/*
|
* The contents of this file are subject to the terms of the Common Development and
|
* Distribution License (the License). You may not use this file except in compliance with the
|
* License.
|
*
|
* You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
|
* specific language governing permission and limitations under the License.
|
*
|
* When distributing Covered Software, include this CDDL Header Notice in each file and include
|
* the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
|
* Header, with the fields enclosed by brackets [] replaced by your own identifying
|
* information: "Portions Copyright [year] [name of copyright owner]".
|
*
|
* Copyright 2024-2026 3A Systems, LLC.
|
*/
|
package org.openidentityplatform.opendj;
|
|
|
import org.forgerock.opendj.adapter.server3x.Adapters;
|
import org.forgerock.opendj.ldap.*;
|
import org.forgerock.opendj.ldap.controls.Control;
|
import org.forgerock.opendj.ldap.controls.GenericControl;
|
import org.forgerock.opendj.ldap.controls.ProxiedAuthV2RequestControl;
|
import org.forgerock.opendj.ldap.controls.RelaxRulesControl;
|
import org.forgerock.opendj.ldap.requests.AddRequest;
|
import org.forgerock.opendj.ldap.requests.ModifyRequest;
|
import org.forgerock.opendj.ldap.requests.Requests;
|
import org.forgerock.opendj.ldap.responses.Result;
|
import org.forgerock.opendj.ldap.responses.SearchResultEntry;
|
import org.opends.server.DirectoryServerTestCase;
|
import org.opends.server.TestCaseUtils;
|
|
import org.testng.annotations.AfterClass;
|
import org.testng.annotations.BeforeClass;
|
import org.testng.annotations.Test;
|
|
import static org.assertj.core.api.Assertions.assertThat;
|
|
@Test(sequential = true)
|
public class RelaxRulesTestCase extends DirectoryServerTestCase {
|
/** A client which may write anything under the suffix, but has no {@code bypass-acl} privilege. */
|
private static final String USER_DN = "uid=relax.user,o=test";
|
/** A client with the {@code bypass-acl} privilege which may act as {@link #USER_DN}. */
|
private static final String PROXY_DN = "uid=relax.proxy,o=test";
|
private static final String ACCESS_HANDLER_DN = "cn=Access Control Handler,cn=config";
|
/** Lets any authenticated client send the Relax Rules control, so that it survives the ACI of the controls. */
|
private static final String RELAX_CONTROL_ACI = "(targetcontrol=\"" + RelaxRulesControl.OID + "\")"
|
+ "(version 3.0; acl \"Relax Rules control access\"; allow(read) userdn=\"ldap:///all\";)";
|
/** The global ACI of the test configuration which lets anyone use any control. */
|
private static final String ANY_CONTROL_ACI = "(targetcontrol=\"*\")"
|
+ " (version 3.0; acl \"Anonymous control access\"; allow(read) userdn=\"ldap:///anyone\";)";
|
private static final String OLD_TIME = "20211203224637.000Z";
|
private static final String PRE_ENCODED_PASSWORD = "{SSHA}K9Hv0w7Z0Q2yL3ZJmD1m4n8q3mYk1Xn1R0x6Xw==";
|
|
Connection connection;
|
private LDAPConnectionFactory factory;
|
|
@BeforeClass
|
public void startServer() throws Exception {
|
TestCaseUtils.startServer();
|
TestCaseUtils.initializeTestBackend(true);
|
|
TestCaseUtils.addEntries(
|
"dn: uid=user.2, o=test",
|
"objectClass: top",
|
"objectClass: person",
|
"objectClass: inetOrgPerson",
|
"objectClass: organizationalPerson",
|
"cn: Aarika Atpco",
|
"sn: user.2",
|
"uid:user.2",
|
"description: This is the description for Aarika Atpco.",
|
"userPassword:: cGFzc3dvcmQ=",
|
"postalAddress: Aarika Atpco$00900 Maple Street$New Orleans, KS 10857",
|
"postalCode: 10857",
|
"",
|
"dn: " + USER_DN,
|
"objectClass: top",
|
"objectClass: person",
|
"objectClass: inetOrgPerson",
|
"objectClass: organizationalPerson",
|
"cn: Relax User",
|
"sn: User",
|
"uid: relax.user",
|
"userPassword: password",
|
"",
|
"dn: " + PROXY_DN,
|
"objectClass: top",
|
"objectClass: person",
|
"objectClass: inetOrgPerson",
|
"objectClass: organizationalPerson",
|
"cn: Relax Proxy",
|
"sn: Proxy",
|
"uid: relax.proxy",
|
"userPassword: password",
|
"ds-privilege-name: bypass-acl",
|
"ds-privilege-name: proxied-auth"
|
);
|
|
factory = new LDAPConnectionFactory("localhost", TestCaseUtils.getServerLdapPort());
|
connection = factory.getConnection();
|
connection.bind("cn=Directory Manager", "password".toCharArray());
|
assertThat(connection.isValid()).isTrue();
|
|
// The user may write anything under the suffix, operational attributes included: what stops it
|
// below is the Relax Rules control alone.
