aboutsummaryrefslogtreecommitdiffstats
path: root/ldap/test-user-acl.sh
diff options
context:
space:
mode:
Diffstat (limited to 'ldap/test-user-acl.sh')
-rwxr-xr-xldap/test-user-acl.sh134
1 files changed, 67 insertions, 67 deletions
diff --git a/ldap/test-user-acl.sh b/ldap/test-user-acl.sh
index c55916e..9b954c7 100755
--- a/ldap/test-user-acl.sh
+++ b/ldap/test-user-acl.sh
@@ -168,36 +168,36 @@ echo "Authenticated users, access to domain entries"
# * entry:
# =s-a for all
-# +rd if children, canCreate{Alias,List}, owner or postmaster
+# +rd if children, canAdd{Alias,List}, owner or postmaster
# +z if owner or postmaster
# * children:
# =w for all
# * objectClass:
# =s for all
# * fvd:
-# =rscd if children, canCreate{Alias,List}, owner or postmaster
+# =rscd if children, canAdd{Alias,List}, owner or postmaster
# +w if owner or postmaster
# * fripostIsStatusActive
-# =rscd if children, canCreate{Alias,List}, owner or postmaster
+# =rscd if children, canAdd{Alias,List}, owner or postmaster
# +w if owner or postmaster
-# * fripostCanCreateAlias
-# =rscd if canCreateAlias, owner or postmaster
+# * fripostCanAddAlias
+# =rscd if canAddAlias, owner or postmaster
# +w if postmaster
-# * fripostCanCreateList
-# =rscd if canCreateList, owner or postmaster
+# * fripostCanAddList
+# =rscd if canAddList, owner or postmaster
# +w if postmaster
# * fripostOwner
# =s for all
# +d if children
-# +rc if canCreate{Alias,List}, owner or postmaster
+# +rc if canAdd{Alias,List}, owner or postmaster
# * fripostPostmaster
# =s for all
# +d if children
-# +rc if canCreate{Alias,List}, owner or postmaster
+# +rc if canAdd{Alias,List}, owner or postmaster
# * fripostOptionalMaildrop
# =wrscd if owner or postmaster
# * description
-# =rscd if children, canCreate{Alias,List}, owner or postmaster
+# =rscd if children, canAdd{Alias,List}, owner or postmaster
# +w if owner or postmaster
usersD () {
@@ -236,8 +236,8 @@ usersD ${OPERATTRS} | isOK '=0$' entryUUID
# We check the following permissions:
# 0. Simple user
-# 1. canCreateAlias (exact,wildcard)
-# 2. canCreateList (exact,wildcard)
+# 1. canAddAlias (exact,wildcard)
+# 2. canAddList (exact,wildcard)
# 3. Owner
# 4. Postmaster
@@ -259,11 +259,11 @@ done | isOK 'ALLOWED$' entry read
# 1
ATTRSA="fripostOwner/read fripostOwner/compare
fripostPostmaster/read fripostPostmaster/compare
- fripostCanCreateAlias/read fripostCanCreateAlias/search fripostCanCreateAlias/compare fripostCanCreateAlias/disclose"
-msg "Have >=rscd access to the public attributes and >=a to \"children\" (if CanCreateAlias, exact)"
+ fripostCanAddAlias/read fripostCanAddAlias/search fripostCanAddAlias/compare fripostCanAddAlias/disclose"
+msg "Have >=rscd access to the public attributes and >=a to \"children\" (if CanAddAlias, exact)"
for U in ${USERS}; do
for D in ${DOMAINS}; do
- search -s base -b "${D},${SUFFIX}" "fripostCanCreateAlias=${U},${SUFFIX}" | grep -q '^dn: ' && \
+ search -s base -b "${D},${SUFFIX}" "fripostCanAddAlias=${U},${SUFFIX}" | grep -q '^dn: ' && \
checkACL "${U}" "${D}" children/add ${ATTRS0} ${ATTRSA}
done
done | isOK 'ALLOWED$' children
@@ -271,11 +271,11 @@ done | isOK 'ALLOWED$' children
# 1
-msg "Have >=rscd to the public attributes and >=a to \"children\" (if CanCreateAlias, wildcard)"
+msg "Have >=rscd to the public attributes and >=a to \"children\" (if CanAddAlias, wildcard)"
for U in ${USERS}; do
DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
for D in ${DOMAINS}; do
- search -s base -b "${D},${SUFFIX}" "fripostCanCreateAlias=${DU},${SUFFIX}" | grep -q '^dn: ' && \
+ search -s base -b "${D},${SUFFIX}" "fripostCanAddAlias=${DU},${SUFFIX}" | grep -q '^dn: ' && \
checkACL "${U}" "${D}" children/add ${ATTRS0} ${ATTRSA}
done
done | isOK 'ALLOWED$' children
@@ -285,11 +285,11 @@ done | isOK 'ALLOWED$' children
# 2
ATTRSL="fripostOwner/read fripostOwner/compare
fripostPostmaster/read fripostPostmaster/compare
- fripostCanCreateList/read fripostCanCreateList/search fripostCanCreateList/compare fripostCanCreateList/disclose"
-msg "Have >=rscd access to the public attributes and >=a to \"children\" (if CanCreateList, exact)"
+ fripostCanAddList/read fripostCanAddList/search fripostCanAddList/compare fripostCanAddList/disclose"
+msg "Have >=rscd access to the public attributes and >=a to \"children\" (if CanAddList, exact)"
for U in ${USERS}; do
for D in ${DOMAINS}; do
- search -s base -b "${D},${SUFFIX}" "fripostCanCreateList=${U},${SUFFIX}" | grep -q '^dn: ' && \
+ search -s base -b "${D},${SUFFIX}" "fripostCanAddList=${U},${SUFFIX}" | grep -q '^dn: ' && \
checkACL "${U}" "${D}" children/add ${ATTRS0} ${ATTRSL}
done
done | isOK 'ALLOWED$' children
@@ -297,11 +297,11 @@ done | isOK 'ALLOWED$' children
# 2
-msg "Have >=rscd access to the public attributes and >=a to \"children\" (if CanCreateList, wildcard)"
+msg "Have >=rscd access to the public attributes and >=a to \"children\" (if CanAddList, wildcard)"
for U in ${USERS}; do
DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
for D in ${DOMAINS}; do
- search -s base -b "${D},${SUFFIX}" "fripostCanCreateList=${DU},${SUFFIX}" | grep -q '^dn: ' && \
+ search -s base -b "${D},${SUFFIX}" "fripostCanAddList=${DU},${SUFFIX}" | grep -q '^dn: ' && \
checkACL "${U}" "${D}" children/add ${ATTRS0} ${ATTRSL}
done
done | isOK 'ALLOWED$' children
@@ -309,10 +309,10 @@ done | isOK 'ALLOWED$' children
# 3
-# >=w to "children", =zrscd to "entry", >=rscd to "fripostCanCreateAlias" and
-# "fripostCanCreateList", and =wrscd to the rest (other than "Owner" and
+# >=w to "children", =zrscd to "entry", >=rscd to "fripostCanAddAlias" and
+# "fripostCanAddList", and =wrscd to the rest (other than "Owner" and
# Postmaster")
-msg "Have =wrscd to the domain attributes (other than \"canCreate\"), and >=w to \"children\" (if Owner)"
+msg "Have =wrscd to the domain attributes (other than \"canAdd\"), and >=w to \"children\" (if Owner)"
ATTRSO="entry/delete
fvd/write
fripostIsStatusActive/write
@@ -328,12 +328,12 @@ done | isOK 'ALLOWED$' children
# 4
-# >=w to "children", =zrscd to "entry", >=rscd to "fripostCanCreateAlias" and
-# "fripostCanCreateList", and =wrscd to the rest (other than "Owner" and
+# >=w to "children", =zrscd to "entry", >=rscd to "fripostCanAddAlias" and
+# "fripostCanAddList", and =wrscd to the rest (other than "Owner" and
# Postmaster")
msg "Have =wrscd to the domain attributes, and >=w to \"children\" (if Postmaster)"
-ATTRSP="fripostCanCreateAlias/add fripostCanCreateAlias/delete
- fripostCanCreateList/add fripostCanCreateList/delete"
+ATTRSP="fripostCanAddAlias/add fripostCanAddAlias/delete
+ fripostCanAddList/add fripostCanAddList/delete"
for U in ${USERS}; do
for D in ${DOMAINS}; do
search -s base -b "${D},${SUFFIX}" "fripostPostmaster=${U},${SUFFIX}" | grep -q '^dn: ' && \
