1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20 package org.apache.directory.server.core.authz;
21
22
23 import org.apache.directory.shared.ldap.exception.LdapNoPermissionException;
24 import org.apache.directory.shared.ldap.name.LdapDN;
25 import org.apache.directory.server.core.integ.CiRunner;
26 import org.apache.directory.server.core.integ.annotations.Factory;
27 import org.apache.directory.server.core.DirectoryService;
28 import org.junit.runner.RunWith;
29
30 import javax.naming.NamingException;
31 import javax.naming.NamingEnumeration;
32 import javax.naming.Name;
33 import javax.naming.directory.Attribute;
34 import javax.naming.directory.Attributes;
35 import javax.naming.directory.BasicAttribute;
36 import javax.naming.directory.BasicAttributes;
37 import javax.naming.directory.DirContext;
38 import javax.naming.directory.ModificationItem;
39
40 import java.util.List;
41 import java.util.ArrayList;
42
43 import static org.junit.Assert.assertTrue;
44 import static org.junit.Assert.assertFalse;
45 import org.junit.Test;
46
47 import static org.apache.directory.server.core.authz.AutzIntegUtils.createUser;
48 import static org.apache.directory.server.core.authz.AutzIntegUtils.getContextAs;
49 import static org.apache.directory.server.core.authz.AutzIntegUtils.getContextAsAdmin;
50 import static org.apache.directory.server.core.authz.AutzIntegUtils.createAccessControlSubentry;
51 import static org.apache.directory.server.core.authz.AutzIntegUtils.addUserToGroup;
52 import static org.apache.directory.server.core.authz.AutzIntegUtils.deleteAccessControlSubentry;
53 import static org.apache.directory.server.core.authz.AutzIntegUtils.createGroup;
54 import static org.apache.directory.server.core.authz.AutzIntegUtils.changePresciptiveACI;
55
56
57
58
59
60
61
62
63 @RunWith ( CiRunner.class )
64 @Factory ( AutzIntegUtils.ServiceFactory.class )
65 public class ModifyAuthorizationIT
66 {
67 public static DirectoryService service;
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88 public boolean checkCanModifyAs( String uid, String password, String entryRdn, ModificationItem[] mods )
89 throws Exception
90 {
91
92 Attributes testEntry = new BasicAttributes( "ou", "testou", true );
93 Attribute objectClass = new BasicAttribute( "objectClass" );
94 testEntry.put( objectClass );
95 objectClass.add( "top" );
96 objectClass.add( "organizationalUnit" );
97 testEntry.put( "telephoneNumber", "867-5309" );
98
99 DirContext adminContext = getContextAsAdmin();
100
101
102 try
103 {
104
105 LdapDN userName = new LdapDN( "uid=" + uid + ",ou=users,ou=system" );
106 adminContext.createSubcontext( entryRdn, testEntry );
107
108
109 DirContext userContext = getContextAs( userName, password );
110 userContext.modifyAttributes( entryRdn, mods );
111
112 return true;
113 }
114 catch ( LdapNoPermissionException e )
115 {
116 }
117 finally
118 {
119
120 adminContext.destroySubcontext( entryRdn );
121 }
122
123 return false;
124 }
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146 public boolean checkCanModifyAs( String uid, String password, String entryRdn, int modOp, Attributes mods )
147 throws Exception
148 {
149
150 Attributes testEntry = new BasicAttributes( "ou", "testou", true );
151 Attribute objectClass = new BasicAttribute( "objectClass" );
152 testEntry.put( objectClass );
153 objectClass.add( "top" );
154 objectClass.add( "organizationalUnit" );
155 testEntry.put( "telephoneNumber", "867-5309" );
156
157 DirContext adminContext = getContextAsAdmin();
158
159 try
160 {
161
162 LdapDN userName = new LdapDN( "uid=" + uid + ",ou=users,ou=system" );
163 adminContext.createSubcontext( entryRdn, testEntry );
164
165
166 DirContext userContext = getContextAs( userName, password );
167 userContext.modifyAttributes( entryRdn, modOp, mods );
168
169 return true;
170 }
