tests/kdc/check-kdc.in

   1 #!/bin/sh
   2 #
   3 # Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
   4 # (Royal Institute of Technology, Stockholm, Sweden).
   5 # All rights reserved.
   6 #
   7 # Redistribution and use in source and binary forms, with or without
   8 # modification, are permitted provided that the following conditions
   9 # are met:
  10 #
  11 # 1. Redistributions of source code must retain the above copyright
  12 #    notice, this list of conditions and the following disclaimer.
  13 #
  14 # 2. Redistributions in binary form must reproduce the above copyright
  15 #    notice, this list of conditions and the following disclaimer in the
  16 #    documentation and/or other materials provided with the distribution.
  17 #
  18 # 3. Neither the name of the Institute nor the names of its contributors
  19 #    may be used to endorse or promote products derived from this software
  20 #    without specific prior written permission.
  21 #
  22 # THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  23 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  24 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  25 # ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  26 # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  27 # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  28 # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  29 # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  30 # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  31 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  32 # SUCH DAMAGE.
  33
  34 top_builddir="@top_builddir@"
  35 env_setup="@env_setup@"
  36 objdir="@objdir@"
  37
  38 . ${env_setup}
  39
  40 KRB5_CONFIG="${1-${objdir}/krb5.conf}"
  41 export KRB5_CONFIG
  42
  43 testfailed="echo test failed; cat messages.log; exit 1"
  44
  45 # If there is no useful db support compiled in, disable test
  46 ${have_db} || exit 77
  47
  48 R=TEST.H5L.SE
  49 RH=TEST-HTTP.H5L.SE
  50 R2=TEST2.H5L.SE
  51 R3=TEST3.H5L.SE
  52 R4=TEST4.H5L.SE
  53 R5=SOME-REALM5.FR
  54 R6=SOME-REALM6.US
  55 R7=SOME-REALM7.UK
  56 R8=SOME-REALM8.UK
  57
  58 H1=H1.$R
  59 H2=H2.$R
  60 H3=H3.$H2
  61 H4=H4.$H2
  62
  63 r=`echo "$R" | tr '[A-Z]' '[a-z]'`
  64 h1=`echo "${H1}" | tr '[A-Z]' '[a-z]'`
  65 h2=`echo "${H2}" | tr '[A-Z]' '[a-z]'`
  66 h3=`echo "${H3}" | tr '[A-Z]' '[a-z]'`
  67 h4=`echo "${H4}" | tr '[A-Z]' '[a-z]'`
  68
  69 port=@port@
  70 pwport=@pwport@
  71
  72 kadmin5="${kadmin} -l -r $R5"
  73 kadmin="${kadmin} -l -r $R"
  74 kdc="${kdc} --addresses=localhost -P $port"
  75 kpasswdd="${kpasswdd} --addresses=localhost -p $pwport"
  76
  77 server=host/datan.test.h5l.se
  78 server2=host/computer.example.com
  79 serverip=host/10.11.12.13
  80 serveripname=host/ip.test.h5l.org
  81 serveripname2=host/10.11.12.14
  82 alias1=host/datan.example.com
  83 alias2=host/datan
  84 aliaskeytab=host/datan
  85 cache="FILE:${objdir}/cache.krb5"
  86 ocache="FILE:${objdir}/ocache.krb5"
  87 o2cache="FILE:${objdir}/o2cache.krb5"
  88 icache="FILE:${objdir}/icache.krb5"
  89 keytabfile=${objdir}/server.keytab
