From 64a160e601e74877e6ec09a9a156efce8924fdb7 Mon Sep 17 00:00:00 2001 From: Radovan Semancik Date: Fri, 22 Nov 2019 18:45:06 +0100 Subject: [PATCH 1/6] Switch to LDAP connector 2.4, tests for "tree delete" LDAP control --- build-system/pom.xml | 2 +- .../impl/opendj/AbstractOpenDjTest.java | 4 + .../provisioning/impl/opendj/TestOpenDj.java | 81 +++++++++++++++++- .../impl/opendj/TestOpenDjDumber.java | 33 +++++++ .../src/test/resources/opendj/ou-super.xml | 24 ++++++ .../opendj/resource-opendj-dumber.xml | 1 + .../resource-opendj-incomplete-password.xml | 1 + .../resource-opendj-readable-password.xml | 1 + .../test/resources/opendj/resource-opendj.xml | 16 ++++ .../src/test/resources/connector-ldap.xml | 2 +- .../ad/AbstractAdLdapMultidomainTest.java | 32 +++++-- .../conntest/ad/TestAdLdapChimeraStrange.java | 37 ++++++++ .../resource-chimera-native-schema.xml | 1 + .../resource-chimera-runas.xml | 1 + .../resource-chimera-strange.xml | 1 + .../ad-ldap-multidomain/resource-chimera.xml | 7 +- .../src/test/resources/truststore.jks | Bin 7400 -> 7400 bytes 17 files changed, 230 insertions(+), 14 deletions(-) create mode 100644 provisioning/provisioning-impl/src/test/resources/opendj/ou-super.xml diff --git a/build-system/pom.xml b/build-system/pom.xml index 7d0da317939..27966258a1c 100644 --- a/build-system/pom.xml +++ b/build-system/pom.xml @@ -765,7 +765,7 @@ com.evolveum.polygon connector-ldap - 2.3 + 2.4 diff --git a/provisioning/provisioning-impl/src/test/java/com/evolveum/midpoint/provisioning/impl/opendj/AbstractOpenDjTest.java b/provisioning/provisioning-impl/src/test/java/com/evolveum/midpoint/provisioning/impl/opendj/AbstractOpenDjTest.java index acd0d16c7d9..203d757bd99 100644 --- a/provisioning/provisioning-impl/src/test/java/com/evolveum/midpoint/provisioning/impl/opendj/AbstractOpenDjTest.java +++ b/provisioning/provisioning-impl/src/test/java/com/evolveum/midpoint/provisioning/impl/opendj/AbstractOpenDjTest.java @@ -136,6 +136,10 @@ public abstract class AbstractOpenDjTest extends AbstractProvisioningIntegration protected static final String GROUP_CORSAIRS_OID = "70a1f3ee-4b5b-11e5-95d0-001e8c717e5b"; protected static final String GROUP_CORSAIRS_DN = "cn=corsairs,ou=groups,dc=example,dc=com"; + protected static final File OU_SUPER_FILE = new File(TEST_DIR, "ou-super.xml"); + protected static final String OU_SUPER_OID = "1d1e519e-0d22-11ea-8cdf-3f09f7f3a585"; + protected static final String OU_SUPER_DN = "ou=Super,dc=example,dc=com"; + protected static final String NON_EXISTENT_OID = "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"; public static final String RESOURCE_NS = "http://midpoint.evolveum.com/xml/ns/public/resource/instance/ef2bc95b-76e0-59e2-86d6-3d4f02d3ffff"; diff --git a/provisioning/provisioning-impl/src/test/java/com/evolveum/midpoint/provisioning/impl/opendj/TestOpenDj.java b/provisioning/provisioning-impl/src/test/java/com/evolveum/midpoint/provisioning/impl/opendj/TestOpenDj.java index 13585c561e0..864ba0f2a04 100644 --- a/provisioning/provisioning-impl/src/test/java/com/evolveum/midpoint/provisioning/impl/opendj/TestOpenDj.java +++ b/provisioning/provisioning-impl/src/test/java/com/evolveum/midpoint/provisioning/impl/opendj/TestOpenDj.java @@ -37,6 +37,7 @@ import org.apache.commons.lang.StringUtils; import