public void DRSR_DRSReadNgcKey_V1_Success()
{
DrsrTestChecker.Check();
EnvironmentConfig.Machine dcServer = EnvironmentConfig.Machine.WritableDC1;
DsServer dcServerMachine = (DsServer)EnvironmentConfig.MachineStore[dcServer];
uint? outVersion;
DRS_MSG_READNGCKEYREPLY?outMessage;
string newObjDN = ldapAdapter.TestAddComputerObj(dcServerMachine);
AddObjectUpdate addUpdate = new AddObjectUpdate(dcServer, newObjDN);
updateStorage.PushUpdate(addUpdate);
string ngcKey = newObjDN;
ResultCode r = ldapAdapter.SetNgcKey(dcServerMachine, newObjDN, ngcKey);
BaseTestSite.Assert.AreEqual <ResultCode>(ResultCode.Success, r, "IDL_DRSReadNgcKey: modify the msDS-KeyCredentialLink of " + newObjDN);
BaseTestSite.Log.Add(LogEntryKind.Comment, "IDL_DRSBind: Binding to DC server: {0}", dcServer);
uint ret = drsTestClient.DrsBind(dcServer, EnvironmentConfig.User.ParentDomainAdmin, DRS_EXTENSIONS_IN_FLAGS.DRS_EXT_BASE);
BaseTestSite.Assert.AreEqual <uint>(0, ret, "IDL_DRSBind: Checking return value - got: {0}, expect: 0, should return 0 with a success bind to DC", ret);
ret = drsTestClient.DrsReadNgcKey(dcServer, (uint)1, newObjDN, out outVersion, out outMessage);
BaseTestSite.Assert.AreEqual <uint>(0, ret, "IDL_DRSReadNgcKey: Checking return value - got: {0}, expect: 0, should return 0 if successful.", ret);
string readNgcKey = Encoding.Unicode.GetString(outMessage.Value.V1.pNgcKey);
BaseTestSite.Assert.AreEqual <string>(ngcKey, readNgcKey, "IDL_DRSReadNgcKey: Checking Ngc Key on an object - got: {0}, expect: {1}", readNgcKey, ngcKey);
}
// <summary>
// the function is used to create a DrsUpdateRef request
// </summary>
public DRS_MSG_UPDREFS CreateRequestForDrsUpdateRef(
EnvironmentConfig.Machine machine,
DsServer dest,
DRS_OPTIONS options,
NamingContext nc = NamingContext.ConfigNC)
{
string nc_name = null;
Guid nc_guid = Guid.Empty;
string nc_sid = null;
DSNAME nc_obj;
switch (nc)
{
case NamingContext.ConfigNC:
nc_obj = dest.Domain.ConfigNC;
break;
case NamingContext.SchemaNC:
nc_obj = dest.Domain.SchemaNC;
break;
case NamingContext.AppNC:
if (EnvironmentConfig.TestDS)
{
nc_obj = ((AddsDomain)dest.Domain).OtherNCs[0];
}
else
{
nc_obj = ((AdldsDomain)dest.Domain).AppNCs[0];
}
break;
case NamingContext.DomainNC:
if (!EnvironmentConfig.TestDS)
{
nc_obj = new DSNAME();
}
nc_obj = ((AddsDomain)dest.Domain).DomainNC;
break;
default:
nc_obj = new DSNAME();
break;
}
nc_name = LdapUtility.ConvertUshortArrayToString(nc_obj.StringName);
nc_guid = nc_obj.Guid;
nc_sid = convertSidToString(nc_obj.Sid);
DRS_MSG_UPDREFS?req = DRSClient.CreateUpdateRefsRequest(
nc_name,
nc_guid,
nc_sid,
dest.DsaNetworkAddress,
dest.NtdsDsaObjectGuid,
options);
return((DRS_MSG_UPDREFS)req);
}
public void DRSR_DRSInterDomainMove_LDAP_Move_Object_From_Child_To_Parent()
{
DrsrTestChecker.Check();
EnvironmentConfig.Machine parentDcType = EnvironmentConfig.Machine.WritableDC1;
DsServer parentDc = (DsServer)EnvironmentConfig.MachineStore[parentDcType];
EnvironmentConfig.Machine childDcType = EnvironmentConfig.Machine.CDC;
DsServer childDc = (DsServer)EnvironmentConfig.MachineStore[childDcType];
DsUser user = EnvironmentConfig.UserStore[EnvironmentConfig.User.ParentDomainAdmin];
string srcObjDn = ldapAdapter.TestAddUserObj(childDc);
BaseTestSite.Log.Add(LogEntryKind.Comment, "LDAP add a new object: {0}.", srcObjDn);
string newObjRdn = DrsrHelper.GetRDNFromDN(srcObjDn);
string tgtParentObjDn = "CN=Users," + DrsrHelper.GetNamingContextDN(parentDc.Domain, NamingContext.DomainNC);
string newObjDn = newObjRdn + "," + tgtParentObjDn;
bool bNewObjAdded = ldapAdapter.IsObjectExist(parentDc, newObjDn);
if (bNewObjAdded)
{
ResultCode rCode = ldapAdapter.DeleteObject(parentDc, newObjDn);
BaseTestSite.Assume.AreEqual <ResultCode>(ResultCode.Success, rCode, "LDAP: {0} should be removed.", newObjDn);
}
using (LdapConnection connection = new LdapConnection(new LdapDirectoryIdentifier(childDc.DnsHostName))) // connecting to the child domain in which the object exists
{
connection.Credential = new System.Net.NetworkCredential(user.Username, user.Password, parentDc.Domain.DNSName);
connection.SessionOptions.ProtocolVersion = 3;
connection.SessionOptions.SspiFlag = connection.SessionOptions.SspiFlag | 1; //Set Delegate flag.
connection.AuthType = AuthType.Kerberos;
connection.Bind();
try
{
BaseTestSite.Log.Add(LogEntryKind.Comment, "LDAP ModifyDN: moving object {0} to {1}.", srcObjDn, newObjDn);
ModifyDNRequest modDnRequest = new ModifyDNRequest(srcObjDn, tgtParentObjDn, newObjRdn);
modDnRequest.Controls.Add(new CrossDomainMoveControl(parentDc.DnsHostName)); // parent domain to which the object need to move
ModifyDNResponse modDnResponse = (ModifyDNResponse)connection.SendRequest(modDnRequest);
BaseTestSite.Assert.AreEqual <ResultCode>(ResultCode.Success, modDnResponse.ResultCode,
"LDAP ModifyDN: server should invoke IDL_DRSInterDomainMove on target Dc and move the object.");
bool bOldObjDeleted = ldapAdapter.IsObjectExist(childDc, srcObjDn);
bNewObjAdded = ldapAdapter.IsObjectExist(parentDc, newObjDn);
BaseTestSite.Assert.IsFalse(bOldObjDeleted, "LDAP ModifyDN: the old object should be deleted from source DC.");
BaseTestSite.Assert.IsTrue(bNewObjAdded, "LDAP ModifyDN: the new object should be added into target DC.");
}
catch (DirectoryOperationException e)
{
BaseTestSite.Log.Add(LogEntryKind.Debug, "LDAP ModifyDN: ResultCode:{0}", e.Response.ResultCode.ToString());
BaseTestSite.Log.Add(LogEntryKind.Debug, "LDAP ModifyDN: ErrorMessage:{0}", e.Response.ErrorMessage.ToString());
BaseTestSite.Assert.AreEqual <ResultCode>(ResultCode.Success, e.Response.ResultCode,
"LDAP ModifyDN: server should invoke the IDL_DRSInterDomainMove on target Dc and move the object.");
}
}
}
public void DRSR_DRSVerifyNames_Verify_Dsnames()
{
DrsrTestChecker.Check();
// Init the data.
