mirror of
https://github.com/osixia/container-openldap.git
synced 2026-11-12 15:23:49 -04:00
98 lines
3.5 KiB
Bash
98 lines
3.5 KiB
Bash
#!/bin/bash
|
|
|
|
set -euo pipefail
|
|
|
|
# if container log level is trace:
|
|
# print commands and their arguments as they are executed
|
|
container log level eq trace && set -x
|
|
|
|
# shellcheck disable=SC1091
|
|
source /tmp/openldap-test-lib.sh
|
|
|
|
URI="ldap://${TEST_NODES}:3890"
|
|
POLICY_DN="cn=default,ou=policies,${TEST_SUFFIX}"
|
|
USER_DN="uid=delay-user,${TEST_SUFFIX}"
|
|
OTHER_DN="uid=other-user,${TEST_SUFFIX}"
|
|
|
|
eventually has_entry "${URI}" "${POLICY_DN}"
|
|
expect_rc 0 bind_search "${URI}" "${ADMIN_DN}" -b "${POLICY_DN}" -s base pwdMinDelay pwdMaxDelay
|
|
if [ "${TEST_PPOLICY_DELAY_MODE}" = default ]; then
|
|
expect_output '^pwdMinDelay: 0$'
|
|
expect_output '^pwdMaxDelay: 0$'
|
|
else
|
|
expect_output '^pwdMinDelay: 2$'
|
|
expect_output '^pwdMaxDelay: 4$'
|
|
fi
|
|
|
|
for user in delay-user other-user; do
|
|
expect_rc 0 bind_modify "${URI}" "${ADMIN_DN}" -a <<LDIF
|
|
dn: uid=${user},${TEST_SUFFIX}
|
|
objectClass: inetOrgPerson
|
|
uid: ${user}
|
|
cn: ${user}
|
|
sn: User
|
|
userPassword: ${TEST_PASSWORD}
|
|
LDIF
|
|
done
|
|
|
|
timestamp_epoch() {
|
|
local stamp="$1"
|
|
date -u -d "${stamp:0:4}-${stamp:4:2}-${stamp:6:2} ${stamp:8:2}:${stamp:10:2}:${stamp:12:2}" +%s
|
|
}
|
|
|
|
check_delay() {
|
|
local expected="$1"
|
|
local failure_time lockout_end
|
|
expect_rc 49 ldapwhoami -x -H "${URI}" -D "${USER_DN}" -w incorrect-password
|
|
expect_rc 0 bind_search "${URI}" "${ADMIN_DN}" -b "${USER_DN}" -s base pwdFailureTime pwdAccountTmpLockoutEnd
|
|
failure_time=$(sed -n 's/^pwdFailureTime: //p' "${OUTPUT_FILE}" | sort | tail -1)
|
|
lockout_end=$(sed -n 's/^pwdAccountTmpLockoutEnd: //p' "${OUTPUT_FILE}")
|
|
[ -n "${failure_time}" ] && [ -n "${lockout_end}" ] || fail 'missing failure or lockout timestamp'
|
|
[ "$(( $(timestamp_epoch "${lockout_end}") - $(timestamp_epoch "${failure_time}") ))" -eq "${expected}" ] || fail "expected ${expected}-second lockout"
|
|
expect_rc 49 ldapwhoami -x -H "${URI}" -D "${USER_DN}" -w "${TEST_PASSWORD}"
|
|
expect_rc 0 ldapwhoami -x -H "${URI}" -D "${OTHER_DN}" -w "${TEST_PASSWORD}"
|
|
}
|
|
|
|
expire_delay() {
|
|
# Expire only the temporary lockout, preserving the failure history for progression.
|
|
expect_rc 0 bind_modify "${URI}" "${ADMIN_DN}" -e relax <<LDIF
|
|
dn: ${USER_DN}
|
|
changetype: modify
|
|
replace: pwdAccountTmpLockoutEnd
|
|
pwdAccountTmpLockoutEnd: 20000101000000Z
|
|
LDIF
|
|
}
|
|
|
|
if [ "${TEST_PPOLICY_DELAY_MODE}" = default ]; then
|
|
expect_rc 49 ldapwhoami -x -H "${URI}" -D "${USER_DN}" -w incorrect-password
|
|
expect_rc 0 bind_search "${URI}" "${ADMIN_DN}" -b "${USER_DN}" -s base pwdAccountTmpLockoutEnd
|
|
expect_no_output '^pwdAccountTmpLockoutEnd:'
|
|
expect_rc 0 ldapwhoami -x -H "${URI}" -D "${USER_DN}" -w "${TEST_PASSWORD}"
|
|
ok 'progressive lockouts are disabled by default'
|
|
exit 0
|
|
fi
|
|
|
|
check_delay 2
|
|
expire_delay
|
|
|
|
if [ "${TEST_PPOLICY_DELAY_MODE}" = threshold ]; then
|
|
expect_rc 49 ldapwhoami -x -H "${URI}" -D "${USER_DN}" -w incorrect-password
|
|
expect_rc 0 bind_search "${URI}" "${ADMIN_DN}" -b "${USER_DN}" -s base pwdAccountLockedTime
|
|
expect_output '^pwdAccountLockedTime: [0-9]{14}Z$'
|
|
expect_rc 49 ldapwhoami -x -H "${URI}" -D "${USER_DN}" -w "${TEST_PASSWORD}"
|
|
ok 'the fixed lockout still applies when pwdMaxFailure is reached'
|
|
exit 0
|
|
fi
|
|
|
|
check_delay 4
|
|
expire_delay
|
|
check_delay 4
|
|
expire_delay
|
|
ok 'per-account lockouts double and stop at the configured maximum'
|
|
|
|
expect_rc 0 ldapwhoami -x -H "${URI}" -D "${USER_DN}" -w "${TEST_PASSWORD}"
|
|
expect_rc 0 bind_search "${URI}" "${ADMIN_DN}" -b "${USER_DN}" -s base pwdFailureTime
|
|
expect_no_output '^pwdFailureTime:'
|
|
check_delay 2
|
|
ok 'successful authentication clears failures and resets the progression'
|