org.opends.server.types.Entry; +import org.opends.server.util.LDIFException; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.test.annotation.DirtiesContext; import org.springframework.test.context.ContextConfiguration; @@ -2852,7 +2853,7 @@ public void test456AddGroupSpecialists() throws Exception { OperationResult result = task.getResult(); ShadowType object = parseObjectType(GROUP_SPECIALISTS_FILE, ShadowType.class); - IntegrationTestTools.display("Adding object", object); + display("Adding object", object); // WHEN displayWhen(TEST_NAME); @@ -3283,6 +3284,84 @@ public void test479ModifyAccountJackDescriptionJack() throws Exception { assertShadows(25); } + @Test + public void test480AddOuSuper() throws Exception { + final String TEST_NAME = "test480AddOuSuper"; + displayTestTitle(TEST_NAME); + + Task task = createTask(TEST_NAME); + OperationResult result = task.getResult(); + + ShadowType object = parseObjectType(OU_SUPER_FILE, ShadowType.class); + display("Adding object", object); + + // WHEN + displayWhen(TEST_NAME); + String addedObjectOid = provisioningService.addObject(object.asPrismObject(), null, null, task, result); + + // THEN + displayThen(TEST_NAME); + assertEquals(OU_SUPER_OID, addedObjectOid); + + ShadowType shadowType = getShadowRepo(OU_SUPER_OID).asObjectable(); + PrismAsserts.assertEqualsPolyString("Wrong ICF name (repo)", OU_SUPER_DN, shadowType.getName()); + + PrismObject provisioningShadow = provisioningService.getObject(ShadowType.class, OU_SUPER_OID, + null, taskManager.createTaskInstance(), result); + ShadowType provisioningShadowType = provisioningShadow.asObjectable(); + assertEquals("Wrong ICF name (provisioning)", dnMatchingRule.normalize(OU_SUPER_DN), + dnMatchingRule.normalize(provisioningShadowType.getName().getOrig())); + + String uid = ShadowUtil.getSingleStringAttributeValue(shadowType, getPrimaryIdentifierQName()); + assertNotNull(uid); + + Entry ldapEntry = openDJController.searchAndAssertByEntryUuid(uid); + display("LDAP ou", ldapEntry); + assertNotNull("No LDAP ou entry"); + String groupDn = ldapEntry.getDN().toString(); + assertEquals("Wrong ou DN", dnMatchingRule.normalize(OU_SUPER_DN), dnMatchingRule.normalize(groupDn)); + + assertShadows(26); + } + + /** + * Try to delete ou=Super,dc=example,dc=com. But before doing that create a subobject: + * ou=sub,ou=Super,dc=example,dc=com. LDAP server should normally refuse to delete the Super OU + * because it is not empty. But we have configured use of "tree delete" control here. + * Therefore the delete should work. + * + * MID-5935 + */ + @Test + public void test489DeleteOuSuperWithSub() throws Exception { + final String TEST_NAME = "test489DeleteOuSuperWithSub"; + displayTestTitle(TEST_NAME); + + Task task = createTask(TEST_NAME); + OperationResult result = task.getResult(); + + createSubOrg(); + + // WHEN + displayWhen(TEST_NAME); + provisioningService.deleteObject(ShadowType.class, OU_SUPER_OID, null, null, task, result); + + // THEN + displayThen(TEST_NAME); + assertSuccess(result); + + assertNoRepoShadow(OU_SUPER_OID); + openDJController.assertNoEntry(OU_SUPER_DN); + + assertShadows(25); + } + + protected void createSubOrg() throws IOException, LDIFException { + openDJController.addEntry("dn: ou=sub,ou=Super,dc=example,dc=com\n"+ + "objectClass: organizationalUnit\n"+ + "ou: sub"); + } + @Test public void test701ConfiguredCapabilityNoRead() throws Exception{ final String TEST_NAME = "test701ConfiguredCapabilityNoRead"; diff --git a/provisioning/provisioning-impl/src/test/java/com/evolveum/midpoint/provisioning/impl/opendj/TestOpenDjDumber.java b/provisioning/provisioning-impl/src/test/java/com/evolveum/midpoint/provisioning/impl/opendj/TestOpenDjDumber.java index 18dce5f52c8..1bbf33d000e 100644 --- a/provisioning/provisioning-impl/src/test/java/com/evolveum/midpoint/provisioning/impl/opendj/TestOpenDjDumber.java +++ b/provisioning/provisioning-impl/src/test/java/com/evolveum/midpoint/provisioning/impl/opendj/TestOpenDjDumber.java @@ -11,6 +11,9 @@ import java.io.File; +import com.evolveum.midpoint.schema.result.OperationResult; +import com.evolveum.midpoint.task.api.Task; +import com.evolveum.midpoint.xml.ns._public.common.common_3.ShadowType; import org.springframework.test.annotation.DirtiesContext; import org.springframework.test.context.ContextConfiguration; @@ -19,6 +22,7 @@ import com.evolveum.midpoint.util.DOMUtil; import com.evolveum.midpoint.util.logging.Trace; import com.evolveum.midpoint.util.logging.TraceManager; +import org.testng.annotations.Test; /** * Test for provisioning service implementation using embedded OpenDj instance. @@ -73,4 +77,33 @@ protected void assertTimestamp(String attrName, Object timestampValue) { assertTrue("Timestamp "+attrName+" does not end with Z: "+str, str.endsWith("Z")); } + /** + * This resource has disabled "tree delete". + */ + @Test + @Override + public void test489DeleteOuSuperWithSub() throws Exception { + final String TEST_NAME = "test489DeleteOuSuperWithSub"; + displayTestTitle(TEST_NAME); + + Task task = createTask(TEST_NAME); + OperationResult result = task.getResult(); + + createSubOrg(); + + try { + // WHEN + displayWhen(TEST_NAME); + provisioningService.deleteObject(ShadowType.class, OU_SUPER_OID, null, null, task, result); + + assertNotReached(); + } catch (IllegalArgumentException e) { + // expected + } + + // THEN + displayThen(TEST_NAME); + assertFailure(result); + } + } diff --git a/provisioning/provisioning-impl/src/test/resources/opendj/ou-super.xml b/provisioning/provisioning-impl/src/test/resources/opendj/ou-super.xml new file mode 100644 index 00000000000..7537381a046 --- /dev/null +++ b/provisioning/provisioning-impl/src/test/resources/opendj/ou-super.xml @@ -0,0 +1,24 @@ + + + + + + ou=Super,dc=example,dc=com + + ri:organizationalUnit + generic + ou + + ou=super,dc=example,dc=com + Super + + diff --git a/provisioning/provisioning-impl/src/test/resources/opendj/resource-opendj-dumber.xml b/provisioning/provisioning-impl/src/test/resources/opendj/resource-opendj-dumber.xml index 8f671fc1823..954ea433f49 100644 --- a/provisioning/provisioning-impl/src/test/resources/opendj/resource-opendj-dumber.xml +++ b/provisioning/provisioning-impl/src/test/resources/opendj/resource-opendj-dumber.xml @@ -39,6 +39,7 @@ somehow dumber: no shortcut in associations, expclicit duplicity checks, etc. ds-pwp-account-disabled isMemberOf createTimestamp + never description never string diff --git a/provisioning/provisioning-impl/src/test/resources/opendj/resource-opendj-incomplete-password.xml b/provisioning/provisioning-impl/src/test/resources/opendj/resource-opendj-incomplete-password.xml