2 # Blackbox tests for kinit and kerberos integration with smbclient etc
3 # Copyright (c) 2015-2016 Andreas Schneider <asn@samba.org>
7 Usage: test_kinit.sh SERVER USERNAME PASSWORD REALM DOMAIN PREFIX SMBCLIENT
22 samba_bindir
="$BINDIR"
23 samba_srcdir
="$SRCDIR/source4"
25 samba_kdestroy
=kdestroy
29 samba_tool
="$samba_bindir/samba-tool"
30 samba_texpect
="$samba_bindir/texpect"
32 samba_enableaccount
="$samba_tool user enable"
33 machineaccountccache
="$samba_srcdir/scripting/bin/machineaccountccache"
36 if [ -x "$samba_bindir/ldbmodify" ]; then
37 ldbmodify
="$samba_bindir/ldbmodify"
41 if [ -x "$samba_bindir/ldbsearch" ]; then
42 ldbsearch
="$samba_bindir/ldbsearch"
45 .
`dirname $0`/subunit.sh
53 $VALGRIND $smbclient $CONFIGURATION //$SERVER/tmp
-c "$cmd" $@
55 if [ x
$status = x0
]; then
63 ADMIN_LDBMODIFY_CONFIG
="-H ldap://$SERVER -U$USERNAME%$PASSWORD"
64 export ADMIN_LDBMODIFY_CONFIG
66 KRB5CCNAME_PATH
="$PREFIX/tmpccache"
67 KRB5CCNAME
="FILE:$KRB5CCNAME_PATH"
68 ADMIN_KRB5CCNAME
="FILE:$KRB5CCNAME_PATH"
70 rm -rf $KRB5CCNAME_PATH
72 testit
"reset password policies beside of minimum password age of 0 days" $VALGRIND $PYTHON $samba_tool domain passwordsettings
set $ADMIN_LDBMODIFY_CONFIG --complexity=default
--history-length=default
--min-pwd-length=default
--min-pwd-age=0 --max-pwd-age=default || failed
=`expr $failed + 1`
74 cat > $PREFIX/tmpkinitscript
<<EOF
79 ###########################################################
80 ### Test kinit defaults
81 ###########################################################
83 testit
"kinit with password" $samba_texpect $PREFIX/tmpkinitscript
$samba_kinit $USERNAME@
$REALM || failed
=`expr $failed + 1`
84 test_smbclient
"Test login with user kerberos ccache" 'ls' -k yes || failed
=`expr $failed + 1`
86 testit
"kinit renew ticket" $samba_kinit -R || failed
=`expr $failed + 1`
87 test_smbclient
"Test login with kerberos ccache" 'ls' -k yes || failed
=`expr $failed + 1`
91 ###########################################################
92 ### Test kinit with enterprice principal
93 ###########################################################
95 testit
"kinit with password (enterprise style)" $samba_texpect $PREFIX/tmpkinitscript
$samba_kinit -E $USERNAME@
$REALM || failed
=`expr $failed + 1`
96 test_smbclient
"Test login with user kerberos ccache" 'ls' -k yes || failed
=`expr $failed + 1`
98 # This does not work with MIT Kerberos 1.14 or older
99 testit
"kinit renew ticket (enterprise style)" $samba_kinit -R || failed
=`expr $failed + 1`
100 test_smbclient
"Test login with kerberos ccache" 'ls' -k yes || failed
=`expr $failed + 1`
104 ###########################################################
105 ### Tests with kinit default again
106 ###########################################################
108 testit
"kinit with password" $samba_texpect $PREFIX/tmpkinitscript
$samba_kinit $USERNAME@
$REALM || failed
=`expr $failed + 1`
109 testit
"check time with kerberos ccache" $VALGRIND $PYTHON $samba_tool time $SERVER $CONFIGURATION -k yes $@ || failed
=`expr $failed + 1`
111 USERPASS
="testPass@12%"
113 testit
"add user with kerberos ccache" $VALGRIND $PYTHON $samba_tool user create nettestuser
$USERPASS $CONFIGURATION -k yes $@ || failed
=`expr $failed + 1`
115 echo "Getting defaultNamingContext"
116 BASEDN
=`$ldbsearch $options --basedn='' -H ldap://$SERVER -s base DUMMY=x defaultNamingContext | grep defaultNamingContext | awk '{print $2}'`
118 cat > $PREFIX/tmpldbmodify
<<EOF
119 dn: cn=nettestuser,cn=users,$BASEDN
121 add: servicePrincipalName
122 servicePrincipalName: host/nettestuser
123 replace: userPrincipalName
124 userPrincipalName: nettest@$REALM
127 testit
"modify servicePrincipalName and userPrincpalName" $VALGRIND $ldbmodify -H ldap
://$SERVER $PREFIX/tmpldbmodify
-k yes $@ || failed
=`expr $failed + 1`
129 testit
"set user password with kerberos ccache" $VALGRIND $PYTHON $samba_tool user setpassword nettestuser
--newpassword=$USERPASS $CONFIGURATION -k yes $@ || failed
=`expr $failed + 1`
131 testit
"enable user with kerberos cache" $VALGRIND $PYTHON $samba_enableaccount nettestuser
-H ldap
://$SERVER -k yes $@ || failed
=`expr $failed + 1`
133 ###########################################################
134 ### Test kinit with user credentials
135 ###########################################################
137 KRB5CCNAME_PATH
="$PREFIX/tmpuserccache"
138 KRB5CCNAME