EnvironmentConfig.Machine srv = EnvironmentConfig.Machine.WritableDC1;
DsServer server = (DsServer)EnvironmentConfig.MachineStore[srv];
uint ret = 0;
ret = drsTestClient.DrsBind(
srv,
EnvironmentConfig.User.ParentDomainAdmin,
DRS_EXTENSIONS_IN_FLAGS.DRS_EXT_BASE
);
BaseTestSite.Assert.AreEqual <uint>(0, ret,
"IDL_DRSBind: Checking return value - got: {0}, expect: {1}, return value should always be 0 with a success bind to DC",
ret, 0);
// Create a DSNAME
string dn = server.Site.DN;
DSNAME dsSite = ldapAdapter.GetDsName(server, dn).Value;
// Prefix table
SCHEMA_PREFIX_TABLE prefixTable = OIDUtility.CreatePrefixTable();
// Create the attribute block. Here we go to RDN attribute.
string rdnAttrId = DRSConstants.RDN_OID;
uint attrTyp = OIDUtility.MakeAttid(prefixTable, rdnAttrId);
ATTRVAL attrVal = DrsuapiClient.CreateATTRVAL(null);
ATTRVALBLOCK attrValBlock = DrsuapiClient.CreateATTRVALBLOCK(new ATTRVAL[] { attrVal });
ATTR attr = DrsuapiClient.CreateATTR(attrTyp, attrValBlock);
ATTRBLOCK attrBlock = DrsuapiClient.CreateATTRBLOCK(new ATTR[] { attr });
// Actual RPC call.
ret = drsTestClient.DrsVerifyNames(
srv,
dwInVersion_Values.V1,
DRS_MSG_VERIFYREQ_V1_dwFlags_Values.DRS_VERIFY_DSNAMES,
new DSNAME[] { dsSite },
new string[] { dn },
attrBlock,
prefixTable
);
BaseTestSite.Assert.AreEqual <uint>(0, ret,
"IDL_DRSVerifyNames: Checking return value - got: {0}, expect: {1}, return value should always be 0",
ret, 0);
// Unbind
ret = drsTestClient.DrsUnbind(srv);
BaseTestSite.Assert.AreEqual <uint>(0, ret,
"IDL_DRSUnbind: Checking return value - got: {0}, expect: {1}, return value should always be 0",
ret, 0);
}
private void DRSUpdateRefs_NONExist_NC(DrsUpdateRefs_Versions ver)
{
uint ret = drsTestClient.DrsBind(EnvironmentConfig.Machine.WritableDC1, EnvironmentConfig.User.ParentDomainAdmin, DRS_EXTENSIONS_IN_FLAGS.DRS_EXT_BASE);
DRS_MSG_UPDREFS req;
EnvironmentConfig.Machine machine = EnvironmentConfig.Machine.WritableDC1;
DsServer dest = (DsServer)EnvironmentConfig.MachineStore[EnvironmentConfig.Machine.WritableDC2];
DRS_OPTIONS options;
try
{
BaseTestSite.Log.Add(LogEntryKind.Checkpoint, "Try to delete replication destination from repsTo for later testing. It MAY fails if there is no such record to delete");
options = DRS_OPTIONS.DRS_DEL_REF;
req = drsTestClient.CreateRequestForDrsUpdateRef(
machine,
ver,
dest,
options
);
ret = drsTestClient.DRSClient.DrsUpdateRefs(EnvironmentConfig.DrsContextStore[machine], (uint)ver, req);
}
catch
{
BaseTestSite.Log.Add(LogEntryKind.Checkpoint, "No similar record to delete in repsTo. It's OK to continue");
}
options = DRS_OPTIONS.DRS_ADD_REF;
req = drsTestClient.CreateRequestForDrsUpdateRef(
machine,
ver,
dest,
options,
NamingContext.None // invalid value
);
ret = drsTestClient.DRSClient.DrsUpdateRefs(EnvironmentConfig.DrsContextStore[machine], (uint)ver, req);
BaseTestSite.Assert.AreEqual <uint>((uint)Win32ErrorCode_32.ERROR_DS_DRA_BAD_NC, ret, "the server should return ERROR_DS_DRA_BAD_NC");
options = DRS_OPTIONS.DRS_DEL_REF;
req = drsTestClient.CreateRequestForDrsUpdateRef(
machine,
ver,
dest,
options
);
ret = drsTestClient.DRSClient.DrsUpdateRefs(EnvironmentConfig.DrsContextStore[machine], (uint)ver, req);
}
public void DRSR_DRSGetMemberships_Get_Global_Groups_Non_Transitive()
{
DrsrTestChecker.Check();
// Init the data.
EnvironmentConfig.Machine srv = EnvironmentConfig.Machine.WritableDC1;
DsServer server = (DsServer)EnvironmentConfig.MachineStore[srv];
DsUser user = EnvironmentConfig.UserStore[EnvironmentConfig.User.ParentDomainAdmin];
uint ret = 0;
ret = drsTestClient.DrsBind(
srv,
EnvironmentConfig.User.ParentDomainAdmin,
DRS_EXTENSIONS_IN_FLAGS.DRS_EXT_BASE
);
BaseTestSite.Assert.AreEqual <uint>(
0,
ret,
"IDL_DRSBind: should return 0 with a success bind to DC");
DSNAME dsUser = ldapAdapter.GetDsName(
server,
ldapAdapter.GetUserDn(
server,
user
)
).Value;
ret = drsTestClient.DrsGetMemberships(
srv,
dwInVersion_Values.V1,
dsUser,
false,
REVERSE_MEMBERSHIP_OPERATION_TYPE.RevMembGlobalGroupsNonTransitive,
((AddsDomain)(server.Domain)).DomainNC);
BaseTestSite.Assert.AreEqual <uint>(
0,
ret,
"IDL_DRSGetMemberships: return value should be 0");
// Unbind
ret = drsTestClient.DrsUnbind(srv);
BaseTestSite.Assert.AreEqual <uint>(
0,
ret,
"IDL_DRSUnbind: return value should be 0");
}
/// <summary>
/// constructor
/// </summary>
/// <param name="svr">sut</param>
/// <param name="toDel">source</param>
/// <param name="op">flags</param>
/// <param name="cred">credential</param>
public DelReplicaSource(EnvironmentConfig.Machine svr, EnvironmentConfig.Machine toDel, DRS_OPTIONS op, EnvironmentConfig.User cred, NamingContext nc = NamingContext.ConfigNC, bool needKCC = true)
{
sut = svr;
target = toDel;
if ((op & DRS_OPTIONS.DRS_LOCAL_ONLY) == 0)
{
options = op | DRS_OPTIONS.DRS_REF_OK;
}
else
{
options = op;
}
user = cred;
doKCC = needKCC;
}
public void DRSR_DRSRemoveDsServer_Remove_DC()
{
DrsrTestChecker.Check();
// Init the data.
EnvironmentConfig.Machine srv = EnvironmentConfig.Machine.WritableDC1;
EnvironmentConfig.Machine dst = EnvironmentConfig.Machine.CDC;
DsServer server = (DsServer)EnvironmentConfig.MachineStore[srv];
DsServer child = (DsServer)EnvironmentConfig.MachineStore[dst];
DsUser user = EnvironmentConfig.UserStore[EnvironmentConfig.User.ParentDomainAdmin];
uint ret = 0;
ret = drsTestClient.DrsBind(
srv,
EnvironmentConfig.User.ParentDomainAdmin,
DRS_EXTENSIONS_IN_FLAGS.DRS_EXT_BASE
);
BaseTestSite.Assert.AreEqual <uint>(
0,
ret,
"IDL_DRSBind: should return 0 with a success bind to DC");
string serverDn = child.ServerObjectName;
string domainDn = child.Domain.Name;
ret = drsTestClient.DrsRemoveDsServer(
srv,
IDL_DRSRemoveDsServer_dwInVersion_Values.V1,
serverDn,
domainDn,
true); // DANGEROUS: We're actually going to remove this server!
BaseTestSite.Assert.AreEqual <uint>(
ret,
0,
"IDL_DRSRemoveDsServer: return value should be 0");
// Unbind
ret = drsTestClient.DrsUnbind(srv);
BaseTestSite.Assert.AreEqual <uint>(
0,
ret,
"IDL_DRSUnbind: return value should be 0");
}
public void DRSR_DRSGetMemberships_Get_Group_Members_Transitive()
{
DrsrTestChecker.Check();
// Init the data.
