, test_uer, aci_of_user
+):
+    """Search Test 13 Deny all access with != target set on wildcard leaf
+    :id: 16c54d76-6e12-11e8-b5ba-8c16451d917b
+    :setup: Standalone Instance
+    :steps:
+        1. Add Entry
+        2. Add ACI
+        3. Bind with test USER_ANUJ
+        4. Try search
+        5. Delete Entry,test USER_ANUJ, ACI
+    :expectedresults:
+        1. Operation should success
+        2. Operation should success
+        3. Operation should success
+        4. Operation should Fail
+        5. Operation should success
+    """
+    ACI_TARGET = "(target != ldap:///uid=Anuj*, ou=*,{})(targetattr=*)".format(
+        DEFAULT_SUFFIX)
+    ACI_ALLOW = '(version 3.0; acl "Name of the ACI"; deny absolute (all)'
+    ACI_SUBJECT = 'userdn="ldap:///anyone";)'
+    ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+    Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
+    conn = UserAccount(topo.standalone, USER_ANANDA).bind(PW_DM)
+    # aci will limit the search to cn=Jeff it will block others
+    assert 1 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=*)'))
+    conn = UserAccount(topo.standalone, USER_ANUJ).bind(PW_DM)
+    # aci will limit the search to cn=Jeff it will block others
+    assert 1 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=*)'))
+    # with root there is no aci blockage
+    assert 2 == len(Accounts(topo.standalone, DEFAULT_SUFFIX).filter('(cn=*)'))
+
+
+def test_deny_all_access_with_targetfilter_using_equality_search(
+    topo, test_uer, aci_of_user
+):
+    """Search Test 14 Deny all access with targetfilter using equality search
+    :id: 27255e04-6e12-11e8-8e35-8c16451d917b
+    :setup: Standalone Instance
+    :steps:
+        1. Add Entry
+        2. Add ACI
+        3. Bind with test USER_ANUJ
+        4. Try search
+        5. Delete Entry,test USER_ANUJ, ACI
+    :expectedresults:
+        1. Operation should success
+        2. Operation should success
+        3. Operation should success
+        4. Operation should Fail
+        5. Operation should success
+    """
+    ACI_TARGET = '(targetfilter ="(uid=Anuj Borah)")(target = ldap:///{})(targetattr=*)'.format(
+        DEFAULT_SUFFIX)
+    ACI_ALLOW = '(version 3.0; acl "Name of the ACI"; deny absolute (all)'
+    ACI_SUBJECT = 'userdn="ldap:///anyone";)'
+    ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+    Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
+    conn = UserAccount(topo.standalone, USER_ANANDA).bind(PW_DM)
+    # aci will block the search to cn=Jeff
+    assert 0 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(uid=Anuj Borah)'))
+    conn = UserAccount(topo.standalone, USER_ANUJ).bind(PW_DM)
+    # aci will block the search to cn=Jeff
+    assert 0 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(uid=Anuj Borah)'))
+    # with root there is no blockage
+    assert 1 == len(Accounts(topo.standalone, DEFAULT_SUFFIX).filter('(uid=Anuj Borah)'))
+
+
+def test_deny_all_access_with_targetfilter_using_equality_search_two(
+    topo, test_uer, aci_of_user
+):
+    """Test that Search Test 15 Deny all access with targetfilter using != equality search
+    :id: 3966bcd4-6e12-11e8-83ce-8c16451d917b
+    :setup: Standalone Instance
+    :steps:
+        1. Add Entry
+        2. Add ACI
+        3. Bind with test USER_ANUJ
+        4. Try search
+        5. Delete Entry,test USER_ANUJ, ACI
+    :expectedresults:
+        1. Operation should success
+        2. Operation should success
+        3. Operation should success
+        4. Operation should Fail
+        5. Operation should success
+    """
+    ACI_TARGET = '(targetfilter !="(uid=Anuj Borah)")(target = ldap:///{})(targetattr=*)'.format(
+        DEFAULT_SUFFIX)
+    ACI_ALLOW = '(version 3.0; acl "Name of the ACI"; deny absolute (all)'
+    ACI_SUBJECT = 'userdn="ldap:///anyone";)'
+    ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+    Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
+    conn = UserAccount(topo.standalone, USER_ANANDA).bind(PW_DM)
+    # aci will limit the search to cn=Jeff it will block others
+    assert 1 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=*)'))
+    conn = UserAccount(topo.standalone, USER_ANUJ).bind(PW_DM)
+    # aci will limit the search to cn=Jeff it will block others
+    assert 1 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=*)'))
+    # with root there is no blockage
+    assert 2 == len(Accounts(topo.standalone, DEFAULT_SUFFIX).filter('(cn=*)'))
+
+
+def test_deny_all_access_with_targetfilter_using_substring_search(
+    topo, test_uer, aci_of_user
+):
+    """Test that Search Test 16 Deny all access with targetfilter using substring search
+    :id: 44d7b4ba-6e12-11e8-b420-8c16451d917b
+    :setup: Standalone Instance
+    :steps:
+        1. Add Entry
+        2. Add ACI
+        3. Bind with test USER_ANUJ
+        4. Try search
+        5. Delete Entry,test USER_ANUJ, ACI
+    :expectedresults:
+        1. Operation should success
+        2. Operation should success
+        3. Operation should success
+        4. Operation should Fail
+        5. Operation should success
+    """
+    ACI_TARGET = '(targetfilter ="(uid=Anu*)")(target = ldap:///{})(targetattr=*)'.format(
+        DEFAULT_SUFFIX)
+    ACI_ALLOW = '(version 3.0; acl "Name of the ACI"; deny absolute (all)'
+    ACI_SUBJECT = 'userdn="ldap:///anyone";)'
+    ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+    Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
+    conn = UserAccount(topo.standalone, USER_ANANDA).bind(PW_DM)
+    # aci block anything cn=j*
+    assert 0 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=Anu*)'))
+    conn = UserAccount(topo.standalone, USER_ANUJ).bind(PW_DM)
+    # aci block anything cn=j*
+    assert 0 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=Anu*)'))
+    # with root there is no blockage
+    assert 1 == len(Accounts(topo.standalone, DEFAULT_SUFFIX).filter('(cn=Anu*)'))
+
+
+def test_deny_all_access_with_targetfilter_using_substring_search_two(
+    topo, test_uer, aci_of_user
+):
+    """Test that Search Test 17 Deny all access with targetfilter using != substring search
+    :id: 55b12d98-6e12-11e8-8cf4-8c16451d917b
+    :setup: Standalone Instance
+    :steps:
+        1. Add Entry
+        2. Add ACI
+        3. Bind with test USER_ANUJ
+        4. Try search
+        5. Delete Entry,test USER_ANUJ, ACI
+    :expectedresults:
+        1. Operation should success
+        2. Operation should success
+        3. Operation should success
+        4. Operation should Fail
+        5. Operation should success
+    """
+    ACI_TARGET = '(targetfilter !="(uid=Anu*)")(target = ldap:///{})(targetattr=*)'.format(
+        DEFAULT_SUFFIX
+    )
+    ACI_ALLOW = '(version 3.0; acl "Name of the ACI"; deny absolute (all)'
+    ACI_SUBJECT = 'userdn="ldap:///anyone";)'
+    ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+    Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
+    conn = UserAccount(topo.standalone, USER_ANANDA).bind(PW_DM)
+    # aci allow anything cn=j*, it will block others
+    assert 1 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(uid=*)'))