  90 keytab="FILE:${keytabfile}"
  91 ps="proxy-service@${R}"
  92 aesenctype="aes256-cts-hmac-sha1-96"
  93
  94 kinit="${kinit} -c $cache ${afs_no_afslog}"
  95 klist="${klist} -c $cache"
  96 kgetcred="${kgetcred} -c $cache"
  97 kgetcred_imp="${kgetcred} -c $cache --out-cache=${ocache}"
  98 kdestroy="${kdestroy} -c $cache ${afs_no_unlog}"
  99 kimpersonate="${kimpersonate} -k ${keytab} --ccache=${ocache}"
 100 test_set_kvno0="${test_set_kvno0} -c $cache"
 101
 102 rm -f ${keytabfile}
 103 rm -f current-db*
 104 rm -f out-*
 105 rm -f mkey.file*
 106
 107 > messages.log
 108
 109 echo Creating database
 110 ${kadmin} \
 111     init \
 112     --realm-max-ticket-life=1day \
 113     --realm-max-renewable-life=1month \
 114     ${R} || exit 1
 115
 116 ${kadmin} \
 117     init \
 118     --realm-max-ticket-life=1day \
 119     --realm-max-renewable-life=1month \
 120     ${R2} || exit 1
 121
 122 ${kadmin} \
 123     init \
 124     --realm-max-ticket-life=1day \
 125     --realm-max-renewable-life=1month \
 126     ${R3} || exit 1
 127
 128 ${kadmin} \
 129     init \
 130     --realm-max-ticket-life=1day \
 131     --realm-max-renewable-life=1month \
 132     ${R4} || exit 1
 133
 134 ${kadmin5} \
 135     init \
 136     --realm-max-ticket-life=1day \
 137     --realm-max-renewable-life=1month \
 138     ${R5} || exit 1
 139
 140 ${kadmin} \
 141     init \
 142     --realm-max-ticket-life=1day \
 143     --realm-max-renewable-life=1month \
 144     ${R6} || exit 1
 145
 146 ${kadmin} \
 147     init \
 148     --realm-max-ticket-life=1day \
 149     --realm-max-renewable-life=1month \
 150     ${R7} || exit 1
 151
 152 ${kadmin} \
 153     init \
 154     --realm-max-ticket-life=1day \
 155     --realm-max-renewable-life=1month \
 156     ${R8} || exit 1
 157
 158 ${kadmin} \
 159     init \
 160     --realm-max-ticket-life=1day \
 161     --realm-max-renewable-life=1month \
 162     ${H1} || exit 1
 163
 164 ${kadmin} \
 165     init \
 166     --realm-max-ticket-life=1day \
 167     --realm-max-renewable-life=1month \
 168     ${H2} || exit 1
 169
 170 ${kadmin} \
 171     init \
 172     --realm-max-ticket-life=1day \
 173     --realm-max-renewable-life=1month \
 174     ${H3} || exit 1
 175
 176 ${kadmin} \
 177     init \
 178     --realm-max-ticket-life=1day \
 179     --realm-max-renewable-life=1month \
 180     ${H4} || exit 1
 181
 182 ${kadmin} \
 183     init \
 184     --realm-max-ticket-life=1day \
 185     --realm-max-renewable-life=1month \
 186     ${RH} || exit 1
 187
 188 ${kadmin} cpw -r krbtgt/${R}@${R} || exit 1
 189 ${kadmin} cpw -r krbtgt/${R}@${R} || exit 1
 190 ${kadmin} cpw -r krbtgt/${R}@${R} || exit 1
 191 ${kadmin} cpw -r krbtgt/${R}@${R} || exit 1
 192
 193 ${kadmin} add -p foo --use-defaults foo@${R} || exit 1
 194 ${kadmin} add -p foo --use-defaults foo/host.${r}@${R} || exit 1
 195 ${kadmin} add -p foo --use-defaults foo@${R2} || exit 1
 196 ${kadmin} add -p foo --use-defaults foo@${R3} || exit 1
 197 ${kadmin} add -p foo --use-defaults foo@${R4} || exit 1
 198 ${kadmin5} add -p foo --use-defaults foo@${R5} || exit 1