EnvironmentConfig.Machine srv = EnvironmentConfig.Machine.WritableDC1;
DsServer server = (DsServer)EnvironmentConfig.MachineStore[srv];
DsUser user = EnvironmentConfig.UserStore[EnvironmentConfig.User.ParentDomainAdmin];
uint ret = 0;
ret = drsTestClient.DrsBind(
srv,
EnvironmentConfig.User.ParentDomainAdmin,
DRS_EXTENSIONS_IN_FLAGS.DRS_EXT_BASE
);
BaseTestSite.Assert.AreEqual <uint>(
0,
ret,
"IDL_DRSBind: should return 0 with a success bind to DC");
string groupDn = "CN=Domain Users,CN=Users," + DrsrHelper.GetDNFromFQDN(ADCommonServerAdapter.Instance(Site).PrimaryDomainDnsName);
DSNAME dsGroup = LdapUtility.CreateDSNameForObject(
server,
groupDn
);
ret = drsTestClient.DrsGetMemberships(
srv,
dwInVersion_Values.V1,
dsGroup,
false,
REVERSE_MEMBERSHIP_OPERATION_TYPE.GroupMembersTransitive,
null);
BaseTestSite.Assert.AreEqual <uint>(
0,
ret,
"IDL_DRSGetMemberships: return value should be 0");
// Unbind
ret = drsTestClient.DrsUnbind(srv);
BaseTestSite.Assert.AreEqual <uint>(
0,
ret,
"IDL_DRSUnbind: return value should be 0");
}
public void DRSR_DRSUpdateRefs_V1_uuidDsaObjDest_NULL()
{
DrsrTestChecker.Check();
uint ret = drsTestClient.DrsBind(EnvironmentConfig.Machine.WritableDC1, EnvironmentConfig.User.ParentDomainAdmin, DRS_EXTENSIONS_IN_FLAGS.DRS_EXT_BASE);
DRS_MSG_UPDREFS req;
EnvironmentConfig.Machine machine = EnvironmentConfig.Machine.WritableDC1;
DsServer dest = (DsServer)EnvironmentConfig.MachineStore[EnvironmentConfig.Machine.WritableDC2];
DRS_OPTIONS options;
try
{
BaseTestSite.Log.Add(LogEntryKind.Checkpoint, "Try to delete replication destination from repsTo for later testing. It MAY fails if there is no such record to delete");
options = DRS_OPTIONS.DRS_DEL_REF;
req = drsTestClient.CreateRequestForDrsUpdateRef(
machine,
dest,
options
);
ret = drsTestClient.DRSClient.DrsUpdateRefs(EnvironmentConfig.DrsContextStore[machine], 1, req);
}
catch
{
BaseTestSite.Log.Add(LogEntryKind.Checkpoint, "No similar record to delete in repsTo. It's OK to continue");
}
options = DRS_OPTIONS.DRS_ADD_REF;
req = drsTestClient.CreateRequestForDrsUpdateRef(
machine,
dest,
options
);
req.V1.uuidDsaObjDest = Guid.Empty; // Invalid value
ret = drsTestClient.DRSClient.DrsUpdateRefs(EnvironmentConfig.DrsContextStore[machine], 1, req);
BaseTestSite.Assert.AreEqual <uint>((uint)Win32ErrorCode_32.ERROR_DS_DRA_INVALID_PARAMETER, ret, "the server should return ERROR_DS_DRA_INVALID_PARAMETER");
options = DRS_OPTIONS.DRS_DEL_REF;
req = drsTestClient.CreateRequestForDrsUpdateRef(
machine,
dest,
options
);
ret = drsTestClient.DRSClient.DrsUpdateRefs(EnvironmentConfig.DrsContextStore[machine], 1, req);
}
public void DRSR_RODC_ReadOnly_LDAP()
{
DrsrTestChecker.Check();
// although this case is really not related to DRSR, using LDAP write access
// to a RODC here could really prove that the DC is Read-only
// A proper-functioning RODC should just return a referral.
EnvironmentConfig.Machine rodcEnum = EnvironmentConfig.Machine.RODC;
EnvironmentConfig.Machine dc1Enum = EnvironmentConfig.Machine.WritableDC1;
EnvironmentConfig.Machine dc2Enum = EnvironmentConfig.Machine.WritableDC2;
DsServer dc1 = (DsServer)EnvironmentConfig.MachineStore[dc1Enum];
DsServer dc2 = (DsServer)EnvironmentConfig.MachineStore[dc2Enum];
DsServer rodc = (DsServer)EnvironmentConfig.MachineStore[rodcEnum];
// try to add a user on the RODC without referral chasing
rodc.LdapConn.SessionOptions.ReferralChasing = ReferralChasingOptions.None;
// to avoid naming conflict
Random rnd = new Random();
string nc = LdapUtility.ConvertUshortArrayToString(((AddsDomain)rodc.Domain).DomainNC.StringName);
string dn = "CN=ShouldNotExist" + rnd.Next().ToString() + ",CN=Users," + nc;
AddResponse resp = null;
try
{
AddRequest req = new AddRequest(dn, "user");
resp = (AddResponse)rodc.LdapConn.SendRequest(req);
}
catch (DirectoryOperationException e)
{
BaseTestSite.Assert.Fail(e.Message);
}
// first, verify the response is a referral
BaseTestSite.Assert.IsTrue(resp.ResultCode == ResultCode.Referral, "Expected a referral");
BaseTestSite.Log.Add(LogEntryKind.Checkpoint, "referral host is " + resp.Referral[0].Host);
// then, verify it is referring to the writable DC
BaseTestSite.Assert.IsTrue(
dc1.DnsHostName.ToLower().Trim() == resp.Referral[0].Host.ToLower().Trim() ||
dc2.DnsHostName.ToLower().Trim() == resp.Referral[0].Host.ToLower().Trim(),
"The referral should point to the writable DC");
}
public void DRSR_DRSRemoveDsServer_Verify_LastDC()
{
DrsrTestChecker.Check();
// Init the data.
EnvironmentConfig.Machine srv = EnvironmentConfig.Machine.WritableDC1;
DsServer server = (DsServer)EnvironmentConfig.MachineStore[srv];
DsUser user = EnvironmentConfig.UserStore[EnvironmentConfig.User.ParentDomainAdmin];
uint ret = 0;
ret = drsTestClient.DrsBind(
srv,
EnvironmentConfig.User.ParentDomainAdmin,
DRS_EXTENSIONS_IN_FLAGS.DRS_EXT_BASE
);
BaseTestSite.Assert.AreEqual <uint>(0, ret,
"IDL_DRSBind: Checking return value - got: {0}, expect: {1}, return value should always be 0 with a success bind to DC",
ret, 0);
string serverDn = server.ServerObjectName;
string domainDn = server.Domain.Name;
ret = drsTestClient.DrsRemoveDsServer(
srv,
IDL_DRSRemoveDsServer_dwInVersion_Values.V1,
serverDn,
domainDn,
false);
BaseTestSite.Assert.AreEqual <uint>(0, ret,
"IDL_DRSRemoveDsServer: Checking return value - got: {0}, expect: {1}, return value should always be 0",
ret, 0);
// Unbind
ret = drsTestClient.DrsUnbind(srv);
BaseTestSite.Assert.AreEqual <uint>(0, ret,
"IDL_DRSUnbind: Checking return value - got: {0}, expect: {1}, return value should always be 0",
ret, 0);
}
public DRS_MSG_REPMOD createDRS_MSG_REPMOD_Request(
EnvironmentConfig.Machine machine,
DsServer src,
DRS_OPTIONS replicaFlags,
DRS_MSG_REPMOD_FIELDS modifyFields,
DRS_OPTIONS options
)
{
#region generate the parameters
string ncReplicaDistinguishedName = LdapUtility.ConvertUshortArrayToString(src.Domain.ConfigNC.StringName);
Guid ncReplicaObjectGuid = src.Domain.ConfigNC.Guid;
NT4SID ncReplicaObjectSid = src.Domain.ConfigNC.Sid;
Guid sourceDsaGuid = src.NtdsDsaObjectGuid;
string sourceDsaName = src.DsaNetworkAddress;
#endregion
REPLTIMES s = new REPLTIMES();
s.rgTimes = new byte[84];
for (int i = 0; i < s.rgTimes.Length; i++)
{
s.rgTimes[i] = 1;
}
string sid = convertSidToString(ncReplicaObjectSid);
DRS_MSG_REPMOD?req = DRSClient.CreateReplicaModifyRequest(
ncReplicaDistinguishedName,
ncReplicaObjectGuid,
sid,
sourceDsaGuid,
