3 ## This work is part of OpenLDAP Software <http://www.openldap.org/>.
5 ## Copyright 1998-2011 The OpenLDAP Foundation.
6 ## All rights reserved.
8 ## Redistribution and use in source and binary forms, with or without
9 ## modification, are permitted only as authorized by the OpenLDAP
12 ## A copy of this license is available in the file LICENSE in the
13 ## top-level directory of the distribution or, alternatively, at
14 ## <http://www.OpenLDAP.org/license.html>.
16 case "$BACKEND" in ldif | null)
17 echo "$BACKEND backend does not support access controls, test skipped"
22 echo "running defines.sh"
23 . $SRCDIR/scripts/defines.sh
25 if test "$ACI" = "acino" ; then
26 echo "ACI not enabled, test skipped"
30 mkdir -p $TESTDIR $DBDIR1
32 echo "Running slapadd to build slapd database..."
33 . $CONFFILTER $BACKEND $MONITORDB < $ACICONF > $CONF1
34 $SLAPADD -f $CONF1 -l $LDIFORDERED
36 if test $RC != 0 ; then
37 echo "slapadd failed ($RC)!"
41 echo "Starting slapd on TCP/IP port $PORT1..."
42 $SLAPD -f $CONF1 -h $URI1 -d $LVL $TIMING > $LOG1 2>&1 &
44 if test $WAIT != 0 ; then
52 echo "Testing slapd ACI access control..."
53 for i in 0 1 2 3 4 5; do
54 $LDAPSEARCH -s base -b "$MONITOR" -h $LOCALHOST -p $PORT1 \
55 'objectclass=*' > /dev/null 2>&1
57 if test $RC = 0 ; then
60 echo "Waiting 5 seconds for slapd to start..."
64 if test $RC != 0 ; then
65 echo "ldapsearch failed ($RC)!"
66 test $KILLSERVERS != no && kill -HUP $KILLPIDS
70 cat /dev/null > $SEARCHOUT
71 cat /dev/null > $TESTOUT
74 BASEDN="dc=example,dc=com"
75 echo "Searching \"$BASEDN\" (should fail)..."
76 echo "# Searching \"$BASEDN\" (should fail)..." >> $SEARCHOUT
77 $LDAPSEARCH -s base -b "$BASEDN" -h $LOCALHOST -p $PORT1 \
78 '(objectclass=*)' >> $SEARCHOUT 2>> $TESTOUT
80 if test $RC != 32 ; then
81 echo "ldapsearch should have failed with noSuchObject ($RC)!"
82 test $KILLSERVERS != no && kill -HUP $KILLPIDS
83 if test $RC = 0 ; then
90 BINDDN="cn=Barbara Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com"
92 echo "Testing ldapwhoami as ${BINDDN} (should fail)..."
93 $LDAPWHOAMI -h $LOCALHOST -p $PORT1 -D "$BINDDN" -w $BINDPW
95 if test $RC = 0 ; then
96 echo "ldapwhoami should have failed!"
97 test $KILLSERVERS != no && kill -HUP $KILLPIDS
102 echo "Writing ACIs as \"$MANAGERDN\"..."
103 $LDAPMODIFY -D "$MANAGERDN" -w $PASSWD -h $LOCALHOST -p $PORT1 \
104 >> $TESTOUT 2>&1 << EOMODS0
105 dn: dc=example,dc=com
108 OpenLDAPaci: 0#subtree#grant;d,c,s,r;[all]#group/groupOfUniqueNames/uniqueMe
109 mber#cn=ITD Staff,ou=Groups,dc=example,dc=com
110 OpenLDAPaci: 1#entry#grant;d;[all]#public#
112 dn: ou=People,dc=example,dc=com
115 OpenLDAPaci: 0#subtree#grant;x;userPassword#public#
116 OpenLDAPaci: 1#subtree#grant;w;userPassword#self#
117 OpenLDAPaci: 2#subtree#grant;w;userPassword#access-id#cn=Bjorn Jensen,ou=Inf
118 ormation Technology Division,ou=People,dc=example,dc=com
120 dn: ou=Groups,dc=example,dc=com
123 OpenLDAPaci: 0#entry#grant;s;[all]#public#
124 OpenLDAPaci: 1#children#grant;r;member;r;uniqueMember#access-id#cn=Bjorn Jen
125 sen,ou=Information Technology Division,ou=People,dc=example,dc=com
128 if test $RC != 0 ; then
129 echo "ldapmodify failed ($RC)!"
130 test $KILLSERVERS != no && kill -HUP $KILLPIDS
134 # Search must succeed with no results
135 BASEDN="dc=example,dc=com"
136 echo "Searching \"$BASEDN\" (should succeed with no results)..."
