test006-acl revision 1.1
1 #! /bin/sh 2 ## $OpenLDAP$ 3 ## This work is part of OpenLDAP Software <http://www.openldap.org/>. 4 ## 5 ## Copyright 2016-2021 The OpenLDAP Foundation. 6 ## All rights reserved. 7 ## 8 ## Redistribution and use in source and binary forms, with or without 9 ## modification, are permitted only as authorized by the OpenLDAP 10 ## Public License. 11 ## 12 ## A copy of this license is available in the file LICENSE in the 13 ## top-level directory of the distribution or, alternatively, at 14 ## <http://www.OpenLDAP.org/license.html>. 15 ## 16 ## ACKNOWLEDGEMENTS: 17 ## This module was written in 2016 by Ondej Kuznk for Symas Corp. 18 19 case "$BACKEND" in ldif | null) 20 echo "$BACKEND backend does not support access controls, test skipped" 21 exit 0 22 esac 23 24 echo "running defines.sh" 25 . $SRCDIR/scripts/defines.sh 26 27 CONF=$ACLCONF 28 . ${SCRIPTDIR}/common.sh 29 30 echo "Applying test-specific configuration..." 31 . $CONFFILTER $BACKEND $MONITORDB < data/test006-config.ldif | \ 32 $LDAPMODIFY -v -D cn=config -H $URI1 -y $CONFIGPWF \ 33 >> $TESTOUT 2>&1 34 RC=$? 35 if test $RC != 0 ; then 36 echo "ldapmodify failed ($RC)!" 37 test $KILLSERVERS != no && kill -HUP $KILLPIDS 38 exit $RC 39 fi 40 41 $LDAPMODIFY -D "$MANAGERDN" -H $URI1 -w $PASSWD >> \ 42 $TESTOUT 2>&1 << EOMODS 43 dn: ou=Add & Delete,dc=example,dc=com 44 changetype: add 45 objectClass: organizationalUnit 46 ou: Add & Delete 47 48 dn: cn=group,ou=Add & Delete,dc=example,dc=com 49 changetype: add 50 objectclass: groupOfNames 51 member: dc=example,dc=com 52 53 dn: sn=Doe,ou=Add & Delete,dc=example,dc=com 54 changetype: add 55 objectclass: OpenLDAPperson 56 cn: John 57 uid: jd 58 59 dn: sn=Elliot,ou=Add & Delete,dc=example,dc=com 60 changetype: add 61 objectclass: OpenLDAPperson 62 cn: Mark 63 uid: me 64 EOMODS 65 RC=$? 66 if test $RC != 0 ; then 67 echo "ldapmodify failed ($RC)!" 68 test $KILLSERVERS != no && kill -HUP $KILLPIDS 69 exit $RC 70 fi 71 72 echo "Testing search ACL processing..." 73 74 echo "# Try to read an entry inside the Alumni Association container. 75 # It should give us noSuchObject if we're not bound..." \ 76 >> $SEARCHOUT 77 # FIXME: temporarily remove the "No such object" message to make 78 # the test succeed even if SLAP_ACL_HONOR_DISCLOSE is not #define'd 79 $LDAPSEARCH -b "$MELLIOTDN" -H $URI1 "(objectclass=*)" \ 80 2>&1 | grep -v "No such object" >> $SEARCHOUT 81 82 echo >>$SEARCHOUT 83 echo "# ... and should return appropriate attributes if we're bound as anyone 84 # under Example." \ 85 >> $SEARCHOUT 86 $LDAPSEARCH -b "$MELLIOTDN" -H $URI1 \ 87 -D "$BABSDN" -w bjensen "(objectclass=*)" >> $SEARCHOUT 2>&1 88 89 $LDAPSEARCH -b "$MELLIOTDN" -H $URI1 \ 90 -D "$BJORNSDN" -w bjorn "(objectclass=*)" >> $SEARCHOUT 2>&1 91 92 echo >>$SEARCHOUT 93 echo "# Add & Delete subtree contents as seen by Babs" >> $SEARCHOUT 94 $LDAPSEARCH -b "ou=Add & Delete,dc=example,dc=com" -H $URI1 \ 95 -D "$BABSDN" -w bjensen "(objectclass=*)" >> $SEARCHOUT 2>&1 96 97 echo >>$SEARCHOUT 98 echo "# Add & Delete subtree contents as seen by Bjorn" >> $SEARCHOUT 99 $LDAPSEARCH -b "ou=Add & Delete,dc=example,dc=com" -H $URI1 \ 100 -D "$BJORNSDN" -w bjorn "(objectclass=*)" >> $SEARCHOUT 2>&1 101 102 echo "Testing modifications..." 