testprogs/blackbox/test_kinit_trusts.sh

   1 #!/bin/sh
   2 # Copyright (C) 2015 Stefan Metzmacher <metze@samba.org>
   3
   4 if [ $# -lt 13 ]; then
   5 cat <<EOF
   6 Usage: test_kinit_trusts.sh SERVER USERNAME PASSWORD REALM DOMAIN TRUST_USERNAME TRUST_PASSWORD TRUST_REALM TRUST_DOMAIN PREFIX TYPE ENCTYPE
   7 EOF
   8 exit 1;
   9 fi
  10
  11 SERVER=$1
  12 USERNAME=$2
  13 PASSWORD=$3
  14 REALM=$4
  15 DOMAIN=$5
  16 shift 5
  17 TRUST_SERVER=$1
  18 TRUST_USERNAME=$2
  19 TRUST_PASSWORD=$3
  20 TRUST_REALM=$4
  21 TRUST_DOMAIN=$5
  22 shift 5
  23 PREFIX=$1
  24 TYPE=$2
  25 ENCTYPE=$3
  26 shift 3
  27 failed=0
  28
  29 samba4bindir="$BINDIR"
  30 samba4kinit=kinit
  31 if test -x $samba4bindir/samba4kinit; then
  32         samba4kinit=$samba4bindir/samba4kinit
  33 fi
  34
  35 smbclient="$samba4bindir/smbclient4"
  36 wbinfo="$samba4bindir/wbinfo"
  37 rpcclient="$samba4bindir/rpcclient"
  38 samba_tool="$samba4bindir/samba-tool"
  39
  40 . `dirname $0`/subunit.sh
  41
  42 SMBCLIENT_UNC="//$SERVER.$REALM/tmp"
  43
  44 test_smbclient() {
  45         name="$1"
  46         cmd="$2"
  47         shift
  48         shift
  49         echo "test: $name"
  50         $VALGRIND $smbclient $CONFIGURATION $SMBCLIENT_UNC -c "$cmd" $@
  51         status=$?
  52         if [ x$status = x0 ]; then
  53                 echo "success: $name"
  54         else
  55                 echo "failure: $name"
  56         fi
  57         return $status
  58 }
  59
  60 enctype="-e $ENCTYPE"
  61
  62 KRB5CCNAME_PATH="$PREFIX/tmpccache"
  63 KRB5CCNAME="FILE:$KRB5CCNAME_PATH"
  64 export KRB5CCNAME
  65 rm -rf $KRB5CCNAME_PATH
  66
  67 echo $TRUST_PASSWORD > $PREFIX/tmppassfile
  68 testit "kinit with password" $samba4kinit $enctype --password-file=$PREFIX/tmppassfile --request-pac $TRUST_USERNAME@$TRUST_REALM   || failed=`expr $failed + 1`
  69 test_smbclient "Test login with user kerberos ccache" 'ls' -k yes || failed=`expr $failed + 1`
  70
  71 testit "kinit with password (enterprise style)" $samba4kinit $enctype --enterprise --password-file=$PREFIX/tmppassfile --request-pac $TRUST_USERNAME@$TRUST_REALM   || failed=`expr $failed + 1`
  72 test_smbclient "Test login with user kerberos ccache" 'ls' -k yes || failed=`expr $failed + 1`
  73
  74 if test x"${TYPE}" = x"forest" ;then
  75         testit "kinit with password (upn enterprise style)" $samba4kinit $enctype --enterprise --password-file=$PREFIX/tmppassfile --request-pac testdenied_upn@${TRUST_REALM}.upn   || failed=`expr $failed + 1`
  76         test_smbclient "Test login with user kerberos ccache" 'ls' -k yes || failed=`expr $failed + 1`
  77 fi
  78
  79 testit "kinit with password (windows style)" $samba4kinit $enctype  --renewable --windows --password-file=$PREFIX/tmppassfile --request-pac $TRUST_USERNAME@$TRUST_REALM   || failed=`expr $failed + 1`
  80 test_smbclient "Test login with user kerberos ccache" 'ls' -k yes || failed=`expr $failed + 1`
  81
  82 testit "kinit renew ticket" $samba4kinit $enctype --request-pac -R
  83
  84 test_smbclient "Test login with kerberos ccache" 'ls' -k yes || failed=`expr $failed + 1`
  85
  86 testit "check time with kerberos ccache" $VALGRIND $samba_tool time $SERVER.$REALM $CONFIGURATION -k yes $@ || failed=`expr $failed + 1`
  87
  88 lowerrealm=$(echo $TRUST_REALM | tr '[A-Z]' '[a-z]')
  89 test_smbclient "Test login with user kerberos lowercase realm" 'ls' -k yes -U$TRUST_USERNAME@$lowerrealm%$TRUST_PASSWORD || failed=`expr $failed + 1`
  90 test_smbclient "Test login with user kerberos lowercase realm 2" 'ls' -k yes -U$TRUST_USERNAME@$TRUST_REALM%$TRUST_PASSWORD --realm=$lowerrealm || failed=`expr $failed + 1`
  91
  92 # Test the outgoing direction
  93 SMBCLIENT_UNC="//$TRUST_SERVER.$TRUST_REALM/tmp"
  94 test_smbclient "Test user login with the first outgoing secret" 'ls' -k yes -U$USERNAME@$REALM%$PASSWORD || failed=`expr $failed + 1`
  95
  96 testit_expect_failure "setpassword should not work" $VALGRIND $samba_tool user setpassword "${TRUST_DOMAIN}\$" --random-password || failed=`expr $failed + 1`
  97
  98 testit "wbinfo ping dc" $VALGRIND $wbinfo --ping-dc --domain=$TRUST_DOMAIN || failed=`expr $failed + 1`
  99 testit "wbinfo change outgoing trust pw" $VALGRIND $wbinfo --change-secret --domain=$TRUST_DOMAIN || failed=`expr $failed + 1`
 100 testit "wbinfo check outgoing trust pw" $VALGRIND $wbinfo --check-secret --domain=$TRUST_DOMAIN || failed=`expr $failed + 1`
 101
 102 test_smbclient "Test user login with the changed outgoing secret" 'ls' -k yes -U$USERNAME@$REALM%$PASSWORD || failed=`expr $failed + 1`
 103
 104 rm -f $PREFIX/tmpccache tmpccfile tmppassfile tmpuserpassfile tmpuserccache tmpkpasswdscript
 105 exit $failed