 199 ${kadmin} add -p foo --use-defaults foo@${R6} || exit 1
 200 ${kadmin} add -p foo --use-defaults foo@${R7} || exit 1
 201 ${kadmin} add -p foo --use-defaults foo@${R8} || exit 1
 202 ${kadmin} add -p foo --use-defaults foo@${H1} || exit 1
 203 ${kadmin} add -p foo --use-defaults foo/host.${h1}@${H1} || exit 1
 204 ${kadmin} add -p foo --use-defaults foo@${H2} || exit 1
 205 ${kadmin} add -p foo --use-defaults foo/host.${h2}@${H2} || exit 1
 206 ${kadmin} add -p foo --use-defaults foo@${H3} || exit 1
 207 ${kadmin} add -p foo --use-defaults foo/host.${h3}@${H3} || exit 1
 208 ${kadmin} add -p foo --use-defaults foo@${H4} || exit 1
 209 ${kadmin} add -p foo --use-defaults foo/host.${h4}@${H4} || exit 1
 210 ${kadmin} add -p bar --use-defaults bar@${R} || exit 1
 211 ${kadmin} add -p foo --use-defaults remove@${R} || exit 1
 212 ${kadmin} add -p nop --use-defaults ${server}@${R} || exit 1
 213 ${kadmin} cpw -p bla --keepold ${server}@${R} || exit 1
 214 ${kadmin} cpw -p kaka --keepold ${server}@${R} || exit 1
 215 ${kadmin} add -p kaka --use-defaults ${server}-des3@${R} || exit 1
 216 ${kadmin} add -p kaka --use-defaults kt-des3@${R} || exit 1
 217 ${kadmin} add -p kaka --use-defaults foo/des3-only@${R} || exit 1
 218 ${kadmin} add -p kaka --use-defaults bar/des3-only@${R} || exit 1
 219 ${kadmin} add -p kaka --use-defaults foo/aes-only@${R} || exit 1
 220 ${kadmin} add -p foo --use-defaults ${ps} || exit 1
 221 ${kadmin} modify --attributes=+trusted-for-delegation ${ps} || exit 1
 222 ${kadmin} modify --constrained-delegation=${server} ${ps} || exit 1
 223 ${kadmin} ext -k ${keytab} ${server}@${R} || exit 1
 224 ${kadmin} ext -k ${keytab} ${ps} || exit 1
 225
 226 ${kadmin} add -p kaka --use-defaults ${server2}@${R2} || exit 1
 227 ${kadmin} ext -k ${keytab} ${server2}@${R2} || exit 1
 228 ${kadmin} add -p kaka --use-defaults ${serverip}@${R} || exit 1
 229 ${kadmin} ext -k ${keytab} ${serverip}@${R} || exit 1
 230 ${kadmin} add -p kaka --use-defaults ${serveripname}@${R} || exit 1
 231 ${kadmin} ext -k ${keytab} ${serveripname}@${R} || exit 1
 232 ${kadmin} modify --alias=${serveripname2}@${R} ${serveripname}@${R}
 233 ${kadmin} add -p foo --use-defaults remove2@${R2} || exit 1
 234
 235 ${kadmin} add -p kaka --use-defaults ${alias1}@${R} || exit 1
 236 ${kadmin} ext -k ${keytab} ${alias1}@${R} || exit 1
 237 ${kadmin} modify --alias=${alias2}@${R} ${alias1}@${R}
 238
 239 ${kadmin} add -p cross1 --use-defaults krbtgt/${R2}@${R} || exit 1
 240 ${kadmin} add -p cross2 --use-defaults krbtgt/${R}@${R2} || exit 1
 241
 242 ${kadmin} add -p cross1 --use-defaults krbtgt/${R3}@${R2} || exit 1
 243 ${kadmin} add -p cross2 --use-defaults krbtgt/${R2}@${R3} || exit 1
 244
 245 ${kadmin} add -p cross1 --use-defaults krbtgt/${R4}@${R2} || exit 1
 246 ${kadmin} add -p cross2 --use-defaults krbtgt/${R2}@${R4} || exit 1
 247
 248 ${kadmin} add -p cross1 --use-defaults krbtgt/${R4}@${R3} || exit 1
 249 ${kadmin} add -p cross2 --use-defaults krbtgt/${R3}@${R4} || exit 1
 250
 251 ${kadmin} add -p cross1 --use-defaults krbtgt/${R5}@${R} || exit 1
 252 ${kadmin5} add -p cross2 --use-defaults krbtgt/${R}@${R5} || exit 1
