path: root/ldap/test-user-acl.sh

#!/bin/sh

# This a test suite for the user ACLs.
# *Every* modification to the schema and/or to the ACLs should be made
# here too! It is crucial that the test suite doesn't break.
#
# Requires a populated database with every possible test case, like
# `populate.ldif'.
# The database remains unchanged, but slapacl needs to have read access,
# so the test suite may have to be run by root.


SLAPACL=/usr/sbin/slapacl
SUFFIXV="ou=virtual,o=mailHosting,dc=fripost,dc=dev"
SUFFIXS="ou=services,o=mailHosting,dc=fripost,dc=dev"
SUFFIX="${SUFFIXV}"

RES=$(tempfile) || exit 1

checkACL () {
    CMD=${SLAPACL}
    if [ x"${1}" = x"''" ]; then BIND=${SUFFIX}; else BIND="${1},${SUFFIX}"; fi
    if [ -n "${1}" ]; then CMD="${CMD} -D ${BIND}"; fi
    if [ -n "${2}" ]; then BASE="${2},${SUFFIXV}"; else BASE="${SUFFIXV}"; fi
    shift; shift

    ${CMD} -b "${BASE}" "$@" 2>&1 | grep -vixF -e "authcDN: \"${BIND}\""
    N=1
}

msg () {
    /bin/echo -n "  "
    /bin/echo -n "$@"
    /bin/echo -n "... "
}

isOK () {
    # Ensures that every line in "$RES" satisfies the regexp "$1".
    # The total count is the number of "$2" attributes, or the number of lines in "$RES".
    [ -n "${1}" ] || exit 1
    cat > "${RES}"
    if [ -n "${2}" ]; then
        if [ -n "${3}" ]; then
            TOT=$(grep -Pic "^${3} access to ${2}: " < "${RES}")
        else
            TOT=$(grep -Pic "^((write|add|delete|read|search|compare|auth|disclose) access to )?${2}: " < "${RES}")
        fi
    else
        TOT=$(wc -l < "${RES}")
    fi
    FAILS=$(grep -vc "${1}" < "${RES}")
    if [ ${FAILS} -eq 0 ]; then
        /bin/echo -n "OK"
    else
        echo "Fail! (x${FAILS})"; exit 1
    fi
    /bin/echo -n " (${TOT}/${TOT})"
    echo
    # We need a complete test suite
    ([ -n "${TOT}" ] && [ ${TOT} -ne 0 ]) || (echo "Add more test data."; exit 1)
}

search () {
    ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:// "$@"
}


########################################################################


DOMAINS=$(search -u -b "${SUFFIX}" "objectClass=FripostVirtualDomain" dn | \
          grep -i '^ufn: ' | sed -re 's/^ufn: ([^,]+),.*/fvd=\1/')
USERS=$(search -u -b "${SUFFIX}" "objectClass=FripostVirtualUser" dn | \
        grep -i '^ufn: ' | sed -re 's/^ufn: ([^,]+), *([^,]+),.*/fvu=\1,fvd=\2/')
ALIASES=$(search -u  -b "${SUFFIX}" "objectClass=FripostVirtualAlias" dn | \
          grep -i '^ufn: ' | sed -re 's/^ufn: ([^,]+), *([^,]+),.*/fva=\1,fvd=\2/')
LISTS=$(search -u -b "${SUFFIX}" "objectClass=FripostVirtualList" dn | \
      grep -i '^ufn: ' | sed -re 's/^ufn: ([^,]+), *([^,]+),.*/fvl=\1,fvd=\2/')
LISTSC=$(search -u -b "${SUFFIX}" "objectClass=FripostVirtualListCommand" dn | \
       grep -i '^ufn: ' | sed -re 's/^ufn: ([^,]+), *([^,]+), *([^,]+),.*/fvlc=\1,fvl=\2,fvd=\3/')

OPERATTRS="structuralObjectClass creatorsName entryUUID createTimestamp entryCSN modifiersName modifyTimestamp"


########################################################################


echo "Anonymous users:"


# Anonymous need to bind to any fvu
msg "Have =xd access to \"userPassword\" attributes"
for U in ${USERS}; do
    checkACL "" "${U}" userPassword
done | isOK '=xd$'
[ $? -eq 0 ] || exit $?


msg "Have =0 access to the rest of user entries"
for U in ${USERS}; do
    checkACL "" "${U}"
done | grep -v '^userPassword=.*: =xd$' | isOK '=0$' entry
[ $? -eq 0 ] || exit $?


msg "Have =0 access to alias entries"
for A in ${ALIASES}; do
    checkACL "" "${A}"
done | isOK '=0$' entry
[ $? -eq 0 ] || exit $?


msg "Have =0 access to list entries"
for L in ${LISTS}; do
    checkACL "" "${L}"
done | isOK '=0$' entry
[ $? -eq 0 ] || exit $?


msg "Have =0 access to list commands entries"
for LC in ${LISTSC}; do
    checkACL "" "${LC}"
done | isOK '=0$' entry
[ $? -eq 0 ] || exit $?


msg "Have =0 access to domain entries"
for D in ${DOMAINS}; do
    checkACL "" "${D}"
done | isOK '=0$' entry
[ $? -eq 0 ] || exit $?


msg "Have =0 access to the base"
checkACL "" "" | isOK '=0$' entry
[ $? -eq 0 ] || exit $?


###########################################################################

echo
echo "Authenticated non-users"
NU="'' ${DOMAINS} ${ALIASES} ${LISTS} ${LISTSC}"

msg "Have =0 access to alias entries"
for X in ${NU}; do
    for A in ${ALIASES}; do
        checkACL "${X}" "${A}"
    done
done | isOK '=0$' entry
[ $? -eq 0 ] || exit $?


msg "Have =0 access to list entries"
for X in ${NU}; do
    for L in ${LISTS}; do
        checkACL "${X}" "${L}"
    done
done | isOK '=0$' entry
[ $? -eq 0 ] || exit $?


msg "Have =0 access to list commands entries"
for X in ${NU}; do
    for LC in ${LISTSC}; do
        checkACL "${X}" "${LC}"
    done
done | isOK '=0$' entry
[ $? -eq 0 ] || exit $?


msg "Have =0 access to domain entries"
for X in ${NU}; do
    for D in ${DOMAINS}; do
        checkACL "${X}" "${D}"
    done
done | isOK '=0$' entry
[ $? -eq 0 ] || exit $?


msg "Have =0 access to the base"
for X in ${NU}; do
    checkACL "${X}" ""
done | isOK '=0$' entry
[ $? -eq 0 ] || exit $?


###########################################################################


echo
echo "Authenticated users, access to the base"


usersB () {
    for U in ${USERS}; do
        checkACL "${U}" "" "$@"
    done
}


msg "Have =s access on the base's \"entry\" attribute"
usersB entry | isOK '=s' entry
[ $? -eq 0 ] || exit $?


