testprogs/blackbox/test_kinit_mit.sh

   1 #!/bin/sh
   2 # Blackbox tests for kinit and kerberos integration with smbclient etc
   3 # Copyright (c) 2015-2016 Andreas Schneider <asn@samba.org>
   4
   5 if [ $# -lt 5 ]; then
   6 cat <<EOF
   7 Usage: test_kinit.sh SERVER USERNAME PASSWORD REALM DOMAIN PREFIX SMBCLIENT
   8 EOF
   9 exit 1;
  10 fi
  11
  12 SERVER=$1
  13 USERNAME=$2
  14 PASSWORD=$3
  15 REALM=$4
  16 DOMAIN=$5
  17 PREFIX=$6
  18 smbclient=$7
  19 shift 7
  20 failed=0
  21
  22 samba_bindir="$BINDIR"
  23 samba_srcdir="$SRCDIR/source4"
  24 samba_kinit=kinit
  25 samba_kdestroy=kdestroy
  26 samba_kpasswd=kpasswd
  27
  28 samba_tool="$samba_bindir/samba-tool"
  29 samba_texpect="$samba_bindir/texpect"
  30
  31 samba_enableaccount="$samba_tool user enable"
  32 machineaccountccache="$samba_srcdir/scripting/bin/machineaccountccache"
  33
  34 ldbmodify="ldbmodify"
  35 if [ -x "$samba4bindir/ldbmodify" ]; then
  36         ldbmodify="$samba4bindir/ldbmodify"
  37 fi
  38
  39 ldbsearch="ldbsearch"
  40 if [ -x "$samba4bindir/ldbsearch" ]; then
  41         ldbsearch="$samba4bindir/ldbsearch"
  42 fi
  43
  44 . `dirname $0`/subunit.sh
  45
  46 test_smbclient() {
  47         name="$1"
  48         cmd="$2"
  49         shift
  50         shift
  51         echo "test: $name"
  52         $VALGRIND $smbclient $CONFIGURATION //$SERVER/tmp -c "$cmd" $@
  53         status=$?
  54         if [ x$status = x0 ]; then
  55                 echo "success: $name"
  56         else
  57                 echo "failure: $name"
  58         fi
  59         return $status
  60 }
  61
  62 ADMIN_LDBMODIFY_CONFIG="-H ldap://$SERVER -U$USERNAME%$PASSWORD"
  63 export ADMIN_LDBMODIFY_CONFIG
  64
  65 KRB5CCNAME_PATH="$PREFIX/tmpccache"
  66 KRB5CCNAME="FILE:$KRB5CCNAME_PATH"
  67 ADMIN_KRB5CCNAME="FILE:$KRB5CCNAME_PATH"
  68 export KRB5CCNAME
  69 rm -rf $KRB5CCNAME_PATH
  70
  71 testit "reset password policies beside of minimum password age of 0 days" $VALGRIND $samba_tool domain passwordsettings $ADMIN_LDBMODIFY_CONFIG set --complexity=default --history-length=default --min-pwd-length=default --min-pwd-age=0 --max-pwd-age=default || failed=`expr $failed + 1`
  72
  73 cat > $PREFIX/tmpkinitscript <<EOF
  74 expect Password for
  75 send ${PASSWORD}\n
  76 EOF
  77
  78 ###########################################################
  79 ### Test kinit defaults
  80 ###########################################################
  81
  82 testit "kinit with password" $samba_texpect $PREFIX/tmpkinitscript $samba_kinit $USERNAME@$REALM   || failed=`expr $failed + 1`
  83 test_smbclient "Test login with user kerberos ccache" 'ls' -k yes || failed=`expr $failed + 1`
  84
  85 testit "kinit renew ticket" $samba_kinit -R   || failed=`expr $failed + 1`
  86 test_smbclient "Test login with kerberos ccache" 'ls' -k yes || failed=`expr $failed + 1`
  87
  88 $samba_kdestroy
  89
  90 ###########################################################
  91 ### Test kinit with enterprice principal
  92 ###########################################################
  93
  94 testit "kinit with password (enterprise style)" $samba_texpect $PREFIX/tmpkinitscript $samba_kinit -E $USERNAME@$REALM   || failed=`expr $failed + 1`
  95 test_smbclient "Test login with user kerberos ccache" 'ls' -k yes || failed=`expr $failed + 1`
  96
  97 # This does not work with MIT Kerberos 1.14 or older
  98 testit "kinit renew ticket (enterprise style)" $samba_kinit -R   || failed=`expr $failed + 1`