sourceDsaName,
s,
replicaFlags,
modifyFields,
options);
return((DRS_MSG_REPMOD)req);
}
public void DRSR_RODC_FAS_Add_Attribute()
{
int timeOut = 0;
DrsrTestChecker.Check();
EnvironmentConfig.Machine rodcEnum = EnvironmentConfig.Machine.RODC;
EnvironmentConfig.Machine dc1Enum = EnvironmentConfig.Machine.WritableDC1;
DsServer dc1 = (DsServer)EnvironmentConfig.MachineStore[dc1Enum];
DsServer rodc = (DsServer)EnvironmentConfig.MachineStore[rodcEnum];
ResultCode r = ResultCode.Other;
// FAS: first try "Employee-Number"
string nc = LdapUtility.GetDnFromNcType(dc1, NamingContext.SchemaNC);
string searchFlagsAttr = "searchFlags";
string attrDn = "CN=Employee-Number," + nc;
string attrName = "employeeNumber";
uint searchFlags = 0;
// wait until FAS is modified on DC01
for (timeOut = 0; timeOut < kMaxTimeOut; ++timeOut)
{
searchFlags = Convert.ToUInt32(
ldapAdapter.GetAttributeValueInString(dc1, attrDn, searchFlagsAttr)
);
if ((searchFlags & kRODC_FAS) != 0)
{
BaseTestSite.Log.Add(LogEntryKind.Comment, "FAS already effective.");
// the attribute is already in the FAS
break;
}
ldapAdapter.ModifyAttribute(dc1, attrDn, new DirectoryAttribute(searchFlagsAttr, kRODC_FAS.ToString()));
System.Threading.Thread.Sleep(kMaxTimeoutInMilliseconds);
}
BaseTestSite.Assert.IsTrue((searchFlags & kRODC_FAS) != 0, "FAS is set successfully on {0}", dc1.NetbiosName);
uint ret = drsTestClient.DrsBind(rodcEnum, EnvironmentConfig.User.ParentDomainAdmin, DRS_EXTENSIONS_IN_FLAGS.DRS_EXT_BASE);
Assert.IsTrue(ret == 0);
ret = drsTestClient.DrsReplicaSync(rodcEnum, DrsReplicaSync_Versions.V1, dc1Enum, DRS_OPTIONS.DRS_FULL_SYNC_NOW, false, NamingContext.SchemaNC);
BaseTestSite.Assert.IsTrue(ret == 0, "Start replica from {0} to {1}.", dc1.NetbiosName, rodc.NetbiosName);
// wait until FAS is replicated to RODC
BaseTestSite.Log.Add(LogEntryKind.Comment, "Waiting for FAS to be replicated, searchFlags: {0}", searchFlags);
bool isReplicated = false;
for (timeOut = 0; timeOut < kMaxTimeOut; ++timeOut)
{
if (IsObjectReplicated(dc1, rodc, NamingContext.SchemaNC, attrDn))
{
// exit the loop when FAS is replicated to the RODC
isReplicated = true;
BaseTestSite.Log.Add(LogEntryKind.Comment, "FAS applied.");
break;
}
System.Threading.Thread.Sleep(kMaxTimeoutInMilliseconds);
}
BaseTestSite.Assert.IsTrue(isReplicated, "Replica from {0} succeeded.", dc1.NetbiosName);
// create the user first if it doesn't exist.
string userDn = ldapAdapter.TestAddUserObj(dc1);
Assert.IsNotNull(userDn);
// take a "snapshot" of the current RODC replication state.
// We'll use this snapshot to impersonate earlier state of the RODC
// AFTER the changes are replicated to the actual RODC.
USN_VECTOR? usnFrom = null;
UPTODATE_VECTOR_V1_EXT?utdVector = null;
SnapshotReplicationState(dc1, rodc, NamingContext.DomainNC, out usnFrom, out utdVector);
// modify Employee Number
int newValue = _rnd.Next();
DirectoryAttribute employeeNumberAttr = new DirectoryAttribute(attrName, newValue.ToString());
r = ldapAdapter.ModifyAttribute(dc1, userDn, employeeNumberAttr);
Assert.AreEqual <ResultCode>(ResultCode.Success, r);
//ret = drsTestClient.DrsBind(rodcEnum, EnvironmentConfig.User.ParentDomainAdmin, DRS_EXTENSIONS_IN_FLAGS.DRS_EXT_BASE);
//Assert.IsTrue(ret == 0);
ret = drsTestClient.DrsReplicaSync(rodcEnum, DrsReplicaSync_Versions.V1, dc1Enum, DRS_OPTIONS.DRS_ASYNC_OP, false, NamingContext.DomainNC);
BaseTestSite.Assert.IsTrue(ret == 0, "Start replica from {0} to {1}.", dc1.NetbiosName, rodc.NetbiosName);
// Wait until the change is replicated by the actual RODC
bool replicated = false;
for (timeOut = 0; timeOut < kMaxTimeOut; ++timeOut)
{
// First, check the originating USNs on RODC to make sure the replication has completed.
if (IsObjectReplicated(dc1, rodc, NamingContext.DomainNC, userDn))
{
replicated = true;
break;
}
// sleep
System.Threading.Thread.Sleep(kMaxTimeoutInMilliseconds);
}
uint?outVersion;
DRS_MSG_GETCHGREPLY?outMessage = null;
// DRSBind
DRS_EXTENSIONS_IN_FLAGS clientCapabilities
= DRS_EXTENSIONS_IN_FLAGS.DRS_EXT_BASE
| DRS_EXTENSIONS_IN_FLAGS.DRS_EXT_GETCHGREPLY_V6
| DRS_EXTENSIONS_IN_FLAGS.DRS_EXT_STRONG_ENCRYPTION;
ret = drsTestClient.DrsBind(dc1Enum, EnvironmentConfig.User.RODCMachineAccount, clientCapabilities);
Assert.IsTrue(ret == 0);
if (replicated)
{
ret = drsTestClient.DrsGetNCChangesV2(
dc1Enum,
dc1,
rodc,
userDn,
usnFrom.Value,
utdVector.Value,
false,
out outVersion,
out outMessage);
}
// remove the temp user
ldapAdapter.DeleteObject(dc1, userDn);
// DRSUnbind
ret = drsTestClient.DrsUnbind(dc1Enum);
Assert.IsTrue(ret == 0);
BaseTestSite.Assert.IsTrue(replicated, "Replica from {0} succeeded.", dc1.NetbiosName);
// check in outMessage that the secret attributes are not replicated.
DRS_MSG_GETCHGREPLY_V6 replyV6 = outMessage.Value.V6;
REPLENTINFLIST[] objectList = replyV6.pObjects;
if (objectList != null)
{
foreach (REPLENTINFLIST entInf in objectList)
{
for (int i = 0; i < entInf.Entinf.AttrBlock.attrCount; ++i)
{
ATTR attr = entInf.Entinf.AttrBlock.pAttr[i];
string displayName = GetLdapDisplayName(dc1, attr.attrTyp, replyV6.PrefixTableSrc);
if (displayName == attrName)
{
// examine the new value
string value = System.Text.Encoding.Unicode.GetString(
attr.AttrVal.pAVal[0].pVal);
BaseTestSite.Assert.AreNotEqual <string>(
newValue.ToString(),
value,
"{0} is in FAS, should not be replicated", attrName);
}
}
}
}
// FAS: Remove "Employee-Number" from the FAS
DirectoryAttribute searchAttr = new DirectoryAttribute(searchFlagsAttr, "0");
r = ldapAdapter.ModifyAttribute(dc1, attrDn, searchAttr);
}
/// <summary>
/// constructor
/// </summary>
/// <param name="dcType"></param>
/// <param name="objDN"></param>
public AddObjectUpdate(EnvironmentConfig.Machine dcType, string objDN)
{
dsServerType = dcType;
objectDN = objDN;
}
public void DRSR_RODC_Credential_Caching_Revealed()
{
int timeOut = 0;
DrsrTestChecker.Check();
EnvironmentConfig.Machine rodcEnum = EnvironmentConfig.Machine.RODC;
EnvironmentConfig.Machine dc1Enum = EnvironmentConfig.Machine.WritableDC1;
DsServer dc1 = (DsServer)EnvironmentConfig.MachineStore[dc1Enum];
DsServer rodc = (DsServer)EnvironmentConfig.MachineStore[rodcEnum];
// take a snapshot of the current replication state of the RODC
USN_VECTOR? usnFrom = null;
UPTODATE_VECTOR_V1_EXT?utdVector = null;
SnapshotReplicationState(dc1, rodc, NamingContext.DomainNC, out usnFrom, out utdVector);
// we need a user and put it into the Revealed List.