 253
 254 ${kadmin5} add -p cross1 --use-defaults krbtgt/${R6}@${R5} || exit 1
 255 ${kadmin} add -p cross2 --use-defaults krbtgt/${R5}@${R6} || exit 1
 256
 257 ${kadmin} add -p cross1 --use-defaults krbtgt/${R7}@${R6} || exit 1
 258 ${kadmin} add -p cross2 --use-defaults krbtgt/${R6}@${R7} || exit 1
 259
 260 ${kadmin} add -p cross1 --use-defaults krbtgt/${R8}@${R6} || exit 1
 261 ${kadmin} add -p cross2 --use-defaults krbtgt/${R6}@${R8} || exit 1
 262
 263 ${kadmin} add -p cross1 --use-defaults krbtgt/${H1}@${R} || exit 1
 264 ${kadmin} add -p cross2 --use-defaults krbtgt/${R}@${H1} || exit 1
 265
 266 ${kadmin} add -p cross1 --use-defaults krbtgt/${H2}@${R} || exit 1
 267 ${kadmin} add -p cross2 --use-defaults krbtgt/${R}@${H2} || exit 1
 268
 269 ${kadmin} add -p cross1 --use-defaults krbtgt/${H3}@${H2} || exit 1
 270 ${kadmin} add -p cross2 --use-defaults krbtgt/${H2}@${H3} || exit 1
 271
 272 ${kadmin} add -p cross1 --use-defaults krbtgt/${H3}@${H4} || exit 1
 273 ${kadmin} add -p cross2 --use-defaults krbtgt/${H4}@${H3} || exit 1
 274
 275 ${kadmin} add -p foo --use-defaults pw-expire@${R} || exit 1
 276 ${kadmin} modify --pw-expiration-time=+1day  pw-expire@${R} || exit 1
 277
 278 ${kadmin} add -p foo --use-defaults pw-expired@${R} || exit 1
 279 ${kadmin} modify --pw-expiration-time=2012-06-12  pw-expired@${R} || exit 1
 280
 281 ${kadmin} add -p foo --use-defaults account-expired@${R} || exit 1
 282 ${kadmin} modify --expiration-time=2012-06-12  account-expired@${R} || exit 1
 283
 284 ${kadmin} add -p foo --use-defaults foo@${RH} || exit 1
 285
 286 echo "Check parser"
 287 ${kadmin} add -p foo --use-defaults -- -p || exit 1
 288 ${kadmin} delete -- -p || exit 1
 289
 290 echo "Doing database check"
 291 ${kadmin} check ${R} || exit 1
 292 ${kadmin} check ${R2} || exit 1
 293 ${kadmin} check ${R3} || exit 1
 294 ${kadmin} check ${R4} || exit 1
 295 ${kadmin5} check ${R5} || exit 1
 296 ${kadmin} check ${R6} || exit 1
 297 ${kadmin} check ${R7} || exit 1
 298 ${kadmin} check ${R8} || exit 1
 299 ${kadmin} check ${H1} || exit 1
 300 ${kadmin} check ${H2} || exit 1
 301 ${kadmin} check ${H3} || exit 1
 302 ${kadmin} check ${H4} || exit 1
 303
 304 echo "Extracting enctypes"
 305 ${ktutil} -k ${keytab} list > tempfile || exit 1
 306 ${EGREP} -v '^FILE:' tempfile | ${EGREP} -v '^Vno' | ${EGREP} -v '^$' | \
 307     ${EGREP} -v "$server" |                 # we did cpw for this one
 308     awk '$1 !~ /1/  { exit 1 }' || exit 1
 309 ${EGREP} -v '^FILE:' tempfile | ${EGREP} -v '^Vno' | ${EGREP} -v '^$' | \
 310     ${EGREP} "$server" | head -1 |
 311     awk '$1 !~ /3/  { exit 1 }' || exit 1
 312
 313
 314 ${kadmin} get foo@${R} > tempfile || exit 1
 315 enctypes=`grep Keytypes: tempfile | sed 's/(pw-salt)//g' | sed 's/,//g' | sed 's/Keytypes://' | sed 's/\[[0-9]*\]//g'`
 316
 317 enctype_sans_aes=`echo $enctypes | sed 's/aes[^ ]*//g'`
 318 enctype_sans_des3=`echo $enctypes | sed 's/des3-cbc-sha1//g'`
 319
 320 echo "deleting all but des enctypes on kt-des3 in keytab"
 321 ${kadmin} ext -k ${keytab} kt-des3@${R} || exit 1
 322 for a in ${enctype_sans_des3} ; do
