From 83972d19e778bd65261ab2cf8411209af40cea3a Mon Sep 17 00:00:00 2001
From: Anuj Borah <aborah@redhat.com>
Date: Nov 12 2019 11:33:51 +0000
Subject: Issue: 48055 -  CI test - automember_plugin(part2)


Bug Description: CI test - automember_plugin(part2)

Relates: https://pagure.io/389-ds-base/issue/48055

Author: aborah

Reviewed by: ???

---

diff --git a/dirsrvtests/tests/suites/automember_plugin/basic_test.py b/dirsrvtests/tests/suites/automember_plugin/basic_test.py
index 1fd34f5..624ab25 100644
--- a/dirsrvtests/tests/suites/automember_plugin/basic_test.py
+++ b/dirsrvtests/tests/suites/automember_plugin/basic_test.py
@@ -11,6 +11,8 @@ Will test AutoMememer Plugin with AotoMember Task and Retro Changelog
 """
 
 import os
+import ldap
+import pytest
 from lib389.topologies import topology_m1 as topo
 from lib389.idm.organizationalunit import OrganizationalUnits
 from lib389.idm.domain import Domain
@@ -20,9 +22,10 @@ from lib389.plugins import AutoMembershipPlugin, AutoMembershipDefinitions, \
 from lib389.backend import Backends
 from lib389.config import Config
 from lib389._constants import DEFAULT_SUFFIX
-import ldap
-import pytest
+from lib389.idm.user import UserAccounts
 from lib389.idm.group import Groups, Group, UniqueGroup, nsAdminGroups, nsAdminGroup
+from lib389.utils import ds_is_older
+
 
 pytestmark = pytest.mark.tier1
 
@@ -34,7 +37,7 @@ REPMANDN = "cn=ReplManager"
 CACHE_SIZE = '-1'
 CACHEMEM_SIZE = '10485760'
 AUTO_MEM_SCOPE_TEST = "ou=Employees,{}".format(TEST_BASE)
-AUTO_MEM_SCOPE_BASE = "ou=Employees,{}".format(BASE_SUFF)
+AUTO_MEM_SCOPE_BASE = f'ou=Employees,{BASE_SUFF}'
 
 
 def add_base_entries(topo):
@@ -72,6 +75,11 @@ def add_user(topo, user_id, suffix, uid_no, gid_no, role_usr):
     """
     Will create entries with nsAdminGroup objectclass
     """
+    objectclasses = ['top', 'person', 'posixaccount', 'inetuser',
+                        'nsMemberOf', 'nsAccount', 'nsAdminGroup']
+    if ds_is_older('1.4.0'):
+        objectclasses.remove('nsAccount')
+
     user = nsAdminGroups(topo.ms["master1"], suffix, rdn=None).create(properties={
         'cn': user_id,
         'sn': user_id,
@@ -80,8 +88,7 @@ def add_user(topo, user_id, suffix, uid_no, gid_no, role_usr):
         'loginShell': '/bin/bash',
         'uidNumber': uid_no,
         'gidNumber': gid_no,
-        'objectclass': ['top', 'person', 'posixaccount', 'inetuser',
-                        'nsMemberOf', 'nsAccount', 'nsAdminGroup'],
+        'objectclass': objectclasses,
         'nsAdminGroupName': role_usr,
         'seeAlso': 'uid={},{}'.format(user_id, suffix),
         'entrydn': 'uid={},{}'.format(user_id, suffix)
@@ -612,7 +619,7 @@ def test_add_regular_expressions_for_user_groups_and_check_for_member_attribute_
         2. Should success
     """
     test_id = "autoMembers_12"
-    default_group = "cn=SuffDef1,ou=userGroups,{}".format(BASE_SUFF)
+    default_group = f'cn=SuffDef1,ou=userGroups,{BASE_SUFF}'
     user = add_user(topo, "User_{}".format(test_id), AUTO_MEM_SCOPE_BASE, "19", "0", "HR")
     assert check_groups(topo, default_group, user.dn, "member")
     assert len(nsAdminGroup(topo.ms["master1"], user.dn).get_attr_vals_utf8('memberOf')) == 5
@@ -633,7 +640,7 @@ def test_users_with_gid_nos_matching_the_inclusive_regular_expression(topo, _cre
         3. Should success
     """
     test_id = "autoMembers_13"
-    managers_grp = "cn=Managers,ou=userGroups,{}".format(BASE_SUFF)
+    managers_grp = f'cn=Managers,ou=userGroups,{BASE_SUFF}'
     user1 = add_user(topo, "User_{}".format(test_id), AUTO_MEM_SCOPE_BASE, "9788", "9789", "VPEngg")