// create the user first if it doesn't exist.
string nc = LdapUtility.GetDnFromNcType(dc1, NamingContext.DomainNC);
string userDn = ldapAdapter.TestAddUserObj(dc1);
Assert.IsNotNull(userDn);
// add this user to the "Allowed RODC Password Replication Group"
string allowedDn = "CN=Allowed RODC Password Replication Group, CN=Users,"
+ LdapUtility.GetDnFromNcType(dc1, NamingContext.DomainNC);
ResultCode r = ldapAdapter.AddObjectToGroup(dc1, userDn, allowedDn);
Assert.IsTrue(r == ResultCode.Success);
// Set password of the user
LdapUtility.ChangeUserPassword(dc1, userDn, "1*admin");
// wait until the object is replicated by the actual RODC
bool replicated = false;
for (timeOut = 0; timeOut < kMaxTimeOut; ++timeOut)
{
if (IsObjectReplicated(dc1, rodc, NamingContext.DomainNC, userDn))
{
replicated = true;
break;
}
System.Threading.Thread.Sleep(kMaxTimeoutInMilliseconds);
}
// wait until the "Allowed RODC Password Replication Group object is replicated by the actual RODC
replicated = false;
for (timeOut = 0; timeOut < kMaxTimeOut; ++timeOut)
{
if (IsObjectReplicated(dc1, rodc, NamingContext.DomainNC, allowedDn))
{
replicated = true;
break;
}
System.Threading.Thread.Sleep(kMaxTimeoutInMilliseconds);
}
BaseTestSite.Assert.IsTrue(replicated, "{0} should be replicated to the RODC", allowedDn);
// DRSBind
DRS_EXTENSIONS_IN_FLAGS clientCapabilities
= DRS_EXTENSIONS_IN_FLAGS.DRS_EXT_BASE
| DRS_EXTENSIONS_IN_FLAGS.DRS_EXT_GETCHGREPLY_V6
| DRS_EXTENSIONS_IN_FLAGS.DRS_EXT_STRONG_ENCRYPTION;
uint ret = drsTestClient.DrsBind(dc1Enum, EnvironmentConfig.User.RODCMachineAccount, clientCapabilities);
Assert.IsTrue(ret == 0);
uint?outVersion;
DRS_MSG_GETCHGREPLY?outMessage = null;
ret = drsTestClient.DrsGetNCChangesV2(
dc1Enum,
dc1,
rodc,
userDn,
usnFrom.Value,
utdVector.Value,
true, // request secrets
out outVersion,
out outMessage);
// DRSUnbind
ret = drsTestClient.DrsUnbind(dc1Enum);
Assert.IsTrue(ret == 0);
ldapAdapter.DeleteObject(dc1, userDn);
// check in outMessage that the secret attributes are not replicated.
DRS_MSG_GETCHGREPLY_V6 replyV6 = outMessage.Value.V6;
REPLENTINFLIST[] objectList = replyV6.pObjects;
bool secretFound = false;
string firstSecretAttrbute = null;
foreach (REPLENTINFLIST entInf in objectList)
{
for (int i = 0; i < entInf.Entinf.AttrBlock.attrCount; ++i)
{
ATTR attr = entInf.Entinf.AttrBlock.pAttr[i];
if (IsSecretAttribute(dc1, attr.attrTyp, replyV6.PrefixTableSrc, out firstSecretAttrbute))
{
if (attr.AttrVal.pAVal != null)
{
secretFound = true;
}
}
}
}
BaseTestSite.Assert.IsTrue(
secretFound,
"Secret attribute {0} should appear in the response when user is in the revealed list",
firstSecretAttrbute);
}
public void DRSR_RODC_Unidirectional_Replication_Denied()
{
DrsrTestChecker.Check();
EnvironmentConfig.Machine rodcEnum = EnvironmentConfig.Machine.RODC;
EnvironmentConfig.Machine dc1Enum = EnvironmentConfig.Machine.WritableDC1;
DsServer dc1 = (DsServer)EnvironmentConfig.MachineStore[dc1Enum];
DsServer rodc = (DsServer)EnvironmentConfig.MachineStore[rodcEnum];
// DRSBind
DRS_EXTENSIONS_IN_FLAGS clientCapabilities
= DRS_EXTENSIONS_IN_FLAGS.DRS_EXT_BASE
| DRS_EXTENSIONS_IN_FLAGS.DRS_EXT_GETCHGREPLY_V6
| DRS_EXTENSIONS_IN_FLAGS.DRS_EXT_STRONG_ENCRYPTION;
uint ret = drsTestClient.DrsBind(rodcEnum, EnvironmentConfig.User.MainDCAccount, clientCapabilities);
Assert.IsTrue(ret == 0);
// test user DN
string nc = LdapUtility.GetDnFromNcType(dc1, NamingContext.DomainNC);
string userDn = "CN=" + EnvironmentConfig.DomainUserName + ",CN=Users," + nc;
EnvironmentConfig.ExpectSuccess = false;
uint?outVersion;
DRS_MSG_GETCHGREPLY?outMessage;
bool exceptionCaught = false;
try
{
ret = drsTestClient.DrsGetNCChanges(
rodcEnum,
DrsGetNCChanges_Versions.V8,
dc1Enum,
DRS_OPTIONS.NONE,
NamingContext.DomainNC,
EXOP_REQ_Codes.EXOP_REPL_SECRETS,
FSMORoles.None,
userDn,
out outVersion,
out outMessage);
}
catch (Exception e)
{
if (EnvironmentConfig.UseNativeRpcLib)
{
// windows behavior, an RODC cannot process GetNCChange request
// Illegal RODC RPC call
BaseTestSite.Assert.IsInstanceOfType(
e,
typeof(SEHException),
"The call should not be accepted by the RODC");
}
else
{
BaseTestSite.Assert.AreEqual <int>(87, int.Parse(e.Message), "RPC error code " + e.Message);
}
exceptionCaught = true;
}
finally
{
EnvironmentConfig.ExpectSuccess = true;
}
BaseTestSite.Assert.IsTrue(exceptionCaught, "An exception should be raised to indicate invalid GetNCChange calls");
}
public void DRSR_DRSRemoveDsDomain_Remove_Domain()
{
DrsrTestChecker.Check();
// Init the data.
EnvironmentConfig.Machine srv = EnvironmentConfig.Machine.WritableDC1;
// The destination server in an external forest. The external forest will be
// removed after this call.
EnvironmentConfig.Machine dst = EnvironmentConfig.Machine.CDC;
DsServer server = (DsServer)EnvironmentConfig.MachineStore[srv];
DsServer child = (DsServer)EnvironmentConfig.MachineStore[dst];
DsUser user = EnvironmentConfig.UserStore[EnvironmentConfig.User.ParentDomainAdmin];
uint ret = 0;
ret = drsTestClient.DrsBind(
srv,
EnvironmentConfig.User.ParentDomainAdmin,
DRS_EXTENSIONS_IN_FLAGS.DRS_EXT_BASE
);
BaseTestSite.Assert.AreEqual <uint>(
0,
ret,
"IDL_DRSBind: should return 0 with a success bind to DC");
string domainDn = child.Domain.Name;
// We call RemoveDsServer to remove an actual
// DC in the external forest, so that a crossRef object
// pointing to a removed NC will exists.
string serverDn = child.ServerObjectName;
ret = drsTestClient.DrsRemoveDsServer(
srv,
IDL_DRSRemoveDsServer_dwInVersion_Values.V1,
serverDn,
domainDn,
true);
BaseTestSite.Assert.AreEqual <uint>(
0,
ret,
"IDL_DRSRemoveDsDomain: should return 0 after removal of server");
// Note that by far, the NTDS DSA object of this server should be removed already.
ret = drsTestClient.DrsRemoveDsDomain(
srv,
IDL_DRSRemoveDsDomain_dwInVersion_Values.V1,
domainDn
);
BaseTestSite.Assert.AreEqual <uint>(
ret,
0,
"IDL_DRSRemoveDsDomain: return value should be 0");
// Unbind
ret = drsTestClient.DrsUnbind(srv);
BaseTestSite.Assert.AreEqual <uint>(
0,
ret,
"IDL_DRSUnbind: return value should be 0");
}
public void DRSR_RODC_Credential_Caching_Not_Revealed()
{
uint timeOut = 0;
DrsrTestChecker.Check();
EnvironmentConfig.Machine rodcEnum = EnvironmentConfig.Machine.RODC;
EnvironmentConfig.Machine dc1Enum = EnvironmentConfig.Machine.WritableDC1;
DsServer dc1 = (DsServer)EnvironmentConfig.MachineStore[dc1Enum];
DsServer rodc = (DsServer)EnvironmentConfig.MachineStore[rodcEnum];
// take a snapshot of the current replication state of the RODC
USN_VECTOR? usnFrom = null;
UPTODATE_VECTOR_V1_EXT?utdVector = null;
SnapshotReplicationState(dc1, rodc, NamingContext.DomainNC, out usnFrom, out utdVector);
// we need a user and put it into the Revealed List.