# Needed to create/delete domains.
msg "Have =w access on the base's \"children\" attribute"
usersB children | isOK '=w$' children
[ $? -eq 0 ] || exit $?


msg "Have =0 access to the operational attributes"
usersB ${OPERATTRS} | isOK '=0$' entryUUID
[ $? -eq 0 ] || exit $?


msg "Cannot create children under a pending entry"
for U in ${USERS}; do
    for X in ${DOMAINS} ${USERS} ${ALIASES} ${LISTS} ${LISTSC}; do
        search -s base -b "${X},${SUFFIX}" "(fripostPendingToken=*)" | grep -q '^dn: ' && \
        checkACL "${U}" "${X}" children
    done
done | isOK '=0$' children
[ $? -eq 0 ] || exit $?


###########################################################################


echo
echo "Authenticated users, access to domain entries"

# * entry:
#       =s for all
#       +a if canAddDomain
#       +rd if children, canAdd{Alias,List}, owner or postmaster
#       +z if owner or postmaster
# * children:
#       =w for all (non-pending entries)
# * objectClass:
#       =s for all
# * fvd:
#       =rscd if children, canAdd{Alias,List}, owner or postmaster
#       +w if owner or postmaster
# * fripostIsStatusActive
#       =rscd if children, canAdd{Alias,List}, owner or postmaster
#       +w if owner or postmaster
# * fripostPendingToken
#       =zscd if owner or postmaster
#       =s for all if there is no pending token
# * fripostCanAddAlias
#       =rscd if canAddAlias, owner or postmaster
#       +w if postmaster
# * fripostCanAddList
#       =rscd if canAddList, owner or postmaster
#       +w if postmaster
# * fripostOwner
#       =s for all
#       +d if children
#       +rc if canAdd{Alias,List}, owner or postmaster
# * fripostPostmaster
#       =s for all
#       +d if children
#       +rc if canAdd{Alias,List}, owner or postmaster
# * fripostOptionalMaildrop
#       =wrscd if owner or postmaster
# * description
#       =rscd if children, canAdd{Alias,List}, owner or postmaster
#       +w if owner or postmaster

usersD () {
    for U in ${USERS}; do
        for D in ${DOMAINS}; do
            checkACL "${U}" "${D}" "$@"
        done
    done
}

msg "Cannot appoint domain Owners or Postmasters"
usersD fripostOwner/add fripostOwner/delete \
       fripostPostmaster/add fripostPostmaster/delete \
       entryUUID/add \
  | isOK 'DENIED$' entryUUID
[ $? -eq 0 ] || exit $?


msg "Have =s rights on the \"pending\" status if absent"
for U in ${USERS}; do
    for D in ${DOMAINS}; do
        search -s base -b "${D},${SUFFIX}" "(!(fripostPendingToken=*))" | grep -q '^dn: ' && \
        checkACL "${U}" "${D}" fripostPendingToken
    done
done | isOK '=s$'
[ $? -eq 0 ] || exit $?


msg "Have =0 rights on the \"pending\" status if present (unless owner or postmaster)"
for U in ${USERS}; do
    for D in ${DOMAINS}; do
        search -s base -b "${D},${SUFFIX}" "(&(!(|(fripostOwner=${U},${SUFFIX})
                                                  (fripostPostmaster=${U},${SUFFIX})))
                                              (fripostPendingToken=*))" | grep -q '^dn: ' && \
        checkACL "${U}" "${D}" fripostPendingToken
    done
done | isOK '=0$'
[ $? -eq 0 ] || exit $?


msg "Have =zscd access on the \"pending\" status if present (if owner or postmaster)"
for U in ${USERS}; do
    for D in ${DOMAINS}; do
        search -s base -b "${D},${SUFFIX}" "(&(|(fripostOwner=${U},${SUFFIX})
                                                (fripostPostmaster=${U},${SUFFIX}))
                                              (fripostPendingToken=*))" | grep -q '^dn: ' && \
        checkACL "${U}" "${D}" fripostPendingToken
    done
done | isOK '=zscd$'
[ $? -eq 0 ] || exit $?


# Needed to create new entries. ("+z" is required to delete, btw.)
msg "Have >=a access to \"entry\" (if CanAddDomain, exact)"
for U in ${USERS}; do
    for D in ${DOMAINS}; do
        search -s base -b "${SUFFIX}" "fripostCanAddDomain=${U},${SUFFIX}" | grep -q '^dn: ' && \
        checkACL "${U}" "${D}" entry/add
    done
done | isOK 'ALLOWED$' entry add
[ $? -eq 0 ] || exit $?


# Needed to create new entries. ("+z" is required to delete, btw.)
msg "Have >=a access to \"entry\" (if CanAddDomain, wildcard)"
for U in ${USERS}; do
    DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
    for D in ${DOMAINS}; do
        search -s base -b "${SUFFIX}" "fripostCanAddDomain=${DU},${SUFFIX}" | grep -q '^dn: ' && \
        checkACL "${U}" "${D}" entry/add
    done
done | isOK 'ALLOWED$' entry add
[ $? -eq 0 ] || exit $?


msg "Do not have >=a access to \"entry\" (unless canAddDomain)"
for U in ${USERS}; do
    DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
    for D in ${DOMAINS}; do
        search -s base -b "${SUFFIX}" "(|(fripostCanAddDomain=${U},${SUFFIX})
                                         (fripostCanAddDomain=${DU},${SUFFIX}))" | grep -q '^dn: ' || \
        checkACL "${U}" "${D}" entry/add
    done
done | isOK 'DENIED$' entry add
[ $? -eq 0 ] || exit $?

# We ensure not to give +a/+z access to the \"entry\" attribute of the
# children, unless justified (required to add/delete a child).
msg "Have =w access to \"children\" (for non-pending attributes)"
for U in ${USERS}; do
    for D in ${DOMAINS}; do
        search -s base -b "${D},${SUFFIX}" "(fripostPendingToken=*)" | grep -q '^dn: ' || \
        checkACL "${U}" "${D}" children
    done
done | isOK '=w$' children
[ $? -eq 0 ] || exit $?

msg "Have =s access to \"objectClass\""
usersD objectClass | isOK '=s' objectClass
[ $? -eq 0 ] || exit $?

msg "Have >=s access on \"entry\", \"fripostOwner\" and \"fripostPostmaster\""
usersD entry/search fripostOwner/search fripostPostmaster/search | isOK 'ALLOWED$' entry
[ $? -eq 0 ] || exit $?

msg "Have =0 access to the operational attributes"
usersD ${OPERATTRS} | isOK '=0$' entryUUID
[ $? -eq 0 ] || exit $?


# We check the following permissions:
#  0. Simple user
#  1. canAddAlias (exact,wildcard)
#  2. canAddList (exact,wildcard)
#  3. Owner
#  4. Postmaster

# 0
ATTRS0="entry/read entry/disclose
        fvd/read fvd/search fvd/compare fvd/disclose
        fripostIsStatusActive/read fripostIsStatusActive/search fripostIsStatusActive/compare fripostIsStatusActive/disclose
        fripostOwner/disclose
        fripostPostmaster/disclose
        description/read description/search description/compare description/disclose"
msg "Have >=rscd access to the public attributes of their parent"
for U in ${USERS}; do
    D="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
    checkACL "${U}" "${D}" ${ATTRS0}
done | isOK 'ALLOWED$' entry read
[ $? -eq 0 ] || exit $?