+    conn = UserAccount(topo.standalone, USER_ANUJ).bind(PW_DM)
+    # aci allow anything cn=j*, it will block others
+    assert 1 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(uid=*)'))
+    # with root there is no blockage
+    assert 2 == len(Accounts(topo.standalone, DEFAULT_SUFFIX).filter('(uid=*)'))
+
+
+def test_deny_all_access_with_targetfilter_using_boolean_or_of_two_equality_search(
+    topo, test_uer, aci_of_user
+):
+    """Search Test 18 Deny all access with targetfilter using boolean OR of two equality search
+    :id: 29cc35fa-793f-11e8-988f-8c16451d917b
+    :setup: Standalone Instance
+    :steps:
+        1. Add Entry
+        2. Add ACI
+        3. Bind with test USER_ANUJ
+        4. Try search
+        5. Delete Entry,test USER_ANUJ, ACI
+    :expectedresults:
+        1. Operation should success
+        2. Operation should success
+        3. Operation should success
+        4. Operation should Fail
+        5. Operation should success
+    """
+    Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",'(target = ldap:///{})(targetattr = "*")'
+    '(targetfilter = (|(cn=scarter)(cn=jvaughan)))(version 3.0; acl "$tet_thistest"; '
+    'deny absolute (all) (userdn = "ldap:///anyone") ;)'.format(DEFAULT_SUFFIX))
+    UserAccount(topo.standalone, USER_ANANDA).set("cn", "scarter")
+    UserAccount(topo.standalone, USER_ANUJ).set("cn", "jvaughan")
+    conn = UserAccount(topo.standalone, USER_ANANDA).bind(PW_DM)
+    # aci will deny_all_access_with_targetfilter_using_boolean_or_of_two_equality_search
+    user = UserAccount(conn, USER_ANANDA)
+    with pytest.raises(IndexError):
+        user.get_attr_val_utf8('uid')
+    # aci will deny_all_access_with_targetfilter_using_boolean_or_of_two_equality_search
+    user = UserAccount(conn, USER_ANUJ)
+    with pytest.raises(IndexError):
+        user.get_attr_val_utf8('uid')
+    # with root no blockage
+    assert UserAccount(topo.standalone, USER_ANANDA).get_attr_val_utf8('uid') == 'Ananda Borah'
+    # with root no blockage
+    assert UserAccount(topo.standalone, USER_ANUJ).get_attr_val_utf8('uid') == 'Anuj Borah'
+
+
+def test_deny_all_access_to__userdn_two(topo, test_uer, aci_of_user):
+    """Search Test 19 Deny all access to != userdn
+    :id: 693496c0-6e12-11e8-80dc-8c16451d917b
+    :setup: Standalone Instance
+    :steps:
+        1. Add Entry
+        2. Add ACI
+        3. Bind with test USER_ANUJ
+        4. Try search
+        5. Delete Entry,test USER_ANUJ, ACI
+    :expectedresults:
+        1. Operation should success
+        2. Operation should success
+        3. Operation should success
+        4. Operation should Fail
+        5. Operation should success
+    """
+    ACI_TARGET = "(target = ldap:///{})(targetattr=*)".format(DEFAULT_SUFFIX)
+    ACI_ALLOW = '(version 3.0; acl "Name of the ACI"; deny absolute (all)'
+    ACI_SUBJECT = 'userdn!="ldap:///{}";)'.format(USER_ANANDA)
+    ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+    Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
+    conn = UserAccount(topo.standalone, USER_ANANDA).bind(PW_DM)
+    # aci will not block anything for USER_ANANDA , it block other users
+    assert  2 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=*)'))
+    conn = UserAccount(topo.standalone, USER_ANUJ).bind(PW_DM)
+    # aci will not block anything for USER_ANANDA , it block other users
+    assert 0 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=*)'))
+    # with root thers is no aci blockage
+    assert 2 == len(Accounts(topo.standalone, DEFAULT_SUFFIX).filter('(cn=*)'))
+
+
+def test_deny_all_access_with_userdn(topo, test_uer, aci_of_user):
+    """
+    Search Test 20 Deny all access with userdn
+    :id: 75aada86-6e12-11e8-bd34-8c16451d917b
+    :setup: Standalone Instance
+    :steps:
+        1. Add Entry
+        2. Add ACI
+        3. Bind with test USER_ANUJ
+        4. Try search
+        5. Delete Entry,test USER_ANUJ, ACI
+    :expectedresults:
+        1. Operation should success
+        2. Operation should success
+        3. Operation should success
+        4. Operation should Fail
+        5. Operation should success
+    """
+    ACI_TARGET = "(target = ldap:///{})(targetattr=*)".format(DEFAULT_SUFFIX)
+    ACI_ALLOW = '(version 3.0; acl "Name of the ACI"; deny absolute (all)'
+    ACI_SUBJECT = 'userdn="ldap:///{}";)'.format(USER_ANANDA)
+    ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+    Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
+    conn = UserAccount(topo.standalone, USER_ANANDA).bind(PW_DM)
+    # aci will block anything for USER_ANANDA , it not block other users
+    assert 0 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=*)'))
+    conn = UserAccount(topo.standalone, USER_ANUJ).bind(PW_DM)
+    # aci will block anything for USER_ANANDA , it not block other users
+    assert 2 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=*)'))
+    # with root thers is no aci blockage
+    assert 2 == len(Accounts(topo.standalone, DEFAULT_SUFFIX).filter('(cn=*)'))
+
+
+def test_deny_all_access_with_targetfilter_using_presence_search(
+    topo, test_uer, aci_of_user
+):
+    """
+    Search Test 21 Deny all access with targetfilter using presence search
+    :id: 85244a42-6e12-11e8-9480-8c16451d917b
+    :setup: Standalone Instance
+    :steps:
+        1. Add Entry
+        2. Add ACI
+        3. Bind with test USER_ANUJ
+        4. Try search
+        5. Delete Entry,test USER_ANUJ, ACI
+    :expectedresults:
+        1. Operation should success
+        2. Operation should success
+        3. Operation should success
+        4. Operation should Fail
+        5. Operation should success
+    """
+    user = UserAccounts(topo.standalone,  DEFAULT_SUFFIX).create_test_user()
+    user.set('userPassword', PW_DM)
+
+    ACI_TARGET = '(targetfilter ="(cn=*)")(target = ldap:///{})(targetattr=*)'.format(
+        DEFAULT_SUFFIX)
+    ACI_ALLOW = '(version 3.0; acl "Name of the ACI"; deny absolute (all)'
+    ACI_SUBJECT = 'userdn="ldap:///anyone";)'
+    ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+    Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
+    conn = UserAccount(topo.standalone, USER_ANANDA).bind(PW_DM)
+    # aci will eny_all_access_with_targetfilter_using_presence_search
+    user = UserAccount(conn, 'uid=test_user_1000,ou=People,{}'.format(DEFAULT_SUFFIX))
+    with pytest.raises(IndexError):
+        user.get_attr_val_utf8('cn')
+    # with root no blockage
+    assert UserAccount(topo.standalone, 'uid=test_user_1000,ou=People,{}'.format(DEFAULT_SUFFIX)).get_attr_val_utf8('cn') == 'test_user_1000'
+
+
+if __name__ == "__main__":
+    CURRENT_FILE = os.path.realpath(__file__)
+    pytest.main("-s -v %s" % CURRENT_FILE)
\ No newline at end of file
diff --git a/dirsrvtests/tests/suites/acl/search_real_part3_test.py b/dirsrvtests/tests/suites/acl/search_real_part3_test.py
new file mode 100644
index 0000000..c14b5bd
--- /dev/null
+++ b/dirsrvtests/tests/suites/acl/search_real_part3_test.py
@@ -0,0 +1,468 @@
+# --- BEGIN COPYRIGHT BLOCK ---
+# Copyright (C) 2019 Red Hat, Inc.