|
connection.modify(Requests.newModifyRequest("o=test").addModification(ModificationType.ADD, "aci",
|
"(targetattr=\"*||+\")(version 3.0; acl \"Relax Rules test user\"; allow(all) userdn=\"ldap:///"
|
+ USER_DN + "\";)"));
|
}
|
|
@AfterClass(alwaysRun = true)
|
public void closeConnection() {
|
if (connection != null) {
|
connection.close();
|
}
|
if (factory != null) {
|
factory.close();
|
}
|
}
|
|
@Test
|
public void test() throws LdapException {
|
final ModifyRequest changeRequest =
|
Requests.newModifyRequest("uid=user.2, o=test")
|
.addControl(new RelaxRulesControl())
|
.addModification(ModificationType.REPLACE, "pwdChangedTime", "20211203224637.000Z");
|
|
final Result result = connection.modify(changeRequest);
|
assertThat(result.getDiagnosticMessage()).isEmpty();
|
assertThat(result.getMatchedDN()).isEmpty();
|
|
//Verifies that entry has been correctly modified.
|
final SearchResultEntry srEntry =
|
connection.searchSingleEntry(Requests.newSearchRequest(
|
"uid=user.2, o=test", SearchScope.BASE_OBJECT, "(uid=user.2)").addAttribute("+"));
|
assertThat(srEntry.getAttribute("pwdChangedTime").firstValueAsString()).isEqualTo(
|
"20211203224637.000Z");
|
}
|
|
@Test
|
public void aRelaxedModifyStillRunsThePreOperationPlugins() throws Exception {
|
final String dn = addPerson("plugins");
|
|
connection.modify(Requests.newModifyRequest(dn)
|
.addControl(new RelaxRulesControl())
|
.addModification(ModificationType.REPLACE, "description", "relaxed"));
|
|
assertThat(valueOf(dn, "modifiersName")).as("the last modified plugin did not run")
|
.isEqualToIgnoringCase("cn=Directory Manager,cn=Root DNs,cn=config");
|
}
|
|
@Test
|
public void aRelaxedModifyKeepsTheLastModifiedValuesTheClientSupplies() throws Exception {
|
final String dn = addPerson("lastmod modify");
|
|
connection.modify(Requests.newModifyRequest(dn)
|
.addControl(new RelaxRulesControl())
|
.addModification(ModificationType.REPLACE, "modifyTimestamp", OLD_TIME)
|
.addModification(ModificationType.REPLACE, "modifiersName", "cn=migrated"));
|
|
assertThat(valueOf(dn, "modifyTimestamp")).isEqualTo(OLD_TIME);
|
assertThat(valueOf(dn, "modifiersName")).isEqualTo("cn=migrated");
|
}
|
|
@Test
|
public void aRelaxedAddKeepsTheCreationValuesTheClientSupplies() throws Exception {
|
final String dn = "cn=lastmod add,o=test";
|
|
connection.add(person(dn)
|
.addAttribute("createTimestamp", OLD_TIME)
|
.addAttribute("creatorsName", "cn=migrated")
|
.addControl(new RelaxRulesControl()));
|
|
assertThat(valueOf(dn, "createTimestamp")).isEqualTo(OLD_TIME);
|
assertThat(valueOf(dn, "creatorsName")).isEqualTo("cn=migrated");
|
}
|
|
@Test
|
public void aRelaxedModifyKeepsAMigratedPasswordAndItsChangeTime() throws Exception {
|
final String dn = addPerson("password modify");
|
|
connection.modify(Requests.newModifyRequest(dn)
|
.addControl(new RelaxRulesControl())
|
.addModification(ModificationType.REPLACE, "userPassword", PRE_ENCODED_PASSWORD)
|
.addModification(ModificationType.REPLACE, "pwdChangedTime", OLD_TIME));
|
|