171 catch ( LdapNoPermissionException e )
172 {
173 return false;
174 }
175 finally
176 {
177
178 adminContext.destroySubcontext( entryRdn );
179 }
180 }
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196 public boolean checkCanSelfModify( String uid, String password, int modOp, Attributes mods ) throws Exception
197 {
198 try
199 {
200
201 Name userEntry = new LdapDN( "uid=" + uid + ",ou=users,ou=system" );
202 DirContext userContext = getContextAs( userEntry, password, userEntry.toString() );
203 userContext.modifyAttributes( "", modOp, mods );
204 return true;
205 }
206 catch ( LdapNoPermissionException e )
207 {
208 return false;
209 }
210 }
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225 public boolean checkCanSelfModify( String uid, String password, ModificationItem[] mods ) throws Exception
226 {
227 try
228 {
229
230 Name userEntry = new LdapDN( "uid=" + uid + ",ou=users,ou=system" );
231 DirContext userContext = getContextAs( userEntry, password, userEntry.toString() );
232 userContext.modifyAttributes( "", mods );
233 return true;
234 }
235 catch ( LdapNoPermissionException e )
236 {
237 return false;
238 }
239 }
240
241
242
243
244
245
246
247
248
249
250 private ModificationItem[] toItems( int modOp, Attributes changes ) throws NamingException
251 {
252 List<ModificationItem> mods = new ArrayList<ModificationItem>();
253 NamingEnumeration<? extends Attribute> list = changes.getAll();
254 while ( list.hasMore() )
255 {
256 Attribute attr = list.next();
257 mods.add( new ModificationItem( modOp, attr ) );
258 }
259 ModificationItem[] modArray = new ModificationItem[mods.size()];
260 return mods.toArray( modArray );
261 }
262
263
264 @Test
265 public void testSelfModification() throws Exception
266 {
267
268
269
270
271
272 createUser( "billyd", "billyd" );
273
274
275 ModificationItem[] mods = toItems( DirContext.REPLACE_ATTRIBUTE, new BasicAttributes( "userPassword",
276 "williams", true ) );
277
278
279 assertFalse( checkCanSelfModify( "billyd", "billyd", mods ) );
280
281
282
283 createAccessControlSubentry( "selfModifyUserPassword", "{ " + "identificationTag \"addAci\", "
284 + "precedence 14, " + "authenticationLevel none, " + "itemOrUserFirst userFirst: { "
285 + "userClasses { thisEntry }, " + "userPermissions { "
286 + "{ protectedItems {entry}, grantsAndDenials { grantModify, grantBrowse, grantRead } }, "
287 + "{ protectedItems {allAttributeValues {userPassword}}, grantsAndDenials { grantAdd, grantRemove } } "
288 + "} } }" );
289
290
291 assertTrue( checkCanSelfModify( "billyd", "billyd", mods ) );
292 deleteAccessControlSubentry( "selfModifyUserPassword" );
293 }
294
295
296
297
298
299
300
301 @Test
302 public void testGrantModifyByTestGroup() throws Exception
303 {
304
305
306
307
308
309 ModificationItem[] mods = toItems( DirContext.ADD_ATTRIBUTE, new BasicAttributes( "registeredAddress",
310 "100 Park Ave.", true ) );
311
312
313 createUser( "billyd", "billyd" );
314
315 createGroup( "TestGroup" );
316
317
318 assertFalse( checkCanModifyAs( "billyd", "billyd", "ou=testou", mods ) );
319
320
321
322 createAccessControlSubentry( "administratorModifyAdd", "{ " + "identificationTag \"addAci\", "
323 + "precedence 14, " + "authenticationLevel none, " + "itemOrUserFirst userFirst: { "
324 + "userClasses { userGroup { \"cn=TestGroup,ou=groups,ou=system\" } }, " + "userPermissions { "
325 + "{ protectedItems {entry}, grantsAndDenials { grantModify, grantBrowse } }, "
326 + "{ protectedItems {attributeType {registeredAddress}, allAttributeValues {registeredAddress}}, grantsAndDenials { grantAdd } } " + "} } }" );
327
328
329
330 assertFalse( checkCanModifyAs( "billyd", "billyd", "ou=testou", mods ) );
331
332
333 addUserToGroup( "billyd", "TestGroup" );
334
335
336 assertTrue( checkCanModifyAs( "billyd", "billyd", "ou=testou", mods ) );
