testprogs/blackbox/test_chgdcpass.sh

   1 #!/bin/sh
   2 # Blackbox tests for kinit and kerberos integration with smbclient etc
   3 # Copyright (C) 2006-2007 Jelmer Vernooij <jelmer@samba.org>
   4 # Copyright (C) 2006-2008 Andrew Bartlett <abartlet@samba.org>
   5
   6 if [ $# -lt 4 ]; then
   7 cat <<EOF
   8 Usage: test_kinit.sh SERVER USERNAME REALM DOMAIN PREFIX SMBCLIENT
   9 EOF
  10 exit 1;
  11 fi
  12
  13 SERVER=$1
  14 USERNAME=$2
  15 REALM=$3
  16 DOMAIN=$4
  17 PREFIX=$5
  18 ENCTYPE=$6
  19 PROVDIR=$7
  20 smbclient=$8
  21 shift 8
  22 failed=0
  23
  24 samba4bindir="$BINDIR"
  25 samba4srcdir="$SRCDIR/source4"
  26 samba4kinit="$samba4bindir/samba4kinit"
  27
  28 machineaccountccache="$samba4srcdir/scripting/bin/machineaccountccache"
  29
  30 . `dirname $0`/subunit.sh
  31
  32 test_smbclient() {
  33         name="$1"
  34         cmd="$2"
  35         shift
  36         shift
  37         echo "test: $name"
  38         $VALGRIND $smbclient $CONFIGURATION //$SERVER/tmp -c "$cmd" $@
  39         status=$?
  40         if [ x$status = x0 ]; then
  41                 echo "success: $name"
  42         else
  43                 echo "failure: $name"
  44         fi
  45         return $status
  46 }
  47
  48 test_drs() {
  49         function="$1"
  50         name="$2"
  51         shift
  52         shift
  53         echo "test: $name"
  54         echo $VALGRIND $samba4bindir/samba-tool drs $function $SERVER -k yes $@
  55         $VALGRIND $samba4bindir/samba-tool drs $function $SERVER -k yes $@
  56         status=$?
  57         if [ x$status = x0 ]; then
  58                 echo "success: $name"
  59         else
  60                 echo "failure: $name"
  61         fi
  62         return $status
  63 }
  64
  65 enctype="-e $ENCTYPE"
  66
  67 KRB5CCNAME="$PREFIX/tmpccache"
  68 export KRB5CCNAME
  69 rm -f $KRB5CCNAME
  70 testit "kinit with keytab" $samba4kinit $enctype -t $PROVDIR/private/secrets.keytab --use-keytab $USERNAME   || failed=`expr $failed + 1`
  71
  72 #This is important because it puts the ticket for the old KVNO and password into a local ccache
  73 test_smbclient "Test login with kerberos ccache before password change" 'ls' -k yes || failed=`expr $failed + 1`
  74
  75 #check that drs bind works before we change the password (prime the ccache)
  76 test_drs bind "Test drs bind with with kerberos ccache" || failed=`expr $failed + 1`
  77
  78 #check that drs options works before we change the password (prime the ccache)
  79 test_drs options "Test drs options with with kerberos ccache" || failed=`expr $failed + 1`
  80
  81 testit "change dc password" $samba4srcdir/scripting/devel/chgtdcpass -s $PROVDIR/etc/smb.conf || failed=`expr $failed + 1`
  82
  83 #This is important because it shows that the old ticket remains valid (as it must) for incoming connections after the DC password is changed
  84 test_smbclient "Test login with kerberos ccache after password change" 'ls' -k yes || failed=`expr $failed + 1`
  85
  86 #check that drs bind works after we change the password
  87 test_drs bind "Test drs bind with new password" || failed=`expr $failed + 1`
  88
  89 #check that drs options works after we change the password
  90 test_drs options "Test drs options with new password" || failed=`expr $failed + 1`
  91
  92 testit "change dc password (2nd time)" $samba4srcdir/scripting/devel/chgtdcpass -s $PROVDIR/etc/smb.conf || failed=`expr $failed + 1`
  93
  94 #This is important because it shows that the old ticket remains valid (as it must) for incoming connections after the DC pass
  95 test_smbclient "Test login with kerberos ccache after 2nd password change" 'ls' -k yes || failed=`expr $failed + 1`
  96
  97 #check that drs bind works after we change the password a 2nd time
  98 test_drs bind "Test drs bind after 2nd password change" || failed=`expr $failed + 1`
  99
 100 #check that drs options works after we change the password a 2nd time
 101 test_drs options "Test drs options after 2nd password change" || failed=`expr $failed + 1`
 102
 103 #This confirms that the DC password is valid for a kinit too
 104 testit "kinit with keytab" $samba4kinit $enctype -t $PROVDIR/private/secrets.keytab --use-keytab $USERNAME   || failed=`expr $failed + 1`
 105 test_smbclient "Test login with kerberos ccache with fresh kinit" 'ls' -k yes || failed=`expr $failed + 1`
 106 rm -f $KRB5CCNAME
 107
 108 rm -f $PREFIX/tmpccache tmpccfile tmppassfile tmpuserpassfile tmpuserccache tmpkpasswdscript
 109 exit $failed