# 1
ATTRSA="fripostOwner/read fripostOwner/compare
        fripostPostmaster/read fripostPostmaster/compare
        fripostCanAddAlias/read fripostCanAddAlias/search fripostCanAddAlias/compare fripostCanAddAlias/disclose"
msg "Have >=rscd access to the public attributes and >=a to \"children\" (if CanAddAlias, exact)"
for U in ${USERS}; do
    for D in ${DOMAINS}; do
        search -s base -b "${D},${SUFFIX}" "(&(fripostCanAddAlias=${U},${SUFFIX})(!(fripostPendingToken=*)))" | grep -q '^dn: ' && \
        checkACL "${U}" "${D}" children/add ${ATTRS0} ${ATTRSA}
    done
done | isOK 'ALLOWED$' children
[ $? -eq 0 ] || exit $?


# 1
msg "Have >=rscd to the public attributes and >=a to \"children\" (if CanAddAlias, wildcard)"
for U in ${USERS}; do
    DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
    for D in ${DOMAINS}; do
        search -s base -b "${D},${SUFFIX}" "(&(fripostCanAddAlias=${DU},${SUFFIX})(!(fripostPendingToken=*)))" | grep -q '^dn: ' && \
        checkACL "${U}" "${D}" children/add ${ATTRS0} ${ATTRSA}
    done
done | isOK 'ALLOWED$' children
[ $? -eq 0 ] || exit $?


# 2
ATTRSL="fripostOwner/read fripostOwner/compare
        fripostPostmaster/read fripostPostmaster/compare
        fripostCanAddList/read fripostCanAddList/search fripostCanAddList/compare fripostCanAddList/disclose"
msg "Have >=rscd access to the public attributes and >=a to \"children\" (if CanAddList, exact)"
for U in ${USERS}; do
    for D in ${DOMAINS}; do
        search -s base -b "${D},${SUFFIX}" "(&(fripostCanAddList=${U},${SUFFIX})(!(fripostPendingToken=*)))" | grep -q '^dn: ' && \
        checkACL "${U}" "${D}" children/add ${ATTRS0} ${ATTRSL}
    done
done | isOK 'ALLOWED$' children
[ $? -eq 0 ] || exit $?


# 2
msg "Have >=rscd access to the public attributes and >=a to \"children\" (if CanAddList, wildcard)"
for U in ${USERS}; do
    DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
    for D in ${DOMAINS}; do
        search -s base -b "${D},${SUFFIX}" "(&(fripostCanAddList=${DU},${SUFFIX})(!(fripostPendingToken=*)))" | grep -q '^dn: ' && \
        checkACL "${U}" "${D}" children/add ${ATTRS0} ${ATTRSL}
    done
done | isOK 'ALLOWED$' children
[ $? -eq 0 ] || exit $?


# 3
# >=w to "children", =zrscd to "entry", >=rscd to "fripostCanAddAlias" and
# "fripostCanAddList", and =wrscd to the rest (other than "Owner" and
# Postmaster")
msg "Have =wrscd to the domain attributes (other than \"canAdd\"), and >=w to \"children\" (if Owner)"
ATTRSO="entry/delete
        fvd/write
        fripostIsStatusActive/write
        fripostOptionalMaildrop/delete fripostOptionalMaildrop/add fripostOptionalMaildrop/read fripostOptionalMaildrop/search fripostOptionalMaildrop/compare fripostOptionalMaildrop/disclose
        description/add description/delete"
for U in ${USERS}; do
    for D in ${DOMAINS}; do
        search -s base -b "${D},${SUFFIX}" "(&(fripostOwner=${U},${SUFFIX})(!(fripostPendingToken=*)))" | grep -q '^dn: ' && \
        checkACL "${U}" "${D}" children/write ${ATTRS0} ${ATTRSA} ${ATTRSL} ${ATTRSO}
    done
done | isOK 'ALLOWED$' children
[ $? -eq 0 ] || exit $?


# 4
# >=w to "children", =zrscd to "entry", >=rscd to "fripostCanAddAlias" and
# "fripostCanAddList", and =wrscd to the rest (other than "Owner" and
# Postmaster")
msg "Have =wrscd to the domain attributes, and >=w to \"children\" (if Postmaster)"
ATTRSP="fripostCanAddAlias/add fripostCanAddAlias/delete
        fripostCanAddList/add fripostCanAddList/delete"
for U in ${USERS}; do
    for D in ${DOMAINS}; do
        search -s base -b "${D},${SUFFIX}" "(&(fripostPostmaster=${U},${SUFFIX})(!(fripostPendingToken=*)))" | grep -q '^dn: ' && \
        checkACL "${U}" "${D}" children/write ${ATTRS0} ${ATTRSA} ${ATTRSL} ${ATTRSO} ${ATTRSP}
    done
done | isOK 'ALLOWED$' children
[ $? -eq 0 ] || exit $?


# not (0 or 1 or 2 or 3 or 4)
msg "Have no access to the public attributes of irrelevant domains"
for U in ${USERS}; do
    DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
    for D in ${DOMAINS}; do
        [ "x${DU}" = "x${D}" ] || \
        search -s base -b "${D},${SUFFIX}" "(|(fripostCanAddAlias=${U},${SUFFIX})
                                              (fripostCanAddAlias=${DU},${SUFFIX})
                                              (fripostCanAddList=${U},${SUFFIX})
                                              (fripostCanAddList=${DU},${SUFFIX})
                                              (fripostOwner=${U},${SUFFIX})
                                              (fripostPostmaster=${U},${SUFFIX}))" | grep -q '^dn: ' || \
        checkACL "${U}" "${D}" ${ATTRS0}
    done
done | isOK 'DENIED$' entry read
[ $? -eq 0 ] || exit $?


# not (1 or 2 or 3 or 4)
msg "Do not have >=rc access to \"canAdd{Alias,List}\", \"Owner\", \"Postmaster\" (unless member)"
for U in ${USERS}; do
    DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
    for D in ${DOMAINS}; do
        search -s base -b "${D},${SUFFIX}" "(|(fripostCanAddAlias=${U},${SUFFIX})
                                              (fripostCanAddAlias=${DU},${SUFFIX})
                                              (fripostCanAddList=${U},${SUFFIX})
                                              (fripostCanAddList=${DU},${SUFFIX})
                                              (fripostOwner=${U},${SUFFIX})
                                              (fripostPostmaster=${U},${SUFFIX}))" | grep -q '^dn: ' || \
        checkACL "${U}" "${D}" ${ATTRSA} ${ATTRSL} entryUUID/add
    done
done | isOK 'DENIED$' entryUUID # "entryUUID" here is useless, but it's just to get the count
[ $? -eq 0 ] || exit $?


# not (1 or 3 or 4)
msg "Have =0 access to \"canAddAlias\" (unless member, Owner, or Postmaster)"
for U in ${USERS}; do
    DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
    for D in ${DOMAINS}; do
        search -s base -b "${D},${SUFFIX}" "(|(fripostCanAddAlias=${U},${SUFFIX})
                                              (fripostCanAddAlias=${DU},${SUFFIX})
                                              (fripostOwner=${U},${SUFFIX})
                                              (fripostPostmaster=${U},${SUFFIX}))" | grep -q '^dn: ' || \
        checkACL "${U}" "${D}" fripostCanAddAlias entryUUID/add
    done
done | isOK '\(=0\|DENIED\)$' entryUUID # "entryUUID" here is useless, but it's just to get the count
[ $? -eq 0 ] || exit $?


