test022-ppolicy revision 1.1.1.4
1 #! /bin/sh 2 # $OpenLDAP$ 3 ## This work is part of OpenLDAP Software <http://www.openldap.org/>. 4 ## 5 ## Copyright 1998-2014 The OpenLDAP Foundation. 6 ## All rights reserved. 7 ## 8 ## Redistribution and use in source and binary forms, with or without 9 ## modification, are permitted only as authorized by the OpenLDAP 10 ## Public License. 11 ## 12 ## A copy of this license is available in the file LICENSE in the 13 ## top-level directory of the distribution or, alternatively, at 14 ## <http://www.OpenLDAP.org/license.html>. 15 16 echo "running defines.sh" 17 . $SRCDIR/scripts/defines.sh 18 19 if test $PPOLICY = ppolicyno; then 20 echo "Password policy overlay not available, test skipped" 21 exit 0 22 fi 23 24 mkdir -p $TESTDIR $DBDIR1 25 26 $SLAPPASSWD -g -n >$CONFIGPWF 27 echo "rootpw `$SLAPPASSWD -T $CONFIGPWF`" >$TESTDIR/configpw.conf 28 29 echo "Starting slapd on TCP/IP port $PORT1..." 30 . $CONFFILTER $BACKEND $MONITORDB < $PPOLICYCONF > $CONF1 31 $SLAPD -f $CONF1 -h $URI1 -d $LVL $TIMING > $LOG1 2>&1 & 32 PID=$! 33 if test $WAIT != 0 ; then 34 echo PID $PID 35 read foo 36 fi 37 KILLPIDS="$PID" 38 39 USER="uid=nd, ou=People, dc=example, dc=com" 40 PASS=testpassword 41 42 sleep 1 43 44 echo "Using ldapsearch to check that slapd is running..." 45 for i in 0 1 2 3 4 5; do 46 $LDAPSEARCH -s base -b "$MONITOR" -h $LOCALHOST -p $PORT1 \ 47 'objectclass=*' > /dev/null 2>&1 48 RC=$? 49 if test $RC = 0 ; then 50 break 51 fi 52 echo "Waiting 5 seconds for slapd to start..." 53 sleep 5 54 done 55 if test $RC != 0 ; then 56 echo "ldapsearch failed ($RC)!" 57 test $KILLSERVERS != no && kill -HUP $KILLPIDS 58 exit $RC 59 fi 60 61 echo /dev/null > $TESTOUT 62 63 echo "Using ldapadd to populate the database..." 64 # may need "-e relax" for draft 09, but not yet. 65 $LDAPADD -D "$MANAGERDN" -h $LOCALHOST -p $PORT1 -w $PASSWD < \ 66 $LDIFPPOLICY >> $TESTOUT 2>&1 67 RC=$? 68 if test $RC != 0 ; then 69 echo "ldapadd failed ($RC)!" 70 test $KILLSERVERS != no && kill -HUP $KILLPIDS 71 exit $RC 72 fi 73 74 echo "Testing account lockout..." 75 $LDAPSEARCH -h $LOCALHOST -p $PORT1 -D "$USER" -w wrongpw >$SEARCHOUT 2>&1 76 sleep 2 77 $LDAPSEARCH -h $LOCALHOST -p $PORT1 -D "$USER" -w wrongpw >>$SEARCHOUT 2>&1 78 sleep 2 79 $LDAPSEARCH -h $LOCALHOST -p $PORT1 -D "$USER" -w wrongpw >>$SEARCHOUT 2>&1 80 sleep 2 81 $LDAPSEARCH -e ppolicy -h $LOCALHOST -p $PORT1 -D "$USER" -w wrongpw >> $SEARCHOUT 2>&1 82 $LDAPSEARCH -e ppolicy -h $LOCALHOST -p $PORT1 -D "$USER" -w $PASS >> $SEARCHOUT 2>&1 83 COUNT=`grep "Account locked" $SEARCHOUT | wc -l` 84 if test $COUNT != 2 ; then 85 echo "Account lockout test failed" 86 test $KILLSERVERS != no && kill -HUP $KILLPIDS 87 exit 1 88 fi 89 90 echo "Waiting 20 seconds for lockout to reset..." 91 sleep 20 92 93 $LDAPSEARCH -e ppolicy -h $LOCALHOST -p $PORT1 -D "$USER" -w $PASS \ 94 -b "$BASEDN" -s base >> $SEARCHOUT 2>&1 95 RC=$? 96 if test $RC != 0 ; then 97 echo "ldapsearch failed ($RC)!" 98 test $KILLSERVERS != no && kill -HUP $KILLPIDS 99 exit $RC 100 fi 101 102 echo "Testing password expiration" 103 echo "Waiting 20 seconds for password to expire..." 