// create the user first if it doesn't exist.
string userDn = ldapAdapter.TestAddUserObj(dc1);
Assert.IsNotNull(userDn);
// at this time, the user is NOT in the revealed list
// wait until the object is replicated by the actual RODC
bool replicated = false;
for (timeOut = 0; timeOut < kMaxTimeOut; ++timeOut)
{
if (IsObjectReplicated(dc1, rodc, NamingContext.DomainNC, userDn))
{
replicated = true;
break;
}
System.Threading.Thread.Sleep(kMaxTimeoutInMilliseconds);
}
BaseTestSite.Assert.IsTrue(replicated, "The object should be replicated to the RODC");
// DRSBind
DRS_EXTENSIONS_IN_FLAGS clientCapabilities
= DRS_EXTENSIONS_IN_FLAGS.DRS_EXT_BASE
| DRS_EXTENSIONS_IN_FLAGS.DRS_EXT_GETCHGREPLY_V6
| DRS_EXTENSIONS_IN_FLAGS.DRS_EXT_STRONG_ENCRYPTION;
uint ret = drsTestClient.DrsBind(dc1Enum, EnvironmentConfig.User.RODCMachineAccount, clientCapabilities);
Assert.IsTrue(ret == 0);
uint?outVersion;
DRS_MSG_GETCHGREPLY?outMessage;
ret = drsTestClient.DrsGetNCChangesV2(
dc1Enum,
dc1,
rodc,
userDn,
usnFrom.Value,
utdVector.Value,
true, // request secrets
out outVersion,
out outMessage);
BaseTestSite.Assert.IsTrue(
(uint)Win32ErrorCode_32.ERROR_DS_DRA_SECRETS_DENIED == ret,
"Replication of secrets should be denied when the object is not in the revealed list"
);
// remove the temp user
ldapAdapter.DeleteObject(dc1, userDn);
// DRSUnbind
ret = drsTestClient.DrsUnbind(dc1Enum);
}
/// <summary>
/// init objects for MachineStore
/// </summary>
static void InitMachineObjects()
{
#region machine objects
string[] enum_vals = Enum.GetNames(typeof(EnvironmentConfig.Machine));
//first loop only initialize physical machines
foreach (string s in enum_vals)
{
DsMachine machine = null;
EnvironmentConfig.Machine val = (EnvironmentConfig.Machine)Enum.Parse(typeof(EnvironmentConfig.Machine), s);
switch (val)
{
case Machine.None:
continue;
case Machine.Endpoint:
//initialize client
machine = new ClientMachine();
machine.Domain = DomainStore[DomainEnum.PrimaryDomain];
machine.NetbiosName = ADCommonServerAdapter.Instance(testSite).ENDPOINTNetbiosName;
machine.DnsHostName = machine.NetbiosName + "." + machine.Domain.DNSName;
break;
case Machine.MainDC:
if (MachineStore.ContainsKey(Machine.WritableDC1))
{
machine = MachineStore[Machine.WritableDC1];
}
else
{
machine = ldapAd.GetDCInfo(ADCommonServerAdapter.Instance(testSite).PDCNetbiosName + "." + ADCommonServerAdapter.Instance(testSite).PrimaryDomainDnsName, UserStore[User.ParentDomainAdmin]);
if (testDS)
{
//do this in AD LDS will assign an AD LDS domain
machine.Domain = DomainStore[DomainEnum.PrimaryDomain];
}
}
break;
case Machine.RODC:
if (string.IsNullOrWhiteSpace(ADCommonServerAdapter.Instance(testSite).RODCNetbiosName))
{
continue;
}
try
{
machine = ldapAd.GetDCInfo(ADCommonServerAdapter.Instance(testSite).RODCNetbiosName + "." + ADCommonServerAdapter.Instance(testSite).PrimaryDomainDnsName, UserStore[User.ParentDomainAdmin]);
if (testDS)
{
//do this in AD LDS will assign an AD LDS domain
machine.Domain = DomainStore[DomainEnum.PrimaryDomain];
}
((AddsServer)machine).IsRODC = true;
}
catch (System.DirectoryServices.Protocols.LdapException)
{
continue;
}
break;
case Machine.WritableDC1:
if (MachineStore.ContainsKey(Machine.MainDC))
{
machine = MachineStore[Machine.MainDC];
}
else
{
machine = ldapAd.GetDCInfo(ADCommonServerAdapter.Instance(testSite).PDCNetbiosName + "." + ADCommonServerAdapter.Instance(testSite).PrimaryDomainDnsName, UserStore[User.ParentDomainAdmin]);
if (testDS)
{
//do this in AD LDS will assign an AD LDS domain
machine.Domain = DomainStore[DomainEnum.PrimaryDomain];
}
}
break;
case Machine.WritableDC2:
if (string.IsNullOrWhiteSpace(ADCommonServerAdapter.Instance(testSite).SDCNetbiosName))
{
continue;
}
try
{
machine = ldapAd.GetDCInfo(ADCommonServerAdapter.Instance(testSite).SDCNetbiosName + "." + ADCommonServerAdapter.Instance(testSite).PrimaryDomainDnsName, UserStore[User.ParentDomainAdmin]);
if (testDS)
{
//do this in AD LDS will assign an AD LDS domain
machine.Domain = DomainStore[DomainEnum.PrimaryDomain];
}
}
catch (System.DirectoryServices.Protocols.LdapException)
{
continue;
}
break;
default:
//by default, it should be a DC
if (testDS)
{
if (string.IsNullOrEmpty(testSite.Properties[s + ".NetbiosName"]))
{
continue;
}
machine = ldapAd.GetDCInfo(testSite.Properties[s + ".NetbiosName"] + "." + GetDomainFromMachineType(val).DNSName, GetDomainFromMachineType(val).Admin);
}
else
{
if (string.IsNullOrEmpty(testSite.Properties[s + ".LDSPort"]))
{
continue;
}
machine = ldapAd.GetDCInfo(
ADCommonServerAdapter.Instance(testSite).PDCNetbiosName
+ "."
+ ADCommonServerAdapter.Instance(testSite).PrimaryDomainDnsName
+ ":"
+ testSite.Properties[s + ".LDSPort"],
UserStore[User.ParentDomainAdmin]);
((AdldsServer)machine).DsaNetworkAddress =
ADCommonServerAdapter.Instance(testSite).PDCNetbiosName
+ "."
+ ADCommonServerAdapter.Instance(testSite).PrimaryDomainDnsName
+ ":"
+ ((AdldsServer)machine).DsaNetworkAddress;
}
((DsServer)machine).IsWindows = bool.Parse(testSite.Properties[s + ".IsWindows"]);
if (machine != null)
{
switch (val)
{
case Machine.CDC:
machine.Domain = DomainStore[DomainEnum.ChildDomain];
break;
case Machine.ExternalDC:
machine.Domain = DomainStore[DomainEnum.ExternalDomain];
break;
default:
machine.Domain = DomainStore[DomainEnum.PrimaryDomain];
break;
}
}
break;
}
if (machine != null)
{
MachineStore.Add(val, machine);
if (val != Machine.MainDC)
{
PhysicalMachineStore.Add(val, machine);
}
}
}
//second loop initialize roles
foreach (string s in enum_vals)
{
EnvironmentConfig.Machine val = (EnvironmentConfig.Machine)Enum.Parse(typeof(EnvironmentConfig.Machine), s);
switch (val)
{
case Machine.DC_With_DomainNamingMasterRole:
break;
case Machine.DC_With_RidAllocationMasterRole:
break;
case Machine.GCServer:
break;
case Machine.PDC:
break;
default:
continue;
}
MachineStore.Add(val, MachineStore[Machine.WritableDC1]);
}
#endregion
}
public void DRSR_DRSVerifyNames_Verify_SAM_Account_Names()
{
DrsrTestChecker.Check();
// Init the data.