@@ -349,10 +349,10 @@ for U in ${USERS}; do
DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
for D in ${DOMAINS}; do
[ "x${DU}" = "x${D}" ] || \
- search -s base -b "${D},${SUFFIX}" "(|(fripostCanCreateAlias=${U},${SUFFIX})
- (fripostCanCreateAlias=${DU},${SUFFIX})
- (fripostCanCreateList=${U},${SUFFIX})
- (fripostCanCreateList=${DU},${SUFFIX})
+ search -s base -b "${D},${SUFFIX}" "(|(fripostCanAddAlias=${U},${SUFFIX})
+ (fripostCanAddAlias=${DU},${SUFFIX})
+ (fripostCanAddList=${U},${SUFFIX})
+ (fripostCanAddList=${DU},${SUFFIX})
(fripostOwner=${U},${SUFFIX})
(fripostPostmaster=${U},${SUFFIX}))" | grep -q '^dn: ' || \
checkACL "${U}" "${D}" ${ATTRS0}
@@ -362,14 +362,14 @@ done | isOK 'DENIED$' entry read
# not (1 or 2 or 3 or 4)
-msg "Do not have >=rc access to \"canCreate{Alias,List}\", \"Owner\", \"Postmaster\" (unless member)"
+msg "Do not have >=rc access to \"canAdd{Alias,List}\", \"Owner\", \"Postmaster\" (unless member)"
for U in ${USERS}; do
DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
for D in ${DOMAINS}; do
- search -s base -b "${D},${SUFFIX}" "(|(fripostCanCreateAlias=${U},${SUFFIX})
- (fripostCanCreateAlias=${DU},${SUFFIX})
- (fripostCanCreateList=${U},${SUFFIX})
- (fripostCanCreateList=${DU},${SUFFIX})
+ search -s base -b "${D},${SUFFIX}" "(|(fripostCanAddAlias=${U},${SUFFIX})
+ (fripostCanAddAlias=${DU},${SUFFIX})
+ (fripostCanAddList=${U},${SUFFIX})
+ (fripostCanAddList=${DU},${SUFFIX})
(fripostOwner=${U},${SUFFIX})
(fripostPostmaster=${U},${SUFFIX}))" | grep -q '^dn: ' || \
checkACL "${U}" "${D}" ${ATTRSA} ${ATTRSL} entry/add
@@ -379,30 +379,30 @@ done | isOK 'DENIED$' entry # "entry" here is useless, but it's just to get the
# not (1 or 3 or 4)
-msg "Have =0 access to \"canCreateAlias\" (unless member, Owner, or Postmaster)"
+msg "Have =0 access to \"canAddAlias\" (unless member, Owner, or Postmaster)"
for U in ${USERS}; do
DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
for D in ${DOMAINS}; do
- search -s base -b "${D},${SUFFIX}" "(|(fripostCanCreateAlias=${U},${SUFFIX})
- (fripostCanCreateAlias=${DU},${SUFFIX})
+ search -s base -b "${D},${SUFFIX}" "(|(fripostCanAddAlias=${U},${SUFFIX})
+ (fripostCanAddAlias=${DU},${SUFFIX})
(fripostOwner=${U},${SUFFIX})
(fripostPostmaster=${U},${SUFFIX}))" | grep -q '^dn: ' || \
- checkACL "${U}" "${D}" fripostCanCreateAlias entry/add
+ checkACL "${U}" "${D}" fripostCanAddAlias entry/add
done
done | isOK '\(=0\|DENIED\)$' entry # "entry" here is useless, but it's just to get the count
[ $? -eq 0 ] || exit $?
# not (2 or 3 or 4)
-msg "Have =0 access to \"canCreateList\" (unless member, Owner, or Postmaster)"
+msg "Have =0 access to \"canAddList\" (unless member, Owner, or Postmaster)"
for U in ${USERS}; do
DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
for D in ${DOMAINS}; do
- search -s base -b "${D},${SUFFIX}" "(|(fripostCanCreateList=${U},${SUFFIX})
- (fripostCanCreateList=${DU},${SUFFIX})
+ search -s base -b "${D},${SUFFIX}" "(|(fripostCanAddList=${U},${SUFFIX})
+ (fripostCanAddList=${DU},${SUFFIX})
(fripostOwner=${U},${SUFFIX})
(fripostPostmaster=${U},${SUFFIX}))" | grep -q '^dn: ' || \
- checkACL "${U}" "${D}" fripostCanCreateList entry/add
+ checkACL "${U}" "${D}" fripostCanAddList entry/add
done
done | isOK '\(=0\|DENIED\)$' entry # "entry" here is useless, but it's just to get the count
[ $? -eq 0 ] || exit $?
