ITS#5189

[openldap] / tests / scripts / test022-ppolicy

diff --git a/tests/scripts/test022-ppolicy b/tests/scripts/test022-ppolicy
index fee6d155fd340b13672cac36e081bd0231f39a9e..5f2f566c7250ef6d7dcf200cefed4ec4237de190 100755 (executable)
--- a/tests/scripts/test022-ppolicy
+++ b/tests/scripts/test022-ppolicy
@@ -2,7 +2,7 @@
 # $OpenLDAP$
 ## This work is part of OpenLDAP Software <http://www.openldap.org/>.
 ##
-## Copyright 1998-2004 The OpenLDAP Foundation.
+## Copyright 1998-2007 The OpenLDAP Foundation.
 ## All rights reserved.
 ##
 ## Redistribution and use in source and binary forms, with or without
@@ -21,11 +21,6 @@ if test $PPOLICY = ppolicyno; then
        exit 0
 fi 
 
-if test "$BACKEND" = "ldbm" ; then
-       echo "Test does not support $BACKEND"
-       exit 0
-fi
-
 mkdir -p $TESTDIR $DBDIR1
 
 echo "Starting slapd on TCP/IP port $PORT1..."
@@ -38,9 +33,11 @@ if test $WAIT != 0 ; then
 fi
 KILLPIDS="$PID"
 
-USER="uid=nd, ou=People, o=University of Michigan, c=US"
+USER="uid=nd, ou=People, dc=example, dc=com"
 PASS=testpassword
 
+sleep 1
+
 echo "Using ldapsearch to check that slapd is running..."
 for i in 0 1 2 3 4 5; do
        $LDAPSEARCH -s base -b "$MONITOR" -h $LOCALHOST -p $PORT1 \
@@ -53,14 +50,17 @@ for i in 0 1 2 3 4 5; do
        sleep 5
 done
 if test $RC != 0 ; then
-       echo "ldapsearch failed $(RC)!"
+       echo "ldapsearch failed ($RC)!"
        test $KILLSERVERS != no && kill -HUP $KILLPIDS
        exit $RC
 fi
 
+echo /dev/null > $TESTOUT
+
 echo "Using ldapadd to populate the database..."
+# may need "-e relax" for draft 09, but not yet.
 $LDAPADD -D "$MANAGERDN" -h $LOCALHOST -p $PORT1 -w $PASSWD < \
-       $LDIFPPOLICY > $TESTOUT 2>&1
+       $LDIFPPOLICY >> $TESTOUT 2>&1
 RC=$?
 if test $RC != 0 ; then
        echo "ldapadd failed ($RC)!"
@@ -84,8 +84,8 @@ if test $COUNT != 2 ; then
        exit 1
 fi
 
-echo "Waiting 30 seconds for lockout to reset..."
-sleep 30
+echo "Waiting 20 seconds for lockout to reset..."
+sleep 20
 
 $LDAPSEARCH -e ppolicy -h $LOCALHOST -p $PORT1 -D "$USER" -w $PASS \
        -b "$BASEDN" -s base >> $SEARCHOUT 2>&1
@@ -96,28 +96,26 @@ if test $RC != 0 ; then
        exit $RC
 fi
 
-echo "Testing password expiration..."
-$LDAPMODIFY -v -D "$MANAGERDN" -h $LOCALHOST -p $PORT1 -w $PASSWD > \
-       $TESTOUT 2>&1 << EOMODS
-dn: uid=nd, ou=People, o=University of Michigan, c=US
-changetype: modify
-replace: pwdChangedTime
-pwdChangedTime: 20031231000001Z
-
-EOMODS
+echo "Testing password expiration"
+echo "Waiting 20 seconds for password to expire..."
+sleep 20
 
-$LDAPSEARCH -e ppolicy -h $LOCALHOST -p $PORT1 -D "$USER" -w $PASS > $SEARCHOUT 2>&1
+$LDAPSEARCH -e ppolicy -h $LOCALHOST -p $PORT1 -D "$USER" -w $PASS \
+       -b "$BASEDN" -s base > $SEARCHOUT 2>&1
 sleep 2
-$LDAPSEARCH -e ppolicy -h $LOCALHOST -p $PORT1 -D "$USER" -w $PASS >> $SEARCHOUT 2>&1
+$LDAPSEARCH -e ppolicy -h $LOCALHOST -p $PORT1 -D "$USER" -w $PASS \
+       -b "$BASEDN" -s base >> $SEARCHOUT 2>&1
 sleep 2
-$LDAPSEARCH -e ppolicy -h $LOCALHOST -p $PORT1 -D "$USER" -w $PASS >> $SEARCHOUT 2>&1
+$LDAPSEARCH -e ppolicy -h $LOCALHOST -p $PORT1 -D "$USER" -w $PASS \
+       -b "$BASEDN" -s base >> $SEARCHOUT 2>&1
 sleep 2
-$LDAPSEARCH -e ppolicy -h $LOCALHOST -p $PORT1 -D "$USER" -w $PASS >> $SEARCHOUT 2>&1
+$LDAPSEARCH -e ppolicy -h $LOCALHOST -p $PORT1 -D "$USER" -w $PASS \
+       -b "$BASEDN" -s base >> $SEARCHOUT 2>&1
 RC=$?
 if test $RC = 0 ; then
        echo "Password expiration failed ($RC)!"
        test $KILLSERVERS != no && kill -HUP $KILLPIDS
-       exit $RC
+       exit 1
 fi
 