337 deleteAccessControlSubentry( "administratorModifyAdd" );
338
339
340
341
342
343
344 mods = toItems( DirContext.REMOVE_ATTRIBUTE, new BasicAttributes( "telephoneNumber", "867-5309", true ) );
345
346
347 assertFalse( checkCanModifyAs( "billyd", "billyd", "ou=testou", mods ) );
348
349
350
351 createAccessControlSubentry( "administratorModifyRemove", "{ " + "identificationTag \"addAci\", "
352 + "precedence 14, " + "authenticationLevel none, " + "itemOrUserFirst userFirst: { "
353 + "userClasses { userGroup { \"cn=TestGroup,ou=groups,ou=system\" } }, " + "userPermissions { "
354 + "{ protectedItems {entry}, grantsAndDenials { grantModify, grantBrowse } }, "
355 + "{ protectedItems {attributeType {telephoneNumber}, allAttributeValues {telephoneNumber}}, grantsAndDenials { grantRemove } } " + "} } }" );
356
357
358 assertTrue( checkCanModifyAs( "billyd", "billyd", "ou=testou", mods ) );
359 deleteAccessControlSubentry( "administratorModifyRemove" );
360
361
362
363
364
365
366 mods = toItems( DirContext.REPLACE_ATTRIBUTE, new BasicAttributes( "telephoneNumber", "867-5309", true ) );
367
368
369 assertFalse( checkCanModifyAs( "billyd", "billyd", "ou=testou", mods ) );
370
371
372
373 createAccessControlSubentry( "administratorModifyReplace", "{ " + "identificationTag \"addAci\", "
374 + "precedence 14, " + "authenticationLevel none, " + "itemOrUserFirst userFirst: { "
375 + "userClasses { userGroup { \"cn=TestGroup,ou=groups,ou=system\" } }, " + "userPermissions { "
376 + "{ protectedItems {entry}, grantsAndDenials { grantModify, grantBrowse } }, "
377 + "{ protectedItems {attributeType {registeredAddress}, allAttributeValues {telephoneNumber}}, grantsAndDenials { grantAdd, grantRemove } } "
378 + "} } }" );
379
380
381 assertTrue( checkCanModifyAs( "billyd", "billyd", "ou=testou", mods ) );
382 deleteAccessControlSubentry( "administratorModifyReplace" );
383
384
385
386
387
388
389
390
391
392 Attributes changes = new BasicAttributes( "registeredAddress", "100 Park Ave.", true );
393
394
395 assertFalse( checkCanModifyAs( "billyd", "billyd", "ou=testou", DirContext.ADD_ATTRIBUTE, changes ) );
396
397
398
399 createAccessControlSubentry( "administratorModifyAdd", "{ " + "identificationTag \"addAci\", "
400 + "precedence 14, " + "authenticationLevel none, " + "itemOrUserFirst userFirst: { "
401 + "userClasses { userGroup { \"cn=TestGroup,ou=groups,ou=system\" } }, " + "userPermissions { "
402 + "{ protectedItems {entry}, grantsAndDenials { grantModify, grantBrowse } }, "
403 + "{ protectedItems {attributeType {registeredAddress}, allAttributeValues {registeredAddress}}, grantsAndDenials { grantAdd } } " + "} } }" );
404
405
406 assertTrue( checkCanModifyAs( "billyd", "billyd", "ou=testou", DirContext.ADD_ATTRIBUTE, changes ) );
407 deleteAccessControlSubentry( "administratorModifyAdd" );
408
409
410
411
412
413
414 changes = new BasicAttributes( "telephoneNumber", "867-5309", true );
415
416
417 assertFalse( checkCanModifyAs( "billyd", "billyd", "ou=testou", DirContext.REMOVE_ATTRIBUTE, changes ) );
418
419
420
421 createAccessControlSubentry( "administratorModifyRemove", "{ " + "identificationTag \"addAci\", "
422 + "precedence 14, " + "authenticationLevel none, " + "itemOrUserFirst userFirst: { "
423 + "userClasses { userGroup { \"cn=TestGroup,ou=groups,ou=system\" } }, " + "userPermissions { "
424 + "{ protectedItems {entry}, grantsAndDenials { grantModify, grantBrowse } }, "
425 + "{ protectedItems {attributeType {telephoneNumber}, allAttributeValues {telephoneNumber}}, grantsAndDenials { grantRemove } } " + "} } }" );
426
427
428 assertTrue( checkCanModifyAs( "billyd", "billyd", "ou=testou", DirContext.REMOVE_ATTRIBUTE, changes ) );
429 deleteAccessControlSubentry( "administratorModifyRemove" );
430
431
432
433
434
435
436 changes = new BasicAttributes( "telephoneNumber", "867-5309", true );
437
438