     user2 = add_user(topo, "SecondUser_{}".format(test_id),
                      AUTO_MEM_SCOPE_BASE, "9392", "9393", "VPEngg")
@@ -657,7 +664,7 @@ def test_users_with_manager_role_matching_inclusive_regular_expression(topo, _cr
         3. Should success
     """
     test_id = "autoMembers_14"
-    managers_grp = "cn=Managers,ou=userGroups,{}".format(BASE_SUFF)
+    managers_grp = f'cn=Managers,ou=userGroups,{BASE_SUFF}'
     user1 = add_user(topo, "User_{}".format(test_id), AUTO_MEM_SCOPE_BASE, "561", "562", "Manager")
     user2 = add_user(topo, "SecondUser_{}".format(test_id),
                      AUTO_MEM_SCOPE_BASE, "562", "563", "Manager")
@@ -681,7 +688,7 @@ def test_users_with_matching_gidrole_for_inclusive_regular_expression(topo, _cre
         3. Should success
     """
     test_id = "autoMembers_15"
-    managers_grp = "cn=Managers,ou=userGroups,{}".format(BASE_SUFF)
+    managers_grp = f'cn=Managers,ou=userGroups,{BASE_SUFF}'
     user1 = add_user(topo, "User_{}".format(test_id), AUTO_MEM_SCOPE_BASE,
                      "9288", "9289", "Manager")
     user2 = add_user(topo, "SecondUser_{}".format(test_id),
@@ -706,8 +713,8 @@ def test_users_with_gid_nos_matching_the_exclusive_regular_expression(topo, _cre
         3. Should success
     """
     test_id = "autoMembers_16"
-    managers_grp = "cn=Managers,ou=userGroups,{}".format(BASE_SUFF)
-    default_group = "cn=SuffDef1,ou=userGroups,{}".format(BASE_SUFF)
+    managers_grp = f'cn=Managers,ou=userGroups,{BASE_SUFF}'
+    default_group = f'cn=SuffDef1,ou=userGroups,{BASE_SUFF}'
     user = add_user(topo, "User_{}".format(test_id), AUTO_MEM_SCOPE_BASE, "6788", "6789", "Manager")
     with pytest.raises(AssertionError):
         assert check_groups(topo, managers_grp, user.dn, "member")
@@ -730,8 +737,8 @@ def test_users_junior_role_matching_the_exclusive_regular_expression(topo, _crea
         3. Should success
     """
     test_id = "autoMembers_17"
-    managers_grp = "cn=Managers,ou=userGroups,{}".format(BASE_SUFF)
-    default_group = "cn=SuffDef1,ou=userGroups,{}".format(BASE_SUFF)
+    managers_grp = f'cn=Managers,ou=userGroups,{BASE_SUFF}'
+    default_group = f'cn=SuffDef1,ou=userGroups,{BASE_SUFF}'
     user = add_user(topo, "User_{}".format(test_id), AUTO_MEM_SCOPE_BASE, "562", "563", "Junior")
     with pytest.raises(AssertionError):
         assert check_groups(topo, managers_grp, user.dn, "member")
@@ -754,8 +761,8 @@ def test_users_with_matching_gid_role_for_the_exclusive_regex_expression(topo, _
         3. Should success
     """
     test_id = "autoMembers_18"
-    managers_grp = "cn=Managers,ou=userGroups,{}".format(BASE_SUFF)
-    default_group = "cn=SuffDef1,ou=userGroups,{}".format(BASE_SUFF)
+    managers_grp = f'cn=Managers,ou=userGroups,{BASE_SUFF}'
+    default_group = f'cn=SuffDef1,ou=userGroups,{BASE_SUFF}'
     user = add_user(topo, "User_{}".format(test_id), AUTO_MEM_SCOPE_BASE, "6788", "6789", "Junior")
     with pytest.raises(AssertionError):
         assert check_groups(topo, managers_grp, user.dn, "member")
@@ -764,6 +771,499 @@ def test_users_with_matching_gid_role_for_the_exclusive_regex_expression(topo, _
     user.delete()
 
 
+def test_the_inclusive_and_exclusive_regular_expression(topo, _create_all_entries):
+    """
+    Users with not matching gid nos and Role for
+    the Inclusive and Exclusive regular expression
+    :id: 4ff6a312-e7ff-11e8-baf0-8c16451d917b
+    :setup: Instance with replication
+    :steps:
+        1. Create Users with not matching gid nos and Role for
+        the Inclusive and Exclusive regular expression
+        2. It will be filtered with gidNumber(5788), uidNumber(5789)