assertThat(valueOf(dn, "userPassword")).isEqualTo(PRE_ENCODED_PASSWORD);
|
assertThat(valueOf(dn, "pwdChangedTime")).isEqualTo(OLD_TIME);
|
}
|
|
@Test
|
public void aRelaxedAddKeepsAMigratedPasswordAndItsChangeTime() throws Exception {
|
final String dn = "cn=password add,o=test";
|
|
connection.add(person(dn)
|
.addAttribute("userPassword", PRE_ENCODED_PASSWORD)
|
.addAttribute("pwdChangedTime", OLD_TIME)
|
.addControl(new RelaxRulesControl()));
|
|
assertThat(valueOf(dn, "userPassword")).isEqualTo(PRE_ENCODED_PASSWORD);
|
assertThat(valueOf(dn, "pwdChangedTime")).isEqualTo(OLD_TIME);
|
}
|
|
@Test
|
public void aRelaxedAddSkipsTheSchemaCheck() throws Exception {
|
// person does not allow mail.
|
assertThat(resultOf(() -> connection.add(person("cn=schema add,o=test").addAttribute("mail", "x@example.com"))))
|
.isEqualTo(ResultCode.OBJECTCLASS_VIOLATION);
|
|
connection.add(person("cn=schema add,o=test")
|
.addAttribute("mail", "x@example.com")
|
.addControl(new RelaxRulesControl()));
|
|
assertThat(valueOf("cn=schema add,o=test", "mail")).isEqualTo("x@example.com");
|
}
|
|
@Test
|
public void aRelaxedModifySkipsTheSchemaCheck() throws Exception {
|
final String dn = addPerson("schema modify");
|
final ModifyRequest addMail = Requests.newModifyRequest(dn)
|
.addModification(ModificationType.ADD, "mail", "x@example.com");
|
assertThat(resultOf(() -> connection.modify(addMail))).isEqualTo(ResultCode.OBJECTCLASS_VIOLATION);
|
|
connection.modify(Requests.copyOfModifyRequest(addMail).addControl(new RelaxRulesControl()));
|
|
assertThat(valueOf(dn, "mail")).isEqualTo("x@example.com");
|
}
|
|
@Test
|
public void aRelaxedModifyMayWriteAnObsoleteAttribute() throws Exception {
|
final String obsoleteType = "( 1.3.6.1.4.1.36733.2.1.999.1053 NAME 'relaxRulesObsoleteTest' OBSOLETE"
|
+ " SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'RelaxRulesTestCase' )";
|
connection.modify(Requests.newModifyRequest("cn=schema")
|
.addModification(ModificationType.ADD, "attributeTypes", obsoleteType));
|
try {
|
final String dn = "cn=obsolete,o=test";
|
connection.add(Requests.newAddRequest(dn)
|
.addAttribute("objectClass", "top", "person", "extensibleObject")
|
.addAttribute("cn", "obsolete")
|
.addAttribute("sn", "obsolete"));
|
final ModifyRequest writeObsolete = Requests.newModifyRequest(dn)
|
.addModification(ModificationType.REPLACE, "relaxRulesObsoleteTest", "value");
|
assertThat(resultOf(() -> connection.modify(writeObsolete))).isEqualTo(ResultCode.CONSTRAINT_VIOLATION);
|
|
connection.modify(Requests.copyOfModifyRequest(writeObsolete).addControl(new RelaxRulesControl()));
|
|
assertThat(valueOf(dn, "relaxRulesObsoleteTest")).isEqualTo("value");
|
connection.delete(dn);
|
} finally {
|
connection.modify(Requests.newModifyRequest("cn=schema")
|
.addModification(ModificationType.DELETE, "attributeTypes", obsoleteType));
|
}
|
}
|
|
/**
|
* A non-critical control the client may not use is dropped (RFC 4511 4.1.11): the request is then an
|
* ordinary one, and succeeds as such.