 323    ${ktutil} -k ${keytab} remove -p kt-des3@${R} -e $a
 324 done
 325
 326 echo "checking globbing keys rules"
 327 ${kadmin} get foo/des3-only@${R} > tempfile || exit 1
 328 enctypes=`grep Keytypes: tempfile | sed 's/(pw-salt)//g' | sed 's/,//g' | sed 's/Keytypes://' | sed 's/\[[0-9]*\]//g' | sed 's/ //g'`
 329 if [ X"$enctypes" != Xdes3-cbc-sha1 ] ; then
 330     echo "des3 only is not only des3: $enctypes"
 331     exit 1
 332 fi
 333
 334 ${kadmin} get foo/aes-only@${R} > tempfile || exit 1
 335 enctypes=`grep Keytypes: tempfile | sed 's/(pw-salt)//g' | sed 's/,//g' | sed 's/Keytypes://' | sed 's/\[[0-9]*\]//g' | sed 's/ //g'`
 336 if [ X"$enctypes" != Xaes256-cts-hmac-sha1-96 ] ; then
 337     echo "aes only is not only aes: $enctypes"
 338     exit 1
 339 fi
 340
 341
 342 echo foo > ${objdir}/foopassword
 343 echo notfoo > ${objdir}/notfoopassword
 344
 345 echo Starting kdc ; > messages.log
 346 env MallocStackLogging=1 MallocStackLoggingNoCompact=1 MallocErrorAbort=1 MallocLogFile=${objdir}/malloc-log \
 347 ${kdc} --detach --testing ||
 348     { echo "kdc failed to start"; exit 1; }
 349 kdcpid=`getpid kdc`
 350
 351 echo Starting kpasswdd; > messages.log
 352 env ${HEIM_MALLOC_DEBUG} ${kpasswdd} --detach ||
 353     { echo "kpasswdd failed to start"; exit 1; }
 354 kpasswddpid=`getpid kpasswdd`
 355
 356
 357 trap "kill -9 ${kdcpid} ${kpasswddpid}; echo signal killing kdc kpasswdd; exit 1;" EXIT
 358
 359 ec=0
 360
 361 echo "Getting client initial tickets with wrong password"; > messages.log
 362 ${kinit} --password-file=${objdir}/notfoopassword \
 363         foo@${R} 2>kinit-log.tmp && \
 364         { ec=1 ; eval "${testfailed}"; }
 365 grep 'Password incorrect' kinit-log.tmp > /dev/null || \
 366         { ec=1 ; eval "${testfailed}"; }
 367 echo "Getting client initial tickets"; > messages.log
 368 ${kinit} --password-file=${objdir}/foopassword foo@$R || \
 369         { ec=1 ; eval "${testfailed}"; }
 370 echo "Doing krbtgt key rollover"; > messages.log
 371 ${kadmin} cpw -r --keepold krbtgt/${R}@${R} || exit 1
 372 echo "Getting tickets"; > messages.log
 373 ${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
 374 echo "Listing tickets"; > messages.log
 375 ${klist} > /dev/null || { ec=1 ; eval "${testfailed}"; }
 376 ${test_ap_req} ${server}@${R} ${keytab} ${cache} || \
 377         { ec=1 ; eval "${testfailed}"; }
 378 ${kdestroy}
 379
 380 echo "Getting client initial tickets (http transport)"; > messages.log
 381 ${kinit} --password-file=${objdir}/foopassword foo@${RH} || \
 382         { ec=1 ; eval "${testfailed}"; }
 383 ${kdestroy}
 384
 385 echo "Testing capaths logic"
 386 ${kinit} --password-file=${objdir}/foopassword \
 387     -e ${aesenctype} -e ${aesenctype} \
 388     foo@$R || \
 389         { ec=1 ; eval "${testfailed}"; }
 390
 391 echo "Getting x-realm tickets with capaths for $R -> $R2"
 392 ${kgetcred} foo@${R2} || { ec=1 ; eval "${testfailed}"; }
 393 echo "Getting x-realm tickets with capaths for $R -> $R3"
 394 ${kgetcred} foo@${R3} || { ec=1 ; eval "${testfailed}"; }
 395 echo "Getting x-realm tickets with capaths for $R -> $R4"