# not (2 or 3 or 4)
msg "Have =0 access to \"canAddList\" (unless member, Owner, or Postmaster)"
for U in ${USERS}; do
    DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
    for D in ${DOMAINS}; do
        search -s base -b "${D},${SUFFIX}" "(|(fripostCanAddList=${U},${SUFFIX})
                                              (fripostCanAddList=${DU},${SUFFIX})
                                              (fripostOwner=${U},${SUFFIX})
                                              (fripostPostmaster=${U},${SUFFIX}))" | grep -q '^dn: ' || \
        checkACL "${U}" "${D}" fripostCanAddList entryUUID/add
    done
done | isOK '\(=0\|DENIED\)$' entryUUID # "entryUUID" here is useless, but it's just to get the count
[ $? -eq 0 ] || exit $?


# not (3 or 4)
msg "Have =0 access to \"fripostOptionalMaildrop\" (unless Owner or Postmaster)"
for U in ${USERS}; do
    for D in ${DOMAINS}; do
        search -s base -b "${D},${SUFFIX}" "(|(fripostOwner=${U},${SUFFIX})
                                              (fripostPostmaster=${U},${SUFFIX}))" | grep -q '^dn: ' || \
        checkACL "${U}" "${D}" ${ATTRSO}
    done
done | isOK 'DENIED$' entry
[ $? -eq 0 ] || exit $?


# not 4
msg "Do not have >=w access to \"canAdd{Alias,List}\" (unless Postmaster)"
for U in ${USERS}; do
    for D in ${DOMAINS}; do
        search -s base -b "${D},${SUFFIX}" "fripostPostmaster=${U},${SUFFIX}" | grep -q '^dn: ' || \
        checkACL "${U}" "${D}" ${ATTRSP} entryUUID/add
    done
done | isOK 'DENIED$' entryUUID # "entryUUID" here is useless, but it's just to get the count
[ $? -eq 0 ] || exit $?



###########################################################################


echo
echo "Authenticated users, access to user entries"

# * entry:
#       =rsd if account owner
#       +a if domain postmaster
# * children:
#       =0 for all
# * objectClass:
#       =s for all
# * fvu:
#       =wrscd if account owner or domain postmaster
# * userPassword:
#       =w if account owner or domain postmaster
# * fripostIsStatusActive:
#       =wrscd if account owner or domain postmaster
# * fripostUserQuota:
#       =rscd if account owner or domain postmaster
# * fripostOptionalMaildrop:
#       =wrscd if account owner or domain postmaster
# * description:
#       =wrscd if account owner or domain postmaster

usersU () {
    for U in ${USERS}; do
        checkACL "${U}" "${U}" "$@"
    done
}

# They would need write access to their fripostUserQuota.
# In practice they can't write fvu either, since it's single valued.
msg "Have =rscd access to their \"fripostUserQuota\""
usersU fripostUserQuota | isOK '=rscd$'
[ $? -eq 0 ] || exit $?

msg "Have =w access to their own \"userPassword\""
usersU userPassword | isOK '=w$'
[ $? -eq 0 ] || exit $?

msg "Have =wrscd access to the other attributes of their own entry"
usersU fvu fripostIsStatusActive fripostOptionalMaildrop description | isOK '=wrscd$' fvu
[ $? -eq 0 ] || exit $?

msg "Have >=rsd access to the \"entry\" attribute of their own entry"
usersU entry/read entry/search entry/disclose fvu/read \
    | isOK 'ALLOWED$' fvu # fvu is useless here, but it's just to get the count
[ $? -eq 0 ] || exit $?

msg "Have =0 access to their \"children\" and operational attributes"
usersU children ${OPERATTRS} | isOK '=0$' children
[ $? -eq 0 ] || exit $?

msg "Have =s access to \"objectClass\""
usersD objectClass | isOK '=s' objectClass
[ $? -eq 0 ] || exit $?

msg "Have =0 access to other user entries (unless Postmaster)"
for U1 in ${USERS}; do
    for U2 in ${USERS}; do
        D2="$(echo "${U2}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
        [ "x${U1}" = "x${U2}" ] || \
        search -s base -b "${D2},${SUFFIX}" "(fripostPostmaster=${U1},${SUFFIX})" | grep -q '^dn: ' || \
        checkACL "${U1}" "${U2}" entry children \
                                 fvu userPassword \
                                 fripostIsStatusActive \
                                 fripostUserQuota \
                                 fripostOptionalMaildrop \
                                 description
    done
done | isOK '=0$' entry
[ $? -eq 0 ] || exit $?


usersP () {
    for P in ${USERS}; do
        for U in ${USERS}; do
            D="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
            [ "x${U}" != "x${P}" ] && \
            search -s base -b "${D},${SUFFIX}" "(fripostPostmaster=${P},${SUFFIX})" | grep -q '^dn: ' && \
            checkACL "${P}" "${U}" "$@"
        done
    done
}

msg "Have =rscd access to their user's \"fripostUserQuota\" (if Postmaster)"
usersP fripostUserQuota | isOK '=rscd$'
[ $? -eq 0 ] || exit $?

msg "Have =wd access to their user's \"userPassword\" (if Postmaster)"
usersP userPassword | isOK '=w$'
[ $? -eq 0 ] || exit $?

msg "Have =wrscd access to the other attributes of their users' entry (if Postmaster)"
usersP fvu fripostIsStatusActive fripostOptionalMaildrop description | isOK '=wrscd$' fvu
[ $? -eq 0 ] || exit $?

# "+a" is needed to create new accounts. "+z" would be required to
# delete such accounts.
msg "Have =arsd access to the \"entry\" attribute of their users' entry (if Postmaster)"
usersP entry | isOK '=arsd$' entry
[ $? -eq 0 ] || exit $?

msg "Have =0 access to their users' \"children\" and operational attributes (if Postmaster)"
usersP children ${OPERATTRS} | isOK '=0$' children
[ $? -eq 0 ] || exit $?


###########################################################################


echo
echo "Authenticated users, access to alias entries"

# * entry:
#       =s for all
#       +a if canAddAlias
#       +zrd if alias owner, domain owner or domain postmaster
# * children:
#       =0 for all
# * objectClass:
#       =s for all
# * fva:
#       =wrscd if alias owner, domain owner or domain postmaster
# * fripostMaildrop:
#       =wrscd if alias owner, domain owner or domain postmaster
# * fripostIsStatusActive:
#       =wrscd if alias owner, domain owner or domain postmaster
# * fripostOwner:
#       =d for all
#       +rsc if alias owner, domain owner or domain postmaster
#       +w if domain owner or domain postmaster
# * description:
#       =wrscd if alias owner, domain owner or domain postmaster

usersA () {
    for U in ${USERS}; do
        for A in ${ALIASES}; do
            checkACL "${U}" "${A}" "$@"
        done
    done
}


msg "Have >=s access to \"entry\" and \"fripostOwner\""
usersA fripostOwner/search entry/search | isOK 'ALLOWED$' entry
[ $? -eq 0 ] || exit $?


msg "Have =0 access to the \"children\" and operational attributes"
usersA children ${OPERATTRS} | isOK '=0$' children
[ $? -eq 0 ] || exit $?

msg "Have =s access to \"objectClass\""
usersD objectClass | isOK '=s' objectClass
[ $? -eq 0 ] || exit $?