104 sleep 20 105 106 $LDAPSEARCH -e ppolicy -h $LOCALHOST -p $PORT1 -D "$USER" -w $PASS \ 107 -b "$BASEDN" -s base > $SEARCHOUT 2>&1 108 sleep 2 109 $LDAPSEARCH -e ppolicy -h $LOCALHOST -p $PORT1 -D "$USER" -w $PASS \ 110 -b "$BASEDN" -s base >> $SEARCHOUT 2>&1 111 sleep 2 112 $LDAPSEARCH -e ppolicy -h $LOCALHOST -p $PORT1 -D "$USER" -w $PASS \ 113 -b "$BASEDN" -s base >> $SEARCHOUT 2>&1 114 sleep 2 115 $LDAPSEARCH -e ppolicy -h $LOCALHOST -p $PORT1 -D "$USER" -w $PASS \ 116 -b "$BASEDN" -s base >> $SEARCHOUT 2>&1 117 RC=$? 118 if test $RC = 0 ; then 119 echo "Password expiration failed ($RC)!" 120 test $KILLSERVERS != no && kill -HUP $KILLPIDS 121 exit 1 122 fi 123 124 COUNT=`grep "grace logins" $SEARCHOUT | wc -l` 125 if test $COUNT != 3 ; then 126 echo "Password expiration test failed" 127 test $KILLSERVERS != no && kill -HUP $KILLPIDS 128 exit 1 129 fi 130 131 echo "Resetting password to clear expired status" 132 $LDAPPASSWD -h $LOCALHOST -p $PORT1 \ 133 -w secret -s $PASS \ 134 -D "$MANAGERDN" "$USER" >> $TESTOUT 2>&1 135 RC=$? 136 if test $RC != 0 ; then 137 echo "ldappasswd failed ($RC)!" 138 test $KILLSERVERS != no && kill -HUP $KILLPIDS 139 exit $RC 140 fi 141 142 echo "Filling password history..." 143 $LDAPMODIFY -v -D "$USER" -h $LOCALHOST -p $PORT1 -w $PASS >> \ 144 $TESTOUT 2>&1 << EOMODS 145 dn: uid=nd, ou=People, dc=example, dc=com 146 changetype: modify 147 delete: userpassword 148 userpassword: $PASS 149 - 150 replace: userpassword 151 userpassword: 20urgle12-1 152 153 dn: uid=nd, ou=People, dc=example, dc=com 154 changetype: modify 155 delete: userpassword 156 userpassword: 20urgle12-1 157 - 158 replace: userpassword 159 userpassword: 20urgle12-2 160 161 dn: uid=nd, ou=People, dc=example, dc=com 162 changetype: modify 163 delete: userpassword 164 userpassword: 20urgle12-2 165 - 166 replace: userpassword 167 userpassword: 20urgle12-3 168 169 dn: uid=nd, ou=People, dc=example, dc=com 170 changetype: modify 171 delete: userpassword 172 userpassword: 20urgle12-3 173 - 174 replace: userpassword 175 userpassword: 20urgle12-4 176 177 dn: uid=nd, ou=People, dc=example, dc=com 178 changetype: modify 179 delete: userpassword 180 userpassword: 20urgle12-4 181 - 182 replace: userpassword 183 userpassword: 20urgle12-5 184 185 dn: uid=nd, ou=People, dc=example, dc=com 186 changetype: modify 187 delete: userpassword 188 userpassword: 20urgle12-5 189 - 190 replace: userpassword 191 userpassword: 20urgle12-6 192 193 EOMODS 194 RC=$? 195 if test $RC != 0 ; then 196 echo "ldapmodify failed ($RC)!" 197 test $KILLSERVERS != no && kill -HUP $KILLPIDS 198 exit $RC 199 fi 200 echo "Testing password history..." 201 $LDAPMODIFY -v -D "$USER" -h $LOCALHOST -p $PORT1 -w 20urgle12-6 >> \ 202 $TESTOUT 2>&1 << EOMODS 203 dn: uid=nd, ou=People, dc=example, dc=com 204 changetype: modify 205 delete: userPassword 206 userPassword: 20urgle12-6 207 - 208 replace: userPassword 209 userPassword: 20urgle12-2 210 211 EOMODS 212 RC=$? 213 if test $RC = 0 ; then 214 echo "ldapmodify failed ($RC)!" 215 test $KILLSERVERS != no && kill -HUP $KILLPIDS 216 exit 1 217 fi 218 219 echo "Testing forced reset..." 