testprogs/blackbox/test_pkinit_pac.sh

   1 #!/bin/sh
   2 # Blackbox tests for pkinit and pac verification
   3 #
   4 # Copyright (C) 2006-2008 Stefan Metzmacher
   5 # Copyright (C) 2022      Andreas Schneider
   6
   7 if [ $# -lt 6 ]; then
   8         cat <<EOF
   9 Usage: test_pkinit_pac.sh SERVER USERNAME PASSWORD REALM DOMAIN PREFIX
  10 EOF
  11         exit 1
  12 fi
  13
  14 SERVER=$1
  15 USERNAME=$2
  16 PASSWORD=$3
  17 REALM=$4
  18 DOMAIN=$5
  19 PREFIX=$6
  20 shift 6
  21 failed=0
  22
  23 samba_bindir="$BINDIR"
  24
  25 samba_kinit="$(command -v kinit)"
  26 if [ -x "${samba_bindir}/samba4kinit" ]; then
  27         samba_kinit="${samba_bindir}/samba4kinit"
  28 fi
  29 samba_smbtorture="${samba_bindir}/smbtorture --basedir=$SELFTEST_TMPDIR"
  30
  31 . "$(dirname "$0")"/subunit.sh
  32 . "$(dirname "$0")"/common_test_fns.inc
  33
  34 KRB5CCNAME_PATH="$PREFIX/tmpccache"
  35 rm -f "${KRB5CCNAME_PATH}"
  36 KRB5CCNAME="FILE:$KRB5CCNAME_PATH"
  37 export KRB5CCNAME
  38
  39 USER_PRINCIPAL_NAME="$(echo "${USERNAME}@${REALM}" | tr "[:upper:]" "[:lower:]")"
  40
  41 kbase="$(basename "${samba_kinit}")"
  42 if [ "${kbase}" = "samba4kinit" ]; then
  43         # HEIMDAL
  44         X509_USER_IDENTITY="--pk-user=FILE:${PREFIX}/pkinit/USER-${USER_PRINCIPAL_NAME}-cert.pem,${PREFIX}/pkinit/USER-${USER_PRINCIPAL_NAME}-private-key.pem"
  45         OPTION_RENEWABLE="--renewable"
  46 else
  47         X509_USER_IDENTITY="-X X509_user_identity=FILE:${PREFIX}/pkinit/USER-${USER_PRINCIPAL_NAME}-cert.pem,${PREFIX}/pkinit/USER-${USER_PRINCIPAL_NAME}-private-key.pem"
  48         OPTION_RENEWABLE="-r 1h"
  49 fi
  50 OPTION_REQUEST_PAC="--request-pac"
  51
  52 testit "STEP1 kinit with pkinit (name specified)" \
  53         "${samba_kinit}" "${OPTION_REQUEST_PAC}" "${OPTION_RENEWABLE}" \
  54         "${X509_USER_IDENTITY}" "${USERNAME}@${REALM}" ||
  55         failed=$((failed + 1))
  56 testit "STEP1 remote.pac verification" \
  57         "${samba_smbtorture}" ncacn_np:"${SERVER}" rpc.pac \
  58         --workgroup="${DOMAIN}" -U"${USERNAME}%${PASSWORD}" \
  59         --option=torture:pkinit_ccache="${KRB5CCNAME}" ||
  60         failed=$((failed + 1))
  61
  62 rm -f "${KRB5CCNAME_PATH}"
  63 exit ${failed}