 396 ${kgetcred} foo@${R4} || { ec=1 ; eval "${testfailed}"; }
 397 echo "Getting x-realm tickets with capaths for $R -> $R5"
 398 ${kgetcred} foo@${R5} || { ec=1 ; eval "${testfailed}"; }
 399 echo "Getting x-realm tickets with capaths for $R -> $R6"
 400 ${kgetcred} foo@${R6} || { ec=1 ; eval "${testfailed}"; }
 401 echo "Getting x-realm tickets with capaths for $R -> $R7"
 402 ${kgetcred} foo@${R7} || { ec=1 ; eval "${testfailed}"; }
 403 echo "Should not get x-realm tickets with capaths for $R -> $R8"
 404 ${kgetcred} foo@${R8} && { ec=1 ; eval "${testfailed}"; }
 405 ${kdestroy}
 406
 407 echo "Testing capaths logic (reverse order)"
 408 ${kinit} --password-file=${objdir}/foopassword \
 409     -e ${aesenctype} -e ${aesenctype} \
 410     foo@$R || \
 411         { ec=1 ; eval "${testfailed}"; }
 412
 413 echo "Getting x-realm tickets with capaths for $R -> $R4"
 414 ${kgetcred} foo@${R4} || { ec=1 ; eval "${testfailed}"; }
 415 echo "Getting x-realm tickets with capaths for $R -> $R3"
 416 ${kgetcred} foo@${R3} || { ec=1 ; eval "${testfailed}"; }
 417 echo "Getting x-realm tickets with capaths for $R -> $R2"
 418 ${kgetcred} foo@${R2} || { ec=1 ; eval "${testfailed}"; }
 419 echo "Getting x-realm tickets with capaths for $R -> $R7"
 420 ${kgetcred} foo@${R7} || { ec=1 ; eval "${testfailed}"; }
 421 echo "Getting x-realm tickets with capaths for $R -> $R6"
 422 ${kgetcred} foo@${R6} || { ec=1 ; eval "${testfailed}"; }
 423 echo "Getting x-realm tickets with capaths for $R -> $R5"
 424 ${kgetcred} foo@${R5} || { ec=1 ; eval "${testfailed}"; }
 425 ${kdestroy}
 426
 427 echo "Testing hierarchical referral logic"
 428 ${kinit} --password-file=${objdir}/foopassword \
 429     -e ${aesenctype} -e ${aesenctype} \
 430     foo@${H3} || \
 431         { ec=1 ; eval "${testfailed}"; }
 432
 433 echo "Getting x-realm tickets with hierarchical referrals for $H3 -> $H1"
 434 ${kgetcred} --hostbased --canonicalize foo host.${h1} || { ec=1 ; eval "${testfailed}"; }
 435 fgrep "cross-realm ${H3} -> ${H1} via [${H2}, ${R}]" messages.log > /dev/null || { ec=1 ; eval "${testfailed}"; }
 436 echo "Getting x-realm tickets with hierarchical referrals for $H3 -> $R"
 437 ${kgetcred} --hostbased --canonicalize foo host.${r} || { ec=1 ; eval "${testfailed}"; }
 438 fgrep "cross-realm ${H3} -> ${R} via [${H2}]" messages.log > /dev/null || { ec=1 ; eval "${testfailed}"; }
 439 echo "Getting x-realm tickets with hierarchical referrals for $H3 -> $H2"
 440 ${kgetcred} --hostbased --canonicalize foo host.${h2} || { ec=1 ; eval "${testfailed}"; }
 441 fgrep "cross-realm ${H3} -> ${H2}" messages.log > /dev/null || { ec=1 ; eval "${testfailed}"; }
 442 ${kdestroy}
 443
 444 echo "Testing multi-hop [capaths] referral logic"
 445 ${kinit} --password-file=${objdir}/foopassword \
 446     -e ${aesenctype} -e ${aesenctype} \
 447     foo@${H4} || \
 448         { ec=1 ; eval "${testfailed}"; }
 449
 450 echo "Getting x-realm tickets with [capaths] referrals for $H4 -> $H1"
 451 ${kgetcred} --hostbased --canonicalize foo/host.${h1}@${H4} || { ec=1 ; eval "${testfailed}"; }
 452 ${kdestroy}
 453
