5 Usage: test_kinit.sh SERVER USERNAME PASSWORD REALM DOMAIN PREFIX
25 samba_tool
="$VALGRIND $PYTHON $BINDIR/samba-tool"
28 if test -x $BINDIR/samba4kinit
; then
29 samba4kinit
=$BINDIR/samba4kinit
32 samba4kgetcred
=kgetcred
33 if test -x $BINDIR/samba4kgetcred
; then
34 samba4kgetcred
=$BINDIR/samba4kgetcred
37 .
`dirname $0`/subunit.sh
38 .
`dirname $0`/common_test_fns.inc
40 ocache
="$PREFIX/tmpoutcache"
41 KRB5CCNAME_PATH
="$PREFIX/tmpccache"
42 KRB5CCNAME
="FILE:$KRB5CCNAME_PATH"
44 rm -rf $KRB5CCNAME_PATH
46 princ
=test_impersonate_princ
47 impersonator
=test_impersonator.
$REALM
48 target
="CIFS/$SERVER.$REALM"
51 testit
"add impersonator principal" $samba_tool user add
$impersonator $PASSWORD || failed
=`expr $failed + 1`
52 testit
"become a service" $samba_tool spn add
"HOST/$impersonator" $impersonator || failed
=`expr $failed + 1`
54 testit
"set TrustedToAuthForDelegation" $samba_tool delegation for-any-protocol
$impersonator on || failed
=`expr $failed + 1`
55 testit
"add msDS-AllowedToDelegateTo" $samba_tool delegation add-service
$impersonator $target || failed
=`expr $failed + 1`
57 testit
"add a new principal" $samba_tool user add
$princ --random-password || failed
=`expr $failed + 1`
58 testit
"set not-delegated flag" $samba_tool user sensitive
$princ on || failed
=`expr $failed + 1`
61 echo $PASSWORD > $PREFIX/tmppassfile
62 testit
"kinit impersonator" $samba4kinit -f --password-file=$PREFIX/tmppassfile
$impersonator || failed
=`expr $failed + 1`
64 testit
"test S4U2Self with normal user" $samba4kgetcred --out-cache=$ocache --forwardable --impersonate=${USERNAME} $impersonator || failed
=`expr $failed + 1`
65 testit
"test S4U2Proxy with normal user" $samba4kgetcred --out-cache=$ocache --delegation-credential-cache=${ocache} $target || failed
=`expr $failed + 1`
67 testit
"test S4U2Self with sensitive user" $samba4kgetcred --out-cache=$ocache --forwardable --impersonate=$princ $impersonator || failed
=`expr $failed + 1`
68 testit_expect_failure
"test S4U2Proxy with sensitive user" $samba4kgetcred --out-cache=$ocache --delegation-credential-cache=${ocache} $target || failed
=`expr $failed + 1`
71 testit
"unset not-delegated flag" $samba_tool user sensitive
$princ off || failed
=`expr $failed + 1`
73 testit
"test S4U2Self after unsetting ND flag" $samba4kgetcred --out-cache=$ocache --forwardable --impersonate=$princ $impersonator || failed
=`expr $failed + 1`
74 testit
"test S4U2Proxy after unsetting ND flag" $samba4kgetcred --out-cache=$ocache --delegation-credential-cache=${ocache} $target || failed
=`expr $failed + 1`
76 testit
"kinit user cache" $samba4kinit -c $ocache -f --password-file=$PREFIX/tmppassfile
$USERNAME || failed
=`expr $failed + 1`
77 testit
"get a ticket to impersonator" $samba4kgetcred -c $ocache --forwardable $impersonator || failed
=`expr $failed + 1`
78 testit
"test S4U2Proxy evidence ticket obtained by TGS" $samba4kgetcred --out-cache=$ocache --delegation-credential-cache=${ocache} $target || failed
=`expr $failed + 1`
80 echo $TRUST_PASSWORD > $PREFIX/tmppassfile
81 testit
"kinit trust user cache" $samba4kinit -c $ocache -f --password-file=$PREFIX/tmppassfile
$TRUST_USERNAME@
$TRUST_REALM || failed
=`expr $failed + 1`
82 testit
"get a ticket to impersonator for trust user" $samba4kgetcred -c $ocache --forwardable $impersonator || failed
=`expr $failed + 1`
83 testit
"test S4U2Proxy evidence ticket obtained by TGS of trust user" $samba4kgetcred --out-cache=$ocache --delegation-credential-cache=${ocache} $target || failed
=`expr $failed + 1`
85 echo $PASSWORD > $PREFIX/tmppassfile
86 testit
"set not-delegated on impersonator" $samba_tool user sensitive
$impersonator on || failed
=`expr $failed + 1`
87 testit
"kinit user cache again" $samba4kinit -c $ocache -f --password-file=$PREFIX/tmppassfile
$USERNAME || failed
=`expr $failed + 1`
88 testit
"get a ticket to sensitive impersonator" $samba4kgetcred -c $ocache --forwardable $impersonator || failed
=`expr $failed + 1`
89 testit_expect_failure
"test S4U2Proxy using received ticket" $samba4kgetcred --out-cache=$ocache --delegation-credential-cache=${ocache} $target || failed
=`expr $failed + 1`
92 rm -f $ocache $PREFIX/tmpccache
$PREFIX/tmppassfile