 COUNT=`grep "grace logins" $SEARCHOUT | wc -l`
@@ -139,9 +137,9 @@ if test $RC != 0 ; then
 fi
 
 echo "Filling password history..."
-$LDAPMODIFY -v -D "$USER" -h $LOCALHOST -p $PORT1 -w $PASS > \
+$LDAPMODIFY -v -D "$USER" -h $LOCALHOST -p $PORT1 -w $PASS >> \
        $TESTOUT 2>&1 << EOMODS
-dn: uid=nd, ou=People, o=University of Michigan,c=US
+dn: uid=nd, ou=People, dc=example, dc=com
 changetype: modify
 delete: userpassword
 userpassword: testpassword
@@ -149,7 +147,7 @@ userpassword: testpassword
 replace: userpassword
 userpassword: 20urgle12-1
 
-dn: uid=nd, ou=People, o=University of Michigan,c=US
+dn: uid=nd, ou=People, dc=example, dc=com
 changetype: modify
 delete: userpassword
 userpassword: 20urgle12-1
@@ -157,7 +155,7 @@ userpassword: 20urgle12-1
 replace: userpassword
 userpassword: 20urgle12-2
 
-dn: uid=nd, ou=People, o=University of Michigan,c=US
+dn: uid=nd, ou=People, dc=example, dc=com
 changetype: modify
 delete: userpassword
 userpassword: 20urgle12-2
@@ -165,7 +163,7 @@ userpassword: 20urgle12-2
 replace: userpassword
 userpassword: 20urgle12-3
 
-dn: uid=nd, ou=People, o=University of Michigan,c=US
+dn: uid=nd, ou=People, dc=example, dc=com
 changetype: modify
 delete: userpassword
 userpassword: 20urgle12-3
@@ -173,7 +171,7 @@ userpassword: 20urgle12-3
 replace: userpassword
 userpassword: 20urgle12-4
 
-dn: uid=nd, ou=People, o=University of Michigan,c=US
+dn: uid=nd, ou=People, dc=example, dc=com
 changetype: modify
 delete: userpassword
 userpassword: 20urgle12-4
@@ -181,7 +179,7 @@ userpassword: 20urgle12-4
 replace: userpassword
 userpassword: 20urgle12-5
 
-dn: uid=nd, ou=People, o=University of Michigan,c=US
+dn: uid=nd, ou=People, dc=example, dc=com
 changetype: modify
 delete: userpassword
 userpassword: 20urgle12-5
@@ -197,9 +195,9 @@ if test $RC != 0 ; then
        exit $RC
 fi
 echo "Testing password history..."
-$LDAPMODIFY -v -D "$USER" -h $LOCALHOST -p $PORT1 -w 20urgle12-6 > \
+$LDAPMODIFY -v -D "$USER" -h $LOCALHOST -p $PORT1 -w 20urgle12-6 >> \
        $TESTOUT 2>&1 << EOMODS
-dn: uid=nd, ou=People, o=University of Michigan, c=US
+dn: uid=nd, ou=People, dc=example, dc=com
 changetype: modify
 delete: userPassword
 userPassword: 20urgle12-6
@@ -212,14 +210,14 @@ RC=$?
 if test $RC = 0 ; then
        echo "ldapmodify failed ($RC)!"
        test $KILLSERVERS != no && kill -HUP $KILLPIDS
-       exit $RC
+       exit 1
 fi
 
 echo "Testing forced reset..."
 
-$LDAPMODIFY -v -D "$MANAGERDN" -h $LOCALHOST -p $PORT1 -w $PASSWD > \
+$LDAPMODIFY -v -D "$MANAGERDN" -h $LOCALHOST -p $PORT1 -w $PASSWD >> \
        $TESTOUT 2>&1 << EOMODS
-dn: uid=nd, ou=People, o=University of Michigan, c=US
+dn: uid=nd, ou=People, dc=example, dc=com
 changetype: modify
 replace: userPassword
 userPassword: testpassword
@@ -241,7 +239,7 @@ RC=$?
 if test $RC = 0 ; then
        echo "Forced reset failed ($RC)!"
        test $KILLSERVERS != no && kill -HUP $KILLPIDS
-       exit $RC
+       exit 1
 fi
 
 COUNT=`grep "Operations are restricted" $SEARCHOUT | wc -l`
@@ -253,9 +251,9 @@ fi
 
 echo "Clearing forced reset..."
 