+        and nsAdminGroupName(HRManager)
+        3. It will a match for default_groups(5) but not for managers_grp
+    :expected results:
+        1. Should success
+        2. Should success
+        3. Should success
+    """
+    testid = "autoMembers_19"
+    auto_mem_scope = f'ou=Employees,{BASE_SUFF}'
+    managers_grp = f'cn=Managers,ou=userGroups,{BASE_SUFF}'
+    default_group = f'cn=SuffDef1,ou=userGroups,{BASE_SUFF}'
+    user = add_user(topo, "User_{}".format(testid), auto_mem_scope, "5788", "5789", "HRManager")
+    with pytest.raises(AssertionError):
+        assert check_groups(topo, managers_grp, user.dn, "member")
+    check_groups(topo, default_group, user.dn, "member")
+    assert len(nsAdminGroup(topo.ms["master1"], user.dn).get_attr_vals_utf8('memberOf')) == 5
+    user.delete()
+
+
+def test_users_with_gid_no_matching_the_inclusive_regular_expression(topo, _create_all_entries):
+    """
+    Gid nos matching the Inclusive regular expression
+    :id: 4ff6cf4a-e7ff-11e8-84ce-8c16451d917b
+    :setup: Instance with replication
+    :steps:
+        1. Create Users with gid nos matching the Inclusive regular expression
+        2. It will be filtered with gidNumber(1188, 1191), uidNumber(1189, 1192)
+        and nsAdminGroupName(CEO)
+        3. Inclusive regular expression will make user member of contract_grp
+    :expected results:
+        1. Should success
+        2. Should success
+        3. Should success
+    """
+    testid = "autoMembers_20"
+    auto_mem_scope = f'ou=Employees,{BASE_SUFF}'
+    contract_grp = f'cn=Contractors,ou=userGroups,{BASE_SUFF}'
+    user1 = add_user(topo, "User_{}".format(testid), auto_mem_scope, "1188", "1189", "CEO")
+    user2 = add_user(topo, "SecondUser_{}".format(testid), auto_mem_scope, "1191", "1192", "CEO")
+    for user_dn in [user1.dn, user2.dn]:
+        assert check_groups(topo, contract_grp, user_dn, "member")
+    assert len(nsAdminGroup(topo.ms["master1"], user1.dn).get_attr_vals_utf8('memberOf')) == 1
+    for user in nsAdminGroups(topo.ms["master1"], auto_mem_scope, rdn=None).list():
+        user.delete()
+
+
+def test_contractor_role_matching_the_inclusive_regular_expression(topo, _create_all_entries):
+    """
+    Contractor role matching the Inclusive regular expression
+    :id: 4ff6f9ca-e7ff-11e8-99c1-8c16451d917b
+    :setup: Instance with replication
+    :steps:
+        1. Create users with Contractor role matching the Inclusive regular expression
+        2. It will be filtered with gidNumber(1161, ), uidNumber(1162, 1163)
+        and nsAdminGroupName(Contractor)
+        3. It will a match for contract_grp
+    :expected results:
+        1. Should success
+        2. Should success
+        3. Should success
+    """
+    testid = "autoMembers_21"
+    auto_mem_scope = f'ou=Employees,{BASE_SUFF}'
+    contract_grp = f'cn=Contractors,ou=userGroups,{BASE_SUFF}'
+    user1 = add_user(topo, "User_{}".format(testid), auto_mem_scope, "1161", "1162", "Contractor")
+    user2 = add_user(topo, "SecondUser_{}".format(testid), auto_mem_scope,
+                     "1162", "1163", "Contractor")
+    for user_dn in [user1.dn, user2.dn]:
+        assert check_groups(topo, contract_grp, user_dn, "member")
+    assert len(nsAdminGroup(topo.ms["master1"], user1.dn).get_attr_vals_utf8('memberOf')) == 1
+    for user in nsAdminGroups(topo.ms["master1"], auto_mem_scope, rdn=None).list():
+        user.delete()
+
+
+def test_matching_gid_nos_and_role_for_the_inclusive_regular_expression(topo, _create_all_entries):
+    """
+    Matching gid nos and Role for the Inclusive regular expression