+# All rights reserved.
+#
+# License: GPL (version 3 or any later version).
+# See LICENSE for details.
+# --- END COPYRIGHT BLOCK ----
+
+import pytest, os, ldap
+from lib389._constants import DEFAULT_SUFFIX, PW_DM, ErrorLog
+from lib389.idm.user import UserAccount, UserAccounts
+from lib389.idm.organization import Organization
+from lib389.idm.account import Accounts, Anonymous
+from lib389.idm.group import Group, UniqueGroup
+from lib389.idm.organizationalunit import OrganizationalUnit
+from lib389.idm.group import Groups
+from lib389.topologies import topology_st as topo
+from lib389.idm.domain import Domain
+
+
+CONTAINER_1_DELADD = "ou=Product Development,{}".format(DEFAULT_SUFFIX)
+CONTAINER_2_DELADD = "ou=Accounting,{}".format(DEFAULT_SUFFIX)
+USER_ANUJ = "uid=Anuj Borah,{}".format(CONTAINER_1_DELADD)
+USER_ANANDA = "uid=Ananda Borah,{}".format(CONTAINER_2_DELADD)
+
+
+@pytest.fixture(scope="function")
+def aci_of_user(request, topo):
+    aci_list = Domain(topo.standalone, DEFAULT_SUFFIX).get_attr_vals('aci')
+
+    def finofaci():
+        domain = Domain(topo.standalone, DEFAULT_SUFFIX)
+        domain.set('aci', None)
+        for i in aci_list:
+            domain.add("aci", i)
+
+    request.addfinalizer(finofaci)
+    
+
+@pytest.fixture(scope="module")
+def test_uer(request, topo):
+    topo.standalone.config.loglevel((ErrorLog.ACL_SUMMARY,))
+
+    for i in ['Product Development', 'Accounting']:
+        OrganizationalUnit(topo.standalone, "ou={},{}".format(i, DEFAULT_SUFFIX)).create(properties={'ou': i})
+
+    users = UserAccounts(topo.standalone, DEFAULT_SUFFIX, rdn='ou=Product Development')
+    users.create(properties={
+        'uid': 'Anuj Borah',
+        'cn': 'Anuj Borah',
+        'sn': 'user',
+        'uidNumber': '1000',
+        'gidNumber': '2000',
+        'homeDirectory': '/home/' + 'AnujBorah',
+        'userPassword': PW_DM
+    })
+
+    users = UserAccounts(topo.standalone, DEFAULT_SUFFIX, rdn='ou=Accounting')
+    users.create(properties={
+        'uid': 'Ananda Borah',
+        'cn': 'Ananda Borah',
+        'sn': 'user',
+        'uidNumber': '1000',
+        'gidNumber': '2000',
+        'homeDirectory': '/home/' + 'AnandaBorah',
+        'userPassword': PW_DM
+    })
+
+
+def test_deny_search_access_to_userdn_with_ldap_url(topo, test_uer, aci_of_user):
+    """
+    Search Test 23 Deny search access to userdn with LDAP URL
+    :id: 94f082d8-6e12-11e8-be72-8c16451d917b
+    :setup: Standalone Instance
+    :steps:
+        1. Add Entry
+        2. Add ACI
+        3. Bind with test USER_ANUJ
+        4. Try search
+        5. Delete Entry,test USER_ANUJ, ACI
+    :expectedresults:
+        1. Operation should success
+        2. Operation should success
+        3. Operation should success
+        4. Operation should Fail
+        5. Operation should success
+    """
+    ACI_TARGET = "(target = ldap:///{})(targetattr=*)".format(DEFAULT_SUFFIX)
+    ACI_ALLOW = '(version 3.0; acl "Name of the ACI"; deny (search)'
+    ACI_SUBJECT = (
+        'userdn="ldap:///%s";)' % "{}??sub?(&(roomnumber=3445))".format(DEFAULT_SUFFIX)
+    )
+    ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+    Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
+    UserAccount(topo.standalone, USER_ANANDA).set('roomnumber', '3445')
+    conn = UserAccount(topo.standalone, USER_ANANDA).bind(PW_DM)
+    # aci will block all users having roomnumber=3445
+    assert 0 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=*)'))
+    conn = UserAccount(topo.standalone, USER_ANUJ).bind(PW_DM)
+    # aci will block roomnumber=3445 for all users USER_ANUJ does not have roomnumber
+    assert 2 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=*)'))
+    # with root there is no aci blockage
+    UserAccount(topo.standalone, USER_ANANDA).remove('roomnumber', '3445')
+
+
+def test_deny_search_access_to_userdn_with_ldap_url_two(topo, test_uer, aci_of_user):
+    """
+    Search Test 24 Deny search access to != userdn with LDAP URL
+    :id: a1ee05d2-6e12-11e8-8260-8c16451d917b
+    :setup: Standalone Instance
+    :steps:
+        1. Add Entry
+        2. Add ACI
+        3. Bind with test USER_ANUJ
+        4. Try search
+        5. Delete Entry,test USER_ANUJ, ACI
+    :expectedresults:
+        1. Operation should success
+        2. Operation should success
+        3. Operation should success
+        4. Operation should Fail
+        5. Operation should success
+    """
+    ACI_TARGET = "(target = ldap:///{})(targetattr=*)".format(DEFAULT_SUFFIX)
+    ACI_ALLOW = '(version 3.0; acl "Name of the ACI"; deny (search)'
+    ACI_SUBJECT = (
+        'userdn != "ldap:///%s";)' % "{}??sub?(&(roomnumber=3445))".format(DEFAULT_SUFFIX)
+    )
+    ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+    Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
+    UserAccount(topo.standalone, USER_ANANDA).set('roomnumber', '3445')
+    conn = UserAccount(topo.standalone, USER_ANANDA).bind(PW_DM)
+    # aci will not block all users having roomnumber=3445 , it will block others
+    assert 2 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=*)'))
+    conn = UserAccount(topo.standalone, USER_ANUJ).bind(PW_DM)
+    # aci will not block all users having roomnumber=3445 , it will block others
+    assert 0 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=*)'))
+    # with root there is no aci blockage
+    UserAccount(topo.standalone, USER_ANANDA).remove('roomnumber', '3445')
+
+
+def test_deny_search_access_to_userdn_with_ldap_url_matching_all_users(
+    topo, test_uer, aci_of_user
+):
+    """
+    Search Test 25 Deny search access to userdn with LDAP URL matching all users
+    :id: b37f72ae-6e12-11e8-9c98-8c16451d917b
+    :setup: Standalone Instance
+    :steps:
+        1. Add Entry
+        2. Add ACI
+        3. Bind with test USER_ANUJ
+        4. Try search
+        5. Delete Entry,test USER_ANUJ, ACI
+    :expectedresults:
+        1. Operation should success
+        2. Operation should success
+        3. Operation should success
+        4. Operation should Fail
+        5. Operation should success
