testprogs/blackbox/test_chgdcpass.sh

   1 #!/bin/sh
   2 # Blackbox tests for kinit and kerberos integration with smbclient etc
   3 # Copyright (C) 2006-2007 Jelmer Vernooij <jelmer@samba.org>
   4 # Copyright (C) 2006-2008 Andrew Bartlett <abartlet@samba.org>
   5
   6 if [ $# -lt 4 ]; then
   7 cat <<EOF
   8 Usage: test_kinit.sh SERVER USERNAME REALM DOMAIN PREFIX SMBCLIENT
   9 EOF
  10 exit 1;
  11 fi
  12
  13 SERVER=$1
  14 USERNAME=$2
  15 REALM=$3
  16 DOMAIN=$4
  17 PREFIX=$5
  18 ENCTYPE=$6
  19 PROVDIR=$7
  20 smbclient=$8
  21 shift 8
  22 failed=0
  23
  24 samba4bindir="$BINDIR"
  25 samba4srcdir="$SRCDIR/source4"
  26
  27 samba4kinit=kinit
  28 heimdal=0
  29 if test -x $BINDIR/samba4kinit; then
  30         heimdal=1
  31         samba4kinit=bin/samba4kinit
  32 fi
  33
  34
  35 machineaccountccache="$samba4srcdir/scripting/bin/machineaccountccache"
  36
  37 unc="//$SERVER/tmp"
  38
  39 . `dirname $0`/subunit.sh
  40 . `dirname $0`/common_test_fns.inc
  41
  42 test_drs() {
  43         function="$1"
  44         name="$2"
  45         shift
  46         shift
  47         echo "test: $name"
  48         echo $VALGRIND $samba4bindir/samba-tool drs $function $SERVER -k yes $@
  49         $VALGRIND $samba4bindir/samba-tool drs $function $SERVER -k yes $@
  50         status=$?
  51         if [ x$status = x0 ]; then
  52                 echo "success: $name"
  53         else
  54                 echo "failure: $name"
  55         fi
  56         return $status
  57 }
  58
  59 enctype="-e $ENCTYPE"
  60
  61 KRB5CCNAME="$PREFIX/tmpccache"
  62 export KRB5CCNAME
  63 rm -f $KRB5CCNAME
  64
  65 if [ $heimdal -eq 1 ]; then
  66         testit "kinit with keytab" $samba4kinit $enctype -t $PROVDIR/private/secrets.keytab --use-keytab $USERNAME   || failed=`expr $failed + 1`
  67 else
  68         testit "kinit with keytab" $samba4kinit -k -t $PROVDIR/private/secrets.keytab $USERNAME || failed=`expr $failed + 1`
  69 fi
  70
  71 #This is important because it puts the ticket for the old KVNO and password into a local ccache
  72 test_smbclient "Test login with kerberos ccache before password change" 'ls' "$unc" -k yes || failed=`expr $failed + 1`
  73
  74 #check that drs bind works before we change the password (prime the ccache)
  75 test_drs bind "Test drs bind with with kerberos ccache" || failed=`expr $failed + 1`
  76
  77 #check that drs options works before we change the password (prime the ccache)
  78 test_drs options "Test drs options with with kerberos ccache" || failed=`expr $failed + 1`
  79
  80 testit "change dc password" $samba4srcdir/scripting/devel/chgtdcpass -s $PROVDIR/etc/smb.conf || failed=`expr $failed + 1`
  81
  82 #This is important because it shows that the old ticket remains valid (as it must) for incoming connections after the DC password is changed
  83 test_smbclient "Test login with kerberos ccache after password change" 'ls' "$unc" -k yes || failed=`expr $failed + 1`
  84
  85 #check that drs bind works after we change the password
  86 test_drs bind "Test drs bind with new password" || failed=`expr $failed + 1`
  87
  88 #check that drs options works after we change the password
  89 test_drs options "Test drs options with new password" || failed=`expr $failed + 1`
  90
  91 testit "change dc password (2nd time)" $samba4srcdir/scripting/devel/chgtdcpass -s $PROVDIR/etc/smb.conf || failed=`expr $failed + 1`
  92
  93 # This is important because it shows that the old ticket is discarded if the server rejects it (as it must) after the password was changed twice in succession.
  94 # This also ensures we handle the case where the domain is re-provisioned etc
  95 test_smbclient "Test login with kerberos ccache after 2nd password change" 'ls' "$unc" -k yes || failed=`expr $failed + 1`
  96
  97 #check that drs bind works after we change the password a 2nd time
  98 test_drs bind "Test drs bind after 2nd password change" || failed=`expr $failed + 1`
  99
 100 #check that drs options works after we change the password a 2nd time
 101 test_drs options "Test drs options after 2nd password change" || failed=`expr $failed + 1`
 102
 103 #This confirms that the DC password is valid for a kinit too
 104 if [ $heimdal -eq 1 ]; then
 105         testit "kinit with keytab" $samba4kinit $enctype -t $PROVDIR/private/secrets.keytab --use-keytab $USERNAME   || failed=`expr $failed + 1`
 106 else
 107         testit "kinit with keytab" $samba4kinit -k -t $PROVDIR/private/secrets.keytab $USERNAME || failed=`expr $failed + 1`
 108 fi
 109 test_smbclient "Test login with kerberos ccache with fresh kinit" 'ls' "$unc" -k yes || failed=`expr $failed + 1`
 110
 111 rm -f $KRB5CCNAME
 112
 113 rm -f $PREFIX/tmpccache tmpccfile tmppassfile tmpuserpassfile tmpuserccache tmpkpasswdscript
 114 exit $failed