testprogs/blackbox/test_trust_token.sh

   1 #!/bin/bash
   2 # Copyright (C) 2017 Stefan Metzmacher <metze@samba.org>
   3
   4 if [ $# -lt 12 ]; then
   5         cat <<EOF
   6 Usage: $# test_trust_token.sh SERVER USERNAME PASSWORD REALM DOMAIN DOMSID TRUST_USERNAME TRUST_PASSWORD TRUST_REALM TRUST_DOMAIN TRUST_DOMSID TYPE
   7 EOF
   8         exit 1
   9 fi
  10
  11 SERVER=$1
  12 shift 1
  13 USERNAME=$1
  14 PASSWORD=$2
  15 REALM=$3
  16 DOMAIN=$4
  17 DOMSID=$5
  18 shift 5
  19 TRUST_USERNAME=$1
  20 TRUST_PASSWORD=$2
  21 TRUST_REALM=$3
  22 TRUST_DOMAIN=$4
  23 TRUST_DOMSID=$5
  24 shift 5
  25 TYPE=$1
  26 shift 1
  27 failed=0
  28
  29 . $(dirname $0)/subunit.sh
  30 . $(dirname $0)/common_test_fns.inc
  31
  32 ldbsearch=$(system_or_builddir_binary ldbsearch "${BINDIR}")
  33
  34 test_token()
  35 {
  36         auth_args="${1}"
  37         auth_sid="${2-}"
  38
  39         out=$($VALGRIND $ldbsearch -H ldap://$SERVER.$REALM -U$TRUST_REALM\\$TRUST_USERNAME%$TRUST_PASSWORD -b '' --scope=base -k ${auth_args} tokenGroups 2>&1)
  40         ret=$?
  41         test x"$ret" = x"0" || {
  42                 echo "$out"
  43                 return 1
  44         }
  45
  46         trust_sids=$(echo "$out" | grep '^tokenGroups' | grep "${TRUST_DOMSID}-" | wc -l)
  47         test "$trust_sids" -ge "2" || {
  48                 echo "$out"
  49                 echo "Less than 2 sids from $TRUST_DOMAIN $TRUST_DOMSID"
  50                 return 1
  51         }
  52
  53         domain_sids=$(echo "$out" | grep '^tokenGroups' | grep "${DOMSID}-" | wc -l)
  54         test "$domain_sids" -ge "1" || {
  55                 echo "$out"
  56                 echo "Less than 1 sid from $DOMAIN $DOMSID"
  57                 return 1
  58         }
  59
  60         builtin_sids=$(echo "$out" | grep '^tokenGroups' | grep "S-1-5-32-" | wc -l)
  61         test "$builtin_sids" -ge "1" || {
  62                 echo "$out"
  63                 echo "Less than 1 sid from BUILTIN S-1-5-32"
  64                 return 1
  65         }
  66
  67         #
  68         # The following should always be present
  69         #
  70         # SID_WORLD(S-1-1-0)
  71         # SID_NT_NETWORK(S-1-5-2)
  72         # SID_NT_AUTHENTICATED_USERS(S-1-5-11)
  73         #
  74         required_sids="S-1-1-0 S-1-5-2 S-1-5-11 ${auth_sid}"
  75         for sid in $required_sids; do
  76                 found=$(echo "$out" | grep "^tokenGroups: ${sid}$" | wc -l)
  77                 test x"$found" = x"1" || {
  78                         echo "$out"
  79                         echo "SID: ${sid} not found"
  80                         return 1
  81                 }
  82         done
  83
  84         return 0
  85 }
  86
  87 testit "Test token with kerberos" test_token "yes" "" || failed=$(expr $failed + 1)
  88 # Check that SID_NT_NTLM_AUTHENTICATION(S-1-5-64-10) is added for NTLMSSP
  89 testit "Test token with NTLMSSP" test_token "no" "S-1-5-64-10" || failed=$(expr $failed + 1)
  90
  91 exit $failed