137 echo "# Searching \"$BASEDN\" (should succeed with no results)..." >> $SEARCHOUT
138 $LDAPSEARCH -s base -b "$BASEDN" -h $LOCALHOST -p $PORT1 \
139 '(objectclass=*)' >> $SEARCHOUT 2>> $TESTOUT
141 if test $RC != 0 ; then
142 ### TEMPORARY (see ITS#3963)
143 echo "ldapsearch failed ($RC)! IGNORED..."
144 ###echo "ldapsearch failed ($RC)!"
145 ###test $KILLSERVERS != no && kill -HUP $KILLPIDS
149 BINDDN="cn=Barbara Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com"
151 echo "Testing ldapwhoami as ${BINDDN}..."
152 $LDAPWHOAMI -h $LOCALHOST -p $PORT1 -D "$BINDDN" -w $BINDPW
154 if test $RC != 0 ; then
155 echo "ldapwhoami failed ($RC)!"
156 test $KILLSERVERS != no && kill -HUP $KILLPIDS
160 # Search must succeed
161 BINDDN="cn=Bjorn Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com"
163 BASEDN="dc=example,dc=com"
164 echo "Searching \"$BASEDN\" as \"$BINDDN\" (should succeed)..."
165 echo "# Searching \"$BASEDN\" as \"$BINDDN\" (should succeed)..." >> $SEARCHOUT
166 $LDAPSEARCH -s base -b "$BASEDN" -h $LOCALHOST -p $PORT1 \
167 -D "$BINDDN" -w "$BINDPW" \
168 '(objectClass=*)' >> $SEARCHOUT 2>> $TESTOUT
170 if test $RC != 0 ; then
171 echo "ldapsearch failed ($RC)!"
172 test $KILLSERVERS != no && kill -HUP $KILLPIDS
176 # Passwd must succeed
177 BINDDN="cn=Bjorn Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com"
179 TGT="cn=John Doe,ou=Information Technology Division,ou=People,dc=example,dc=com"
181 echo "Setting \"$TGT\" password..."
182 $LDAPPASSWD -h $LOCALHOST -p $PORT1 \
183 -w "$BINDPW" -s "$NEWPW" \
184 -D "$BINDDN" "$TGT" >> $TESTOUT 2>&1
186 if test $RC != 0 ; then
187 echo "ldappasswd failed ($RC)!"
188 test $KILLSERVERS != no && kill -HUP $KILLPIDS
192 # Re-change as self...
193 echo "Changing self password..."
196 TGT="cn=John Doe,ou=Information Technology Division,ou=People,dc=example,dc=com"
198 $LDAPPASSWD -h $LOCALHOST -p $PORT1 \
199 -w "$BINDPW" -s "$NEWPW" \
200 -D "$BINDDN" "$TGT" >> $TESTOUT 2>&1
202 if test $RC != 0 ; then
203 echo "ldappasswd failed ($RC)!"
204 test $KILLSERVERS != no && kill -HUP $KILLPIDS
210 BASEDN="ou=Groups,dc=example,dc=com"
211 echo "Searching \"$BASEDN\" as \"$BINDDN\" (should succeed)..."
212 echo "# Searching \"$BASEDN\" as \"$BINDDN\" (should succeed)..." >> $SEARCHOUT
213 $LDAPSEARCH -s one -b "$BASEDN" -h $LOCALHOST -p $PORT1 \
214 -D "$BINDDN" -w "$BINDPW" \
215 '(objectClass=*)' >> $SEARCHOUT 2>> $TESTOUT
217 if test $RC != 0 ; then
218 echo "ldapsearch failed ($RC)!"
219 test $KILLSERVERS != no && kill -HUP $KILLPIDS
224 BINDDN="cn=Barbara Jensen,ou=Information Technology Division,ou=People,dc=example,dc=com"
226 echo "Searching \"$BASEDN\" as \"$BINDDN\" (should succeed with no results)..."
227 echo "# Searching \"$BASEDN\" as \"$BINDDN\" (should succeed with no results)..." >> $SEARCHOUT
228 $LDAPSEARCH -s one -b "$BASEDN" -h $LOCALHOST -p $PORT1 \
229 -D "$BINDDN" -w "$BINDPW" \
230 '(objectClass=*)' >> $SEARCHOUT 2>> $TESTOUT
232 if test $RC != 0 ; then
233 echo "ldapsearch failed ($RC)!"
234 test $KILLSERVERS != no && kill -HUP $KILLPIDS
238 test $KILLSERVERS != no && kill -HUP $KILLPIDS
242 echo "Filtering ldapsearch results..."
243 $LDIFFILTER < $SEARCHOUT > $SEARCHFLT
244 echo "Filtering original ldif used to create database..."
245 $LDIFFILTER < $LDIF > $LDIFFLT
246 echo "Comparing filter output..."
247 $CMP $SEARCHFLT $LDIFFLT > $CMPOUT
249 if test $? != 0 ; then
250 echo "comparison failed - operations did not complete correctly"
254 echo ">>>>> Test succeeded"
256 test $KILLSERVERS != no && wait