ATTRS="entry/delete entry/read entry/disclose
       fva/write fva/read fva/search fva/compare fva/disclose
       fripostMaildrop/add fripostMaildrop/delete fripostMaildrop/read fripostMaildrop/search fripostMaildrop/compare fripostMaildrop/disclose
       fripostIsStatusActive/write fripostIsStatusActive/read fripostIsStatusActive/search fripostIsStatusActive/compare fripostIsStatusActive/disclose
       fripostOwner/read fripostOwner/compare fripostOwner/disclose
       description/add description/delete description/read description/search description/compare description/disclose"
ATTRSO="fripostOwner/add fripostOwner/delete"

msg "Can edit alias (if alias Owner)"
for U in ${USERS}; do
    for A in ${ALIASES}; do
        search -s base -b "${A},${SUFFIX}" "fripostOwner=${U},${SUFFIX}" | grep -q '^dn: ' && \
        checkACL "${U}" "${A}" ${ATTRS}
    done
done | isOK 'ALLOWED$' entry read
[ $? -eq 0 ] || exit $?


msg "Can edit alias and create new aliases (if domain Owner)"
for U in ${USERS}; do
    for A in ${ALIASES}; do
        DA="$(echo "${A}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
        search -s base -b "${DA},${SUFFIX}" "fripostOwner=${U},${SUFFIX}" | grep -q '^dn: ' && \
        checkACL "${U}" "${A}" entry/add ${ATTRS}
    done
done | isOK 'ALLOWED$' entry add
[ $? -eq 0 ] || exit $?


msg "Can edit alias and create new aliases (if domain Postmaster)"
for U in ${USERS}; do
    for A in ${ALIASES}; do
        DA="$(echo "${A}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
        search -s base -b "${DA},${SUFFIX}" "fripostPostmaster=${U},${SUFFIX}" | grep -q '^dn: ' && \
        checkACL "${U}" "${A}" entry/add ${ATTRS}
    done
done | isOK 'ALLOWED$' entry add
[ $? -eq 0 ] || exit $?


# Needed to create new entries. ("+z" is required to delete, btw.)
msg "Have >=a access to \"entry\" (if CanAddAlias, exact)"
for U in ${USERS}; do
    for A in ${ALIASES}; do
        DA="$(echo "${A}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
        search -s base -b "${DA},${SUFFIX}" "fripostCanAddAlias=${U},${SUFFIX}" | grep -q '^dn: ' && \
        checkACL "${U}" "${A}" entry/add
    done
done | isOK 'ALLOWED$' entry add
[ $? -eq 0 ] || exit $?


# Needed to create new entries. ("+z" is required to delete, btw.)
msg "Have >=a access to \"entry\" (if CanAddAlias, wildcard)"
for U in ${USERS}; do
    DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
    for A in ${ALIASES}; do
        DA="$(echo "${A}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
        search -s base -b "${DA},${SUFFIX}" "fripostCanAddAlias=${DU},${SUFFIX}" | grep -q '^dn: ' && \
        checkACL "${U}" "${A}" entry/add
    done
done | isOK 'ALLOWED$' entry add
[ $? -eq 0 ] || exit $?


msg "Do not have >=a access to \"entry\" (unless canAddAlias)"
for U in ${USERS}; do
    DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
    for A in ${ALIASES}; do
        DA="$(echo "${A}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
        search -s base -b "${DA},${SUFFIX}" "(|(fripostCanAddAlias=${U},${SUFFIX})
                                               (fripostCanAddAlias=${DU},${SUFFIX})
                                               (fripostOwner=${U},${SUFFIX})
                                               (fripostPostmaster=${U},${SUFFIX}))" | grep -q '^dn: ' || \
        checkACL "${U}" "${A}" entry/add
    done
done | isOK 'DENIED$' entry add
[ $? -eq 0 ] || exit $?


msg "Cannot manage ownership (unless domain owner/domain postmaster)"
for U in ${USERS}; do
    for A in ${ALIASES}; do
        DA="$(echo "${A}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
        search -s base -b "${DA},${SUFFIX}" "(|(fripostOwner=${U},${SUFFIX})
                                               (fripostPostmaster=${U},${SUFFIX}))" | grep -q '^dn: ' || \
        checkACL "${U}" "${A}" ${ATTRSO}
    done
done | isOK 'DENIED$' fripostOwner add
[ $? -eq 0 ] || exit $?


msg "Have no access to aliases entries (unless alias owner/domain owner/domain postmaster)"
for U in ${USERS}; do
    for A in ${ALIASES}; do
        DA="$(echo "${A}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
        search -s base -b "${A},${SUFFIX}" "fripostOwner=${U},${SUFFIX}" | grep -q '^dn: ' || \
        search -s base -b "${DA},${SUFFIX}" "(|(fripostOwner=${U},${SUFFIX})
                                               (fripostPostmaster=${U},${SUFFIX}))" | grep -q '^dn: ' || \
        checkACL "${U}" "${A}" ${ATTRS} ${ATTRSO}
    done
done | isOK 'DENIED$' entry delete
[ $? -eq 0 ] || exit $?



###########################################################################


echo
echo "Authenticated users, access to list entries"

# * entry:
#       =s for all
#       +a if canAddList, domain owner or domain postmaster
#       +rd if list owner, domain owner or domain postmaster
# * children:
#       =0 for all
# * fvl:
#       =wrscd if list owner, domain owner or domain postmaster
# * fripostListManager:
#       =rscd if list owner, domain owner or domain postmaster
# * fripostIsStatusActive:
#       =wrscd if list owner, domain owner or domain postmaster
# * fripostPendingToken:
#       =scd if list owner, domain owner or domain postmaster
# * fripostOwner:
#       =d for all
#       +rsc if list owner, domain owner or domain postmaster
#       +w if domain owner or domain postmaster
# * description:
#       =wrscd if list owner, domain owner or domain postmaster

usersL () {
    for U in ${USERS}; do
        for L in ${LISTS}; do
            checkACL "${U}" "${L}" "$@"
        done
    done
}


msg "Have >=s access on \"entry\" and \"fripostOwner\""
usersL fripostOwner/search entry/search | isOK 'ALLOWED$' entry
[ $? -eq 0 ] || exit $?


msg "Have =0 access the \"children\" and operational attributes"
usersL children ${OPERATTRS} | isOK '=0$' children
[ $? -eq 0 ] || exit $?


msg "Cannot change transport"
for U in ${USERS}; do
    for L in ${LISTS}; do
        checkACL "${U}" "${L}" fripostListManager/write
    done
done | isOK 'DENIED$' fripostListManager
[ $? -eq 0 ] || exit $?


msg "Cannot read or delete the pending status; Cannot delete entry"
for U in ${USERS}; do
    for L in ${LISTS}; do
        checkACL "${U}" "${L}" fripostPendingToken/read fripostPendingToken/add fripostPendingToken/delete entry/delete
    done
done | isOK 'DENIED$' entry
[ $? -eq 0 ] || exit $?