+    """
+    ACI_TARGET = "(target = ldap:///{})(targetattr=*)".format(DEFAULT_SUFFIX)
+    ACI_ALLOW = '(version 3.0; acl "Name of the ACI"; deny (search)'
+    ACI_SUBJECT = 'userdn = "ldap:///%s";)' % "{}??sub?(&(cn=*))".format(DEFAULT_SUFFIX)
+    ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+    Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
+    conn = UserAccount(topo.standalone, USER_ANANDA).bind(PW_DM)
+    # aci will  block all users LDAP URL matching all users
+    assert 0 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=*)'))
+    conn = UserAccount(topo.standalone, USER_ANUJ).bind(PW_DM)
+    # aci will  block all users LDAP URL matching all users
+    assert 0 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=*)'))
+    # with root there is no aci blockage
+    assert 2 == len(Accounts(topo.standalone, DEFAULT_SUFFIX).filter('(cn=*)'))
+
+
+def test_deny_read_access_to_a_dynamic_group(topo, test_uer, aci_of_user):
+    """
+    Search Test 26 Deny read access to a dynamic group
+    :id: c0c5290e-6e12-11e8-a900-8c16451d917b
+    :setup: Standalone Instance
+    :steps:
+        1. Add Entry
+        2. Add ACI
+        3. Bind with test USER_ANUJ
+        4. Try search
+        5. Delete Entry,test USER_ANUJ, ACI
+    :expectedresults:
+        1. Operation should success
+        2. Operation should success
+        3. Operation should success
+        4. Operation should Fail
+        5. Operation should success
+    """
+    groups = Groups(topo.standalone, DEFAULT_SUFFIX)
+    group_properties = {"cn": "group1", "description": "testgroup"}
+    group = groups.create(properties=group_properties)
+    group.add('objectClass', 'groupOfURLS')
+    group.set('memberURL', "ldap:///{}??sub?(&(ou=Accounting)(cn=Sam*))".format(DEFAULT_SUFFIX))
+    group.add_member(USER_ANANDA)
+
+    ACI_TARGET = '(target = ldap:///{})(targetattr = "*")'.format(DEFAULT_SUFFIX)
+    ACI_ALLOW = '(version 3.0; acl "All rights for %s"; deny(read)' % "Unknown"
+    ACI_SUBJECT = 'groupdn = "ldap:///cn=group1,ou=Groups,{}";)'.format(DEFAULT_SUFFIX)
+    ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+    Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
+    conn = UserAccount(topo.standalone, USER_ANANDA).bind(PW_DM)
+    # aci will block all 'memberURL', "ldap:///{}??sub?(&(ou=Accounting)(cn=Sam*))".format(DEFAULT_SUFFIX)
+    assert 0 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=*)'))
+    conn = UserAccount(topo.standalone, USER_ANUJ).bind(PW_DM)
+    # USER_ANUJ is not a member
+    assert 2 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=*)'))
+    group.delete()
+
+
+def test_deny_read_access_to_dynamic_group_with_host_port_set_on_ldap_url(
+    topo, test_uer, aci_of_user
+):
+    """
+    Search Test 27 Deny read access to dynamic group with host:port set on LDAP URL
+    :id: ceb62158-6e12-11e8-8c36-8c16451d917b
+    :setup: Standalone Instance
+    :steps:
+        1. Add Entry
+        2. Add ACI
+        3. Bind with test USER_ANUJ
+        4. Try search
+        5. Delete Entry,test USER_ANUJ, ACI
+    :expectedresults:
+        1. Operation should success
+        2. Operation should success
+        3. Operation should success
+        4. Operation should Fail
+        5. Operation should success
+    """
+    groups = Groups(topo.standalone, DEFAULT_SUFFIX)
+    group = groups.create(properties={"cn": "group1",
+                                      "description": "testgroup"
+                                      })
+    group.add('objectClass', 'groupOfURLS')
+    group.set('memberURL', "ldap:///localhost:38901/{}??sub?(&(ou=Accounting)(cn=Sam*))".format(DEFAULT_SUFFIX))
+    group.add_member(USER_ANANDA)
+
+    ACI_TARGET = '(target = ldap:///{})(targetattr = "*")'.format(DEFAULT_SUFFIX)
+    ACI_ALLOW = '(version 3.0; acl "All rights for %s"; deny(read)' % "Unknown"
+    ACI_SUBJECT = 'groupdn = "ldap:///cn=group1,ou=Groups,{}";)'.format(DEFAULT_SUFFIX)
+    ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+    Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
+    conn = UserAccount(topo.standalone, USER_ANANDA).bind(PW_DM)
+    # aci will block 'memberURL', "ldap:///localhost:38901/dc=example,dc=com??sub?(&(ou=Accounting)(cn=Sam*))"
+    assert 0 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=*)'))
+    # with root there is no aci blockage
+    assert 2 == len(Accounts(topo.standalone, DEFAULT_SUFFIX).filter('(cn=*)'))
+    group.delete()
+
+
+def test_deny_read_access_to_dynamic_group_with_scope_set_to_one_in_ldap_url(
+    topo, test_uer, aci_of_user
+):
+    """
+    Search Test 28 Deny read access to dynamic group with scope set to "one" in LDAP URL
+    :id: ddb30432-6e12-11e8-94db-8c16451d917b
+    :setup: Standalone Instance
+    :steps:
+        1. Add Entry
+        2. Add ACI
+        3. Bind with test USER_ANUJ
+        4. Try search
+        5. Delete Entry,test USER_ANUJ, ACI
+    :expectedresults:
+        1. Operation should success
+        2. Operation should success
+        3. Operation should success
+        4. Operation should Fail
+        5. Operation should success
+    """
+    groups = Groups(topo.standalone, DEFAULT_SUFFIX)
+    group = groups.create(properties={"cn": "group1",
+                                      "description": "testgroup"
+                                      })
+    group.add('objectClass', 'groupOfURLS')
+    group.set('memberURL', "ldap:///{}??sub?(&(ou=Accounting)(cn=Sam*))".format(DEFAULT_SUFFIX))
+    group.add_member(USER_ANANDA)
+
+    ACI_TARGET = '(targetattr = "*")'
+    ACI_ALLOW = '(version 3.0; acl "All rights for %s"; deny(read) ' % "Unknown"
+    ACI_SUBJECT = 'groupdn != "ldap:///cn=group1,ou=Groups,{}";)'.format(DEFAULT_SUFFIX)
+    ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+    Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
+    conn = UserAccount(topo.standalone, USER_ANANDA).bind(PW_DM)
+    # aci will allow only 'memberURL', "ldap:///{dc=example,dc=com??sub?(&(ou=Accounting)(cn=Sam*))"
+    assert 2 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=*)'))