 454 echo "Testing forwardable/renewable flag copying in TGS-REQ"
 455 ${kinit} -f --renewable -r 5d --password-file=${objdir}/foopassword foo@$R || \
 456         { ec=1 ; eval "${testfailed}"; }
 457 ${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
 458 ${klist} -f | grep ${server} | grep FRA > /dev/null || \
 459         { ec=1 ; eval "${testfailed}"; }
 460
 461
 462 echo "Specific enctype"; > messages.log
 463 ${kinit} --password-file=${objdir}/foopassword \
 464     -e ${aesenctype} -e ${aesenctype} \
 465     foo@$R || \
 466         { ec=1 ; eval "${testfailed}"; }
 467
 468 for a in $enctypes; do
 469         echo "Getting client initial tickets ($a)"; > messages.log
 470         ${kinit} --enctype=$a --password-file=${objdir}/foopassword foo@$R || { ec=1 ; eval "${testfailed}"; }
 471         echo "Getting tickets"; > messages.log
 472         ${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
 473         ${test_ap_req} ${server}@${R} ${keytab} ${cache} || { ec=1 ; eval "${testfailed}"; }
 474         ${kdestroy}
 475 done
 476
 477
 478 echo "Getting client initial tickets"; > messages.log
 479 ${kinit} --password-file=${objdir}/foopassword foo@$R || \
 480         { ec=1 ; eval "${testfailed}"; }
 481 for a in $enctypes; do
 482         echo "Getting tickets ($a)"; > messages.log
 483         ${kgetcred} -e $a ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
 484         ${test_ap_req} ${server}@${R} ${keytab} ${cache} || \
 485                 { ec=1 ; eval "${testfailed}"; }
 486         ${kdestroy} --credential=${server}@${R}
 487 done
 488 ${kdestroy}
 489
 490 echo "Getting client authenticated anonymous initial tickets"; > messages.log
 491 ${kinit} -n --password-file=${objdir}/foopassword foo@$R || \
 492         { ec=1 ; eval "${testfailed}"; }
 493 for a in $enctypes; do
 494         echo "Getting tickets ($a)"; > messages.log
 495         ${kgetcred} -e $a ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
 496         ${test_ap_req} ${server}@${R} ${keytab} ${cache} || \
 497                 { ec=1 ; eval "${testfailed}"; }
 498         ${kdestroy} --credential=${server}@${R}
 499 done
 500 ${kdestroy}
 501
 502 echo "Getting client anonymous service tickets"; > messages.log
 503 ${kinit} --password-file=${objdir}/foopassword foo@$R || \
 504         { ec=1 ; eval "${testfailed}"; }
 505 for a in $enctypes; do
 506         echo "Getting tickets ($a)"; > messages.log
 507         ${kgetcred} -n -e $a ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
 508         ${test_ap_req} ${server}@${R} ${keytab} ${cache} || \
 509                 { ec=1 ; eval "${testfailed}"; }
 510         ${kdestroy} --credential=${server}@${R}
 511 done
 512 ${kdestroy}
 513
 514 echo "Getting client initial tickets for cross realm case"; > messages.log
 515 ${kinit} --password-file=${objdir}/foopassword foo@$R || { ec=1 ; eval "${testfailed}"; }
 516 for a in $enctypes; do
 517         echo "Getting cross realm tickets ($a)"; > messages.log
 518         ${kgetcred} -e $a ${server2}@${R2} || { ec=1 ; eval "${testfailed}"; }
 519         echo "  checking we we got back right ticket"