="FILE:$KRB5CCNAME_PATH"
141 rm -f $KRB5CCNAME_PATH
143 cat > $PREFIX/tmpkinituserpassscript
<<EOF
148 testit
"kinit with user password" $samba_texpect $PREFIX/tmpkinituserpassscript
$samba_kinit nettestuser@
$REALM || failed
=`expr $failed + 1`
149 test_smbclient
"Test login with user kerberos ccache" 'ls' -k yes || failed
=`expr $failed + 1`
153 NEWUSERPASS
="testPaSS@34%"
154 testit
"change user password with 'samba-tool user password' (rpc)" $VALGRIND $PYTHON $samba_tool user password
-W$DOMAIN -Unettestuser%$USERPASS $CONFIGURATION -k no
--newpassword=$NEWUSERPASS $@ || failed
=`expr $failed + 1`
156 cat > $PREFIX/tmpkinituserpassscript
<<EOF
158 send ${NEWUSERPASS}\n
161 testit
"kinit with new user password" $samba_texpect $PREFIX/tmpkinituserpassscript
$samba_kinit nettestuser@
$REALM || failed
=`expr $failed + 1`
162 test_smbclient
"Test login with user kerberos ccache" 'ls' -k yes || failed
=`expr $failed + 1`
166 ###########################################################
167 ### Test kinit with user credentials in special formats
168 ###########################################################
170 testit
"kinit with new (NT-Principal style) using UPN" $samba_texpect $PREFIX/tmpkinituserpassscript
$samba_kinit nettest@
$REALM || failed
=`expr $failed + 1`
171 test_smbclient
"Test login with user kerberos ccache from NT UPN" 'ls' -k yes || failed
=`expr $failed + 1`
175 testit
"kinit with new (enterprise style) using UPN" $samba_texpect $PREFIX/tmpkinituserpassscript
$samba_kinit -E nettest@
$REALM || failed
=`expr $failed + 1`
176 test_smbclient
"Test login with user kerberos ccache from enterprise UPN" 'ls' -k yes || failed
=`expr $failed + 1`
180 ###########################################################
181 ### Test kinit with user credentials and changed realm
182 ###########################################################
184 cat > $PREFIX/tmpldbmodify
<<EOF
185 dn: cn=nettestuser,cn=users,$BASEDN
187 replace: userPrincipalName
188 userPrincipalName: nettest@$REALM.org
191 testit
"modify userPrincipalName to be a different domain" $VALGRIND $ldbmodify $ADMIN_LDBMODIFY_CONFIG $PREFIX/tmpldbmodify
$PREFIX/tmpldbmodify
-k yes $@ || failed
=`expr $failed + 1`
193 testit
"kinit with new (enterprise style) using UPN" $samba_texpect $PREFIX/tmpkinituserpassscript
$samba_kinit -E nettest@
$REALM.org || failed
=`expr $failed + 1`
194 test_smbclient
"Test login with user kerberos ccache from enterprise UPN" 'ls' -k yes || failed
=`expr $failed + 1`
198 ###########################################################
199 ### Test password change with kpasswd
200 ###########################################################
202 testit
"kinit with user password" $samba_texpect $PREFIX/tmpkinituserpassscript
$samba_kinit nettestuser@
$REALM || failed
=`expr $failed + 1`
203 test_smbclient
"Test login with user kerberos ccache" 'ls' -k yes || failed
=`expr $failed + 1`
205 USERPASS
=$NEWUSERPASS
206 NEWUSERPASS
=testPaSS@
56%
208 cat > $PREFIX/tmpkpasswdscript
<<EOF
210 password ${USERPASS}\n
211 expect Enter new password
212 send ${NEWUSERPASS}\n
213 expect Enter it again
214 send ${NEWUSERPASS}\n
215 expect Password changed
218 testit
"change user password with kpasswd" $samba_texpect $PREFIX/tmpkpasswdscript
$samba_kpasswd nettestuser@
$REALM || failed
=`expr $failed + 1`
222 USERPASS
=$NEWUSERPASS
223 cat > $PREFIX/tmpkinituserpassscript
<<EOF
228 testit
"kinit with user password" $samba_texpect $PREFIX/tmpkinituserpassscript
$samba_kinit nettestuser@
$REALM || failed
=`expr $failed + 1`
229 test_smbclient
"Test login with user kerberos ccache" 'ls' -k yes || failed
=`expr $failed + 1`
233 ###########################################################
234 ### TODO Test set password with kpasswd
235 ###########################################################
237 # This is not implemented in kpasswd
239 ###########################################################
240 ### Test password expiry
241 ###########################################################
243 cat > $PREFIX/tmpldbmodify
<<EOF
244 dn: cn=nettestuser,cn=users,$BASEDN
250 USERPASS
=$NEWUSERPASS
251 NEWUSERPASS
=testPaSS@
911%
253 testit
"modify pwdLastSet" $VALGRIND $ldbmodify $ADMIN_LDBMODIFY_CONFIG $PREFIX/tmpldbmodify
$PREFIX/tmpldbmodify
-k yes $@ || failed
=`expr $failed + 1`
255 cat > $PREFIX/tmpkinituserpassscript
<<EOF
258 expect Password expired. You must change it now.