+    conn = UserAccount(topo.standalone, USER_ANUJ).bind(PW_DM)
+    # aci will allow only 'memberURL', "ldap:///{dc=example,dc=com??sub?(&(ou=Accounting)(cn=Sam*))"
+    assert 0 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=*)'))
+    group.delete()
+
+
+def test_deny_read_access_to_dynamic_group_two(topo, test_uer, aci_of_user):
+    """
+    Search Test 29 Deny read access to != dynamic group
+    :id: eae2a6c6-6e12-11e8-80f3-8c16451d917b
+    :setup: Standalone Instance
+    :steps:
+        1. Add Entry
+        2. Add ACI
+        3. Bind with test USER_ANUJ
+        4. Try search
+        5. Delete Entry,test USER_ANUJ, ACI
+    :expectedresults:
+        1. Operation should success
+        2. Operation should success
+        3. Operation should success
+        4. Operation should Fail
+        5. Operation should success
+    """
+    groups = Groups(topo.standalone, DEFAULT_SUFFIX)
+    group_properties = {"cn": "group1",
+                        "description": "testgroup"
+                        }
+    group = groups.create(properties=group_properties)
+    group.add('objectClass', 'groupofuniquenames')
+    group.set('uniquemember', [USER_ANANDA,USER_ANUJ])
+
+    ACI_TARGET = '(targetattr = "*")'
+    ACI_ALLOW = '(version 3.0; acl "All rights for %s"; deny(read) ' % "Unknown"
+    ACI_SUBJECT = 'groupdn = "ldap:///cn=group1,ou=Groups,{}";)'.format(DEFAULT_SUFFIX)
+    ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+    Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
+    conn = UserAccount(topo.standalone, USER_ANANDA).bind(PW_DM)
+    # aci will block groupdn = "ldap:///cn=group1,ou=Groups,dc=example,dc=com";)
+    assert 0 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=*)'))
+    conn = UserAccount(topo.standalone, USER_ANUJ).bind(PW_DM)
+    # aci will block groupdn = "ldap:///cn=group1,ou=Groups,dc=example,dc=com";)
+    assert 0 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=*)'))
+    # with root there is no aci blockage
+    assert 2 == len(Accounts(topo.standalone, DEFAULT_SUFFIX).filter('(cn=*)'))
+    group.delete()
+
+
+def test_deny_access_to_group_should_deny_access_to_all_uniquemember(
+    topo, test_uer, aci_of_user
+):
+    """
+    Search Test 38 Deny access to group should deny access to all uniquemember (including chain group)
+    :id: 56b470e4-7941-11e8-912b-8c16451d917b
+    :setup: Standalone Instance
+    :steps:
+        1. Add Entry
+        2. Add ACI
+        3. Bind with test USER_ANUJ
+        4. Try search
+        5. Delete Entry,test USER_ANUJ, ACI
+    :expectedresults:
+        1. Operation should success
+        2. Operation should success
+        3. Operation should success
+        4. Operation should Fail
+        5. Operation should success
+    """
+
+    grp = UniqueGroup(topo.standalone, 'cn=Nested Group 1,' + DEFAULT_SUFFIX)
+    grp.create(properties={
+        'cn': 'Nested Group 1',
+        'ou': 'groups',
+        'uniquemember': "cn=Nested Group 2, {}".format(DEFAULT_SUFFIX)
+    })
+
+    grp = UniqueGroup(topo.standalone, 'cn=Nested Group 2,' + DEFAULT_SUFFIX)
+    grp.create(properties={
+        'cn': 'Nested Group 2',
+        'ou': 'groups',
+        'uniquemember': "cn=Nested Group 3, {}".format(DEFAULT_SUFFIX)
+    })
+
+    grp = UniqueGroup(topo.standalone, 'cn=Nested Group 3,' + DEFAULT_SUFFIX)
+    grp.create(properties={
+        'cn': 'Nested Group 3',
+        'ou': 'groups',
+        'uniquemember': [USER_ANANDA, USER_ANUJ]
+    })
+
+    Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", '(target = ldap:///{})(targetattr=*)'
+    '(version 3.0; acl "$tet_thistest"; deny(read)(groupdn = "ldap:///cn=Nested Group 1, {}"); )'.format(DEFAULT_SUFFIX, DEFAULT_SUFFIX))
+    conn = UserAccount(topo.standalone, USER_ANANDA).bind(PW_DM)
+    # deny_access_to_group_should_deny_access_to_all_uniquemember
+    assert 0 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=*)'))
+    conn = UserAccount(topo.standalone, USER_ANUJ).bind(PW_DM)
+    # deny_access_to_group_should_deny_access_to_all_uniquemember
+    assert 0 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=*)'))
+    # with root there is no aci blockage
+    assert 2 == len(Accounts(topo.standalone, DEFAULT_SUFFIX).filter('(cn=*)'))
+
+
+def test_entry_with_lots_100_attributes(topo, test_uer, aci_of_user):
+    """
+    Search Test 39 entry with lots (>100) attributes
+    :id: fc155f74-6e12-11e8-96ac-8c16451d917b
+    :setup: Standalone Instance
+    :steps:
+        1. Add Entry
+        2. Bind with test USER_ANUJ
+        3. Try search
+        4. Delete Entry,test USER_ANUJ, ACI
+    :expectedresults:
+        1. Operation should success
+        3. Operation should success
+        4. Operation should success
+        5. Operation should success
+    """
+    for i in range(100):
+        user = UserAccounts(topo.standalone, DEFAULT_SUFFIX, rdn='ou=People').create_test_user(uid=i)
+        user.set("userPassword", "password")
+
+    conn = UserAccount(topo.standalone, "uid=test_user_1,ou=People,{}".format(DEFAULT_SUFFIX)).bind(PW_DM)
+    # no aci no blockage
+    assert 1 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=Anuj*)'))
+    # no aci no blockage
+    assert 102 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(uid=*)'))
+    conn = Anonymous(topo.standalone).bind()
+    # anonymous_search_on_monitor_entry
+    assert 102 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(uid=*)'))
+
+
+@pytest.mark.bz301798
+def test_groupdnattr_value_is_another_group(topo):
+    """
+    Search Test 42 groupdnattr value is another group test #1
+    :id: 52299e16-7944-11e8-b471-8c16451d917b
+    :setup: server
+    :steps:
+        1. Add test entry
+        2. Add ACI
+        3. USER_ANUJ should follow ACI role
+    :expectedresults:
+        1. Entry should be added
+        2. Operation should  succeed
+        3. Operation should  succeed
+    """
+    Organization(topo.standalone).create(properties={"o": "nscpRoot"}, basedn=DEFAULT_SUFFIX)
+
+    user = UserAccount(topo.standalone, "cn=dchan,o=nscpRoot,{}".format(DEFAULT_SUFFIX))
