testprogs/blackbox/test_chgdcpass.sh

   1 #!/bin/sh
   2 # Blackbox tests for kinit and kerberos integration with smbclient etc
   3 # Copyright (C) 2006-2007 Jelmer Vernooij <jelmer@samba.org>
   4 # Copyright (C) 2006-2008 Andrew Bartlett <abartlet@samba.org>
   5
   6 if [ $# -lt 4 ]; then
   7 cat <<EOF
   8 Usage: test_kinit.sh SERVER USERNAME REALM DOMAIN PREFIX SMBCLIENT
   9 EOF
  10 exit 1;
  11 fi
  12
  13 SERVER=$1
  14 USERNAME=$2
  15 REALM=$3
  16 DOMAIN=$4
  17 PREFIX=$5
  18 ENCTYPE=$6
  19 PROVDIR=$7
  20 smbclient=$8
  21 shift 8
  22 failed=0
  23
  24 samba4bindir="$BINDIR"
  25 samba4srcdir="$SRCDIR/source4"
  26
  27 samba4kinit=kinit
  28 if test -x $BINDIR/samba4kinit; then
  29         samba4kinit=bin/samba4kinit
  30 fi
  31
  32
  33 machineaccountccache="$samba4srcdir/scripting/bin/machineaccountccache"
  34
  35 unc="//$SERVER/tmp"
  36
  37 . `dirname $0`/subunit.sh
  38 . `dirname $0`/common_test_fns.inc
  39
  40 test_drs() {
  41         function="$1"
  42         name="$2"
  43         shift
  44         shift
  45         echo "test: $name"
  46         echo $VALGRIND $samba4bindir/samba-tool drs $function $SERVER -k yes $@
  47         $VALGRIND $samba4bindir/samba-tool drs $function $SERVER -k yes $@
  48         status=$?
  49         if [ x$status = x0 ]; then
  50                 echo "success: $name"
  51         else
  52                 echo "failure: $name"
  53         fi
  54         return $status
  55 }
  56
  57 enctype="-e $ENCTYPE"
  58
  59 KRB5CCNAME="$PREFIX/tmpccache"
  60 export KRB5CCNAME
  61 rm -f $KRB5CCNAME
  62 testit "kinit with keytab" $samba4kinit $enctype -t $PROVDIR/private/secrets.keytab --use-keytab $USERNAME   || failed=`expr $failed + 1`
  63
  64 #This is important because it puts the ticket for the old KVNO and password into a local ccache
  65 test_smbclient "Test login with kerberos ccache before password change" 'ls' "$unc" -k yes || failed=`expr $failed + 1`
  66
  67 #check that drs bind works before we change the password (prime the ccache)
  68 test_drs bind "Test drs bind with with kerberos ccache" || failed=`expr $failed + 1`
  69
  70 #check that drs options works before we change the password (prime the ccache)
  71 test_drs options "Test drs options with with kerberos ccache" || failed=`expr $failed + 1`
  72
  73 testit "change dc password" $samba4srcdir/scripting/devel/chgtdcpass -s $PROVDIR/etc/smb.conf || failed=`expr $failed + 1`
  74
  75 #This is important because it shows that the old ticket remains valid (as it must) for incoming connections after the DC password is changed
  76 test_smbclient "Test login with kerberos ccache after password change" 'ls' "$unc" -k yes || failed=`expr $failed + 1`
  77
  78 #check that drs bind works after we change the password
  79 test_drs bind "Test drs bind with new password" || failed=`expr $failed + 1`
  80
  81 #check that drs options works after we change the password
  82 test_drs options "Test drs options with new password" || failed=`expr $failed + 1`
  83
  84 testit "change dc password (2nd time)" $samba4srcdir/scripting/devel/chgtdcpass -s $PROVDIR/etc/smb.conf || failed=`expr $failed + 1`
  85
  86 # This is important because it shows that the old ticket is discarded if the server rejects it (as it must) after the password was changed twice in succession.
  87 # This also ensures we handle the case where the domain is re-provisioned etc
  88 test_smbclient "Test login with kerberos ccache after 2nd password change" 'ls' "$unc" -k yes || failed=`expr $failed + 1`
  89
  90 #check that drs bind works after we change the password a 2nd time
  91 test_drs bind "Test drs bind after 2nd password change" || failed=`expr $failed + 1`
  92
  93 #check that drs options works after we change the password a 2nd time
  94 test_drs options "Test drs options after 2nd password change" || failed=`expr $failed + 1`
  95
  96 #This confirms that the DC password is valid for a kinit too
  97 testit "kinit with keytab" $samba4kinit $enctype -t $PROVDIR/private/secrets.keytab --use-keytab $USERNAME   || failed=`expr $failed + 1`
  98 test_smbclient "Test login with kerberos ccache with fresh kinit" 'ls' "$unc" -k yes || failed=`expr $failed + 1`
  99 rm -f $KRB5CCNAME
 100
 101 rm -f $PREFIX/tmpccache tmpccfile tmppassfile tmpuserpassfile tmpuserccache tmpkpasswdscript
 102 exit $failed