From eb2a3b87adfdb0a90003280789c45ff3c40aea21 Mon Sep 17 00:00:00 2001 From: Valera V Harseko Date: Fri, 3 Jul 2026 11:52:47 +0300 Subject: [PATCH 1/2] Fix two broken AciTests cases and enable the suite in the default build AciTests (515 tests covering the dseecompat ACI machinery) is in the "slow" TestNG group, which the build excludes, so the suite never ran in CI and two tests silently rotted: - testValidAcis declared an ACI with targattrfilters attribute "1sn_" valid. The name passes the deliberately lenient dseecompat ATTR_NAME pattern, but the filter part is now parsed as an RFC 4512 attribute description, where a leading digit means a numeric OID, so the ACI is rejected at decode time (result 21). No schema can define such an attribute, so strict rejection is correct: the case moves to the invalidAcis provider. - testCompare expected the ldapcompare tool to exit with COMPARE_TRUE (6), but the tool returns 0 for a successful true comparison unless --useCompareResultCode is given. Pass the flag so the test asserts the actual comparison result again. Remove the "slow" group from the AciTests class so the suite runs in the default build (~34 s); other slow-group classes are unaffected. --- .../server/authorization/dseecompat/AciTests.java | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/opendj-server-legacy/src/test/java/org/opends/server/authorization/dseecompat/AciTests.java b/opendj-server-legacy/src/test/java/org/opends/server/authorization/dseecompat/AciTests.java index 1ff81f087f..6c6a3e2398 100644 --- a/opendj-server-legacy/src/test/java/org/opends/server/authorization/dseecompat/AciTests.java +++ b/opendj-server-legacy/src/test/java/org/opends/server/authorization/dseecompat/AciTests.java @@ -75,7 +75,7 @@ * the syntax. */ @SuppressWarnings("javadoc") -@Test(sequential=true, groups="slow") +@Test(sequential=true) public class AciTests extends AciTestCase { // TODO: test modify use cases // TODO: test searches where we expect a subset of attributes and entries @@ -643,7 +643,6 @@ public void clearBackend() throws Exception { buildAciValue("name", "w/ targattrfilters", "targattrfilters=", TARG_ATTR_FILTERS_1 , "allow (write)", BIND_RULE_USERDN_SELF), buildAciValue("name", "w/ targattrfilters", "targattrfilters=", TARG_ATTR_FILTERS_2 , "allow (write)", BIND_RULE_USERDN_SELF), buildAciValue("name", "w/ targattrfilters", "targattrfilters=", TARG_ATTR_FILTERS_5 , "allow (write)", BIND_RULE_USERDN_SELF), - buildAciValue("name", "bad_ATTR_TYPE_NAME", "targattrfilters",TARG_ATTR_FILTERS_ATTR_TYPE_NAME, "allow (write)", BIND_RULE_USERDN_SELF), buildAciValue("name", "read", "targetattr", "*", "allow (read)", BIND_RULE_USERDN_SELF), buildAciValue("name", "write", "targetattr", "*", "allow (write)", BIND_RULE_USERDN_SELF), buildAciValue("name", "add", "targetattr", "*", "allow (add)", BIND_RULE_USERDN_SELF), @@ -746,6 +745,11 @@ public void clearBackend() throws Exception { buildAciValue("name", "bad_op", "targattrfilters",TARG_ATTR_FILTERS_BAD_OP, "allow (write)", BIND_RULE_USERDN_SELF), buildAciValue("name", "bad_op_match", "targattrfilters",TARG_ATTR_FILTERS_BAD_OP_MATCH, "allow (write)", BIND_RULE_USERDN_SELF), buildAciValue("name", "bad_filter_attr", "targattrfilters",TARG_ATTR_FILTERS_BAD_FILTER_ATTR, "allow (write)", BIND_RULE_USERDN_SELF), + // The attribute name "1sn_" passes the lenient dseecompat ATTR_NAME + // pattern, but the filter part is parsed as an RFC 4512 attribute + // description, which cannot start with a digit unless it is a + // numeric OID, so the ACI is rejected at decode time. + buildAciValue("name", "bad_ATTR_TYPE_NAME", "targattrfilters",TARG_ATTR_FILTERS_ATTR_TYPE_NAME, "allow (write)", BIND_RULE_USERDN_SELF), buildAciValue("name", "bad_format", "targattrfilters",TARG_ATTR_FILTERS_BAD_FORMAT, "allow (write)", BIND_RULE_USERDN_SELF), buildAciValue("name", "too_many_lists", "targattrfilters",TARG_ATTR_FILTERS_TOO_MANY_LISTS, "allow (write)", BIND_RULE_USERDN_SELF), buildAciValue("name", "bad_tok", "targattrfilters",TARG_ATTR_FILTERS_BAD_TOK, "allow (write)", BIND_RULE_USERDN_SELF), @@ -1727,6 +1731,9 @@ public String[] getLdapCompareArgs(String attrAssertion) { "-p", getServerLdapPort(), "-D", _bindDn, "-w", _bindPw, + // Return the actual compare result code (COMPARE_TRUE / COMPARE_FALSE) + // instead of 0 on success, so callers can assert the evaluation result. + "--useCompareResultCode", attrAssertion, _searchBaseDn}; } From 64a44d54bbe45ef9c984f8cbb14fa8b62afc9b6e Mon Sep 17 00:00:00 2001 From: Valery Kharseko Date: Fri, 3 Jul 2026 11:59:19 +0300 Subject: [PATCH 2/2] Update copyright information in AciTests.java --- .../org/opends/server/authorization/dseecompat/AciTests.java | 1 + 1 file changed, 1 insertion(+) diff --git a/opendj-server-legacy/src/test/java/org/opends/server/authorization/dseecompat/AciTests.java b/opendj-server-legacy/src/test/java/org/opends/server/authorization/dseecompat/AciTests.java index 6c6a3e2398..a02df497d7 100644 --- a/opendj-server-legacy/src/test/java/org/opends/server/authorization/dseecompat/AciTests.java +++ b/opendj-server-legacy/src/test/java/org/opends/server/authorization/dseecompat/AciTests.java @@ -14,6 +14,7 @@ * Copyright 2008-2010 Sun Microsystems, Inc. * Portions Copyright 2011-2016 ForgeRock AS. * Portions Copyright 2013 Manuel Gaupp + * Portions Copyright 2026 3A Systems, LLC */ package org.opends.server.authorization.dseecompat;