+    :id: 4ff71ce8-e7ff-11e8-b69b-8c16451d917b
+    :setup: Instance with replication
+    :steps:
+        1. Create users with matching gid nos and Role for the Inclusive regular expression
+        2. It will be filtered with gidNumber(5288, 5291), uidNumber(5289, 5292)
+        and nsAdminGroupName(Contractor)
+        3. It will a match for contract_grp
+    :expected results:
+        1. Should success
+        2. Should success
+        3. Should success
+    """
+    testid = "autoMembers_22"
+    auto_mem_scope = f'ou=Employees,{BASE_SUFF}'
+    contract_grp = f'cn=Contractors,ou=userGroups,{BASE_SUFF}'
+    user1 = add_user(topo, "User_{}".format(testid), auto_mem_scope, "5288", "5289", "Contractor")
+    user2 = add_user(topo, "SecondUser_{}".format(testid), auto_mem_scope,
+                     "5291", "5292", "Contractor")
+    for user_dn in [user1.dn, user2.dn]:
+        assert check_groups(topo, contract_grp, user_dn, "member")
+    assert len(nsAdminGroup(topo.ms["master1"], user1.dn).get_attr_vals_utf8('memberOf')) == 1
+    for user in nsAdminGroups(topo.ms["master1"], auto_mem_scope, rdn=None).list():
+        user.delete()
+
+
+def test_with_gid_nos_matching_the_exclusive_regular_expression(topo, _create_all_entries):
+    """
+    Gid nos matching the Exclusive regular expression
+    :id: 4ff74222-e7ff-11e8-a6ce-8c16451d917b
+    :setup: Instance with replication
+    :steps:
+        1. Create users with gid nos matching the Exclusive regular expression
+        2. It will be filtered with gidNumber(2788), uidNumber(2789)
+        and nsAdminGroupName(Contractor)
+        3. It will not match for contract_grp(Exclusive regular expression)
+    :expected results:
+        1. Should success
+        2. Should success
+        3. Should success
+    """
+    testid = "autoMembers_23"
+    auto_mem_scope = f'ou=Employees,{BASE_SUFF}'
+    contract_grp = f'cn=Contractors,ou=userGroups,{BASE_SUFF}'
+    default_group = f'cn=SuffDef1,ou=userGroups,{BASE_SUFF}'
+    user = add_user(topo, "User_{}".format(testid), auto_mem_scope, "2788", "2789", "Contractor")
+    with pytest.raises(AssertionError):
+        assert check_groups(topo, contract_grp, user.dn, "member")
+    check_groups(topo, default_group, user.dn, "member")
+    assert len(nsAdminGroup(topo.ms["master1"], user.dn).get_attr_vals_utf8('memberOf')) == 5
+    user.delete()
+
+
+def test_employee_role_matching_the_exclusive_regular_expression(topo, _create_all_entries):
+    """
+    Employee role matching the Exclusive regular expression
+    :id: 4ff76e64-e7ff-11e8-b9a5-8c16451d917b
+    :setup: Instance with replication
+    :steps:
+        1. Create user with Junior role matching the Exclusive regular expression
+        2. It will be filtered with gidNumber(1110), uidNumber(1111)
+        and nsAdminGroupName(Employee)
+        3. It will not match for contract_grp(Exclusive regular expression)
+    :expected results:
+        1. Should success
+        2. Should success
+        3. Should success
+    """
+    testid = "autoMembers_24"
+    auto_mem_scope = f'ou=Employees,{BASE_SUFF}'
+    contract_grp = f'cn=Contractors,ou=userGroups,{BASE_SUFF}'
+    default_group = f'cn=SuffDef1,ou=userGroups,{BASE_SUFF}'
+    user = add_user(topo, "User_{}".format(testid), auto_mem_scope, "1110", "1111", "Employee")
+    with pytest.raises(AssertionError):
+        assert check_groups(topo, contract_grp, user.dn, "member")
+    check_groups(topo, default_group, user.dn, "member")
+    assert len(nsAdminGroup(topo.ms["master1"], user.dn).get_attr_vals_utf8('memberOf')) == 5
+    user.delete()
+
+