-$LDAPMODIFY -v -D "$MANAGERDN" -h $LOCALHOST -p $PORT1 -w $PASSWD > \
+$LDAPMODIFY -v -D "$MANAGERDN" -h $LOCALHOST -p $PORT1 -w $PASSWD >> \
        $TESTOUT 2>&1 << EOMODS
-dn: uid=nd, ou=People, o=University of Michigan, c=US
+dn: uid=nd, ou=People, dc=example, dc=com
 changetype: modify
 delete: pwdReset
 
@@ -280,19 +278,19 @@ echo "Testing Safe modify..."
 
 $LDAPPASSWD -h $LOCALHOST -p $PORT1 \
        -w $PASS -s failexpect \
-       -D "$USER" > $TESTOUT 2>&1
+       -D "$USER" >> $TESTOUT 2>&1
 RC=$?
 if test $RC = 0 ; then
        echo "Safe modify test 1 failed ($RC)!"
        test $KILLSERVERS != no && kill -HUP $KILLPIDS
-       exit $RC
+       exit 1
 fi
 
 sleep 2
 
 $LDAPPASSWD -h $LOCALHOST -p $PORT1 \
        -w $PASS -s failexpect -a $PASS \
-       -D "$USER" > $TESTOUT 2>&1
+       -D "$USER" >> $TESTOUT 2>&1
 RC=$?
 if test $RC != 0 ; then
        echo "Safe modify test 2 failed ($RC)!"
@@ -304,21 +302,101 @@ echo "Testing length requirement..."
 
 $LDAPPASSWD -h $LOCALHOST -p $PORT1 \
        -w failexpect -a failexpect -s spw \
-       -D "$USER" > $TESTOUT 2>&1
+       -D "$USER" > ${TESTOUT}.2 2>&1
 RC=$?
+cat ${TESTOUT}.2 >> $TESTOUT
 if test $RC = 0 ; then
        echo "Length requirement test failed ($RC)!"
        test $KILLSERVERS != no && kill -HUP $KILLPIDS
-       exit $RC
+       exit 1
 fi
-COUNT=`grep "Password fails quality" $TESTOUT | wc -l`
+COUNT=`grep "Password fails quality" ${TESTOUT}.2 | wc -l`
 if test $COUNT != 1 ; then
        echo "Length requirement test failed"
        test $KILLSERVERS != no && kill -HUP $KILLPIDS
        exit 1
 fi
 
+echo "Testing hashed length requirement..."
+
+$LDAPMODIFY -h $LOCALHOST -p $PORT1 -D "$USER" -w failexpect > \
+       ${TESTOUT}.2 2>&1 << EOMODS
+dn: $USER
+changetype: modify
+delete: userPassword
+userPassword: failexpect
+-
+add: userPassword
+userPassword: {MD5}xxxxxx
+
+EOMODS
+RC=$?
+cat ${TESTOUT}.2 >> $TESTOUT
+if test $RC = 0 ; then
+       echo "Hashed length requirement test failed ($RC)!"
+       test $KILLSERVERS != no && kill -HUP $KILLPIDS
+       exit 1
+fi
+COUNT=`grep "Password fails quality" ${TESTOUT}.2 | wc -l`
+if test $COUNT != 1 ; then
+       echo "Hashed length requirement test failed"
+       test $KILLSERVERS != no && kill -HUP $KILLPIDS
+       exit 1
+fi
+
+echo "Testing multiple password add/modify checks..."
+
+$LDAPMODIFY -h $LOCALHOST -p $PORT1 -D "$MANAGERDN" -w $PASSWD >> \
+       $TESTOUT 2>&1 << EOMODS
+dn: cn=Add Should Fail, ou=People, dc=example, dc=com
+changetype: add
+objectClass: inetOrgPerson
+cn: Add Should Fail
+sn: Fail
+userPassword: firstpw
+userPassword: secondpw
+EOMODS
+RC=$?
+if test $RC = 0 ; then
+       echo "Multiple password add test failed ($RC)!"
+       test $KILLSERVERS != no && kill -HUP $KILLPIDS
+       exit 1
+fi
+
+$LDAPMODIFY -h $LOCALHOST -p $PORT1 -D "$MANAGERDN" -w $PASSWD >> \
+       $TESTOUT 2>&1 << EOMODS
+dn: $USER
+changetype: modify
+add: userPassword
+userPassword: firstpw
+userPassword: secondpw
+EOMODS
+RC=$?
+if test $RC = 0 ; then
+       echo "Multiple password modify add test failed ($RC)!"
+       test $KILLSERVERS != no && kill -HUP $KILLPIDS
+       exit 1
+fi
+
+$LDAPMODIFY -h $LOCALHOST -p $PORT1 -D "$MANAGERDN" -w $PASSWD >> \
+       $TESTOUT 2>&1 << EOMODS
+dn: $USER
+changetype: modify
+replace: userPassword
+userPassword: firstpw
+userPassword: secondpw
+EOMODS
+RC=$?
+if test $RC = 0 ; then
+       echo "Multiple password modify replace test failed ($RC)!"
+       test $KILLSERVERS != no && kill -HUP $KILLPIDS
+       exit 1
+fi
+
 test $KILLSERVERS != no && kill -HUP $KILLPIDS
 
 echo ">>>>> Test succeeded"
+
+test $KILLSERVERS != no && wait
+
 exit 0