ATTRS="entry/read entry/disclose
       fvl/write fvl/read fvl/search fvl/compare fvl/disclose
       fripostListManager/read fripostListManager/search fripostListManager/compare fripostListManager/disclose
       fripostIsStatusActive/write fripostIsStatusActive/read fripostIsStatusActive/search fripostIsStatusActive/compare fripostIsStatusActive/disclose
       fripostPendingToken/search fripostPendingToken/compare fripostPendingToken/disclose
       fripostOwner/read fripostOwner/compare fripostOwner/disclose
       description/add description/delete description/read description/compare description/disclose"
ATTRS2="fripostOwner/add fripostOwner/delete"

msg "Can edit list (if list Owner)"
for U in ${USERS}; do
    for L in ${LISTS}; do
        search -s base -b "${L},${SUFFIX}" "fripostOwner=${U},${SUFFIX}" | grep -q '^dn: ' && \
        checkACL "${U}" "${L}" ${ATTRS}
    done
done | isOK 'ALLOWED$' entry read
[ $? -eq 0 ] || exit $?


msg "Can edit/create list (if domain Owner)"
[ $? -eq 0 ] || exit $?
for U in ${USERS}; do
    for L in ${LISTS}; do
        DL="$(echo "${L}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
        search -s base -b "${DL},${SUFFIX}" "fripostOwner=${U},${SUFFIX}" | grep -q '^dn: ' && \
        checkACL "${U}" "${L}" ${ATTRS} ${ATTRS2} entry/add
    done
done | isOK 'ALLOWED$' entry add
[ $? -eq 0 ] || exit $?


msg "Can edit/create list (if domain Postmaster)"
[ $? -eq 0 ] || exit $?
for U in ${USERS}; do
    for L in ${LISTS}; do
        DL="$(echo "${L}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
        search -s base -b "${DL},${SUFFIX}" "fripostPostmaster=${U},${SUFFIX}" | grep -q '^dn: ' && \
        checkACL "${U}" "${L}" ${ATTRS} ${ATTRS2} entry/add
    done
done | isOK 'ALLOWED$' entry add
[ $? -eq 0 ] || exit $?


# Needed to create new entries. ("+z" is required to delete, btw.)
msg "Have >=a access to \"entry\" (if CanAddList, exact)"
for U in ${USERS}; do
    for L in ${LISTS}; do
        DL="$(echo "${L}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
        search -s base -b "${DL},${SUFFIX}" "fripostCanAddList=${U},${SUFFIX}" | grep -q '^dn: ' && \
        checkACL "${U}" "${L}" entry/add
    done
done | isOK 'ALLOWED$' entry
[ $? -eq 0 ] || exit $?


# Needed to create new entries. ("+z" is required to delete, btw.)
msg "Have >=a access to \"entry\" (if CanAddList, wildcard)"
for U in ${USERS}; do
    DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
    for L in ${LISTS}; do
        DL="$(echo "${L}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
        search -s base -b "${DL},${SUFFIX}" "fripostCanAddList=${DU},${SUFFIX}" | grep -q '^dn: ' && \
        checkACL "${U}" "${L}" entry/add
    done
done | isOK 'ALLOWED$' entry
[ $? -eq 0 ] || exit $?


msg "Do not have >=a access to \"entry\" (unless canAddList)"
for U in ${USERS}; do
    DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
    for L in ${LISTS}; do
        DL="$(echo "${L}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
        search -s base -b "${DL},${SUFFIX}" "(|(fripostCanAddList=${U},${SUFFIX})
                                                (fripostCanAddList=${DU},${SUFFIX})
                                                (fripostOwner=${U},${SUFFIX})
                                                (fripostPostmaster=${U},${SUFFIX}))" | grep -q '^dn: ' || \
        checkACL "${U}" "${L}" entry/add
    done
done | isOK 'DENIED$' entry
[ $? -eq 0 ] || exit $?


msg "Cannot manage ownership (unless domain owner/domain postmaster)"
for U in ${USERS}; do
    for A in ${ALIASES}; do
        DA="$(echo "${A}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
        search -s base -b "${DA},${SUFFIX}" "(|(fripostOwner=${U},${SUFFIX})
                                               (fripostPostmaster=${U},${SUFFIX}))" | grep -q '^dn: ' || \
        checkACL "${U}" "${A}" ${ATTRS2}
    done
done | isOK 'DENIED$' fripostOwner add
[ $? -eq 0 ] || exit $?


msg "Have no access to list entries (unless list owner/domain owner/domain postmaster)"
for U in ${USERS}; do
    for L in ${LISTS}; do
        DL="$(echo "${L}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
        search -s base -b "${L},${SUFFIX}" "fripostOwner=${U},${SUFFIX}" | grep -q '^dn: ' || \
        search -s base -b "${DL},${SUFFIX}" "(|(fripostOwner=${U},${SUFFIX})
                                                (fripostPostmaster=${U},${SUFFIX}))" | grep -q '^dn: ' || \
        checkACL "${U}" "${L}" ${ATTRS} entry/delete
    done
done | isOK 'DENIED$' entry delete
[ $? -eq 0 ] || exit $?

msg "Have =0 access to the list command entries"
for U in ${USERS}; do
    for LC in ${LISTSC}; do
        checkACL "${U}" "${LC}"
    done
done | grep -Ev '^(objectClass|creatorsName)=' | isOK '=0$' entry
[ $? -eq 0 ] || exit $?


###########################################################################


SUFFIX="${SUFFIXS}"

echo
echo "Service Postfix"

msg "Have =0 access on non-active or pending entries"
for X in ${DOMAINS} ${USERS} ${ALIASES} ${LISTS} ${LISTSC}; do
    search -s base -b "${X},${SUFFIXV}" "(|(fripostIsStatusActive=TRUE)(fripostPendingToken=*))" | grep -q '^dn: ' && \
    checkACL "cn=Postfix" "${D}"
done | isOK '=0$' entry
[ $? -eq 0 ] || exit $?

msg "Can read and search the domain attributes it needs"
for D in ${DOMAINS}; do
    search -s base -b "${D},${SUFFIXV}" "(|(fripostIsStatusActive=FALSE)(fripostPendingToken=*))" | grep -q '^dn: ' || \
    checkACL "cn=Postfix" "${D}" entry fvd fripostOptionalMaildrop
done | isOK '=rsd$' entry
[ $? -eq 0 ] || exit $?

msg "Can search the domain attributes it needs"
for D in ${DOMAINS}; do
    search -s base -b "${D},${SUFFIXV}" "(|(fripostIsStatusActive=FALSE)(fripostPendingToken=*))" | grep -q '^dn: ' || \
    checkACL "cn=Postfix" "${D}" objectClass
done | isOK '=s$' objectClass
[ $? -eq 0 ] || exit $?

msg "Have =0 access on other domain attributes"
for D in ${DOMAINS}; do
    checkACL "cn=Postfix" "${D}" children ${OPERATTRS} fripostCanAddAlias fripostCanAddList fripostOwner fripostPostmaster description fripostPendingToken fripostIsStatusActive
done | isOK '=0$' children
[ $? -eq 0 ] || exit $?