+    user.create(properties={
+        'uid': 'dchan',
+        'cn': 'dchan',
+        'sn': 'user',
+        'uidNumber': '1000',
+        'gidNumber': '2000',
+        'homeDirectory': '/home/' + 'dchan',
+        'userPassword': PW_DM
+    })
+
+    grp = UniqueGroup(topo.standalone, 'cn=groupx,o=nscpRoot,' + DEFAULT_SUFFIX)
+    grp.create(properties={
+        'cn': 'groupx',
+        'ou': 'groups',
+    })
+    grp.set('uniquemember', 'cn=dchan,o=nscpRoot,{}'.format(DEFAULT_SUFFIX))
+    grp.set('aci', '(targetattr="*")(version 3.0; acl "Enable Group Expansion"; allow (read, search, compare) groupdnattr="ldap:///o=nscpRoot?uniquemember?sub";)')
+
+    conn = UserAccount(topo.standalone, 'cn=dchan,o=nscpRoot,{}'.format(DEFAULT_SUFFIX),).bind(PW_DM)
+    # acil will allow ldap:///o=nscpRoot?uniquemember?sub"
+    assert UserAccount(conn, 'cn=groupx,o=nscpRoot,{}'.format(DEFAULT_SUFFIX)).get_attr_val_utf8('cn') == 'groupx'
+
+
+if __name__ == "__main__":
+    CURRENT_FILE = os.path.realpath(__file__)
+    pytest.main("-s -v %s" % CURRENT_FILE)
\ No newline at end of file
diff --git a/dirsrvtests/tests/suites/acl/search_real_test.py b/dirsrvtests/tests/suites/acl/search_real_test.py
new file mode 100644
index 0000000..f12d14a
--- /dev/null
+++ b/dirsrvtests/tests/suites/acl/search_real_test.py
@@ -0,0 +1,409 @@
+# --- BEGIN COPYRIGHT BLOCK ---
+# Copyright (C) 2019 Red Hat, Inc.
+# All rights reserved.
+#
+# License: GPL (version 3 or any later version).
+# See LICENSE for details.
+# --- END COPYRIGHT BLOCK ----
+
+import pytest, os, ldap
+from lib389._constants import DEFAULT_SUFFIX, PW_DM, ErrorLog
+from lib389.idm.user import UserAccount, UserAccounts
+from lib389.idm.account import Accounts
+from lib389.idm.organizationalunit import OrganizationalUnit
+from lib389.idm.group import Groups
+from lib389.topologies import topology_st as topo
+from lib389.idm.domain import Domain
+from lib389.idm.posixgroup import PosixGroups
+
+
+CONTAINER_1_DELADD = "ou=Product Development,{}".format(DEFAULT_SUFFIX)
+CONTAINER_2_DELADD = "ou=Accounting,{}".format(DEFAULT_SUFFIX)
+USER_ANUJ = "uid=Anuj Borah,{}".format(CONTAINER_1_DELADD)
+USER_ANANDA = "uid=Ananda Borah,{}".format(CONTAINER_2_DELADD)
+
+
+@pytest.fixture(scope="function")
+def aci_of_user(request, topo):
+    aci_list = Domain(topo.standalone, DEFAULT_SUFFIX).get_attr_vals('aci')
+
+    def finofaci():
+        domain = Domain(topo.standalone, DEFAULT_SUFFIX)
+        domain.set('aci', None)
+        for i in aci_list:
+            domain.add("aci", i)
+
+    request.addfinalizer(finofaci)
+
+
+@pytest.fixture(scope="module")
+def test_uer(request, topo):
+    topo.standalone.config.loglevel((ErrorLog.ACL_SUMMARY,))
+
+    for i in ['Product Development', 'Accounting']:
+        OrganizationalUnit(topo.standalone, "ou={},{}".format(i, DEFAULT_SUFFIX)).create(properties={'ou': i})
+
+    users = UserAccounts(topo.standalone, DEFAULT_SUFFIX, rdn='ou=Product Development')
+    users.create(properties={
+        'uid': 'Anuj Borah',
+        'cn': 'Anuj Borah',
+        'sn': 'user',
+        'uidNumber': '1000',
+        'gidNumber': '2000',
+        'homeDirectory': '/home/' + 'AnujBorah',
+        'userPassword': PW_DM
+    })
+
+    users = UserAccounts(topo.standalone, DEFAULT_SUFFIX, rdn='ou=Accounting')
+    users.create(properties={
+        'uid': 'Ananda Borah',
+        'cn': 'Ananda Borah',
+        'sn': 'user',
+        'uidNumber': '1000',
+        'gidNumber': '2000',
+        'homeDirectory': '/home/' + 'AnandaBorah',
+        'userPassword': PW_DM
+    })
+
+
+def test_deny_all_access_with_target_set(topo, test_uer, aci_of_user):
+    """Test that Deny all access with target set
+    :id: 0550e680-6e0e-11e8-82f4-8c16451d917b
+    :setup: Standalone Instance
+    :steps:
+        1. Add Entry
+        2. Add ACI
+        3. Bind with test USER_ANUJ
+        4. Try search
+        5. Delete Entry,test USER_ANUJ, ACI
+    :expectedresults:
+        1. Operation should success
+        2. Operation should success
+        3. Operation should success
+        4. Operation should Fail
+        5. Operation should success
+    """
+    ACI_TARGET = "(target = ldap:///{})(targetattr=*)".format(USER_ANANDA)
+    ACI_ALLOW = '(version 3.0; acl "Name of the ACI"; deny absolute (all)'
+    ACI_SUBJECT = 'userdn="ldap:///anyone";)'
+    ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+    Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
+    conn = UserAccount(topo.standalone, USER_ANANDA).bind(PW_DM)
+    # aci will block all for all usrs
+    assert 0 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=Ananda*)'))
+    conn = UserAccount(topo.standalone, USER_ANUJ).bind(PW_DM)
+    # aci will block all for all usrs
+    assert 0 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=Ananda*)'))
+    # with root there is no aci blockage
+    assert 1 == len(Accounts(topo.standalone, DEFAULT_SUFFIX).filter('(cn=Ananda*)'))
+
+
+def test_deny_all_access_to_a_target_with_wild_card(topo, test_uer, aci_of_user):
+    """Search Test 2 Deny all access to a target with wild card
+    :id: 1c370f98-6e11-11e8-9f10-8c16451d917b
+    :setup: Standalone Instance
+    :steps:
+        1. Add Entry
+        2. Add ACI
+        3. Bind with test USER_ANUJ
+        4. Try search
+        5. Delete Entry,test USER_ANUJ, ACI
+    :expectedresults:
+        1. Operation should success
+        2. Operation should success
+        3. Operation should success
+        4. Operation should Fail
+        5. Operation should success
+    """
+    ACI_TARGET = "(target = ldap:///uid=Ananda*, ou=*,{})(targetattr=*)".format(
+        DEFAULT_SUFFIX
+    )
+    ACI_ALLOW = '(version 3.0; acl "Name of the ACI"; deny absolute (all)'
+    ACI_SUBJECT = 'userdn="ldap:///anyone";)'
+    ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+    Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
+    conn = UserAccount(topo.standalone, USER_ANANDA).bind(PW_DM)
+    # aci will block (cn=Sam*) for all usrs
