testprogs/blackbox/test_s4u_heimdal.sh

   1 #!/bin/sh
   2
   3 if [ $# -lt 5 ]; then
   4         cat <<EOF
   5 Usage: test_s4u_heimdal.sh SERVER USERNAME PASSWORD REALM DOMAIN TRUST_SERVER TRUST_USERNAME TRUST_PASSWORD TRUST_REALM TRUST_DOMAIN PREFIX
   6 EOF
   7         exit 1
   8 fi
   9
  10 SERVER=$1
  11 USERNAME=$2
  12 PASSWORD=$3
  13 REALM=$4
  14 DOMAIN=$5
  15 TRUST_SERVER=$6
  16 TRUST_USERNAME=$7
  17 TRUST_PASSWORD=$8
  18 TRUST_REALM=$9
  19 TRUST_DOMAIN=${10}
  20 PREFIX=${11}
  21 shift 11
  22 failed=0
  23
  24 samba_tool="$VALGRIND $PYTHON $BINDIR/samba-tool"
  25
  26 samba4kinit_binary=kinit
  27 if test -x $BINDIR/samba4kinit; then
  28         samba4kinit_binary=$BINDIR/samba4kinit
  29 fi
  30
  31 samba4kgetcred=kgetcred
  32 if test -x $BINDIR/samba4kgetcred; then
  33         samba4kgetcred=$BINDIR/samba4kgetcred
  34 fi
  35
  36 . $(dirname $0)/subunit.sh
  37 . $(dirname $0)/common_test_fns.inc
  38
  39 ocache="$PREFIX/tmpoutcache"
  40 KRB5CCNAME_PATH="$PREFIX/tmpccache"
  41 KRB5CCNAME="FILE:$KRB5CCNAME_PATH"
  42 samba4kinit="$samba4kinit_binary -c $KRB5CCNAME"
  43 export KRB5CCNAME
  44 rm -rf $KRB5CCNAME_PATH
  45
  46 princ=test_impersonate_princ
  47 impersonator=test_impersonator.$REALM
  48 target="CIFS/$SERVER.$REALM"
  49
  50 testit "add impersonator principal" $samba_tool user add $impersonator $PASSWORD || failed=$(expr $failed + 1)
  51 testit "become a service" $samba_tool spn add "HOST/$impersonator" $impersonator || failed=$(expr $failed + 1)
  52
  53 testit "set TrustedToAuthForDelegation" $samba_tool delegation for-any-protocol $impersonator on || failed=$(expr $failed + 1)
  54 testit "add msDS-AllowedToDelegateTo" $samba_tool delegation add-service $impersonator $target || failed=$(expr $failed + 1)
  55
  56 testit "add a new principal" $samba_tool user add $princ --random-password || failed=$(expr $failed + 1)
  57 testit "set not-delegated flag" $samba_tool user sensitive $princ on || failed=$(expr $failed + 1)
  58
  59 echo $PASSWORD >$PREFIX/tmppassfile
  60 testit "kinit impersonator" $samba4kinit -f --password-file=$PREFIX/tmppassfile $impersonator || failed=$(expr $failed + 1)
  61
  62 testit "test S4U2Self with normal user" $samba4kgetcred --out-cache=$ocache --forwardable --impersonate=${USERNAME} $impersonator || failed=$(expr $failed + 1)
  63 testit "test S4U2Proxy with normal user" $samba4kgetcred --out-cache=$ocache --delegation-credential-cache=${ocache} $target || failed=$(expr $failed + 1)
  64
  65 testit "test S4U2Self with sensitive user" $samba4kgetcred --out-cache=$ocache --forwardable --impersonate=$princ $impersonator || failed=$(expr $failed + 1)
  66 testit_expect_failure "test S4U2Proxy with sensitive user" $samba4kgetcred --out-cache=$ocache --delegation-credential-cache=${ocache} $target || failed=$(expr $failed + 1)
  67
  68 rm -f $ocache
  69 testit "unset not-delegated flag" $samba_tool user sensitive $princ off || failed=$(expr $failed + 1)
  70
  71 testit "test S4U2Self after unsetting ND flag" $samba4kgetcred --out-cache=$ocache --forwardable --impersonate=$princ $impersonator || failed=$(expr $failed + 1)
  72 testit "test S4U2Proxy after unsetting ND flag" $samba4kgetcred --out-cache=$ocache --delegation-credential-cache=${ocache} $target || failed=$(expr $failed + 1)
  73
  74 testit "kinit user cache" $samba4kinit -c $ocache -f --password-file=$PREFIX/tmppassfile $USERNAME || failed=$(expr $failed + 1)
  75 testit "get a ticket to impersonator" $samba4kgetcred -c $ocache --forwardable $impersonator || failed=$(expr $failed + 1)
  76 testit "test S4U2Proxy evidence ticket obtained by TGS" $samba4kgetcred --out-cache=$ocache --delegation-credential-cache=${ocache} $target || failed=$(expr $failed + 1)
  77
  78 echo $TRUST_PASSWORD >$PREFIX/tmppassfile
  79 testit "kinit trust user cache" $samba4kinit -c $ocache -f --password-file=$PREFIX/tmppassfile $TRUST_USERNAME@$TRUST_REALM || failed=$(expr $failed + 1)
  80 testit "get a ticket to impersonator for trust user" $samba4kgetcred -c $ocache --forwardable $impersonator || failed=$(expr $failed + 1)
  81 testit "test S4U2Proxy evidence ticket obtained by TGS of trust user" $samba4kgetcred --out-cache=$ocache --delegation-credential-cache=${ocache} $target || failed=$(expr $failed + 1)
  82
  83 echo $PASSWORD >$PREFIX/tmppassfile
  84 testit "set not-delegated on impersonator" $samba_tool user sensitive $impersonator on || failed=$(expr $failed + 1)
  85 testit "kinit user cache again" $samba4kinit -c $ocache -f --password-file=$PREFIX/tmppassfile $USERNAME || failed=$(expr $failed + 1)
  86 testit "get a ticket to sensitive impersonator" $samba4kgetcred -c $ocache --forwardable $impersonator || failed=$(expr $failed + 1)
  87 testit_expect_failure "test S4U2Proxy using received ticket" $samba4kgetcred --out-cache=$ocache --delegation-credential-cache=${ocache} $target || failed=$(expr $failed + 1)
  88
  89 rm -f $ocache $PREFIX/tmpccache $PREFIX/tmppassfile
  90 exit $failed