EnvironmentConfig.Machine srv = EnvironmentConfig.Machine.WritableDC1;
DsServer server = (DsServer)EnvironmentConfig.MachineStore[srv];
DsUser user = EnvironmentConfig.UserStore[EnvironmentConfig.User.ParentDomainAdmin];
uint ret = 0;
ret = drsTestClient.DrsBind(
srv,
EnvironmentConfig.User.ParentDomainAdmin,
DRS_EXTENSIONS_IN_FLAGS.DRS_EXT_BASE
);
BaseTestSite.Assert.AreEqual <uint>(
0,
ret,
"IDL_DRSBind: should return 0 with a success bind to DC");
// Create a DSNAME with only SAMAccountName.
string userDn = ldapAdapter.GetUserDn(server, user);
string sAMAccountName = (string)ldapAdapter.GetAttributeValue(server, userDn, "sAMAccountName");
DSNAME dsUser = DrsuapiClient.CreateDsName(sAMAccountName, Guid.Empty, null);
// Prefix table
SCHEMA_PREFIX_TABLE prefixTable = OIDUtility.CreatePrefixTable();
// Create the attribute block. Here we go to RDN attribute.
string rdnAttrId = DRSConstants.RDN_OID;
uint attrTyp = OIDUtility.MakeAttid(prefixTable, rdnAttrId);
ATTRVAL attrVal = DrsuapiClient.CreateATTRVAL(null);
ATTRVALBLOCK attrValBlock = DrsuapiClient.CreateATTRVALBLOCK(new ATTRVAL[] { attrVal });
ATTR attr = DrsuapiClient.CreateATTR(attrTyp, attrValBlock);
ATTRBLOCK attrBlock = DrsuapiClient.CreateATTRBLOCK(new ATTR[] { attr });
// Actual RPC call.
ret = drsTestClient.DrsVerifyNames(
srv,
dwInVersion_Values.V1,
DRS_MSG_VERIFYREQ_V1_dwFlags_Values.DRS_VERIFY_SAM_ACCOUNT_NAMES,
new DSNAME[] { dsUser },
new string[] { userDn },
attrBlock,
prefixTable
);
BaseTestSite.Assert.AreEqual <uint>(
0,
ret,
"IDL_DRSVerifyNames: return value should be 0"
);
// Unbind
ret = drsTestClient.DrsUnbind(srv);
BaseTestSite.Assert.AreEqual <uint>(
0,
ret,
"IDL_DRSUnbind: return value should be 0");
}
DRS_MSG_REPDEL GenerateReplicaDelReq(EnvironmentConfig.Machine machine, EnvironmentConfig.Machine src)
{
return(drsTestClient.CreateReplicaDelReq(machine, (DsServer)EnvironmentConfig.MachineStore[src], DRS_OPTIONS.DRS_WRIT_REP, NamingContext.ConfigNC));
}
DRS_MSG_REPADD GenerateReplicaAddReq(EnvironmentConfig.Machine sut, EnvironmentConfig.Machine partner, DRS_MSG_REPADD_Versions version)
{
return(drsTestClient.CreateReplicaAddReq(sut, version, (DsServer)EnvironmentConfig.MachineStore[partner], DRS_OPTIONS.DRS_WRIT_REP, NamingContext.ConfigNC));
}
private void DRSUpdateRefs_pszDsaDest_NULL(DrsUpdateRefs_Versions ver)
{
uint ret = drsTestClient.DrsBind(EnvironmentConfig.Machine.WritableDC1, EnvironmentConfig.User.ParentDomainAdmin, DRS_EXTENSIONS_IN_FLAGS.DRS_EXT_BASE);
DRS_MSG_UPDREFS req;
EnvironmentConfig.Machine machine = EnvironmentConfig.Machine.WritableDC1;
DsServer dest = (DsServer)EnvironmentConfig.MachineStore[EnvironmentConfig.Machine.WritableDC2];
DRS_OPTIONS options;
try
{
BaseTestSite.Log.Add(LogEntryKind.Checkpoint, "Try to delete replication destination from repsTo for later testing. It MAY fails if there is no such record to delete");
options = DRS_OPTIONS.DRS_DEL_REF;
req = drsTestClient.CreateRequestForDrsUpdateRef(
machine,
ver,
dest,
options
);
ret = drsTestClient.DRSClient.DrsUpdateRefs(EnvironmentConfig.DrsContextStore[machine], (uint)ver, req);
}
catch
{
BaseTestSite.Log.Add(LogEntryKind.Checkpoint, "No similar record to delete in repsTo. It's OK to continue");
}
options = DRS_OPTIONS.DRS_ADD_REF;
req = drsTestClient.CreateRequestForDrsUpdateRef(
machine,
ver,
dest,
options
);
// Invalid value
switch (ver)
{
case DrsUpdateRefs_Versions.V1:
req.V1.pszDsaDest = "";
break;
case DrsUpdateRefs_Versions.V2:
req.V2.pszDsaDest = "";
break;
default:
BaseTestSite.Assert.Fail("The version {0} is not supported.", ver);
break;
}
ret = drsTestClient.DRSClient.DrsUpdateRefs(EnvironmentConfig.DrsContextStore[machine], (uint)ver, req);
BaseTestSite.Assert.AreEqual <uint>((uint)Win32ErrorCode_32.ERROR_DS_DRA_INVALID_PARAMETER, ret, "the server should return ERROR_DS_DRA_INVALID_PARAMETER");
options = DRS_OPTIONS.DRS_DEL_REF;
req = drsTestClient.CreateRequestForDrsUpdateRef(
machine,
ver,
dest,
options
);
ret = drsTestClient.DRSClient.DrsUpdateRefs(EnvironmentConfig.DrsContextStore[machine], (uint)ver, req);
}
/// <summary>
/// constructor
/// </summary>
/// <param name="svr">sut</param>
/// <param name="toDel">source</param>
/// <param name="op">flags</param>
/// <param name="cred">credential</param>
public RecoverReplicaSource(EnvironmentConfig.Machine svr, EnvironmentConfig.User cred)
{
sut = svr;
user = cred;
}
public NeedRepSourceUpdate(EnvironmentConfig.Machine sut, EnvironmentConfig.Machine srcSvr, NamingContext nc)
{
server = sut;
src = srcSvr;
srcNC = nc;
}
/// <summary>
/// Verify CrackNames results.
/// </summary>
/// <param name="machine"></param>
/// <param name="retVal"></param>
/// <param name="dwInVersion"></param>
/// <param name="req"></param>
/// <param name="outVersion"></param>
/// <param name="reply"></param>
public void VerifyDrsCrackNames(
EnvironmentConfig.Machine machine,
uint retVal,
uint dwInVersion,
DRS_MSG_CRACKREQ req,
uint?outVersion,
DRS_MSG_CRACKREPLY?reply)
{
// IDL_DRSCrackNames supports only V1
testSite.Assert.IsTrue(outVersion == 1,
"IDL_DRSCrackNames: Checking outVersion - got: {0}, expect: {1}, outVersion should be 1.", outVersion, 1);
testSite.Assert.IsNotNull(reply, "IDL_DRSCrackNames: Checking outMessage - outMessage should not be null.");
testSite.Assert.IsNotNull(reply.Value.V1.pResult, "IDL_DRSCrackNames: Checking pResult - pResult in outMessage should not be null.");
DsServer srv = (DsServer)EnvironmentConfig.MachineStore[machine];
uint flag = req.V1.dwFlags;
switch (flag)
{
case (uint)DRS_MSG_CRACKREQ_FLAGS.DS_NAME_FLAG_GC_VERIFY:
{
const uint ERROR_DS_GCVERIFY_ERROR = 0x20e1;
bool isGc = ldapAd.IsGc(srv);
if (!isGc)
{
testSite.Assert.IsTrue(
retVal == ERROR_DS_GCVERIFY_ERROR,
"IDL_DRSCrackNames: Cannot verify the GC server {0}",
srv.NetbiosName);
}
else
{
testSite.Assert.IsTrue(
retVal == (uint)DS_NAME_ERROR.DS_NAME_NO_ERROR,
"IDL_DRSCrackNames: DC {0} is not a GC server",
srv.NetbiosName);
}
}
break;
default:
break;
}
// formats
uint formatOffered = req.V1.formatOffered;
switch (formatOffered)
{
case (uint)DS_NAME_FORMAT.DS_INVALID_NAME:
// Invalid name, just break.