+def test_for_the_exclusive_regular_expression(topo, _create_all_entries):
+    """
+    Matching gid nos and Role for the Exclusive regular expression
+    :id: 4ff79b64-e7ff-11e8-befd-8c16451d917b
+    :setup: Instance with replication
+    :steps:
+        1. Create user with matching gid nos and Role for the Exclusive regular expression
+        2. It will be filtered with gidNumber(9788), uidNumber(9789)
+        and nsAdminGroupName(Employee)
+        3. It will not match for contract_grp(Exclusive regular expression)
+        4. It will match for managers_grp(Inclusive regular expression)
+    :expected results:
+        1. Should success
+        2. Should success
+        3. Should success
+    """
+    testid = "autoMembers_25"
+    auto_mem_scope = f'ou=Employees,{BASE_SUFF}'
+    contract_grp = f'cn=Contractors,ou=userGroups,{BASE_SUFF}'
+    managers_grp = f'cn=Managers,ou=userGroups,{BASE_SUFF}'
+    user = add_user(topo, "User_{}".format(testid), auto_mem_scope, "9788", "9789", "Employee")
+    with pytest.raises(AssertionError):
+        assert check_groups(topo, contract_grp, user.dn, "member")
+    check_groups(topo, managers_grp, user.dn, "member")
+    assert len(nsAdminGroup(topo.ms["master1"], user.dn).get_attr_vals_utf8('memberOf')) == 1
+    user.delete()
+
+
+def test_gid_nos_and_role_for_the_inclusive_exclusive_regular_expression(topo, _create_all_entries):
+    """
+    Matching gid nos and Role for the Inclusive and Exclusive regular expression
+    :id: 4ff7d160-e7ff-11e8-8fbc-8c16451d917b
+    :setup: Instance with replication
+    :steps:
+        1. Create user with not matching gid nos and Role for
+        the Inclusive and Exclusive regular expression
+        2. It will be filtered with gidNumber(5788), uidNumber(5789)
+        and nsAdminGroupName(Intern)
+        3. It will not match for contract_grp(Exclusive regular expression)
+        4. It will match for default_group(Inclusive regular expression)
+    :expected results:
+        1. Should success
+        2. Should success
+        3. Should success
+        4. Should success
+    """
+    testid = "autoMembers_26"
+    auto_mem_scope = f'ou=Employees,{BASE_SUFF}'
+    contract_grp = f'cn=Contractors,ou=userGroups,{BASE_SUFF}'
+    default_group = f'cn=SuffDef1,ou=userGroups,{BASE_SUFF}'
+    user = add_user(topo, "User_{}".format(testid), auto_mem_scope, "5788", "5789", "Intern")
+    with pytest.raises(AssertionError):
+        assert check_groups(topo, contract_grp, user.dn, "member")
+    check_groups(topo, default_group, user.dn, "member")
+    assert len(nsAdminGroup(topo.ms["master1"], user.dn).get_attr_vals_utf8('memberOf')) == 5
+    user.delete()
+
+
+def test_contractors_group_no_member_uid_for_managers_group(topo, _create_all_entries):
+    """
+    Matching gid nos and Role for the Inclusive and Exclusive regular expression
+    :id: 4ff7fdc0-e7ff-11e8-b15e-8c16451d917b
+    :setup: Instance with replication
+    :steps:
+        1. Add user to go to Contractors group, no memberUid for Managers group
+        2. It will be filtered with gidNumber(595), uidNumber(690)
+        and nsAdminGroupName(ContractHR)
+        3. It will not match for contract_grp(Exclusive regular expression)
+        4. It will match for contract_grp(Inclusive regular expression)
+    :expected results:
+        1. Should success
+        2. Should success
+        3. Should success
+        4. Should success
+    """
+    testid = "autoMembers_27"
+    auto_mem_scope = f'ou=Employees,{BASE_SUFF}'
+    contract_grp = f'cn=Contractors,cn=subsuffGroups,{SUBSUFFIX}'
+    managers_grp = f'cn=Managers,cn=subsuffGroups,{SUBSUFFIX}'