@@ -421,7 +421,7 @@ done | isOK 'DENIED$' entry
# not 4
-msg "Do not have >=w access to \"canCreate{Alias,List}\" (unless Postmaster)"
+msg "Do not have >=w access to \"canAdd{Alias,List}\" (unless Postmaster)"
for U in ${USERS}; do
for D in ${DOMAINS}; do
search -s base -b "${D},${SUFFIX}" "fripostPostmaster=${U},${SUFFIX}" | grep -q '^dn: ' || \
@@ -550,7 +550,7 @@ echo "Authenticated users, access to alias entries"
# * entry:
# =s for all
-# +a if canCreateAlias
+# +a if canAddAlias
# +zrd if alias owner, domain owner or domain postmaster
# * children:
# =0 for all
@@ -633,11 +633,11 @@ done | isOK 'ALLOWED$' entry add
# Needed to create new entries. ("+z" is required to delete, btw.)
-msg "Have >=a access to \"entry\" (if CanCreateAlias, exact)"
+msg "Have >=a access to \"entry\" (if CanAddAlias, exact)"
for U in ${USERS}; do
for A in ${ALIASES}; do
DA="$(echo "${A}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
- search -s base -b "${DA},${SUFFIX}" "fripostCanCreateAlias=${U},${SUFFIX}" | grep -q '^dn: ' && \
+ search -s base -b "${DA},${SUFFIX}" "fripostCanAddAlias=${U},${SUFFIX}" | grep -q '^dn: ' && \
checkACL "${U}" "${A}" entry/add
done
done | isOK 'ALLOWED$' entry add
@@ -645,25 +645,25 @@ done | isOK 'ALLOWED$' entry add
# Needed to create new entries. ("+z" is required to delete, btw.)
-msg "Have >=a access to \"entry\" (if CanCreateAlias, wildcard)"
+msg "Have >=a access to \"entry\" (if CanAddAlias, wildcard)"
for U in ${USERS}; do
DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
for A in ${ALIASES}; do
DA="$(echo "${A}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
- search -s base -b "${DA},${SUFFIX}" "fripostCanCreateAlias=${DU},${SUFFIX}" | grep -q '^dn: ' && \
+ search -s base -b "${DA},${SUFFIX}" "fripostCanAddAlias=${DU},${SUFFIX}" | grep -q '^dn: ' && \
checkACL "${U}" "${A}" entry/add
done
done | isOK 'ALLOWED$' entry add
[ $? -eq 0 ] || exit $?
-msg "Do not have >=a access to \"entry\" (unless canCreateAlias)"
+msg "Do not have >=a access to \"entry\" (unless canAddAlias)"
for U in ${USERS}; do
DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
for A in ${ALIASES}; do
DA="$(echo "${A}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
- search -s base -b "${DA},${SUFFIX}" "(|(fripostCanCreateAlias=${U},${SUFFIX})
- (fripostCanCreateAlias=${DU},${SUFFIX})
+ search -s base -b "${DA},${SUFFIX}" "(|(fripostCanAddAlias=${U},${SUFFIX})
+ (fripostCanAddAlias=${DU},${SUFFIX})
(fripostOwner=${U},${SUFFIX})
(fripostPostmaster=${U},${SUFFIX}))" | grep -q '^dn: ' || \
checkACL "${U}" "${A}" entry/add
@@ -706,7 +706,7 @@ echo "Authenticated users, access to list entries"
# * entry:
# =s for all
-# +a if canCreateList, domain owner or domain postmaster
+# +a if canAddList, domain owner or domain postmaster
# +rd if list owner, domain owner or domain postmaster
# * children:
# =0 for all
@@ -806,11 +806,11 @@ done | isOK 'ALLOWED$' entry add
# Needed to create new entries. ("+z" is required to delete, btw.)
-msg "Have >=a access to \"entry\" (if CanCreateList, exact)"
+msg "Have >=a access to \"entry\" (if CanAddList, exact)"
for U in ${USERS}; do
for L in ${LISTS}; do
DL="$(echo "${L}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
- search -s base -b "${DL},${SUFFIX}" "fripostCanCreateList=${U},${SUFFIX}" | grep -q '^dn: ' && \
+ search -s base -b "${DL},${SUFFIX}" "fripostCanAddList=${U},${SUFFIX}" | grep -q '^dn: ' && \