index 88a715b1264..030c275ada3 100644 --- a/provisioning/provisioning-impl/src/test/resources/opendj/resource-opendj-incomplete-password.xml +++ b/provisioning/provisioning-impl/src/test/resources/opendj/resource-opendj-incomplete-password.xml @@ -34,6 +34,7 @@ ds-pwp-account-disabled isMemberOf createTimestamp + auto description false incompleteRead diff --git a/provisioning/provisioning-impl/src/test/resources/opendj/resource-opendj-readable-password.xml b/provisioning/provisioning-impl/src/test/resources/opendj/resource-opendj-readable-password.xml index 569ec734d45..ae83b3f6d27 100644 --- a/provisioning/provisioning-impl/src/test/resources/opendj/resource-opendj-readable-password.xml +++ b/provisioning/provisioning-impl/src/test/resources/opendj/resource-opendj-readable-password.xml @@ -34,6 +34,7 @@ ds-pwp-account-disabled isMemberOf createTimestamp + auto description false readable diff --git a/provisioning/provisioning-impl/src/test/resources/opendj/resource-opendj.xml b/provisioning/provisioning-impl/src/test/resources/opendj/resource-opendj.xml index e27dcfcec3c..06d4ccca4d0 100644 --- a/provisioning/provisioning-impl/src/test/resources/opendj/resource-opendj.xml +++ b/provisioning/provisioning-impl/src/test/resources/opendj/resource-opendj.xml @@ -35,6 +35,7 @@ isMemberOf createTimestamp description + auto false @@ -226,6 +227,21 @@ + + generic + ou + Organizational Unit + ri:organizationalUnit + + ri:entryUUID + mr:stringIgnoreCase + + + ri:dn + mr:distinguishedName + + + diff --git a/provisioning/ucf-impl-connid/src/test/resources/connector-ldap.xml b/provisioning/ucf-impl-connid/src/test/resources/connector-ldap.xml index 2abb168de72..4399a15dcb2 100644 --- a/provisioning/ucf-impl-connid/src/test/resources/connector-ldap.xml +++ b/provisioning/ucf-impl-connid/src/test/resources/connector-ldap.xml @@ -14,7 +14,7 @@ ICF com.evolveum.polygon.connector.ldap.LdapConnector http://midpoint.evolveum.com/xml/ns/public/connector/icf-1 com.evolveum.polygon.connector.ldap.LdapConnector - 2.3 + 2.4 com.evolveum.polygon.connector-ldap http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/bundle/com.evolveum.polygon.connector-ldap/com.evolveum.polygon.connector.ldap.LdapConnector diff --git a/testing/conntest/src/test/java/com/evolveum/midpoint/testing/conntest/ad/AbstractAdLdapMultidomainTest.java b/testing/conntest/src/test/java/com/evolveum/midpoint/testing/conntest/ad/AbstractAdLdapMultidomainTest.java index 4b826419060..fd4bf9151d5 100644 --- a/testing/conntest/src/test/java/com/evolveum/midpoint/testing/conntest/ad/AbstractAdLdapMultidomainTest.java +++ b/testing/conntest/src/test/java/com/evolveum/midpoint/testing/conntest/ad/AbstractAdLdapMultidomainTest.java @@ -325,6 +325,7 @@ public void test000Sanity() throws Exception { cleanupDelete(toOrgGroupDn(GROUP_MELEE_ISLAND_PIRATES_NAME, GROUP_MELEE_ISLAND_NAME)); cleanupDelete(toOrgGroupDn(GROUP_MELEE_ISLAND_PIRATES_NAME, GROUP_MELEE_ISLAND_ALT_NAME)); cleanupDelete(toOrgDn(GROUP_MELEE_ISLAND_NAME)); + cleanupDelete("ou=underMelee," + toOrgDn(GROUP_MELEE_ISLAND_ALT_NAME)); cleanupDelete(toOrgDn(GROUP_MELEE_ISLAND_ALT_NAME)); } @@ -1654,8 +1655,7 @@ public void test500AddOrgMeleeIsland() throws Exception { // THEN displayThen(TEST_NAME); - result.computeStatus(); - TestUtil.assertSuccess(result); + assertSuccess(result); orgMeleeIslandOid = org.getOid(); Entry entryGroup = assertLdapGroup(GROUP_MELEE_ISLAND_NAME); @@ -1868,8 +1868,7 @@ public void test524GetMeleeIslandPirates() throws Exception { // THEN displayThen(TEST_NAME); - result.computeStatus(); - TestUtil.assertSuccess(result); + assertSuccess(result); display("Shadow after", shadow); assertNotNull(shadow); @@ -1879,6 +1878,7 @@ public void test524GetMeleeIslandPirates() throws Exception { Entry entryOu = assertLdapOrg(GROUP_MELEE_ISLAND_ALT_NAME); assertNoLdapOrg(GROUP_MELEE_ISLAND_NAME); Entry entryOrgGroup = assertLdapOrgGroup(GROUP_MELEE_ISLAND_PIRATES_NAME, GROUP_MELEE_ISLAND_ALT_NAME); + display("Melee org", entryOrgGroup); assertNoLdapOrgGroup(GROUP_MELEE_ISLAND_PIRATES_NAME, GROUP_MELEE_ISLAND_NAME); // assertLdapConnectorInstances(2); @@ -1899,8 +1899,7 @@ public void test595DeleteOrgGroupMeleeIslandPirates() throws Exception { // THEN displayThen(TEST_NAME); - result.computeStatus(); - TestUtil.assertSuccess(result); + assertSuccess(result); assertNoLdapOrgGroup(GROUP_MELEE_ISLAND_PIRATES_NAME, GROUP_MELEE_ISLAND_ALT_NAME); assertNoLdapOrgGroup(GROUP_MELEE_ISLAND_PIRATES_NAME, GROUP_MELEE_ISLAND_NAME); @@ -1910,6 +1909,13 @@ public void test595DeleteOrgGroupMeleeIslandPirates() throws Exception { // assertLdapConnectorInstances(2); } + /** + * We create "underMelee" org that gets into the way of the delete. + * Melee cannot be deleted in an ordinary way. "tree delete" control must + * be used. This is configured in the connector config. + * + * MID-5935 + */ @Test public void test599DeleteOrgMeleeIsland() throws Exception { final String TEST_NAME = "test599DeleteOrgMeleeIsland"; @@ -1919,14 +1925,15 @@ public void test599DeleteOrgMeleeIsland() throws Exception { Task task = createTask(TEST_NAME); OperationResult result = task.getResult(); + createUnderMeleeEntry(); + // WHEN displayWhen(TEST_NAME); deleteObject(OrgType.class, orgMeleeIslandOid, task, result); // THEN displayThen(TEST_NAME); - result.computeStatus(); - TestUtil.assertSuccess(result); + assertSuccess(result); assertNoLdapGroup(GROUP_MELEE_ISLAND_NAME); assertNoLdapGroup(GROUP_MELEE_ISLAND_ALT_NAME); @@ -1939,6 +1946,15 @@ public void test599DeleteOrgMeleeIsland() throws Exception { // assertLdapConnectorInstances(2); } + protected void createUnderMeleeEntry() throws LdapException, IOException { + // This OU just gets into the way of the delete. + Entry entry = new DefaultEntry("ou=underMelee," + toOrgDn(GROUP_MELEE_ISLAND_ALT_NAME), + "objectclass", "organizationalUnit", + "ou", "underMelee"); + display("underMelee org", entry); + addLdapEntry(entry); + } + @Test public void test600AssignAccountSubman() throws Exception { final String TEST_NAME = "test600AssignAccountSubman"; diff --git a/testing/conntest/src/test/java/com/evolveum/midpoint/testing/conntest/ad/TestAdLdapChimeraStrange.java b/testing/conntest/src/test/java/com/evolveum/midpoint/testing/conntest/ad/TestAdLdapChimeraStrange.java index 611aa565f1d..11cb55ff27d 100644 --- a/testing/conntest/src/test/java/com/evolveum/midpoint/testing/conntest/ad/TestAdLdapChimeraStrange.java +++ b/testing/conntest/src/test/java/com/evolveum/midpoint/testing/conntest/ad/TestAdLdapChimeraStrange.java @@ -6,10 +6,15 @@ */ package com.evolveum.midpoint.testing.conntest.ad; +import