From 770c47d971edeaed7f52e290ff3c202aa3786ccf Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Wed, 08 Jul 2026 16:07:39 +0000
Subject: [PATCH] Fix two broken AciTests cases and enable the suite in the default build (#675)
---
opendj-server-legacy/src/test/java/org/opends/server/authorization/dseecompat/AciTests.java | 12 ++++++++++--
1 files changed, 10 insertions(+), 2 deletions(-)
diff --git a/opendj-server-legacy/src/test/java/org/opends/server/authorization/dseecompat/AciTests.java b/opendj-server-legacy/src/test/java/org/opends/server/authorization/dseecompat/AciTests.java
index 1ff81f0..a02df49 100644
--- a/opendj-server-legacy/src/test/java/org/opends/server/authorization/dseecompat/AciTests.java
+++ b/opendj-server-legacy/src/test/java/org/opends/server/authorization/dseecompat/AciTests.java
@@ -14,6 +14,7 @@
* Copyright 2008-2010 Sun Microsystems, Inc.
* Portions Copyright 2011-2016 ForgeRock AS.
* Portions Copyright 2013 Manuel Gaupp
+ * Portions Copyright 2026 3A Systems, LLC
*/
package org.opends.server.authorization.dseecompat;
@@ -75,7 +76,7 @@
* the syntax.
*/
@SuppressWarnings("javadoc")
-@Test(sequential=true, groups="slow")
+@Test(sequential=true)
public class AciTests extends AciTestCase {
// TODO: test modify use cases
// TODO: test searches where we expect a subset of attributes and entries
@@ -643,7 +644,6 @@
buildAciValue("name", "w/ targattrfilters", "targattrfilters=", TARG_ATTR_FILTERS_1 , "allow (write)", BIND_RULE_USERDN_SELF),
buildAciValue("name", "w/ targattrfilters", "targattrfilters=", TARG_ATTR_FILTERS_2 , "allow (write)", BIND_RULE_USERDN_SELF),
buildAciValue("name", "w/ targattrfilters", "targattrfilters=", TARG_ATTR_FILTERS_5 , "allow (write)", BIND_RULE_USERDN_SELF),
- buildAciValue("name", "bad_ATTR_TYPE_NAME", "targattrfilters",TARG_ATTR_FILTERS_ATTR_TYPE_NAME, "allow (write)", BIND_RULE_USERDN_SELF),
buildAciValue("name", "read", "targetattr", "*", "allow (read)", BIND_RULE_USERDN_SELF),
buildAciValue("name", "write", "targetattr", "*", "allow (write)", BIND_RULE_USERDN_SELF),
buildAciValue("name", "add", "targetattr", "*", "allow (add)", BIND_RULE_USERDN_SELF),
@@ -746,6 +746,11 @@
buildAciValue("name", "bad_op", "targattrfilters",TARG_ATTR_FILTERS_BAD_OP, "allow (write)", BIND_RULE_USERDN_SELF),
buildAciValue("name", "bad_op_match", "targattrfilters",TARG_ATTR_FILTERS_BAD_OP_MATCH, "allow (write)", BIND_RULE_USERDN_SELF),
buildAciValue("name", "bad_filter_attr", "targattrfilters",TARG_ATTR_FILTERS_BAD_FILTER_ATTR, "allow (write)", BIND_RULE_USERDN_SELF),
+ // The attribute name "1sn_" passes the lenient dseecompat ATTR_NAME
+ // pattern, but the filter part is parsed as an RFC 4512 attribute
+ // description, which cannot start with a digit unless it is a
+ // numeric OID, so the ACI is rejected at decode time.
+ buildAciValue("name", "bad_ATTR_TYPE_NAME", "targattrfilters",TARG_ATTR_FILTERS_ATTR_TYPE_NAME, "allow (write)", BIND_RULE_USERDN_SELF),
buildAciValue("name", "bad_format", "targattrfilters",TARG_ATTR_FILTERS_BAD_FORMAT, "allow (write)", BIND_RULE_USERDN_SELF),
buildAciValue("name", "too_many_lists", "targattrfilters",TARG_ATTR_FILTERS_TOO_MANY_LISTS, "allow (write)", BIND_RULE_USERDN_SELF),
buildAciValue("name", "bad_tok", "targattrfilters",TARG_ATTR_FILTERS_BAD_TOK, "allow (write)", BIND_RULE_USERDN_SELF),
@@ -1727,6 +1732,9 @@
"-p", getServerLdapPort(),
"-D", _bindDn,
"-w", _bindPw,
+ // Return the actual compare result code (COMPARE_TRUE / COMPARE_FALSE)
+ // instead of 0 on success, so callers can assert the evaluation result.
+ "--useCompareResultCode",
attrAssertion,
_searchBaseDn};
}
--
Gitblit v1.10.0