testprogs/blackbox/test_chgdcpass.sh

   1 #!/bin/sh
   2 # Blackbox tests for kinit and kerberos integration with smbclient etc
   3 # Copyright (C) 2006-2007 Jelmer Vernooij <jelmer@samba.org>
   4 # Copyright (C) 2006-2008 Andrew Bartlett <abartlet@samba.org>
   5
   6 if [ $# -lt 4 ]; then
   7         cat <<EOF
   8 Usage: test_chgdcpass.sh SERVER USERNAME REALM DOMAIN PREFIX ENCTYPE PROVDIR SMBCLIENT
   9 EOF
  10         exit 1
  11 fi
  12
  13 SERVER=$1
  14 USERNAME=$2
  15 REALM=$3
  16 DOMAIN=$4
  17 PREFIX=$5
  18 ENCTYPE=$6
  19 PROVDIR=$7
  20 smbclient=$8
  21 shift 8
  22 failed=0
  23
  24 samba4bindir="$BINDIR"
  25 samba4srcdir="$SRCDIR/source4"
  26
  27 samba4kinit_binary=kinit
  28 heimdal=0
  29 if test -x $BINDIR/samba4kinit; then
  30         heimdal=1
  31         samba4kinit_binary=bin/samba4kinit
  32 fi
  33
  34 machineaccountccache="$samba4srcdir/scripting/bin/machineaccountccache"
  35
  36 unc="//$SERVER/tmp"
  37
  38 . $(dirname $0)/subunit.sh
  39 . $(dirname $0)/common_test_fns.inc
  40
  41 test_drs()
  42 {
  43         function="$1"
  44         name="$2"
  45         shift
  46         shift
  47         echo "test: $name"
  48         echo $VALGRIND $PYTHON $samba4bindir/samba-tool drs $function $SERVER -k yes "$@"
  49         $VALGRIND $PYTHON $samba4bindir/samba-tool drs $function $SERVER -k yes "$@"
  50         status=$?
  51         if [ x$status = x0 ]; then
  52                 echo "success: $name"
  53         else
  54                 echo "failure: $name"
  55         fi
  56         return $status
  57 }
  58
  59 enctype="-e $ENCTYPE"
  60
  61 KRB5CCNAME="$PREFIX/tmpccache"
  62 samba4kinit="$samba4kinit_binary -c $KRB5CCNAME"
  63 export KRB5CCNAME
  64 rm -f $KRB5CCNAME
  65
  66 if [ $heimdal -eq 1 ]; then
  67         testit "kinit with keytab" $samba4kinit $enctype -t $PROVDIR/private/secrets.keytab --use-keytab $USERNAME || failed=$(expr $failed + 1)
  68 else
  69         testit "kinit with keytab" $samba4kinit -k -t $PROVDIR/private/secrets.keytab $USERNAME || failed=$(expr $failed + 1)
  70 fi
  71
  72 #This is important because it puts the ticket for the old KVNO and password into a local ccache
  73 test_smbclient "Test login with kerberos ccache before password change" 'ls' "$unc" --use-krb5-ccache=$KRB5CCNAME || failed=$(expr $failed + 1)
  74
  75 #check that drs bind works before we change the password (prime the ccache)
  76 test_drs bind "Test drs bind with with kerberos ccache" || failed=$(expr $failed + 1)
  77
  78 #check that drs options works before we change the password (prime the ccache)
  79 test_drs options "Test drs options with with kerberos ccache" || failed=$(expr $failed + 1)
  80
  81 testit "change dc password" $PYTHON $samba4srcdir/scripting/devel/chgtdcpass --configfile=$PROVDIR/etc/smb.conf || failed=$(expr $failed + 1)
  82
  83 #This is important because it shows that the old ticket remains valid (as it must) for incoming connections after the DC password is changed
  84 test_smbclient "Test login with kerberos ccache after password change" 'ls' "$unc" --use-krb5-ccache=$KRB5CCNAME || failed=$(expr $failed + 1)
  85
  86 #check that drs bind works after we change the password
  87 test_drs bind "Test drs bind with new password" || failed=$(expr $failed + 1)
  88
  89 #check that drs options works after we change the password
  90 test_drs options "Test drs options with new password" || failed=$(expr $failed + 1)
  91
  92 testit "change dc password (2nd time)" $PYTHON $samba4srcdir/scripting/devel/chgtdcpass --configfile=$PROVDIR/etc/smb.conf || failed=$(expr $failed + 1)
  93
  94 # This is important because it shows that the old ticket is discarded if the server rejects it (as it must) after the password was changed twice in succession.
  95 # This also ensures we handle the case where the domain is re-provisioned etc
  96 test_smbclient "Test login with kerberos ccache after 2nd password change" 'ls' "$unc" --use-krb5-ccache=$KRB5CCNAME || failed=$(expr $failed + 1)
  97
  98 #check that drs bind works after we change the password a 2nd time
  99 test_drs bind "Test drs bind after 2nd password change" || failed=$(expr $failed + 1)
 100
 101 #check that drs options works after we change the password a 2nd time
 102 test_drs options "Test drs options after 2nd password change" || failed=$(expr $failed + 1)
 103
 104 #This confirms that the DC password is valid for a kinit too
 105 if [ $heimdal -eq 1 ]; then
 106         testit "kinit with keytab" $samba4kinit $enctype -t $PROVDIR/private/secrets.keytab --use-keytab $USERNAME || failed=$(expr $failed + 1)
 107 else
 108         testit "kinit with keytab" $samba4kinit -k -t $PROVDIR/private/secrets.keytab $USERNAME || failed=$(expr $failed + 1)
 109 fi
 110 test_smbclient "Test login with kerberos ccache with fresh kinit" 'ls' "$unc" --use-krb5-ccache=$KRB5CCNAME || failed=$(expr $failed + 1)
 111
 112 rm -f $KRB5CCNAME
 113
 114 rm -f $PREFIX/tmpccache tmpccfile tmppassfile tmpuserpassfile tmpuserccache
 115 exit $failed