+    assert 0 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=Ananda*)'))
+    conn = UserAccount(topo.standalone, USER_ANUJ).bind(PW_DM)
+    # aci will block (cn=Sam*) for all usrs
+    assert 0 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=Ananda*)'))
+    # with root there is no aci blockage
+    assert 1 == len(Accounts(topo.standalone, DEFAULT_SUFFIX).filter('(cn=Ananda*)'))
+
+
+def test_deny_all_access_without_a_target_set(topo, test_uer, aci_of_user):
+    """Search Test 3 Deny all access without a target set
+    :id: 2dbeb36a-6e11-11e8-ab9f-8c16451d917b
+    :setup: Standalone Instance
+    :steps:
+        1. Add Entry
+        2. Add ACI
+        3. Bind with test USER_ANUJ
+        4. Try search
+        5. Delete Entry,test USER_ANUJ, ACI
+    :expectedresults:
+        1. Operation should success
+        2. Operation should success
+        3. Operation should success
+        4. Operation should Fail
+        5. Operation should success
+    """
+    ACI_TARGET = "(targetattr=*)"
+    ACI_ALLOW = '(version 3.0; acl "Name of the ACI"; deny absolute (all)'
+    ACI_SUBJECT = 'userdn="ldap:///anyone";)'
+    ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+    Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
+    conn = UserAccount(topo.standalone, USER_ANANDA).bind(PW_DM)
+    # aci will block all for all usrs
+    assert 0 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(ou=Accounting)'))
+    conn = UserAccount(topo.standalone, USER_ANUJ).bind(PW_DM)
+    # aci will block all for all usrs
+    assert 0 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(ou=Accounting)'))
+    # with root there is no aci blockage
+    assert 1 == len(Accounts(topo.standalone, DEFAULT_SUFFIX).filter('(ou=Accounting)'))
+
+
+def test_deny_read_search_and_compare_access_with_target_and_targetattr_set(
+    topo, test_uer, aci_of_user
+):
+    """Search Test 4 Deny read, search and compare access with target and targetattr set
+    :id: 3f4a87e4-6e11-11e8-a09f-8c16451d917b
+    :setup: Standalone Instance
+    :steps:
+        1. Add Entry
+        2. Add ACI
+        3. Bind with test USER_ANUJ
+        4. Try search
+        5. Delete Entry,test USER_ANUJ, ACI
+    :expectedresults:
+        1. Operation should success
+        2. Operation should success
+        3. Operation should success
+        4. Operation should Fail
+        5. Operation should success
+    """
+    ACI_TARGET = "(target = ldap:///{})(targetattr=*)".format(CONTAINER_2_DELADD)
+    ACI_ALLOW = '(version 3.0; acl "Name of the ACI"; deny absolute (all)'
+    ACI_SUBJECT = 'userdn="ldap:///anyone";)'
+    ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+    Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
+    conn = UserAccount(topo.standalone, USER_ANANDA).bind(PW_DM)
+    # aci will block all for all usrs
+    assert 0 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(ou=Accounting)'))
+    conn = UserAccount(topo.standalone, USER_ANUJ).bind(PW_DM)
+    # aci will block all for all usrs
+    assert 0 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(ou=Accounting)'))
+    # with root there is no aci blockage
+    assert 1 == len(Accounts(topo.standalone, DEFAULT_SUFFIX).filter('(ou=Accounting)'))
+
+
+def test_deny_read_access_to_multiple_groupdns(topo, test_uer, aci_of_user):
+    """Search Test 6 Deny read access to multiple groupdn's
+    :id: 8f3ba440-6e11-11e8-8b20-8c16451d917b
+    :setup: Standalone Instance
+    :steps:
+        1. Add Entry
+        2. Add ACI
+        3. Bind with test USER_ANUJ
+        4. Try search
+        5. Delete Entry,test USER_ANUJ, ACI
+    :expectedresults:
+        1. Operation should success
+        2. Operation should success
+        3. Operation should success
+        4. Operation should Fail
+        5. Operation should success
+    """
+    groups = Groups(topo.standalone, DEFAULT_SUFFIX)
+    group = groups.create(properties={"cn": "group1",
+                                      "description": "testgroup"
+                                      })
+    group.add_member(USER_ANANDA)
+
+    posix_groups = PosixGroups(topo.standalone, DEFAULT_SUFFIX)
+    posix_group = posix_groups.create(properties={
+        "cn": "group2",
+        "description": "testgroup2",
+        "gidNumber": "2000",
+    })
+    posix_group.add_member(USER_ANUJ)
+
+    ACI_TARGET = '(targetattr="*")'
+    ACI_ALLOW = '(version 3.0; acl "All rights for cn=group1,ou=Groups,{}"; deny(read)'.format(DEFAULT_SUFFIX)
+    ACI_SUBJECT = 'groupdn="ldap:///cn=group1,ou=Groups,{}||ldap:///cn=group2,ou=Groups,{}";)'.format(DEFAULT_SUFFIX, DEFAULT_SUFFIX)
+    ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+    Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
+    conn = UserAccount(topo.standalone, USER_ANANDA).bind(PW_DM)
+    # aci will block 'groupdn="ldap:///cn=group1,ou=Groups,dc=example,dc=com||ldap:///cn=group2,ou=Groups,dc=example,dc=com";)
+    assert 0 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=*)'))
+    conn = UserAccount(topo.standalone, USER_ANUJ).bind(PW_DM)
+    # aci will block 'groupdn="ldap:///cn=group1,ou=Groups,dc=example,dc=com||ldap:///cn=group2,ou=Groups,dc=example,dc=com";)
+    assert 0 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=*)'))
+    # with root there is no aci blockage
+    assert 3 == len(Accounts(topo.standalone, DEFAULT_SUFFIX).filter('(cn=*)'))
+    group = groups.get("group1")
+    group.delete()
+    posix_groups.get("group2")
+    posix_group.delete()
+
+
+def test_deny_all_access_to_userdnattr(topo, test_uer, aci_of_user):
+    """Search Test 7 Deny all access to userdnattr"
+    :id: ae482494-6e11-11e8-ae33-8c16451d917b
+    :setup: Standalone Instance
+    :steps:
+        1. Add Entry
+        2. Add ACI
+        3. Bind with test USER_ANUJ
+        4. Try search
+        5. Delete Entry,test USER_ANUJ, ACI
+    :expectedresults:
+        1. Operation should success
+        2. Operation should success
+        3. Operation should success
+        4. Operation should Fail
+        5. Operation should success
+    """