|
*/
|
@Test
|
public void aNonCriticalControlTheClientMayNotUseIsIgnored() throws Exception {
|
final String dn = addPerson("ignored control");
|
try (ControlAccess restricted = restrictControlAccess(null);
|
Connection user = bindAsUser()) {
|
user.modify(Requests.newModifyRequest(dn)
|
.addControl(nonCriticalRelaxRules())
|
.addModification(ModificationType.REPLACE, "description", "ordinary"));
|
user.add(person("cn=ignored control add,o=test").addControl(nonCriticalRelaxRules()));
|
}
|
|
assertThat(valueOf(dn, "description")).isEqualTo("ordinary");
|
assertThat(exists("cn=ignored control add,o=test")).isTrue();
|
}
|
|
/** Once the control ACI lets the control through, only the {@code bypass-acl} privilege lets it relax anything. */
|
@Test
|
public void aClientWithoutBypassAclMayNotRelaxTheRules() throws Exception {
|
final String dn = addPerson("unprivileged");
|
try (ControlAccess relaxAllowed = restrictControlAccess(RELAX_CONTROL_ACI);
|
Connection user = bindAsUser()) {
|
assertThat(resultOf(() -> user.add(person("cn=unprivileged add,o=test")
|
.addAttribute("pwdChangedTime", OLD_TIME)
|
.addControl(new RelaxRulesControl()))))
|
.isNotEqualTo(ResultCode.SUCCESS);
|
assertThat(resultOf(() -> user.add(person("cn=unprivileged plain add,o=test")
|
.addControl(new RelaxRulesControl()))))
|
.isEqualTo(ResultCode.INSUFFICIENT_ACCESS_RIGHTS);
|
assertThat(resultOf(() -> user.modify(Requests.newModifyRequest(dn)
|
.addControl(new RelaxRulesControl())
|
.addModification(ModificationType.REPLACE, "pwdChangedTime", OLD_TIME))))
|
.isEqualTo(ResultCode.INSUFFICIENT_ACCESS_RIGHTS);
|
}
|
|
assertThat(exists("cn=unprivileged add,o=test")).isFalse();
|
assertThat(exists("cn=unprivileged plain add,o=test")).isFalse();
|
assertThat(valueOf(dn, "pwdChangedTime")).isNull();
|
}
|
|
/**
|
* The privilege which lets the rules be relaxed is the one of the identity the request runs as: a
|
* client with {@code bypass-acl} which proxies as an ordinary user relaxes nothing, whether the control
|
* ACI lets the control through for that user or not.
|
*/
|
@Test
|
public void aProxiedIdentityWithoutBypassAclMayNotRelaxTheRules() throws Exception {
|
assertAProxiedRelaxedChangeIsRefused("proxied kept");
|
try (ControlAccess restricted = restrictControlAccess(null)) {
|
assertAProxiedRelaxedChangeIsRefused("proxied dropped");
|
}
|
}
|
|
private void assertAProxiedRelaxedChangeIsRefused(String cn) throws Exception {
|
final String dn = addPerson(cn);
|
final String addedDN = "cn=" + cn + " add,o=test";
|
final ProxiedAuthV2RequestControl asUser = ProxiedAuthV2RequestControl.newControl("dn:" + USER_DN);
|
|
try (Connection proxy = factory.getConnection()) {
|
proxy.bind(PROXY_DN, "password".toCharArray());
|
// Without the Relax Rules control, the proxy may act as the user.