  99 test_smbclient "Test login with kerberos ccache" 'ls' -k yes || failed=`expr $failed + 1`
 100
 101 $samba_kdestroy
 102
 103 ###########################################################
 104 ### Tests with kinit default again
 105 ###########################################################
 106
 107 testit "kinit with password" $samba_texpect $PREFIX/tmpkinitscript $samba_kinit $USERNAME@$REALM   || failed=`expr $failed + 1`
 108 testit "check time with kerberos ccache" $VALGRIND $samba_tool time $SERVER $CONFIGURATION -k yes $@ || failed=`expr $failed + 1`
 109
 110 USERPASS="testPass@12%"
 111
 112 testit "add user with kerberos ccache" $VALGRIND $samba_tool user create nettestuser $USERPASS $CONFIGURATION  -k yes $@ || failed=`expr $failed + 1`
 113
 114 echo "Getting defaultNamingContext"
 115 BASEDN=`$ldbsearch $options --basedn='' -H ldap://$SERVER -s base DUMMY=x defaultNamingContext | grep defaultNamingContext | awk '{print $2}'`
 116
 117 cat > $PREFIX/tmpldbmodify <<EOF
 118 dn: cn=nettestuser,cn=users,$BASEDN
 119 changetype: modify
 120 add: servicePrincipalName
 121 servicePrincipalName: host/nettestuser
 122 replace: userPrincipalName
 123 userPrincipalName: nettest@$REALM
 124 EOF
 125
 126 testit "modify servicePrincipalName and userPrincpalName" $VALGRIND $ldbmodify -H ldap://$SERVER $PREFIX/tmpldbmodify -k yes $@ || failed=`expr $failed + 1`
 127
 128 testit "set user password with kerberos ccache" $VALGRIND $samba_tool user setpassword nettestuser --newpassword=$USERPASS $CONFIGURATION  -k yes $@ || failed=`expr $failed + 1`
 129
 130 testit "enable user with kerberos cache" $VALGRIND $samba_enableaccount nettestuser -H ldap://$SERVER -k yes $@ || failed=`expr $failed + 1`
 131
 132 ###########################################################
 133 ### Test kinit with user credentials
 134 ###########################################################
 135
 136 KRB5CCNAME_PATH="$PREFIX/tmpuserccache"
 137 KRB5CCNAME="FILE:$KRB5CCNAME_PATH"
 138 export KRB5CCNAME
 139
 140 rm -f $KRB5CCNAME_PATH
 141
 142 cat > $PREFIX/tmpkinituserpassscript <<EOF
 143 expect Password for
 144 send ${USERPASS}\n
 145 EOF
 146
 147 testit "kinit with user password" $samba_texpect $PREFIX/tmpkinituserpassscript $samba_kinit nettestuser@$REALM   || failed=`expr $failed + 1`
 148 test_smbclient "Test login with user kerberos ccache" 'ls' -k yes || failed=`expr $failed + 1`
 149
 150 ### Change password
 151
 152 NEWUSERPASS="testPaSS@34%"
 153 testit "change user password with 'samba-tool user password' (rpc)" $VALGRIND $samba_tool user password -W$DOMAIN -Unettestuser%$USERPASS $CONFIGURATION -k no --newpassword=$NEWUSERPASS $@ || failed=`expr $failed + 1`
 154
 155 cat > $PREFIX/tmpkinituserpassscript <<EOF
 156 expect Password for
 157 send ${NEWUSERPASS}\n
 158 EOF
 159
 160 testit "kinit with new user password" $samba_texpect $PREFIX/tmpkinituserpassscript $samba_kinit nettestuser@$REALM   || failed=`expr $failed + 1`
 161 test_smbclient "Test login with user kerberos ccache" 'ls' -k yes || failed=`expr $failed + 1`
 162
 163 $samba_kdestroy
 164
 165 ###########################################################
 166 ### Test kinit with user credentials in special formats
 167 ###########################################################
 168
 169 testit "kinit with new (NT-Principal style) using UPN" $samba_texpect $PREFIX/tmpkinituserpassscript $samba_kinit nettest@$REALM   || failed=`expr $failed + 1`
 170 test_smbclient "Test login with user kerberos ccache from NT UPN" 'ls' -k yes || failed=`expr $failed + 1`