msg "Can read and search the user attributes it needs"
for U in ${USERS}; do
    search -s base -b "${U},${SUFFIXV}" "(fripostIsStatusActive=FALSE)" | grep -q '^dn: ' || \
    checkACL "cn=Postfix" "${U}" entry fvu fripostOptionalMaildrop
done | isOK '=rsd$' entry
[ $? -eq 0 ] || exit $?

msg "Can search the user attributes it needs"
for U in ${USERS}; do
    search -s base -b "${U},${SUFFIXV}" "(fripostIsStatusActive=FALSE)" | grep -q '^dn: ' || \
    checkACL "cn=Postfix" "${U}" objectClass
done | isOK '=s$' objectClass
[ $? -eq 0 ] || exit $?

msg "Have =0 access on other user attributes"
for U in ${USERS}; do
    checkACL "cn=Postfix" "${U}" children ${OPERATTRS} userPassword fripostUserQuota description fripostIsStatusActive
done | isOK '=0$' children
[ $? -eq 0 ] || exit $?

msg "Can read and search the alias attributes it needs"
for A in ${ALIASES}; do
    search -s base -b "${A},${SUFFIXV}" "(fripostIsStatusActive=FALSE)" | grep -q '^dn: ' || \
    checkACL "cn=Postfix" "${A}" entry fva fripostMaildrop
done | isOK '=rsd$' entry
[ $? -eq 0 ] || exit $?

msg "Can search the alias attributes it needs"
for A in ${ALIASES}; do
    search -s base -b "${A},${SUFFIXV}" "(fripostIsStatusActive=FALSE)" | grep -q '^dn: ' || \
    checkACL "cn=Postfix" "${A}" objectClass
done | isOK '=s$' objectClass
[ $? -eq 0 ] || exit $?

msg "Have =0 access on other alias attributes"
for A in ${ALIASES}; do
    checkACL "cn=Postfix" "${A}" children ${OPERATTRS} fripostOwner description fripostIsStatusActive
done | isOK '=0$' children
[ $? -eq 0 ] || exit $?

msg "Can read and search the list attributes it needs"
for L in ${LISTS}; do
    search -s base -b "${L},${SUFFIXV}" "(|(fripostIsStatusActive=FALSE)(fripostPendingToken=*))" | grep -q '^dn: ' || \
    checkACL "cn=Postfix" "${L}" entry fvl fripostLocalAlias
done | isOK '=rsd$' entry
[ $? -eq 0 ] || exit $?

msg "Can search the list attributes it needs"
for L in ${LISTS}; do
    search -s base -b "${L},${SUFFIXV}" "(|(fripostIsStatusActive=FALSE)(fripostPendingToken=*))" | grep -q '^dn: ' || \
    checkACL "cn=Postfix" "${L}" objectClass
done | isOK '=s$' objectClass
[ $? -eq 0 ] || exit $?

msg "Have =0 access on other list attributes"
for L in ${LISTS}; do
    checkACL "cn=Postfix" "${L}" children ${OPERATTRS} fripostListManager fripostOwner description fripostIsStatusActive fripostPendingToken
done | isOK '=0$' children
[ $? -eq 0 ] || exit $?

msg "Can read and search the list command attributes it needs"
for LC in ${LISTSC}; do
    checkACL "cn=Postfix" "${LC}" entry fvlc fripostLocalAlias
done | isOK '=rsd$' entry
[ $? -eq 0 ] || exit $?

msg "Can search the list command attributes it needs"
for LC in ${LISTSC}; do
    checkACL "cn=Postfix" "${LC}" objectClass
done | isOK '=s$' objectClass
[ $? -eq 0 ] || exit $?

msg "Have =0 access on other list command attributes"
for LC in ${LISTSC}; do
    checkACL "cn=Postfix" "${LC}" children ${OPERATTRS}
done | isOK '=0$' children
[ $? -eq 0 ] || exit $?


###########################################################################

echo
echo "Service CreateList"

msg "Have =0 access on domain attributes"
for D in ${DOMAINS}; do
    checkACL "cn=CreateList" "${D}" entry children ${OPERATTRS} fvd fripostIsStatusActive fripostOptionalMaildrop fripostCanAddAlias fripostCanAddList fripostOwner fripostPostmaster description fripostPendingToken
done | isOK '=0$' entry
[ $? -eq 0 ] || exit $?

msg "Have =0 access on user attributes"
for U in ${USERS}; do
    checkACL "cn=CreateList" "${U}" entry children ${OPERATTRS} fvu userPassword fripostIsStatusActive fripostUserQuota fripostOptionalMaildrop description
done | isOK '=0$' entry
[ $? -eq 0 ] || exit $?

msg "Have =0 access on alias attributes"
for A in ${ALIASES}; do
    checkACL "cn=CreateList" "${A}" entry children ${OPERATTRS} fva fripostMaildrop fripostIsStatusActive fripostOwner description
done | isOK '=0$' entry
[ $? -eq 0 ] || exit $?

msg "Have =zsd access on lists' pending status"
for L in ${LISTS}; do
    checkACL "cn=CreateList" "${L}" fripostPendingToken
done | isOK '=zsd$'
[ $? -eq 0 ] || exit $?

msg "Have =rsd access on lists' entry attribute"
for L in ${LISTS}; do
    checkACL "cn=CreateList" "${L}" entry
done | isOK '=rsd$'
[ $? -eq 0 ] || exit $?

msg "Have =a access on lists' children attribute"
for L in ${LISTS}; do
    search -s base -b "${L},${SUFFIXV}" "(fripostPendingToken=*)" | grep -q '^dn: ' || \
    checkACL "cn=CreateList" "${L}" children
done | isOK '=a$'
[ $? -eq 0 ] || exit $?

msg "Have =0 access on other list attributes"
for L in ${LISTS}; do
    checkACL "cn=CreateList" "${L}" ${OPERATTRS} fvl fripostListManager fripostIsStatusActive fripostLocalAlias fripostOwner description
done | isOK '=0$' fvl
[ $? -eq 0 ] || exit $?

msg "Have =a access on list commands' entry attribute"
for LC in ${LISTSC}; do
    checkACL "cn=CreateList" "${LC}" entry
done | isOK '=a$'
[ $? -eq 0 ] || exit $?

msg "Have =0 access on other list command attributes"
for LC in ${LISTSC}; do
    checkACL "cn=CreateList" "${LC}" children ${OPERATTRS} fvlc fripostLocalAlias
done | isOK '=0$' children
[ $? -eq 0 ] || exit $?


