2 # Blackbox tests for kinit and kerberos integration with smbclient etc
3 # Copyright (C) 2006-2007 Jelmer Vernooij <jelmer@samba.org>
4 # Copyright (C) 2006-2008 Andrew Bartlett <abartlet@samba.org>
8 Usage: test_kinit.sh SERVER USERNAME REALM DOMAIN PREFIX SMBCLIENT
24 samba4bindir
="$BINDIR"
25 samba4srcdir
="$SRCDIR/source4"
28 if test -x $BINDIR/samba4kinit
; then
29 samba4kinit
=bin
/samba4kinit
33 machineaccountccache
="$samba4srcdir/scripting/bin/machineaccountccache"
35 .
`dirname $0`/subunit.sh
43 $VALGRIND $smbclient $CONFIGURATION //$SERVER/tmp
-c "$cmd" $@
45 if [ x
$status = x0
]; then
59 echo $VALGRIND $samba4bindir/samba-tool drs
$function $SERVER -k yes $@
60 $VALGRIND $samba4bindir/samba-tool drs
$function $SERVER -k yes $@
62 if [ x
$status = x0
]; then
72 KRB5CCNAME
="$PREFIX/tmpccache"
75 testit
"kinit with keytab" $samba4kinit $enctype -t $PROVDIR/private
/secrets.keytab
--use-keytab $USERNAME || failed
=`expr $failed + 1`
77 #This is important because it puts the ticket for the old KVNO and password into a local ccache
78 test_smbclient
"Test login with kerberos ccache before password change" 'ls' -k yes || failed
=`expr $failed + 1`
80 #check that drs bind works before we change the password (prime the ccache)
81 test_drs
bind "Test drs bind with with kerberos ccache" || failed
=`expr $failed + 1`
83 #check that drs options works before we change the password (prime the ccache)
84 test_drs options
"Test drs options with with kerberos ccache" || failed
=`expr $failed + 1`
86 testit
"change dc password" $samba4srcdir/scripting
/devel
/chgtdcpass
-s $PROVDIR/etc
/smb.conf || failed
=`expr $failed + 1`
88 #This is important because it shows that the old ticket remains valid (as it must) for incoming connections after the DC password is changed
89 test_smbclient
"Test login with kerberos ccache after password change" 'ls' -k yes || failed
=`expr $failed + 1`
91 #check that drs bind works after we change the password
92 test_drs
bind "Test drs bind with new password" || failed
=`expr $failed + 1`
94 #check that drs options works after we change the password
95 test_drs options
"Test drs options with new password" || failed
=`expr $failed + 1`
97 testit
"change dc password (2nd time)" $samba4srcdir/scripting
/devel
/chgtdcpass
-s $PROVDIR/etc
/smb.conf || failed
=`expr $failed + 1`
99 #This is important because it shows that the old ticket remains valid (as it must) for incoming connections after the DC pass
100 test_smbclient
"Test login with kerberos ccache after 2nd password change" 'ls' -k yes || failed
=`expr $failed + 1`
102 #check that drs bind works after we change the password a 2nd time
103 test_drs
bind "Test drs bind after 2nd password change" || failed
=`expr $failed + 1`
105 #check that drs options works after we change the password a 2nd time
106 test_drs options
"Test drs options after 2nd password change" || failed
=`expr $failed + 1`
108 #This confirms that the DC password is valid for a kinit too
109 testit
"kinit with keytab" $samba4kinit $enctype -t $PROVDIR/private
/secrets.keytab
--use-keytab $USERNAME || failed
=`expr $failed + 1`
110 test_smbclient
"Test login with kerberos ccache with fresh kinit" 'ls' -k yes || failed
=`expr $failed + 1`
113 rm -f $PREFIX/tmpccache tmpccfile tmppassfile tmpuserpassfile tmpuserccache tmpkpasswdscript