103 echo "... ACL on the alternative entry" 104 $LDAPMODIFY -D "$BJORNSDN" -H $URI1 -w bjorn >> \ 105 $TESTOUT 2>&1 << EOMODS 106 dn: cn=group,ou=Add & Delete,dc=example,dc=com 107 changetype: modify 108 add: seealso 109 seealso: $BJORNSDN 110 EOMODS 111 RC=$? 112 if test $RC != 0 ; then 113 echo "ldapmodify failed ($RC)!" 114 test $KILLSERVERS != no && kill -HUP $KILLPIDS 115 exit $RC 116 fi 117 118 $LDAPMODIFY -D "$BABSDN" -H $URI1 -w bjensen >> \ 119 $TESTOUT 2>&1 << EOMODS 120 dn: cn=Alumni Assoc Staff, ou=Groups, dc=example, dc=com 121 changetype: modify 122 add: description 123 description: added by bjensen (should fail) 124 EOMODS 125 RC=$? 126 case $RC in 127 50) 128 ;; 129 0) 130 echo "ldapmodify should have failed ($RC)!" 131 test $KILLSERVERS != no && kill -HUP $KILLPIDS 132 exit -1 133 ;; 134 *) 135 echo "ldapmodify failed ($RC)!" 136 test $KILLSERVERS != no && kill -HUP $KILLPIDS 137 exit $RC 138 ;; 139 esac 140 141 $LDAPMODIFY -D "$MANAGERDN" -H $URI1 -w $PASSWD >> \ 142 $TESTOUT 2>&1 << EOMODS 143 dn: cn=group,ou=Add & Delete,dc=example,dc=com 144 changetype: modify 145 add: seealso 146 seealso: $BABSDN 147 EOMODS 148 RC=$? 149 if test $RC != 0 ; then 150 echo "ldapmodify failed ($RC)!" 151 test $KILLSERVERS != no && kill -HUP $KILLPIDS 152 exit $RC 153 fi 154 155 $LDAPMODIFY -D "$BJORNSDN" -H $URI1 -w bjorn >> \ 156 $TESTOUT 2>&1 << EOMODS 157 dn: cn=Alumni Assoc Staff, ou=Groups, dc=example, dc=com 158 changetype: modify 159 add: description 160 description: added by bjorn (removed later) 161 EOMODS 162 RC=$? 163 if test $RC != 0 ; then 164 echo "ldapmodify failed ($RC)!" 165 test $KILLSERVERS != no && kill -HUP $KILLPIDS 166 exit $RC 167 fi 168 169 $LDAPMODIFY -D "$BABSDN" -H $URI1 -w bjensen >> \ 170 $TESTOUT 2>&1 << EOMODS 171 dn: cn=Group,ou=Add & Delete,dc=example,dc=com 172 changetype: modify 173 delete: description 174 description: added by bjorn (removed later) 175 EOMODS 176 RC=$? 177 if test $RC != 0 ; then 178 echo "ldapmodify failed ($RC)!" 179 test $KILLSERVERS != no && kill -HUP $KILLPIDS 180 exit $RC 181 fi 182 183 $LDAPMODIFY -D "$BJORNSDN" -H $URI1 -w bjorn >> \ 184 $TESTOUT 2>&1 << EOMODS 185 dn: cn=Added by Bjorn,ou=Add & Delete,dc=example,dc=com 186 changetype: add 187 objectClass: inetOrgPerson 188 sn: Jensen 189 EOMODS 190 RC=$? 191 if test $RC != 0 ; then 192 echo "ldapmodify failed ($RC)!" 193 test $KILLSERVERS != no && kill -HUP $KILLPIDS 194 exit $RC 195 fi 196 197 $LDAPMODIFY -D "$BJORNSDN" -H $URI1 -w bjorn >> \ 198 $TESTOUT 2>&1 << EOMODS 199 dn: cn=Group,ou=Add & Delete,dc=example,dc=com 200 changetype: modify 201 add: description 202 description: another one added by bjorn (should succeed) 203 EOMODS 204 RC=$? 205 if test $RC != 0 ; then 206 echo "ldapmodify failed ($RC)!" 