 171
 172 $samba_kdestroy
 173
 174 testit "kinit with new (enterprise style) using UPN" $samba_texpect $PREFIX/tmpkinituserpassscript $samba_kinit -E nettest@$REALM   || failed=`expr $failed + 1`
 175 test_smbclient "Test login with user kerberos ccache from enterprise UPN" 'ls' -k yes || failed=`expr $failed + 1`
 176
 177 $samba_kdestroy
 178
 179 ###########################################################
 180 ### Test kinit with user credentials and changed realm
 181 ###########################################################
 182
 183 cat > $PREFIX/tmpldbmodify <<EOF
 184 dn: cn=nettestuser,cn=users,$BASEDN
 185 changetype: modify
 186 replace: userPrincipalName
 187 userPrincipalName: nettest@$REALM.org
 188 EOF
 189
 190 testit "modify userPrincipalName to be a different domain" $VALGRIND $ldbmodify $ADMIN_LDBMODIFY_CONFIG $PREFIX/tmpldbmodify $PREFIX/tmpldbmodify -k yes $@ || failed=`expr $failed + 1`
 191
 192 testit "kinit with new (enterprise style) using UPN" $samba_texpect $PREFIX/tmpkinituserpassscript $samba_kinit -E nettest@$REALM.org   || failed=`expr $failed + 1`
 193 test_smbclient "Test login with user kerberos ccache from enterprise UPN" 'ls' -k yes || failed=`expr $failed + 1`
 194
 195 $samba_kdestroy
 196
 197 ###########################################################
 198 ### Test password change with kpasswd
 199 ###########################################################
 200
 201 testit "kinit with user password" $samba_texpect $PREFIX/tmpkinituserpassscript $samba_kinit nettestuser@$REALM   || failed=`expr $failed + 1`
 202 test_smbclient "Test login with user kerberos ccache" 'ls' -k yes || failed=`expr $failed + 1`
 203
 204 USERPASS=$NEWUSERPASS
 205 NEWUSERPASS=testPaSS@56%
 206
 207 cat > $PREFIX/tmpkpasswdscript <<EOF
 208 expect Password for
 209 password ${USERPASS}\n
 210 expect Enter new password
 211 send ${NEWUSERPASS}\n
 212 expect Enter it again
 213 send ${NEWUSERPASS}\n
 214 expect Password changed
 215 EOF
 216
 217 testit "change user password with kpasswd" $samba_texpect $PREFIX/tmpkpasswdscript $samba_kpasswd nettestuser@$REALM || failed=`expr $failed + 1`
 218
 219 $samba_kdestroy
 220
 221 USERPASS=$NEWUSERPASS
 222 cat > $PREFIX/tmpkinituserpassscript <<EOF
 223 expect Password for
 224 send ${USERPASS}\n
 225 EOF
 226
 227 testit "kinit with user password" $samba_texpect $PREFIX/tmpkinituserpassscript $samba_kinit nettestuser@$REALM   || failed=`expr $failed + 1`
 228 test_smbclient "Test login with user kerberos ccache" 'ls' -k yes || failed=`expr $failed + 1`
 229
 230 $samba_kdestroy
 231
 232 ###########################################################
 233 ### TODO Test set password with kpasswd
 234 ###########################################################
 235
 236 # This is not implemented in kpasswd
 237
 238 ###########################################################
 239 ### Test password expiry
 240 ###########################################################
 241
 242 cat > $PREFIX/tmpldbmodify <<EOF
 243 dn: cn=nettestuser,cn=users,$BASEDN
 244 changetype: modify
 245 replace: pwdLastSet
 246 pwdLastSet: 0
 247 EOF
 248
 249 USERPASS=$NEWUSERPASS
 250 NEWUSERPASS=testPaSS@911%
 251
 252 testit "modify pwdLastSet" $VALGRIND $ldbmodify $ADMIN_LDBMODIFY_CONFIG $PREFIX/tmpldbmodify $PREFIX/tmpldbmodify -k yes $@ || failed=`expr $failed + 1`
 253
 254 cat > $PREFIX/tmpkinituserpassscript <<EOF
 255 expect Password for
 256 send ${USERPASS}\n
 257 expect Password expired.  You must change it now.