com.evolveum.midpoint.schema.result.OperationResult; +import com.evolveum.midpoint.task.api.Task; +import com.evolveum.midpoint.xml.ns._public.common.common_3.OrgType; +import com.evolveum.midpoint.xml.ns._public.common.common_3.ShadowType; import org.springframework.test.annotation.DirtiesContext; import org.springframework.test.annotation.DirtiesContext.ClassMode; import org.springframework.test.context.ContextConfiguration; import org.testng.annotations.Listeners; +import org.testng.annotations.Test; import java.io.File; @@ -28,4 +33,36 @@ protected File getResourceFile() { return new File(getBaseDir(), "resource-chimera-strange.xml"); } + /** + * This resource has "tree delete" disabled. + * MID-5935 + */ + @Test + public void test599DeleteOrgMeleeIsland() throws Exception { + final String TEST_NAME = "test599DeleteOrgMeleeIsland"; + displayTestTitle(TEST_NAME); + + // GIVEN + Task task = createTask(TEST_NAME); + OperationResult result = task.getResult(); + + createUnderMeleeEntry(); + + try { + // WHEN + displayWhen(TEST_NAME); + deleteObject(OrgType.class, orgMeleeIslandOid, task, result); + + assertNotReached(); + } catch (IllegalArgumentException e) { + // expected + } + + // THEN + displayThen(TEST_NAME); + assertFailure(result); + +// assertLdapConnectorInstances(2); + } + } diff --git a/testing/conntest/src/test/resources/ad-ldap-multidomain/resource-chimera-native-schema.xml b/testing/conntest/src/test/resources/ad-ldap-multidomain/resource-chimera-native-schema.xml index 19e41a8adda..21ccc770627 100644 --- a/testing/conntest/src/test/resources/ad-ldap-multidomain/resource-chimera-native-schema.xml +++ b/testing/conntest/src/test/resources/ad-ldap-multidomain/resource-chimera-native-schema.xml @@ -44,6 +44,7 @@ msExchHideFromAddressLists true false + auto midpoint midpoint credssp diff --git a/testing/conntest/src/test/resources/ad-ldap-multidomain/resource-chimera-runas.xml b/testing/conntest/src/test/resources/ad-ldap-multidomain/resource-chimera-runas.xml index 20cf530f1fa..a3d9a6a2d42 100644 --- a/testing/conntest/src/test/resources/ad-ldap-multidomain/resource-chimera-runas.xml +++ b/testing/conntest/src/test/resources/ad-ldap-multidomain/resource-chimera-runas.xml @@ -41,6 +41,7 @@ bind true false + auto midpoint midpoint credssp diff --git a/testing/conntest/src/test/resources/ad-ldap-multidomain/resource-chimera-strange.xml b/testing/conntest/src/test/resources/ad-ldap-multidomain/resource-chimera-strange.xml index 16b894e93be..1a426b539f7 100644 --- a/testing/conntest/src/test/resources/ad-ldap-multidomain/resource-chimera-strange.xml +++ b/testing/conntest/src/test/resources/ad-ldap-multidomain/resource-chimera-strange.xml @@ -40,6 +40,7 @@ msExchHideFromAddressLists true false + never midpoint midpoint credssp diff --git a/testing/conntest/src/test/resources/ad-ldap-multidomain/resource-chimera.xml b/testing/conntest/src/test/resources/ad-ldap-multidomain/resource-chimera.xml index 088df2d8af8..2cdb21d6c3d 100644 --- a/testing/conntest/src/test/resources/ad-ldap-multidomain/resource-chimera.xml +++ b/testing/conntest/src/test/resources/ad-ldap-multidomain/resource-chimera.xml @@ -40,6 +40,7 @@ msExchHideFromAddressLists true false + always midpoint midpoint credssp @@ -87,7 +88,7 @@ mr:distinguishedName - $user/fullName + fullName