|
proxy.modify(Requests.newModifyRequest(dn)
|
.addControl(asUser)
|
.addModification(ModificationType.REPLACE, "description", "proxied"));
|
|
assertThat(resultOf(() -> proxy.add(person(addedDN)
|
.addAttribute("pwdChangedTime", OLD_TIME)
|
.addControl(asUser)
|
.addControl(nonCriticalRelaxRules()))))
|
.isNotEqualTo(ResultCode.SUCCESS);
|
assertThat(resultOf(() -> proxy.modify(Requests.newModifyRequest(dn)
|
.addControl(asUser)
|
.addControl(nonCriticalRelaxRules())
|
.addModification(ModificationType.REPLACE, "pwdChangedTime", OLD_TIME))))
|
.isNotEqualTo(ResultCode.SUCCESS);
|
}
|
|
assertThat(valueOf(dn, "modifiersName")).isEqualToIgnoringCase(USER_DN);
|
assertThat(exists(addedDN)).isFalse();
|
assertThat(valueOf(dn, "pwdChangedTime")).isNull();
|
}
|
|
/**
|
* Removes the global ACI of the test configuration which lets anyone use any control, adding the provided
|
* one instead if any, until closed.
|
*/
|
private ControlAccess restrictControlAccess(String aci) throws LdapException {
|
connection.modify(Requests.newModifyRequest(ACCESS_HANDLER_DN)
|
.addModification(ModificationType.DELETE, "ds-cfg-global-aci", ANY_CONTROL_ACI));
|
if (aci != null) {
|
connection.modify(Requests.newModifyRequest(ACCESS_HANDLER_DN)
|
.addModification(ModificationType.ADD, "ds-cfg-global-aci", aci));
|
}
|
return () -> {
|
if (aci != null) {
|
connection.modify(Requests.newModifyRequest(ACCESS_HANDLER_DN)
|
.addModification(ModificationType.DELETE, "ds-cfg-global-aci", aci));
|
}
|
connection.modify(Requests.newModifyRequest(ACCESS_HANDLER_DN)
|
.addModification(ModificationType.ADD, "ds-cfg-global-aci", ANY_CONTROL_ACI));
|
};
|
}
|
|
private interface ControlAccess extends AutoCloseable {
|
@Override
|
void close() throws LdapException;
|
}
|
|
/** {@link RelaxRulesControl} is always critical. */
|
private static Control nonCriticalRelaxRules() {
|
return GenericControl.newControl(RelaxRulesControl.OID, false);
|
}
|
|
private String addPerson(String cn) throws LdapException {
|
final String dn = "cn=" + cn + ",o=test";
|
connection.add(person(dn));
|
return dn;
|
}
|
|
private static AddRequest person(String dn) {
|
final String cn = DN.valueOf(dn).rdn().getFirstAVA().getAttributeValue().toString();
|
return Requests.newAddRequest(dn)
|
.addAttribute("objectClass", "top", "person")
|
.addAttribute("cn", cn)
|
.addAttribute("sn", cn);
|
}
|
|
private Connection bindAsUser() throws LdapException {
|
final Connection user = factory.getConnection();
|
user.bind(USER_DN, "password".toCharArray());
|
return user;
|
}
|
|
private String valueOf(String dn, String attribute) throws LdapException {
|
final SearchResultEntry entry = connection.searchSingleEntry(
|
Requests.newSearchRequest(dn, SearchScope.BASE_OBJECT, "(objectClass=*)").addAttribute("*", "+"));
|
final Attribute attr = entry.getAttribute(attribute);
|
return attr != null ? attr.firstValueAsString() : null;
|
}
|
|
private boolean exists(String dn) {
|
return resultOf(() -> connection.searchSingleEntry(
|
Requests.newSearchRequest(dn, SearchScope.BASE_OBJECT, "(objectClass=*)"))) == ResultCode.SUCCESS;
|
}
|
|
private interface Request {
|
Object send() throws LdapException;
|
}
|
|
private static ResultCode resultOf(Request request) {
|
try {
|
request.send();
|
return ResultCode.SUCCESS;
|
} catch (LdapException e) {
|
return e.getResult().getResultCode();
|
}
|
}
|
}
|