220 221 $LDAPMODIFY -v -D "$MANAGERDN" -h $LOCALHOST -p $PORT1 -w $PASSWD >> \ 222 $TESTOUT 2>&1 << EOMODS 223 dn: uid=nd, ou=People, dc=example, dc=com 224 changetype: modify 225 replace: userPassword 226 userPassword: $PASS 227 - 228 replace: pwdReset 229 pwdReset: TRUE 230 231 EOMODS 232 RC=$? 233 if test $RC != 0 ; then 234 echo "ldapmodify failed ($RC)!" 235 test $KILLSERVERS != no && kill -HUP $KILLPIDS 236 exit $RC 237 fi 238 239 $LDAPSEARCH -e ppolicy -h $LOCALHOST -p $PORT1 -D "$USER" -w $PASS \ 240 -b "$BASEDN" -s base > $SEARCHOUT 2>&1 241 RC=$? 242 if test $RC = 0 ; then 243 echo "Forced reset failed ($RC)!" 244 test $KILLSERVERS != no && kill -HUP $KILLPIDS 245 exit 1 246 fi 247 248 COUNT=`grep "Operations are restricted" $SEARCHOUT | wc -l` 249 if test $COUNT != 1 ; then 250 echo "Forced reset test failed" 251 test $KILLSERVERS != no && kill -HUP $KILLPIDS 252 exit 1 253 fi 254 255 echo "Clearing forced reset..." 256 257 $LDAPMODIFY -v -D "$MANAGERDN" -h $LOCALHOST -p $PORT1 -w $PASSWD >> \ 258 $TESTOUT 2>&1 << EOMODS 259 dn: uid=nd, ou=People, dc=example, dc=com 260 changetype: modify 261 delete: pwdReset 262 263 EOMODS 264 RC=$? 265 if test $RC != 0 ; then 266 echo "ldapmodify failed ($RC)!" 267 test $KILLSERVERS != no && kill -HUP $KILLPIDS 268 exit $RC 269 fi 270 271 $LDAPSEARCH -e ppolicy -h $LOCALHOST -p $PORT1 -D "$USER" -w $PASS \ 272 -b "$BASEDN" -s base > $SEARCHOUT 2>&1 273 RC=$? 274 if test $RC != 0 ; then 275 echo "Clearing forced reset failed ($RC)!" 276 test $KILLSERVERS != no && kill -HUP $KILLPIDS 277 exit $RC 278 fi 279 280 echo "Testing Safe modify..." 281 282 $LDAPPASSWD -h $LOCALHOST -p $PORT1 \ 283 -w $PASS -s failexpect \ 284 -D "$USER" >> $TESTOUT 2>&1 285 RC=$? 286 if test $RC = 0 ; then 287 echo "Safe modify test 1 failed ($RC)!" 288 test $KILLSERVERS != no && kill -HUP $KILLPIDS 289 exit 1 290 fi 291 292 sleep 2 293 294 OLDPASS=$PASS 295 PASS=successexpect 296 297 $LDAPPASSWD -h $LOCALHOST -p $PORT1 \ 298 -w $OLDPASS -s $PASS -a $OLDPASS \ 299 -D "$USER" >> $TESTOUT 2>&1 300 RC=$? 301 if test $RC != 0 ; then 302 echo "Safe modify test 2 failed ($RC)!" 303 test $KILLSERVERS != no && kill -HUP $KILLPIDS 304 exit $RC 305 fi 306 307 echo "Testing length requirement..." 308 # check control in response (ITS#5711) 309 $LDAPPASSWD -h $LOCALHOST -p $PORT1 \ 310 -w $PASS -a $PASS -s 2shr \ 311 -D "$USER" -e ppolicy > ${TESTOUT}.2 2>&1 312 RC=$? 313 cat ${TESTOUT}.2 >> $TESTOUT 314 if test $RC = 0 ; then 315 echo "Length requirement test failed ($RC)!" 316 test $KILLSERVERS != no && kill -HUP $KILLPIDS 317 exit 1 318 fi 319 COUNT=`grep "Password fails quality" ${TESTOUT}.2 | wc -l` 320 if test $COUNT != 1 ; then 321 echo "Length requirement test failed" 322 test $KILLSERVERS != no && kill -HUP $KILLPIDS 323 exit 1 324 fi 325 COUNT=`grep "Password is too short for policy" ${TESTOUT}.2 | wc -l` 326 if test $COUNT != 1 ; then 327 echo "Control not returned in response" 328 test $KILLSERVERS != no && kill -HUP $KILLPIDS 329 exit 1 330 fi 331 332 echo "Testing hashed length requirement..." 