 258 expect Enter new password
 259 send ${NEWUSERPASS}\n
 260 expect Enter it again
 261 send ${NEWUSERPASS}\n
 262 EOF
 263
 264 testit "kinit (MIT) with user password for expired password" $samba_texpect $PREFIX/tmpkinituserpassscript $samba_kinit nettestuser@$REALM || failed=`expr $failed + 1`
 265 test_smbclient "Test login with user kerberos ccache" 'ls' -k yes || failed=`expr $failed + 1`
 266
 267 USERPASS=$NEWUSERPASS
 268 cat > $PREFIX/tmpkinituserpassscript <<EOF
 269 expect Password for
 270 send ${USERPASS}\n
 271 EOF
 272
 273 testit "kinit with user password" $samba_texpect $PREFIX/tmpkinituserpassscript $samba_kinit nettestuser@$REALM   || failed=`expr $failed + 1`
 274 test_smbclient "Test login with user kerberos ccache" 'ls' -k yes || failed=`expr $failed + 1`
 275
 276 ###########################################################
 277 ### Test login with lowercase realm
 278 ###########################################################
 279
 280 KRB5CCNAME_PATH="$PREFIX/tmpccache"
 281 KRB5CCNAME="FILE:$KRB5CCNAME_PATH"
 282 export KRB5CCNAME
 283
 284 rm -rf $KRB5CCNAME_PATH
 285
 286 lowerrealm=$(echo $REALM | tr '[A-Z]' '[a-z]')
 287 test_smbclient "Test login with user kerberos lowercase realm" 'ls' -k yes -Unettestuser@$lowerrealm%$NEWUSERPASS || failed=`expr $failed + 1`
 288 test_smbclient "Test login with user kerberos lowercase realm 2" 'ls' -k yes -Unettestuser@$REALM%$NEWUSERPASS --realm=$lowerrealm || failed=`expr $failed + 1`
 289
 290 testit "del user with kerberos ccache" $VALGRIND $samba_tool user delete nettestuser $CONFIGURATION -k yes $@ || failed=`expr $failed + 1`
 291
 292 ###########################################################
 293 ### Test login with machine account
 294 ###########################################################
 295
 296 rm -f $KRB5CCNAME_PATH
 297 testit "kinit with machineaccountccache script" $machineaccountccache $CONFIGURATION $KRB5CCNAME || failed=`expr $failed + 1`
 298 test_smbclient "Test machine account login with kerberos ccache" 'ls' -k yes || failed=`expr $failed + 1`
 299
 300 testit "reset password policies" $VALGRIND $samba_tool domain passwordsettings $ADMIN_LDBMODIFY_CONFIG set --complexity=default --history-length=default --min-pwd-length=default --min-pwd-age=default --max-pwd-age=default || failed=`expr $failed + 1`
 301
 302 ### Cleanup
 303
 304 $samba_kdestroy
 305
 306 rm -f $KRB5CCNAME_PATH
 307 rm -f $PREFIX/tmpkinituserpassscript
 308 rm -f $PREFIX/tmpkinitscript
 309
 310 exit $failed