###########################################################################

echo
echo "Service DeletePendingEntries"

msg "Have =z access on the \"children\" attribute of non-pending entries"
(checkACL "cn=DeletePendingEntries" "" children
for X in ${DOMAINS} ${USERS} ${ALIASES} ${LISTS} ${LISTSC}; do
    search -s base -b "${X},${SUFFIXV}" "(fripostPendingToken=*)" | grep -q '^dn: ' || \
    checkACL "cn=DeletePendingEntries" "${X}" children
done) | isOK '=z$' children
[ $? -eq 0 ] || exit $?

msg "Have =zrsd access on the \"entry\" attribute of pending entries"
for X in ${DOMAINS} ${USERS} ${ALIASES} ${LISTS} ${LISTSC}; do
    search -s base -b "${X},${SUFFIXV}" "(fripostPendingToken=*)" | grep -q '^dn: ' && \
    checkACL "cn=DeletePendingEntries" "${X}" entry
done | isOK '=zrsd$' entry
[ $? -eq 0 ] || exit $?

msg "Have =s access on the \"entry\" attribute of non-pending entries"
(checkACL "cn=DeletePendingEntries" "" entry
for X in ${DOMAINS} ${USERS} ${ALIASES} ${LISTS} ${LISTSC}; do
    search -s base -b "${X},${SUFFIXV}" "(fripostPendingToken=*)" | grep -q '^dn: ' || \
    checkACL "cn=DeletePendingEntries" "${X}" entry
done) | isOK '=s$' entry
[ $? -eq 0 ] || exit $?

msg "Have =s access on the attributes it needs on pending entries"
for X in ${DOMAINS} ${USERS} ${ALIASES} ${LISTS} ${LISTSC}; do
    search -s base -b "${X},${SUFFIXV}" "(fripostPendingToken=*)" | grep -q '^dn: ' && \
    checkACL "cn=DeletePendingEntries" "${X}" createTimestamp fripostPendingToken
done | isOK '=s$' fripostPendingToken
[ $? -eq 0 ] || exit $?

msg "Have =0 access these attributes for non-pending entries"
for X in ${DOMAINS} ${USERS} ${ALIASES} ${LISTS} ${LISTSC}; do
    search -s base -b "${X},${SUFFIXV}" "(fripostPendingToken=*)" | grep -q '^dn: ' || \
    checkACL "cn=DeletePendingEntries" "${X}" createTimestamp fripostPendingToken
done | isOK '=0$' fripostPendingToken
[ $? -eq 0 ] || exit $?

msg "Have =s access on the object class"
for X in ${DOMAINS} ${USERS} ${ALIASES} ${LISTS} ${LISTSC}; do
    checkACL "cn=DeletePendingEntries" "${X}" objectClass
done | isOK '=s$' objectClass
[ $? -eq 0 ] || exit $?

msg "Have =0 access on other domain attributes"
for D in ${DOMAINS}; do
    checkACL "cn=DeletePendingEntries" "${D}" fvd fripostIsStatusActive fripostOptionalMaildrop fripostCanAddAlias fripostCanAddList fripostOwner fripostPostmaster description
done | isOK '=0$' fvd
[ $? -eq 0 ] || exit $?

msg "Have =0 access on other user attributes"
for U in ${USERS}; do
    checkACL "cn=DeletePendingEntries" "${U}" fvu userPassword fripostIsStatusActive fripostUserQuota fripostOptionalMaildrop description
done | isOK '=0$' fvu
[ $? -eq 0 ] || exit $?

msg "Have =0 access on other alias attributes"
for A in ${ALIASES}; do
    checkACL "cn=DeletePendingEntries" "${A}" fva fripostMaildrop fripostIsStatusActive fripostOwner description
done | isOK '=0$' fva
[ $? -eq 0 ] || exit $?

msg "Have =0 access on other list attributes"
for L in ${LISTS}; do
    checkACL "cn=DeletePendingEntries" "${L}" fvl fripostListManager fripostIsStatusActive fripostLocalAlias fripostOwner description
done | isOK '=0$' fvl
[ $? -eq 0 ] || exit $?

msg "Have =0 access on other list command attributes"
for LC in ${LISTSC}; do
    checkACL "cn=AdminWebPanel" "${LC}" fvlc fripostLocalAlias
done | isOK '=0$' fvlc
[ $? -eq 0 ] || exit $?


###########################################################################

echo
echo "Service AdminWebPanel"

msg "Have =0 access on domain attributes"
for D in ${DOMAINS}; do
    checkACL "cn=AdminWebPanel" "${D}" entry children ${OPERATTRS} fvd fripostIsStatusActive fripostOptionalMaildrop fripostCanAddAlias fripostCanAddList fripostOwner fripostPostmaster description fripostPendingToken
done | isOK '=0$' entry
[ $? -eq 0 ] || exit $?

msg "Have =0 access on user attributes"
for U in ${USERS}; do
    checkACL "cn=AdminWebPanel" "${U}" entry children ${OPERATTRS} fvu userPassword fripostIsStatusActive fripostUserQuota fripostOptionalMaildrop description
done | isOK '=0$' entry
[ $? -eq 0 ] || exit $?

msg "Have =0 access on alias attributes"
for A in ${ALIASES}; do
    checkACL "cn=AdminWebPanel" "${A}" entry children ${OPERATTRS} fva fripostMaildrop fripostIsStatusActive fripostOwner description
done | isOK '=0$' entry
[ $? -eq 0 ] || exit $?

msg "Have =0 access on list attributes"
for L in ${LISTS}; do
    checkACL "cn=AdminWebPanel" "${L}" entry children ${OPERATTRS} fvl fripostListManager fripostIsStatusActive fripostLocalAlias fripostOwner description fripostPendingToken
done | isOK '=0$' entry
[ $? -eq 0 ] || exit $?

msg "Have =0 access on list command attributes"
for LC in ${LISTSC}; do
    checkACL "cn=AdminWebPanel" "${LC}" entry children ${OPERATTRS} fvlc fripostLocalAlias
done | isOK '=0$' entry
[ $? -eq 0 ] || exit $?

MECH='DIGEST-MD5'
PANEL='AdminWebPanel@fripost.org'
msg "Check authcID"
slapauth -U "${PANEL}" 2>&1 | grep '^ID: ' | isOK 'check succeeded$'
[ $? -eq 0 ] || exit $?

msg "Can proxy authorize (${MECH})"
for U in ${USERS}; do
    DN=$(echo "dn:${U},${SUFFIXV}" | tr [A-Z] [a-z])
    slapauth -U "${PANEL}" -X "${DN}" 2>&1 | grep '^authorization '
done | isOK '^authorization failed$'

# TODO: is that needed?
if test -x /usr/bin/sudo && sudo -u fpanel klist >/dev/null; then
    msg "Can SASL authenticate (GSSAPI)"
    DN=$(echo "dn:cn=AdminWebPanel,${SUFFIXS}" | tr [A-Z] [a-z])
    DN2=$(sudo -u fpanel ldapwhoami -Q | tr [A-Z] [a-z])
    if [ "${DN}" = "${DN2}" ]; then echo ok; else echo fail; fi | isOK '^ok$'

    msg "Can proxy authorize"
    for U in ${USERS}; do
        DN=$(echo "dn:${U},${SUFFIXV}" | tr [A-Z] [a-z])
        DN2=$(sudo -u fpanel ldapwhoami -Q -X "${DN}" | tr [A-Z] [a-z])
        if [ "${DN}" = "${DN2}" ]; then echo ok; else echo fail; fi
    done | isOK '^ok$'
else
    echo "WARN: No valid ticket found. Didn't check SASL GSSAPI authentication"
fi

rm "${RES}"