333 334 $LDAPMODIFY -h $LOCALHOST -p $PORT1 -D "$USER" -w $PASS > \ 335 ${TESTOUT}.2 2>&1 << EOMODS 336 dn: $USER 337 changetype: modify 338 delete: userPassword 339 userPassword: $PASS 340 - 341 add: userPassword 342 userPassword: {MD5}xxxxxx 343 344 EOMODS 345 RC=$? 346 cat ${TESTOUT}.2 >> $TESTOUT 347 if test $RC = 0 ; then 348 echo "Hashed length requirement test failed ($RC)!" 349 test $KILLSERVERS != no && kill -HUP $KILLPIDS 350 exit 1 351 fi 352 COUNT=`grep "Password fails quality" ${TESTOUT}.2 | wc -l` 353 if test $COUNT != 1 ; then 354 echo "Hashed length requirement test failed" 355 test $KILLSERVERS != no && kill -HUP $KILLPIDS 356 exit 1 357 fi 358 359 echo "Testing multiple password add/modify checks..." 360 361 $LDAPMODIFY -h $LOCALHOST -p $PORT1 -D "$MANAGERDN" -w $PASSWD >> \ 362 $TESTOUT 2>&1 << EOMODS 363 dn: cn=Add Should Fail, ou=People, dc=example, dc=com 364 changetype: add 365 objectClass: inetOrgPerson 366 cn: Add Should Fail 367 sn: Fail 368 userPassword: firstpw 369 userPassword: secondpw 370 EOMODS 371 RC=$? 372 if test $RC = 0 ; then 373 echo "Multiple password add test failed ($RC)!" 374 test $KILLSERVERS != no && kill -HUP $KILLPIDS 375 exit 1 376 fi 377 378 $LDAPMODIFY -h $LOCALHOST -p $PORT1 -D "$MANAGERDN" -w $PASSWD >> \ 379 $TESTOUT 2>&1 << EOMODS 380 dn: $USER 381 changetype: modify 382 add: userPassword 383 userPassword: firstpw 384 userPassword: secondpw 385 EOMODS 386 RC=$? 387 if test $RC = 0 ; then 388 echo "Multiple password modify add test failed ($RC)!" 389 test $KILLSERVERS != no && kill -HUP $KILLPIDS 390 exit 1 391 fi 392 393 $LDAPMODIFY -h $LOCALHOST -p $PORT1 -D "$MANAGERDN" -w $PASSWD >> \ 394 $TESTOUT 2>&1 << EOMODS 395 dn: $USER 396 changetype: modify 397 replace: userPassword 398 userPassword: firstpw 399 userPassword: secondpw 400 EOMODS 401 RC=$? 402 if test $RC = 0 ; then 403 echo "Multiple password modify replace test failed ($RC)!" 404 test $KILLSERVERS != no && kill -HUP $KILLPIDS 405 exit 1 406 fi 407 408 if test "$BACKLDAP" != "ldapno" && test "$SYNCPROV" != "syncprovno" ; then 409 echo "" 410 echo "Setting up policy state forwarding test..." 411 412 mkdir $DBDIR2 413 sed -e "s,$DBDIR1,$DBDIR2," < $CONF1 > $CONF2 414 echo "Starting slapd consumer on TCP/IP port $PORT2..." 415 $SLAPD -f $CONF2 -h $URI2 -d $LVL $TIMING > $LOG2 2>&1 & 416 PID=$! 417 if test $WAIT != 0 ; then 418 echo PID $PID 419 read foo 420 fi 421 KILLPIDS="$KILLPIDS $PID" 422 423 echo "Configuring syncprov on provider..." 424 if [ "$SYNCPROV" = syncprovmod ]; then 425 $LDAPADD -D cn=config -H $URI1 -y $CONFIGPWF <<EOF >> $TESTOUT 2>&1 426 dn: cn=module,cn=config 427 objectclass: olcModuleList 428 cn: module 429 olcModulePath: $TESTWD/../servers/slapd/overlays 430 olcModuleLoad: syncprov.la 431 432 EOF 433 RC=$? 434 if test $RC != 0 ; then 435 echo "ldapadd failed for moduleLoad ($RC)!" 436 test $KILLSERVERS != no && kill -HUP $KILLPIDS 437 exit $RC 438 fi 439 fi 440 441 $LDAPADD -D cn=config -H $URI1 -y $CONFIGPWF <<EOF >> $TESTOUT 2>&1 442 dn: olcOverlay={1}syncprov,olcDatabase={1}$BACKEND,cn=config 443 objectClass: olcOverlayConfig 444 objectClass: olcSyncProvConfig 445 olcOverlay: {1}syncprov 446 447 EOF 448 RC=$? 449 if test $RC != 0 ; then 450 echo "ldapadd failed for provider database config ($RC)!" 