topology_st = <lib389.topologies.TopologyMain object at 0x7f2f62ac7f50>

def test_lockout_bypass(topology_st):
inst = topology_st.standalone

# Configure the lock policy
inst.config.set('passwordMaxFailure', '1')
inst.config.set('passwordLockoutDuration', '99999')
inst.config.set('passwordLockout', 'on')

# Create the account
users = UserAccounts(inst, DEFAULT_SUFFIX)
testuser = users.create(properties=TEST_USER_PROPERTIES)
testuser.set('userPassword', GOOD_PASSWORD)

conn = testuser.bind(GOOD_PASSWORD)
assert conn != None
conn.unbind_s()

# Bind with bad creds twice
# This is the failure.
with pytest.raises(ldap.INVALID_CREDENTIALS):
conn = testuser.bind(BAD_PASSWORD)
# Now we should not be able to ATTEMPT the bind. It doesn't matter that
# we disclose that we have hit the rate limit here, what matters is that
# it exists.
with pytest.raises(ldap.CONSTRAINT_VIOLATION):
> conn = testuser.bind(BAD_PASSWORD)

suites/password/pwd_lockout_bypass_test.py:48:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
/mnt/tests/rhds/tests/upstream/src/lib389/lib389/_mapped_object.py:381: in bind
conn.simple_bind_s(self.dn, password)
/mnt/tests/rhds/tests/upstream/src/lib389/lib389/__init__.py:162: in inner
return f(*args, **kwargs)
/opt/rh/python27/root/usr/lib64/python2.7/site-packages/ldap/ldapobject.py:229: in simple_bind_s
resp_type, resp_data, resp_msgid, resp_ctrls = self.result3(msgid,all=1,timeout=self.timeout)
/mnt/tests/rhds/tests/upstream/src/lib389/lib389/__init__.py:162: in inner
return f(*args, **kwargs)
/opt/rh/python27/root/usr/lib64/python2.7/site-packages/ldap/ldapobject.py:519: in result3
resp_ctrl_classes=resp_ctrl_classes
/mnt/tests/rhds/tests/upstream/src/lib389/lib389/__init__.py:162: in inner
return f(*args, **kwargs)
/opt/rh/python27/root/usr/lib64/python2.7/site-packages/ldap/ldapobject.py:526: in result4
ldap_result = self._ldap_call(self._l.result4,msgid,all,timeout,add_ctrls,add_intermediates,add_extop)
/mnt/tests/rhds/tests/upstream/src/lib389/lib389/__init__.py:162: in inner
return f(*args, **kwargs)
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

self = <lib389.DirSrv object at 0x7f2f62ae0b90>, func = <built-in method result4 of LDAP object at 0x7f2f630c1288>, args = (2, 1, -1, 0, 0, 0), kwargs = {}
diagnostic_message_success = None, e = INVALID_CREDENTIALS({'desc': 'Invalid credentials'},)

def _ldap_call(self,func,*args,**kwargs):
"""
Wrapper method mainly for serializing calls into OpenLDAP libs
and trace logs
"""
self._ldap_object_lock.acquire()
if __debug__:
if self._trace_level>=1:
self._trace_file.write('*** %s %s - %s\n%s\n' % (
repr(self),
self._uri,
'.'.join((self.__class__.__name__,func.__name__)),
pprint.pformat((args,kwargs))
))
if self._trace_level>=9:
traceback.print_stack(limit=self._trace_stack_limit,file=self._trace_file)
diagnostic_message_success = None
try:
try:
> result = func(*args,**kwargs)
E INVALID_CREDENTIALS: {'desc': 'Invalid credentials'}

/opt/rh/python27/root/usr/lib64/python2.7/site-packages/ldap/ldapobject.py:108: INVALID_CREDENTIALS
---------------------------- Captured stdout setup -----------------------------
OK group dirsrv exists OK user dirsrv exists