+    user = add_user(topo, "User_{}".format(testid), auto_mem_scope, "595", "690", "ContractHR")
+    check_groups(topo, contract_grp, user.dn, "memberUid")
+    with pytest.raises(AssertionError):
+        assert check_groups(topo, managers_grp, user.dn, "memberUid")
+    user.delete()
+
+
+def test_member_uid_attr_at_contractors_and_managers_group(topo, _create_all_entries):
+    """
+    Match both inclusive regex rules, memberUid attr
+    :id: 4ff8275a-e7ff-11e8-a28b-8c16451d917b
+    :setup: Instance with replication
+    :steps:
+        1. Add User to match both inclusive regex rules, memberUid attr
+        should be created at Contractors and Managers group
+        2. It will be filtered with gidNumber(555), uidNumber(3663)
+        and nsAdminGroupName(ContractHR)
+        3. It will match for contract_grp and managers_grp(Inclusive regular expression)
+    :expected results:
+        1. Should success
+        2. Should success
+        3. Should success
+    """
+    testid = "autoMembers_28"
+    auto_mem_scope = f'ou=Employees,{BASE_SUFF}'
+    contract_grp = f'cn=Contractors,cn=subsuffGroups,{SUBSUFFIX}'
+    managers_grp = f'cn=Managers,cn=subsuffGroups,{SUBSUFFIX}'
+    user = add_user(topo, "User_{}".format(testid), auto_mem_scope, "555", "3663", "ContractHR")
+    for group in [contract_grp, managers_grp]:
+        check_groups(topo, group, user.dn, "memberuid")
+    user.delete()
+
+
+def test_inclusive_contractors_exclusive_regex_rules(topo, _create_all_entries):
+    """
+    Match managers inclusive regex rules, Contractors exclusive regex rules
+    :id: 4ff85126-e7ff-11e8-8992-8c16451d917b
+    :setup: Instance with replication
+    :steps:
+        1. Add User to match managers inclusive regex rules, Contractors exclusive regex rules
+        2. It will be filtered with gidNumber(8195), uidNumber(2753)
+        and nsAdminGroupName(Employee)
+        3. It will match for managers_grp(Inclusive regular expression)
+        4. It will not match for contract_grp(Exclusive regular expression)
+    :expected results:
+        1. Should success
+        2. Should success
+        3. Should success
+        4. Should success
+    """
+    testid = "autoMembers_29"
+    auto_mem_scope = f'ou=Employees,{BASE_SUFF}'
+    contract_grp = f'cn=Contractors,cn=subsuffGroups,{SUBSUFFIX}'
+    managers_grp = f'cn=Managers,cn=subsuffGroups,{SUBSUFFIX}'
+    user = add_user(topo, "User_{}".format(testid), auto_mem_scope, "8195", "2753", "Employee")
+    check_groups(topo, managers_grp, user.dn, "memberuid")
+    with pytest.raises(AssertionError):
+        assert check_groups(topo, contract_grp, user.dn, "memberuid")
+    user.delete()
+
+
+def test_managers_contractors_exclusive_regex_rules(topo, _create_all_entries):
+    """
+    Match both managers and contractors exclusive regex rules
+    :id: 4ff87bba-e7ff-11e8-99dc-8c16451d917b
+    :setup: Instance with replication
+    :steps:
+        1. Add User to match both managers and contractors exclusive regex rules,
+        memberUid created in Default grp
+        2. It will be filtered with gidNumber(999), uidNumber(400)
+        and nsAdminGroupName(Supervisor)
+        3. It will match for default_group1 and default_group2(Inclusive regular expression)
+    :expected results:
+        1. Should success
+        2. Should success
+        3. Should success
+    """
+    testid = "autoMembers_30"
+    auto_mem_scope = f'ou=Employees,{BASE_SUFF}'
+    default_group1 = f'cn=SubDef1,{SUBSUFFIX}'
+    default_group2 = f'cn=SubDef2,{SUBSUFFIX}'
+    user = add_user(topo, "User_{}".format(testid), auto_mem_scope, "999", "400", "Supervisor")