451 test $KILLSERVERS != no && kill -HUP $KILLPIDS 452 exit $RC 453 fi 454 455 echo "Using ldapsearch to check that slapd is running..." 456 for i in 0 1 2 3 4 5; do 457 $LDAPSEARCH -s base -b "$MONITOR" -H $URI2 \ 458 'objectclass=*' > /dev/null 2>&1 459 RC=$? 460 if test $RC = 0 ; then 461 break 462 fi 463 echo "Waiting 5 seconds for slapd to start..." 464 sleep 5 465 done 466 if test $RC != 0 ; then 467 echo "ldapsearch failed ($RC)!" 468 test $KILLSERVERS != no && kill -HUP $KILLPIDS 469 exit $RC 470 fi 471 472 echo "Configuring syncrepl on consumer..." 473 if [ "$BACKLDAP" = ldapmod ]; then 474 $LDAPADD -D cn=config -H $URI2 -y $CONFIGPWF <<EOF >> $TESTOUT 2>&1 475 dn: cn=module,cn=config 476 objectclass: olcModuleList 477 cn: module 478 olcModulePath: $TESTWD/../servers/slapd/back-ldap 479 olcModuleLoad: back_ldap.la 480 481 EOF 482 RC=$? 483 if test $RC != 0 ; then 484 echo "ldapadd failed for moduleLoad ($RC)!" 485 test $KILLSERVERS != no && kill -HUP $KILLPIDS 486 exit $RC 487 fi 488 fi 489 $LDAPMODIFY -D cn=config -H $URI2 -y $CONFIGPWF <<EOF >> $TESTOUT 2>&1 490 dn: olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config 491 changetype: add 492 objectClass: olcOverlayConfig 493 objectClass: olcChainConfig 494 olcOverlay: {0}chain 495 496 dn: olcDatabase=ldap,olcOverlay={0}chain,olcDatabase={-1}frontend,cn=config 497 changetype: add 498 objectClass: olcLDAPConfig 499 objectClass: olcChainDatabase 500 olcDBURI: $URI1 501 olcDbIDAssertBind: bindmethod=simple 502 binddn="cn=manager,dc=example,dc=com" 503 credentials=secret 504 mode=self 505 506 dn: olcDatabase={1}$BACKEND,cn=config 507 changetype: modify 508 add: olcSyncrepl 509 olcSyncrepl: rid=1 510 provider=$URI1 511 binddn="cn=manager,dc=example,dc=com" 512 bindmethod=simple 513 credentials=secret 514 searchbase="dc=example,dc=com" 515 type=refreshAndPersist 516 retry="3 5 300 5" 517 - 518 add: olcUpdateref 519 olcUpdateref: $URI1 520 - 521 522 dn: olcOverlay={0}ppolicy,olcDatabase={1}$BACKEND,cn=config 523 changetype: modify 524 replace: olcPPolicyForwardUpdates 525 olcPPolicyForwardUpdates: TRUE 526 - 527 528 EOF 529 RC=$? 530 if test $RC != 0 ; then 531 echo "ldapmodify failed ($RC)!" 532 test $KILLSERVERS != no && kill -HUP $KILLPIDS 533 exit $RC 534 fi 535 536 echo "Waiting for consumer to sync..." 537 sleep $SLEEP1 538 539 echo "Testing policy state forwarding..." 540 $LDAPSEARCH -H $URI2 -D "$USER" -w wrongpw >$SEARCHOUT 2>&1 541 RC=$? 542 if test $RC != 49 ; then 543 echo "ldapsearch should have failed with 49, got ($RC)!" 544 test $KILLSERVERS != no && kill -HUP $KILLPIDS 545 exit 1 546 fi 547 548 $LDAPSEARCH -H $URI1 -D "$MANAGERDN" -w $PASSWD -b "$USER" \* \+ >> $SEARCHOUT 2>&1 549 COUNT=`grep "pwdFailureTime" $SEARCHOUT | wc -l` 550 if test $COUNT != 1 ; then 551 echo "Policy state forwarding failed" 552 test $KILLSERVERS != no && kill -HUP $KILLPIDS 553 exit 1 554 fi 555 556 # End of chaining test 557 558 fi 559 560 test $KILLSERVERS != no && kill -HUP $KILLPIDS 561 562 echo ">>>>> Test succeeded" 563 564 test $KILLSERVERS != no && wait 565 566 exit 0 567
Indexes created Sun Aug 30 00:27:18 UTC 2026