+    UserAccount(topo.standalone, USER_ANUJ).add('manager', USER_ANANDA)
+    ACI_TARGET = "(target = ldap:///{})(targetattr=*)".format(DEFAULT_SUFFIX)
+    ACI_ALLOW = '(version 3.0; acl "Name of the ACI"; deny absolute (all)'
+    ACI_SUBJECT = 'userdnattr="manager";)'
+    ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+    Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
+    conn = UserAccount(topo.standalone, USER_ANANDA).bind(PW_DM)
+    # aci will block only 'userdnattr="manager"
+    assert 0 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=Anuj Borah)'))
+    conn = UserAccount(topo.standalone, USER_ANUJ).bind(PW_DM)
+    # aci will block only 'userdnattr="manager"
+    assert 1 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=Anuj Borah)'))
+    # with root there is no aci blockage
+    assert 1 == len(Accounts(topo.standalone, DEFAULT_SUFFIX).filter('(cn=Anuj Borah)'))
+    UserAccount(topo.standalone, USER_ANUJ).remove('manager', USER_ANANDA)
+
+
+def test_deny_all_access_with__target_set(topo, test_uer, aci_of_user):
+    """Search Test 8 Deny all access with != target set
+    :id: bc00aed0-6e11-11e8-be66-8c16451d917b
+    :setup: Standalone Instance
+    :steps:
+        1. Add Entry
+        2. Add ACI
+        3. Bind with test USER_ANUJ
+        4. Try search
+        5. Delete Entry,test USER_ANUJ, ACI
+    :expectedresults:
+        1. Operation should success
+        2. Operation should success
+        3. Operation should success
+        4. Operation should Fail
+        5. Operation should success
+    """
+    Domain(topo.standalone, DEFAULT_SUFFIX).add("aci",'(target != "ldap:///{}")(targetattr = "*")'
+    '(version 3.0; acl "$tet_thistest"; deny absolute (all) (userdn = "ldap:///anyone") ;)'.format(USER_ANANDA))
+    conn = UserAccount(topo.standalone, USER_ANANDA).bind(PW_DM)
+    # aci will not block USER_ANANDA will block others
+    assert 1 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=*)'))
+    conn = UserAccount(topo.standalone, USER_ANUJ).bind(PW_DM)
+    # aci will not block USER_ANANDA will block others
+    assert 1 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=*)'))
+    # with root there is no aci blockage
+    assert 2 == len(Accounts(topo.standalone, DEFAULT_SUFFIX).filter('(cn=*)'))
+
+
+def test_deny_all_access_with__targetattr_set(topo, test_uer, aci_of_user):
+    """Search Test 9 Deny all access with != targetattr set
+    :id: d2d73b2e-6e11-11e8-ad3d-8c16451d917b
+    :setup: Standalone Instance
+    :steps:
+        1. Add Entry
+        2. Add ACI
+        3. Bind with test USER_ANUJ
+        4. Try search
+        5. Delete Entry,test USER_ANUJ, ACI
+    :expectedresults:
+        1. Operation should success
+        2. Operation should success
+        3. Operation should success
+        4. Operation should Fail
+        5. Operation should success
+    """
+    testusers = UserAccounts(topo.standalone, DEFAULT_SUFFIX)
+    user = testusers.create(properties={
+        'uid': 'Anuj',
+        'cn': 'Anuj',
+        'sn': 'user',
+        'uidNumber': '1000',
+        'gidNumber': '2000',
+        'homeDirectory': '/home/' + 'Anuj',
+        'userPassword': PW_DM
+    })
+
+    ACI_TARGET = "(targetattr != uid||Objectclass)"
+    ACI_ALLOW = '(version 3.0; acl "Name of the ACI"; deny absolute (all)'
+    ACI_SUBJECT = 'userdn="ldap:///anyone";)'
+    ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+    Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
+    conn = UserAccount(topo.standalone, USER_ANANDA).bind(PW_DM)
+    # aci will allow only uid=*
+    assert 3 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(uid=*)'))
+    # aci will allow only uid=*
+    assert 0 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=*)'))
+    conn = UserAccount(topo.standalone, USER_ANUJ).bind(PW_DM)
+    # aci will allow only uid=*
+    assert 3 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(uid=*)'))
+    # aci will allow only uid=*
+    assert 0 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(cn=*)'))
+    # with root there is no aci blockage
+    assert 3 == len(Accounts(topo.standalone, DEFAULT_SUFFIX).filter('(uid=*)'))
+    # with root there is no aci blockage
+    assert 3 == len(Accounts(topo.standalone, DEFAULT_SUFFIX).filter('(cn=*)'))
+    user.delete()
+
+
+def test_deny_all_access_with_targetattr_set(topo, test_uer, aci_of_user):
+    """Search Test 10 Deny all access with targetattr set
+    :id: e1602ff2-6e11-11e8-8e55-8c16451d917b
+    :setup: Standalone Instance
+    :steps:
+        1. Add Entry
+        2. Add ACI
+        3. Bind with test USER_ANUJ
+        4. Try search
+        5. Delete Entry,test USER_ANUJ, ACI
+    :expectedresults:
+        1. Operation should success
+        2. Operation should success
+        3. Operation should success
+        4. Operation should Fail
+        5. Operation should success
+    """
+    testuser = UserAccount(topo.standalone, "cn=Anuj12,ou=People,{}".format(DEFAULT_SUFFIX))
+    testuser.create(properties={
+        'uid': 'Anuj12',
+        'cn': 'Anuj12',
+        'sn': 'user',
+        'uidNumber': '1000',
+        'gidNumber': '2000',
+        'homeDirectory': '/home/' + 'Anuj12'
+    })
+
+    ACI_TARGET = "(targetattr = uid)"
+    ACI_ALLOW = '(version 3.0; acl "Name of the ACI"; deny absolute (all)'
+    ACI_SUBJECT = 'userdn="ldap:///anyone";)'
+    ACI_BODY = ACI_TARGET + ACI_ALLOW + ACI_SUBJECT
+    Domain(topo.standalone, DEFAULT_SUFFIX).add("aci", ACI_BODY)
+    conn = UserAccount(topo.standalone, USER_ANANDA).bind(PW_DM)
+    # aci will block only uid=*
+    assert 0 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(uid=*)'))
+    conn = UserAccount(topo.standalone, USER_ANUJ).bind(PW_DM)
+    # aci will block only uid=*
+    assert 0 == len(Accounts(conn, DEFAULT_SUFFIX).filter('(uid=*)'))
+    # with root there is no aci blockage
+    assert 3 == len(Accounts(topo.standalone, DEFAULT_SUFFIX).filter('(uid=*)'))
+    testuser.delete()
+
+
+if __name__ == "__main__":
+    CURRENT_FILE = os.path.realpath(__file__)
+    pytest.main("-s -v %s" % CURRENT_FILE)