+    for group in [default_group1, default_group2]:
+        assert check_groups(topo, group, user.dn, "memberuid")
+    user.delete()
+
+
+def test_managers_contractors_exclusive_regex_rules_default_grp(topo, _create_all_entries):
+    """
+    Match both managers and contractors exclusive regex rules
+    :id: 4ff89d84-e7ff-11e8-bc8c-8c16451d917b
+    :setup: Instance with replication
+    :steps:
+        1. Add Users to match both managers and contractors exclusive regex rules,
+        memberUid created in Default grp
+        2. It will be filtered with gidNumber(515), uidNumber(200)
+        and nsAdminGroupName(Junior)
+        3. It will match for default_group1 and default_group2(Inclusive regular expression)
+    :expected results:
+        1. Should success
+        2. Should success
+        3. Should success
+    """
+    testid = "autoMembers_31"
+    auto_mem_scope = f'ou=Employees,{BASE_SUFF}'
+    default_group1 = f'cn=SubDef1,{SUBSUFFIX}'
+    default_group2 = f'cn=SubDef5,{SUBSUFFIX}'
+    user = add_user(topo, "User_{}".format(testid), auto_mem_scope, "515", "200", "Junior")
+    for group in [default_group1, default_group2]:
+        assert check_groups(topo, group, user.dn, "memberuid")
+    user.delete()
+
+
+def test_managers_contractors_exclusive_regex_rules_member_uid(topo, _create_all_entries):
+    """
+    Match both managers and contractors exclusive regex rules
+    :id: 4ff8be18-e7ff-11e8-94aa-8c16451d917b
+    :setup: Instance with replication
+    :steps:
+        1. Add Users to match both managers and contractors exclusive regex rules,
+        memberUid created in Default grp
+        2. It will be filtered with gidNumber(555), uidNumber(720)
+        and nsAdminGroupName(Employee)
+        3. It will match for default_group1 and default_group2(Inclusive regular expression)
+    :expected results:
+        1. Should success
+        2. Should success
+        3. Should success
+    """
+    testid = "autoMembers_32"
+    auto_mem_scope = f'ou=Employees,{BASE_SUFF}'
+    default_group1 = f'cn=SubDef1,{SUBSUFFIX}'
+    default_group2 = f'cn=SubDef3,{SUBSUFFIX}'
+    user = add_user(topo, "User_{}".format(testid), auto_mem_scope, "555", "720", "Employee")
+    for group in [default_group1, default_group2]:
+        assert check_groups(topo, group, user.dn, "memberuid")
+    user.delete()
+
+
+def test_managers_inclusive_regex_rule(topo, _create_all_entries):
+    """
+    Match managers inclusive regex rule, and no
+    inclusive/exclusive Contractors regex rules
+    :id: 4ff8d862-e7ff-11e8-b688-8c16451d917b
+    :setup: Instance with replication
+    :steps:
+        1. Add User to match managers inclusive regex rule, and no
+        inclusive/exclusive Contractors regex rules
+        2. It will be filtered with gidNumber(545), uidNumber(3333)
+        and nsAdminGroupName(Supervisor)
+        3. It will match for managers_grp(Inclusive regular expression)
+        4. It will not match for contract_grp(Exclusive regular expression)
+    :expected results:
+        1. Should success
+        2. Should success
+        3. Should success
+        4. Should success
+    """
+    testid = "autoMembers_33"
+    auto_mem_scope = f'ou=Employees,{BASE_SUFF}'
+    contract_grp = f'cn=Contractors,cn=subsuffGroups,{SUBSUFFIX}'
+    managers_grp = f'cn=Managers,cn=subsuffGroups,{SUBSUFFIX}'
+    user = add_user(topo, "User_{}".format(testid), auto_mem_scope, "545", "3333", "Supervisor")
+    check_groups(topo, managers_grp, user.dn, "memberuid")
+    with pytest.raises(AssertionError):
+        assert check_groups(topo, contract_grp, user.dn, "memberuid")