207 test $KILLSERVERS != no && kill -HUP $KILLPIDS 208 exit $RC 209 fi 210 211 echo "... ACL on the variant entry" 212 $LDAPMODIFY -D "$BABSDN" -H $URI1 -w bjensen >> \ 213 $TESTOUT 2>&1 << EOMODS 214 dn: cn=Group,ou=Add & Delete,dc=example,dc=com 215 changetype: modify 216 add: description 217 description: added by bjensen (should fail) 218 EOMODS 219 RC=$? 220 case $RC in 221 50) 222 ;; 223 0) 224 echo "ldapmodify should have failed ($RC)!" 225 test $KILLSERVERS != no && kill -HUP $KILLPIDS 226 exit -1 227 ;; 228 *) 229 echo "ldapmodify failed ($RC)!" 230 test $KILLSERVERS != no && kill -HUP $KILLPIDS 231 exit $RC 232 ;; 233 esac 234 235 $LDAPMODIFY -D "$BJORNSDN" -H $URI1 -w bjorn >> \ 236 $TESTOUT 2>&1 << EOMODS 237 dn: sn=Doe,ou=Add & Delete,dc=example,dc=com 238 changetype: modify 239 add: description 240 description: added by bjorn (will be removed) 241 EOMODS 242 RC=$? 243 if test $RC != 0 ; then 244 echo "ldapmodify failed ($RC)!" 245 test $KILLSERVERS != no && kill -HUP $KILLPIDS 246 exit $RC 247 fi 248 249 $LDAPMODIFY -D "$BABSDN" -H $URI1 -w bjensen >> \ 250 $TESTOUT 2>&1 << EOMODS 251 dn: cn=Added by Bjorn,ou=Add & Delete,dc=example,dc=com 252 changetype: modify 253 replace: description 254 description: added by bjensen (should fail) 255 EOMODS 256 RC=$? 257 case $RC in 258 50) 259 ;; 260 0) 261 echo "ldapmodify should have failed ($RC)!" 262 test $KILLSERVERS != no && kill -HUP $KILLPIDS 263 exit -1 264 ;; 265 *) 266 echo "ldapmodify failed ($RC)!" 267 test $KILLSERVERS != no && kill -HUP $KILLPIDS 268 exit $RC 269 ;; 270 esac 271 272 $LDAPMODIFY -D "$JAJDN" -H $URI1 -w jaj >> \ 273 $TESTOUT 2>&1 << EOMODS 274 dn: sn=Elliot,ou=Add & Delete,dc=example,dc=com 275 changetype: modify 276 delete: description 277 description: added by bjorn (will be removed) 278 - 279 add: description 280 description: added by jaj (should succeed) 281 EOMODS 282 RC=$? 283 if test $RC != 0 ; then 284 echo "ldapmodify failed ($RC)!" 285 test $KILLSERVERS != no && kill -HUP $KILLPIDS 286 exit $RC 287 fi 288 289 sleep $SLEEP0 290 291 echo >>$SEARCHOUT 292 echo "Using ldapsearch to retrieve all the entries..." 293 echo "# Using ldapsearch to retrieve all the entries..." >> $SEARCHOUT 294 $LDAPSEARCH -S "" -b "ou=Add & Delete,dc=example,dc=com" \ 295 -D "$MANAGERDN" -H $URI1 -w $PASSWD \ 296 'objectClass=*' >> $SEARCHOUT 2>&1 297 RC=$? 298 if test $RC != 0 ; then 299 echo "ldapsearch failed ($RC)!" 300 exit $RC 301 fi 302 303 test $KILLSERVERS != no && kill -HUP $KILLPIDS 304 305 LDIF=data/test006-out.ldif 306 307 echo "Filtering ldapsearch results..." 308 $LDIFFILTER -s e < $SEARCHOUT > $SEARCHFLT 309 echo "Filtering expected entries..." 310 $LDIFFILTER -s e < $LDIF > $LDIFFLT 311 echo "Comparing filter output..." 312 $CMP $SEARCHFLT $LDIFFLT > $CMPOUT 313 314 if test $? != 0 ; then 315 echo "comparison failed - operations did not complete correctly" 316 exit 1 317 fi 318 319 echo ">>>>> Test succeeded" 320 321 test $KILLSERVERS != no && wait 322 323 exit 0 324
Indexes created Tue Aug 11 00:25:38 UTC 2026