break;
case (uint)formatOffered_Values.DS_LIST_SITES:
VerifyCrackNamesListAllSites(srv, req, reply);
break;
case (uint)formatOffered_Values.DS_LIST_SERVERS_IN_SITE:
VerifyCrackNamesListServersInSite(srv, req, reply);
break;
case (uint)formatOffered_Values.DS_LIST_DOMAINS_IN_SITE:
VerifyCrackNamesListDomainsInSite(srv, req, reply);
break;
case (uint)formatOffered_Values.DS_LIST_SERVERS_FOR_DOMAIN_IN_SITE:
VerifyCrackNamesListServersForDomainInSite(srv, req, reply);
break;
case (uint)formatOffered_Values.DS_LIST_INFO_FOR_SERVER:
VerifyCrackNamesListInfoForServer(srv, req, reply);
break;
case (uint)formatOffered_Values.DS_LIST_ROLES:
VerifyCrackNamesListRoles(srv, req, reply);
break;
case (uint)formatOffered_Values.DS_LIST_DOMAINS:
VerifyCrackNamesListDomains(srv, req, reply);
break;
case (uint)formatOffered_Values.DS_LIST_NCS:
VerifyCrackNamesListNcs(srv, req, reply);
break;
case (uint)formatOffered_Values.DS_LIST_SERVERS_WITH_DCS_IN_SITE:
VerifyCrackNamesListServersWithDcsInSite(srv, req, reply);
break;
case (uint)formatOffered_Values.DS_LIST_GLOBAL_CATALOG_SERVERS:
VerifyCrackNamesListGlobalCatalogServers(srv, req, reply);
break;
case (uint)formatOffered_Values.DS_MAP_SCHEMA_GUID:
VerifyCrackNamesMapSchemaGuid(srv, req, reply);
break;
case (uint)DS_NAME_FORMAT.DS_UNKNOWN_NAME:
case (uint)DS_NAME_FORMAT.DS_FQDN_1779_NAME:
case (uint)DS_NAME_FORMAT.DS_NT4_ACCOUNT_NAME:
case (uint)DS_NAME_FORMAT.DS_DISPLAY_NAME:
case (uint)DS_NAME_FORMAT.DS_UNIQUE_ID_NAME:
case (uint)DS_NAME_FORMAT.DS_CANONICAL_NAME:
case (uint)DS_NAME_FORMAT.DS_USER_PRINCIPAL_NAME:
case (uint)DS_NAME_FORMAT.DS_CANONICAL_NAME_EX:
case (uint)DS_NAME_FORMAT.DS_SERVICE_PRINCIPAL_NAME:
case (uint)DS_NAME_FORMAT.DS_SID_OR_SID_HISTORY_NAME:
case (uint)DS_NAME_FORMAT.DS_DNS_DOMAIN_NAME:
case (uint)formatOffered_Values.DS_NT4_ACCOUNT_NAME_SANS_DOMAIN:
case (uint)formatOffered_Values.DS_NT4_ACCOUNT_NAME_SANS_DOMAIN_EX:
case (uint)formatOffered_Values.DS_ALT_SECURITY_IDENTITIES_NAME:
case (uint)formatOffered_Values.DS_STRING_SID_NAME:
case (uint)formatOffered_Values.DS_USER_PRINCIPAL_NAME_AND_ALTSECID:
{
for (int i = 0; i < req.V1.cNames; ++i)
{
DS_NAME_RESULT_ITEMW r = ldapAd.LookupNames(
srv,
req.V1.dwFlags,
req.V1.formatOffered,
req.V1.formatDesired,
req.V1.rpNames[i]
);
// status code
testSite.Assert.IsTrue(
r.status == reply.Value.V1.pResult[0].rItems[i].status,
"IDL_DRSCrackNames: Verify status failed, expect: {0}, got: {1}",
r.status,
reply.Value.V1.pResult[0].rItems[i].status
);
// name
if (r.pName == null)
{
testSite.Assert.IsNull(reply.Value.V1.pResult[0].rItems[i].pName,
"IDL_DRSCrackNames: Verify pName failed, expect: null, got: {0}.",
reply.Value.V1.pResult[0].rItems[i].pName);
}
else
{
testSite.Assert.IsTrue(
r.pName == reply.Value.V1.pResult[0].rItems[i].pName,
"IDL_DRSCrackNames: Verify pName failed, expect: {0}, got: {1}.",
r.pName,
reply.Value.V1.pResult[0].rItems[i].pName
);
}
// domain
if (r.pDomain == null)
{
testSite.Assert.IsNull(reply.Value.V1.pResult[0].rItems[i].pDomain,
"IDL_DRSCrackNames: Verify pDomain failed, expect: null, got: {0}.",
reply.Value.V1.pResult[0].rItems[i].pDomain);
}
else
{
testSite.Assert.IsTrue(
r.pDomain == reply.Value.V1.pResult[0].rItems[i].pDomain,
"IDL_DRSCrackNames: Verify pDomain failed, expect: {0}, got: {1}.",
r.pDomain,
reply.Value.V1.pResult[0].rItems[i].pDomain
);
}
}
}
break;
default:
throw new NotImplementedException();
}
}
public void DRSR_DRSGetNCChanges_Failed_NoStrongEncryptionByClient()
{
DrsrTestChecker.Check();
EnvironmentConfig.Machine dcServer = EnvironmentConfig.Machine.WritableDC1;
EnvironmentConfig.Machine dcPartner = EnvironmentConfig.Machine.WritableDC2;
DsServer dcServerMachine = (DsServer)EnvironmentConfig.MachineStore[dcServer];
DsServer dcPartnerMachine = (DsServer)EnvironmentConfig.MachineStore[dcPartner];
NamingContext specifiedNC = NamingContext.DomainNC;
string userdn = ldapAdpter.TestAddUserObj(dcServerMachine);
AddObjectUpdate aou = new AddObjectUpdate(dcServer, userdn);
updateStorage.PushUpdate(aou);
string groupdn = DRSTestData.DRSGetNCChange_ExistGroup + "," + LdapUtility.ConvertUshortArrayToString(((AddsDomain)dcServerMachine.Domain).DomainNC.StringName);
DRS_OPTIONS ulFlags = DRS_OPTIONS.NONE;
try
{
ldapAdpter.RemoveObjectFromGroup(dcServerMachine, userdn, groupdn);
}
catch
{
//it's OK if user is not in group
}
drsTestClient.SyncDCs(dcServer, dcServer);
//add a user to group dn
BaseTestSite.Log.Add(LogEntryKind.Comment, "Add user dn {0} to group dn {1} on DC {2}", userdn, groupdn, dcServer);
ResultCode addret = ldapAdpter.AddObjectToGroup(dcServerMachine, userdn, groupdn);
BaseTestSite.Assert.IsTrue(addret == ResultCode.Success, "add userdn {0} to group dn {1} failed", userdn, groupdn);
AddObjectUpdate adduserUpdate = new AddObjectUpdate(dcServer, userdn);
updateStorage.PushUpdate(adduserUpdate);
DRS_EXTENSIONS_IN_FLAGS clientCapbilities = DRS_EXTENSIONS_IN_FLAGS.DRS_EXT_BASE | DRS_EXTENSIONS_IN_FLAGS.DRS_EXT_GETCHGREPLY_V6; // not contains | DRS_EXTENSIONS_IN_FLAGS.DRS_EXT_STRONG_ENCRYPTION;
BaseTestSite.Log.Add(LogEntryKind.Comment, "Bind to DC server: {0}", dcServer);
uint ret = drsTestClient.DrsBind(dcServer, EnvironmentConfig.User.WritableDC2Account, clientCapbilities);
BaseTestSite.Assert.AreEqual <uint>(0, ret, "IDL_DRSBind should return 0 with a success bind to DC");
BaseTestSite.Log.Add(LogEntryKind.Comment,
"Calling IDL_DRSNCChanges (V8 request) to get changes for a specified NC from a DC server. The reply compression is not required.");
uint?outVersion;
DRS_MSG_GETCHGREPLY?outMessage;
ret = drsTestClient.DrsGetNCChanges(
dcServer,
DrsGetNCChanges_Versions.V8,
dcPartner,
ulFlags,
specifiedNC,
EXOP_REQ_Codes.None,
FSMORoles.None,
null,
out outVersion,
out outMessage);
BaseTestSite.Assert.AreNotEqual <uint>(0, ret, "IDL_DRSGetNCChanges should not return 0x0 for failure");
BaseTestSite.Assert.AreEqual <uint>((uint)Win32ErrorCode_32.SEC_E_ALGORITHM_MISMATCH, ret, "Verify error code detail: IDL_DRSNCChanges should return SEC_E_ALGORITHM_MISMATCH due to DRS_EXT_STRONG_ENCRYPTION not included in bind.");
}