+    user.delete()
+
+
+def test_contractors_rule_managers_regex_rules(topo, _create_all_entries):
+    """
+    Match Contractors inclusive regex rule
+    and no inclusive/exclusive Managers regex rules
+    :id: 4ff8f2ca-e7ff-11e8-83b6-8c16451d917b
+    :setup: Instance with replication
+    :steps:
+        1. Add User to match Contractors inclusive regex rule,
+        and no inclusive/exclusive Managers regex rules
+        2. It will be filtered with gidNumber(8195), uidNumber(693)
+        and nsAdminGroupName(Temporary)
+        3. It will match for contract_grp(Inclusive regular expression)
+        4. It will not match for managers_grp(Exclusive regular expression)
+    :expected results:
+        1. Should success
+        2. Should success
+        3. Should success
+        4. Should success
+    """
+    testid = "autoMembers_34"
+    auto_mem_scope = f'ou=Employees,{BASE_SUFF}'
+    contract_grp = f'cn=Contractors,cn=subsuffGroups,{SUBSUFFIX}'
+    managers_grp = f'cn=Managers,cn=subsuffGroups,{SUBSUFFIX}'
+    user = add_user(topo, "User_{}".format(testid), auto_mem_scope, "8195", "693", "Temporary")
+    check_groups(topo, contract_grp, user.dn, "memberuid")
+    with pytest.raises(AssertionError):
+        assert check_groups(topo, managers_grp, user.dn, "memberuid")
+    user.delete()
+
+
+def test_reject_invalid_config_and_we_donot_deadlock_the_server(topo, _create_all_entries):
+    """
+    Verify DS reject invalid config, and we don't deadlock the server
+    :id: 4ff90c38-e7ff-11e8-b72a-8c16451d917b
+    :setup: Instance with replication
+    :steps:
+        1. Verify DS reject invalid config,
+        2. This operation don't deadlock the server
+    :expected results:
+        1. Should success
+        2. Should success
+    """
+    # Changing config area to dc=automembers,dc=com
+    instance = AutoMembershipPlugin(topo.ms["master1"])
+    instance.replace("nsslapd-pluginConfigArea", BASE_SUFF)
+    topo.ms["master1"] .restart()
+    # Attempting to add invalid config...
+    automembers = AutoMembershipDefinitions(topo.ms["master1"], BASE_SUFF)
+    with pytest.raises(ldap.UNWILLING_TO_PERFORM):
+        automembers.create(properties={
+            'cn': 'userGroups',
+            "autoMemberScope": BASE_SUFF,
+            "autoMemberFilter": "objectclass=posixAccount",
+            "autoMemberDefaultGroup": f'cn=SuffDef1,ou=userGroups,{BASE_SUFF}',
+            "autoMemberGroupingAttr": "member: dn"
+        })
+    # Verify server is still working
+    automembers = AutoMembershipRegexRules(topo.ms["master1"],
+                                           f'cn=userGroups,cn=Auto Membership Plugin,'
+                                           f'cn=plugins,cn=config')
+    with pytest.raises(ldap.ALREADY_EXISTS):
+        automembers.create(properties={
+            'cn': 'Managers',
+            'description': f'Group placement for Managers',
+            'autoMemberTargetGroup': [f'cn=Managers,ou=userGroups,{BASE_SUFF}'],
+            'autoMemberInclusiveRegex': [
+                "gidNumber=^9",
+                "nsAdminGroupName=^Manager",
+            ],
+        })
+
+    # Adding first user...
+    for uid in range(300, 302):
+        UserAccounts(topo.ms["master1"], BASE_SUFF, rdn=None).create_test_user(uid=uid, gid=uid)
+    # Adding this line code to remove the automembers plugin configuration.
+    instance.remove("nsslapd-pluginConfigArea", BASE_SUFF)
+    topo.ms["master1"] .restart()
+
+
 if __name__ == "__main__":
     CURRENT_FILE = os.path.realpath(__file__)
     pytest.main("-s -v %s" % CURRENT_FILE)

