5 Usage: test_s4u_heimdal.sh SERVER USERNAME PASSWORD REALM DOMAIN TRUST_SERVER TRUST_USERNAME TRUST_PASSWORD TRUST_REALM TRUST_DOMAIN PREFIX
24 samba_tool
="$VALGRIND $PYTHON $BINDIR/samba-tool"
26 samba4kinit_binary
=kinit
27 if test -x $BINDIR/samba4kinit
; then
28 samba4kinit_binary
=$BINDIR/samba4kinit
31 samba4kgetcred
=kgetcred
32 if test -x $BINDIR/samba4kgetcred
; then
33 samba4kgetcred
=$BINDIR/samba4kgetcred
36 . $
(dirname $0)/subunit.sh
37 . $
(dirname $0)/common_test_fns.inc
39 ocache
="$PREFIX/tmpoutcache"
40 KRB5CCNAME_PATH
="$PREFIX/tmpccache"
41 KRB5CCNAME
="FILE:$KRB5CCNAME_PATH"
42 samba4kinit
="$samba4kinit_binary -c $KRB5CCNAME"
44 rm -rf $KRB5CCNAME_PATH
46 princ
=test_impersonate_princ
47 impersonator
=test_impersonator.
$REALM
48 target
="CIFS/$SERVER.$REALM"
50 testit
"add impersonator principal" $samba_tool user add
$impersonator $PASSWORD || failed
=$
(expr $failed + 1)
51 testit
"become a service" $samba_tool spn add
"HOST/$impersonator" $impersonator || failed
=$
(expr $failed + 1)
53 testit
"set TrustedToAuthForDelegation" $samba_tool delegation for-any-protocol
$impersonator on || failed
=$
(expr $failed + 1)
54 testit
"add msDS-AllowedToDelegateTo" $samba_tool delegation add-service
$impersonator $target || failed
=$
(expr $failed + 1)
56 testit
"add a new principal" $samba_tool user add
$princ --random-password || failed
=$
(expr $failed + 1)
57 testit
"set not-delegated flag" $samba_tool user sensitive
$princ on || failed
=$
(expr $failed + 1)
59 echo $PASSWORD >$PREFIX/tmppassfile
60 testit
"kinit impersonator" $samba4kinit -f --password-file=$PREFIX/tmppassfile
$impersonator || failed
=$
(expr $failed + 1)
62 testit
"test S4U2Self with normal user" $samba4kgetcred --out-cache=$ocache --forwardable --impersonate=${USERNAME} $impersonator || failed
=$
(expr $failed + 1)
63 testit
"test S4U2Proxy with normal user" $samba4kgetcred --out-cache=$ocache --delegation-credential-cache=${ocache} $target || failed
=$
(expr $failed + 1)
65 testit
"test S4U2Self with sensitive user" $samba4kgetcred --out-cache=$ocache --forwardable --impersonate=$princ $impersonator || failed
=$
(expr $failed + 1)
66 testit_expect_failure
"test S4U2Proxy with sensitive user" $samba4kgetcred --out-cache=$ocache --delegation-credential-cache=${ocache} $target || failed
=$
(expr $failed + 1)
69 testit
"unset not-delegated flag" $samba_tool user sensitive
$princ off || failed
=$
(expr $failed + 1)
71 testit
"test S4U2Self after unsetting ND flag" $samba4kgetcred --out-cache=$ocache --forwardable --impersonate=$princ $impersonator || failed
=$
(expr $failed + 1)
72 testit
"test S4U2Proxy after unsetting ND flag" $samba4kgetcred --out-cache=$ocache --delegation-credential-cache=${ocache} $target || failed
=$
(expr $failed + 1)
74 testit
"kinit user cache" $samba4kinit -c $ocache -f --password-file=$PREFIX/tmppassfile
$USERNAME || failed
=$
(expr $failed + 1)
75 testit
"get a ticket to impersonator" $samba4kgetcred -c $ocache --forwardable $impersonator || failed
=$
(expr $failed + 1)
76 testit
"test S4U2Proxy evidence ticket obtained by TGS" $samba4kgetcred --out-cache=$ocache --delegation-credential-cache=${ocache} $target || failed
=$
(expr $failed + 1)
78 echo $TRUST_PASSWORD >$PREFIX/tmppassfile
79 testit
"kinit trust user cache" $samba4kinit -c $ocache -f --password-file=$PREFIX/tmppassfile
$TRUST_USERNAME@
$TRUST_REALM || failed
=$
(expr $failed + 1)
80 testit
"get a ticket to impersonator for trust user" $samba4kgetcred -c $ocache --forwardable $impersonator || failed
=$
(expr $failed + 1)
81 testit
"test S4U2Proxy evidence ticket obtained by TGS of trust user" $samba4kgetcred --out-cache=$ocache --delegation-credential-cache=${ocache} $target || failed
=$
(expr $failed + 1)
83 echo $PASSWORD >$PREFIX/tmppassfile
84 testit
"set not-delegated on impersonator" $samba_tool user sensitive
$impersonator on || failed
=$
(expr $failed + 1)
85 testit
"kinit user cache again" $samba4kinit -c $ocache -f --password-file=$PREFIX/tmppassfile
$USERNAME || failed
=$
(expr $failed + 1)
86 testit
"get a ticket to sensitive impersonator" $samba4kgetcred -c $ocache --forwardable $impersonator || failed
=$
(expr $failed + 1)
87 testit_expect_failure
"test S4U2Proxy using received ticket" $samba4kgetcred --out-cache=$ocache --delegation-credential-cache=${ocache} $target || failed
=$
(expr $failed + 1)
89 rm -f $ocache $PREFIX/tmpccache
$PREFIX/tmppassfile