diff --git a/opendj-server-legacy/src/test/java/org/opends/server/authorization/dseecompat/AciTests.java b/opendj-server-legacy/src/test/java/org/opends/server/authorization/dseecompat/AciTests.java index 1ff81f087f..a02df497d7 100644 --- a/opendj-server-legacy/src/test/java/org/opends/server/authorization/dseecompat/AciTests.java +++ b/opendj-server-legacy/src/test/java/org/opends/server/authorization/dseecompat/AciTests.java @@ -14,6 +14,7 @@ * Copyright 2008-2010 Sun Microsystems, Inc. * Portions Copyright 2011-2016 ForgeRock AS. * Portions Copyright 2013 Manuel Gaupp + * Portions Copyright 2026 3A Systems, LLC */ package org.opends.server.authorization.dseecompat; @@ -75,7 +76,7 @@ * the syntax. */ @SuppressWarnings("javadoc") -@Test(sequential=true, groups="slow") +@Test(sequential=true) public class AciTests extends AciTestCase { // TODO: test modify use cases // TODO: test searches where we expect a subset of attributes and entries @@ -643,7 +644,6 @@ public void clearBackend() throws Exception { buildAciValue("name", "w/ targattrfilters", "targattrfilters=", TARG_ATTR_FILTERS_1 , "allow (write)", BIND_RULE_USERDN_SELF), buildAciValue("name", "w/ targattrfilters", "targattrfilters=", TARG_ATTR_FILTERS_2 , "allow (write)", BIND_RULE_USERDN_SELF), buildAciValue("name", "w/ targattrfilters", "targattrfilters=", TARG_ATTR_FILTERS_5 , "allow (write)", BIND_RULE_USERDN_SELF), - buildAciValue("name", "bad_ATTR_TYPE_NAME", "targattrfilters",TARG_ATTR_FILTERS_ATTR_TYPE_NAME, "allow (write)", BIND_RULE_USERDN_SELF), buildAciValue("name", "read", "targetattr", "*", "allow (read)", BIND_RULE_USERDN_SELF), buildAciValue("name", "write", "targetattr", "*", "allow (write)", BIND_RULE_USERDN_SELF), buildAciValue("name", "add", "targetattr", "*", "allow (add)", BIND_RULE_USERDN_SELF), @@ -746,6 +746,11 @@ public void clearBackend() throws Exception { buildAciValue("name", "bad_op", "targattrfilters",TARG_ATTR_FILTERS_BAD_OP, "allow (write)", BIND_RULE_USERDN_SELF), buildAciValue("name", "bad_op_match", "targattrfilters",TARG_ATTR_FILTERS_BAD_OP_MATCH, "allow (write)", BIND_RULE_USERDN_SELF), buildAciValue("name", "bad_filter_attr", "targattrfilters",TARG_ATTR_FILTERS_BAD_FILTER_ATTR, "allow (write)", BIND_RULE_USERDN_SELF), + // The attribute name "1sn_" passes the lenient dseecompat ATTR_NAME + // pattern, but the filter part is parsed as an RFC 4512 attribute + // description, which cannot start with a digit unless it is a + // numeric OID, so the ACI is rejected at decode time. + buildAciValue("name", "bad_ATTR_TYPE_NAME", "targattrfilters",TARG_ATTR_FILTERS_ATTR_TYPE_NAME, "allow (write)", BIND_RULE_USERDN_SELF), buildAciValue("name", "bad_format", "targattrfilters",TARG_ATTR_FILTERS_BAD_FORMAT, "allow (write)", BIND_RULE_USERDN_SELF), buildAciValue("name", "too_many_lists", "targattrfilters",TARG_ATTR_FILTERS_TOO_MANY_LISTS, "allow (write)", BIND_RULE_USERDN_SELF), buildAciValue("name", "bad_tok", "targattrfilters",TARG_ATTR_FILTERS_BAD_TOK, "allow (write)", BIND_RULE_USERDN_SELF), @@ -1727,6 +1732,9 @@ public String[] getLdapCompareArgs(String attrAssertion) { "-p", getServerLdapPort(), "-D", _bindDn, "-w", _bindPw, + // Return the actual compare result code (COMPARE_TRUE / COMPARE_FALSE) + // instead of 0 on success, so callers can assert the evaluation result. + "--useCompareResultCode", attrAssertion, _searchBaseDn}; }