checkACL "${U}" "${L}" entry/add
done
done | isOK 'ALLOWED$' entry
@@ -818,25 +818,25 @@ done | isOK 'ALLOWED$' entry
# Needed to create new entries. ("+z" is required to delete, btw.)
-msg "Have >=a access to \"entry\" (if CanCreateList, wildcard)"
+msg "Have >=a access to \"entry\" (if CanAddList, wildcard)"
for U in ${USERS}; do
DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
for L in ${LISTS}; do
DL="$(echo "${L}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
- search -s base -b "${DL},${SUFFIX}" "fripostCanCreateList=${DU},${SUFFIX}" | grep -q '^dn: ' && \
+ search -s base -b "${DL},${SUFFIX}" "fripostCanAddList=${DU},${SUFFIX}" | grep -q '^dn: ' && \
checkACL "${U}" "${L}" entry/add
done
done | isOK 'ALLOWED$' entry
[ $? -eq 0 ] || exit $?
-msg "Do not have >=a access to \"entry\" (unless canCreateList)"
+msg "Do not have >=a access to \"entry\" (unless canAddList)"
for U in ${USERS}; do
DU="$(echo "${U}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
for L in ${LISTS}; do
DL="$(echo "${L}" | sed -re 's/.*,(fvd=[^,]+)$/\1/')"
- search -s base -b "${DL},${SUFFIX}" "(|(fripostCanCreateList=${U},${SUFFIX})
- (fripostCanCreateList=${DU},${SUFFIX})
+ search -s base -b "${DL},${SUFFIX}" "(|(fripostCanAddList=${U},${SUFFIX})
+ (fripostCanAddList=${DU},${SUFFIX})
(fripostOwner=${U},${SUFFIX})
(fripostPostmaster=${U},${SUFFIX}))" | grep -q '^dn: ' || \
checkACL "${U}" "${L}" entry/add
@@ -893,7 +893,7 @@ done | isOK '=rsd$' entry
msg "Have =0 access on other domain attributes"
for D in ${DOMAINS}; do
- checkACL "cn=SMTP" "${D}" children ${OPERATTRS} fripostCanCreateAlias fripostCanCreateList fripostOwner fripostPostmaster description
+ checkACL "cn=SMTP" "${D}" children ${OPERATTRS} fripostCanAddAlias fripostCanAddList fripostOwner fripostPostmaster description
done | isOK 'none(=0)$' children
msg "Can read and search the user attributes it needs"
@@ -944,7 +944,7 @@ echo "Service ListCreator"
msg "Have =0 access on domain attributes"
for D in ${DOMAINS}; do
- checkACL "cn=ListCreator" "${D}" entry children ${OPERATTRS} fvd fripostIsStatusActive fripostOptionalMaildrop fripostCanCreateAlias fripostCanCreateList fripostOwner fripostPostmaster description
+ checkACL "cn=ListCreator" "${D}" entry children ${OPERATTRS} fvd fripostIsStatusActive fripostOptionalMaildrop fripostCanAddAlias fripostCanAddList fripostOwner fripostPostmaster description
done | isOK '=0$' entry
msg "Have =0 access on user attributes"
@@ -995,7 +995,7 @@ echo "Service AdminWebPanel"
msg "Have =0 access on domain attributes"
for D in ${DOMAINS}; do
- checkACL "cn=AdminWebPanel" "${D}" entry children ${OPERATTRS} fvd fripostIsStatusActive fripostOptionalMaildrop fripostCanCreateAlias fripostCanCreateList fripostOwner fripostPostmaster description
+ checkACL "cn=AdminWebPanel" "${D}" entry children ${OPERATTRS} fvd fripostIsStatusActive fripostOptionalMaildrop fripostCanAddAlias fripostCanAddList fripostOwner fripostPostmaster description
done | isOK 'none(=0)$' entry
msg "Have =0 access on user attributes"
@@ -1018,7 +1018,7 @@ for LC in ${LISTSC}; do
checkACL "cn=AdminWebPanel" "${LC}" entry children ${OPERATTRS} fvlc fripostLocalAlias
done | isOK 'none(=0)$' entry
-if sudo -u fpanel klist >/dev/null; then
+if test -x /usr/bin/sudo && sudo -u fpanel klist >/dev/null; then
msg "Can SASL authenticate (GSSAPI)"
DN=$(echo "dn:cn=AdminWebPanel,${SUFFIXS}" | tr [A-Z] [a-z])
DN2=$(sudo -u fpanel ldapwhoami -Q | tr [A-Z] [a-z])