259 expect Enter new password
260 send ${NEWUSERPASS}\n
261 expect Enter it again
262 send ${NEWUSERPASS}\n
265 testit
"kinit (MIT) with user password for expired password" $samba_texpect $PREFIX/tmpkinituserpassscript
$samba_kinit nettestuser@
$REALM || failed
=`expr $failed + 1`
266 test_smbclient
"Test login with user kerberos ccache" 'ls' -k yes || failed
=`expr $failed + 1`
268 USERPASS
=$NEWUSERPASS
269 cat > $PREFIX/tmpkinituserpassscript
<<EOF
274 testit
"kinit with user password" $samba_texpect $PREFIX/tmpkinituserpassscript
$samba_kinit nettestuser@
$REALM || failed
=`expr $failed + 1`
275 test_smbclient
"Test login with user kerberos ccache" 'ls' -k yes || failed
=`expr $failed + 1`
277 ###########################################################
278 ### Test login with lowercase realm
279 ###########################################################
281 KRB5CCNAME_PATH
="$PREFIX/tmpccache"
282 KRB5CCNAME
="FILE:$KRB5CCNAME_PATH"
285 rm -rf $KRB5CCNAME_PATH
287 lowerrealm
=$
(echo $REALM |
tr '[A-Z]' '[a-z]')
288 test_smbclient
"Test login with user kerberos lowercase realm" 'ls' -k yes -Unettestuser@
$lowerrealm%$NEWUSERPASS || failed
=`expr $failed + 1`
289 test_smbclient
"Test login with user kerberos lowercase realm 2" 'ls' -k yes -Unettestuser@
$REALM%$NEWUSERPASS --realm=$lowerrealm || failed
=`expr $failed + 1`
291 testit
"del user with kerberos ccache" $VALGRIND $PYTHON $samba_tool user delete nettestuser
$CONFIGURATION -k yes $@ || failed
=`expr $failed + 1`
293 ###########################################################
294 ### Test login with machine account
295 ###########################################################
297 rm -f $KRB5CCNAME_PATH
298 testit
"kinit with machineaccountccache script" $PYTHON $machineaccountccache $CONFIGURATION $KRB5CCNAME || failed
=`expr $failed + 1`
299 test_smbclient
"Test machine account login with kerberos ccache" 'ls' -k yes || failed
=`expr $failed + 1`
301 testit
"reset password policies" $VALGRIND $PYTHON $samba_tool domain passwordsettings
set $ADMIN_LDBMODIFY_CONFIG --complexity=default
--history-length=default
--min-pwd-length=default
--min-pwd-age=default
--max-pwd-age=default || failed
=`expr $failed + 1`
303 ###########################################################
304 ### Test basic s4u2self request
305 ###########################################################
307 # Use previous acquired machine creds to request a ticket for self.
308 # We expect it to fail for now.
309 MACHINE_ACCOUNT
="$(hostname -s | tr [a-z] [A-Z])\$@$REALM"
310 $samba_kvno -U$MACHINE_ACCOUNT $MACHINE_ACCOUNT
311 # But we expect the KDC to be up and running still
312 testit
"kinit with machineaccountccache after s4u2self" $machineaccountccache $CONFIGURATION $KRB5CCNAME || failed
=`expr $failed + 1`
318 rm -f $KRB5CCNAME_PATH
319 rm -f $PREFIX/tmpkinituserpassscript
320 rm -f $PREFIX/tmpkinitscript
321 rm -f $PREFIX/tmpkpasswdscript