439 assertFalse( checkCanModifyAs( "billyd", "billyd", "ou=testou", DirContext.REPLACE_ATTRIBUTE, changes ) );
440
441
442
443 createAccessControlSubentry( "administratorModifyReplace", "{ " + "identificationTag \"addAci\", "
444 + "precedence 14, " + "authenticationLevel none, " + "itemOrUserFirst userFirst: { "
445 + "userClasses { userGroup { \"cn=TestGroup,ou=groups,ou=system\" } }, " + "userPermissions { "
446 + "{ protectedItems {entry}, grantsAndDenials { grantModify, grantBrowse } }, "
447 + "{ protectedItems {attributeType {registeredAddress}, allAttributeValues {telephoneNumber}}, grantsAndDenials { grantAdd, grantRemove } } "
448 + "} } }" );
449
450
451 assertTrue( checkCanModifyAs( "billyd", "billyd", "ou=testou", DirContext.REPLACE_ATTRIBUTE, changes ) );
452 deleteAccessControlSubentry( "administratorModifyReplace" );
453 }
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544 @Test
545 public void testPresciptiveACIModification() throws Exception
546 {
547
548 ModificationItem[] mods = toItems( DirContext.ADD_ATTRIBUTE,
549 new BasicAttributes( "registeredAddress", "100 Park Ave.", true ) );
550
551 createUser( "billyd", "billyd" );
552
553 createAccessControlSubentry( "modifyACI", "{ " + "identificationTag \"modifyAci\", "
554 + "precedence 14, " + "authenticationLevel none, " + "itemOrUserFirst userFirst: { "
555 + "userClasses { allUsers }, " + "userPermissions { "
556 + "{ protectedItems {entry, allUserAttributeTypesAndValues}, grantsAndDenials { grantModify, grantBrowse, grantAdd, grantRemove } } } } }" );
557
558 assertTrue( checkCanModifyAs( "billyd", "billyd", "ou=testou", mods ) );
559
560 mods = toItems( DirContext.REPLACE_ATTRIBUTE,
561 new BasicAttributes( "registeredAddress", "200 Park Ave.", true ) );
562
563 changePresciptiveACI( "modifyACI", "{ " + "identificationTag \"modifyAci\", "
564 + "precedence 14, " + "authenticationLevel none, " + "itemOrUserFirst userFirst: { "
565 + "userClasses { allUsers }, " + "userPermissions { "
566 + "{ protectedItems {entry, allUserAttributeTypesAndValues}, grantsAndDenials { denyModify } } } } }" );
567
568 assertFalse( checkCanModifyAs( "billyd", "billyd", "ou=testou", mods ) );
569
570 deleteAccessControlSubentry( "modifyACI" );
571
572 }
573
574
575 @Test
576 public void testMaxValueCountProtectedItem() throws Exception
577 {
578 createUser( "billyd", "billyd" );
579 createAccessControlSubentry( "mvcACI",
580 " {" +
581 " identificationTag \"mvcACI\"," +
582 " precedence 10," +
583 " authenticationLevel simple," +
584 " itemOrUserFirst userFirst:" +
585 " {" +
586 " userClasses { allUsers }," +
587 " userPermissions" +
588 " {" +
589 " {" +
590 " protectedItems { entry }," +
591 " grantsAndDenials { grantModify, grantBrowse }" +
592 " }" +
593 " ," +
594 " {" +
595 " protectedItems" +
596 " {" +
597 " attributeType { description }," +
598 " allAttributeValues { description }," +
599 " maxValueCount" +
600 " {" +
601 " { type description, maxCount 1 }" +
602 " }" +
603 " }" +
604 " ," +
605 " grantsAndDenials" +
606 " {" +
607 " grantRemove," +
608 " grantAdd" +
609 " }" +
610 " }" +
611 " }" +
612 " }" +
613 " }" );
614
615 ModificationItem[] mods = toItems( DirContext.ADD_ATTRIBUTE,
616 new BasicAttributes( "description", "description 1", true ) );
617
618 assertTrue( checkCanModifyAs( "billyd", "billyd", "ou=testou", mods ) );
619
620 Attributes attrs = new BasicAttributes( true );
621 Attribute attr = new BasicAttribute( "description" );
622 attr.add( "description 1" );
623 attr.add( "description 2" );
624 attrs.put( attr );
625 mods = toItems( DirContext.ADD_ATTRIBUTE, attrs );
626
627 assertFalse( checkCanModifyAs( "billyd", "billyd", "ou=testou", mods ) );
628
629 mods = toItems( DirContext.REPLACE_ATTRIBUTE, attrs );
630
631 assertFalse( checkCanModifyAs( "billyd", "billyd", "ou=testou", mods ) );
632 }
633 }