 520         ${klist} | grep ${server2}@ > /dev/null || { ec=1 ; eval "${testfailed}"; }
 521         echo "  checking if ticket is useful"
 522         ${test_ap_req} ${server2}@${R2} ${keytab} ${cache} || \
 523                 { ec=1 ; eval "${testfailed}"; }
 524         ${kdestroy} --credential=${server2}@${R2}
 525 done
 526 ${kdestroy}
 527
 528 echo "Trying x-realm TGT with kvno 0 case";
 529 ${kinit} --password-file=${objdir}/foopassword foo@$R ||
 530         { ec=1 ; eval "${testfailed}"; }
 531 ${test_set_kvno0} || { ec=1 ; eval "${testfailed}"; }
 532 echo "Getting cross realm tickets"; > messages.log
 533 ${kgetcred} krbtgt/${R2}@${R} || { ec=1 ; eval "${testfailed}"; }
 534 ${test_set_kvno0} || { ec=1 ; eval "${testfailed}"; }
 535 echo "Getting service ticket"; > messages.log
 536 ${kgetcred} ${server2}@${R2} || { ec=1 ; eval "${testfailed}"; }
 537 ${kdestroy}
 538
 539 echo "Trying x-realm TGT with kvno 0 case with key rollover";
 540 ${kinit} --password-file=${objdir}/foopassword foo@$R ||
 541         { ec=1 ; eval "${testfailed}"; }
 542 ${test_set_kvno0} || { ec=1 ; eval "${testfailed}"; }
 543 echo "Getting cross realm tickets"; > messages.log
 544 ${kgetcred} krbtgt/${R2}@${R} || { ec=1 ; eval "${testfailed}"; }
 545 echo "Rolling over cross realm keys"; > messages.log
 546 ${kadmin} cpw -r --keepold krbtgt/${R}@${R} || { ec=1 ; eval "${testfailed}"; }
 547 ${kadmin} cpw -r --keepold krbtgt/${R2}@${R} || { ec=1 ; eval "${testfailed}"; }
 548 ${kadmin} cpw -r --keepold krbtgt/${R}@${R2} || { ec=1 ; eval "${testfailed}"; }
 549 ${test_set_kvno0} || { ec=1 ; eval "${testfailed}"; }
 550 echo "Getting service ticket"; > messages.log
 551 echo "Start tracing kdc, then hit return"
 552 ${kgetcred} ${server2}@${R2} || { ec=1 ; eval "${testfailed}"; }
 553 ${kdestroy}
 554
 555 echo "Trying x-realm TGT with no kvno case";
 556 ${kinit} --password-file=${objdir}/foopassword foo@$R ||
 557         { ec=1 ; eval "${testfailed}"; }
 558 ${test_set_kvno0} -n || { ec=1 ; eval "${testfailed}"; }
 559 echo "Getting cross realm tickets"; > messages.log
 560 ${kgetcred} krbtgt/${R2}@${R} || { ec=1 ; eval "${testfailed}"; }
 561 ${test_set_kvno0} -n || { ec=1 ; eval "${testfailed}"; }
 562 echo "Getting service ticket"; > messages.log
 563 ${kgetcred} ${server2}@${R2} || { ec=1 ; eval "${testfailed}"; }
 564 ${kdestroy}
 565
 566 echo "Trying x-realm TGT with no kvno case with key rollover";
 567 ${kinit} --password-file=${objdir}/foopassword foo@$R ||
 568         { ec=1 ; eval "${testfailed}"; }
 569 ${test_set_kvno0} -n || { ec=1 ; eval "${testfailed}"; }
 570 echo "Getting cross realm tickets"; > messages.log
 571 ${kgetcred} krbtgt/${R2}@${R} || { ec=1 ; eval "${testfailed}"; }
 572 echo "Rolling over cross realm keys"; > messages.log
 573 ${kadmin} cpw -r --keepold krbtgt/${R}@${R} || { ec=1 ; eval "${testfailed}"; }
 574 ${kadmin} cpw -r --keepold krbtgt/${R2}@${R} || { ec=1 ; eval "${testfailed}"; }
 575 ${kadmin} cpw -r --keepold krbtgt/${R}@${R2} || { ec=1 ; eval "${testfailed}"; }
 576 ${test_set_kvno0} -n || { ec=1 ; eval "${testfailed}"; }
 577 echo "Getting service ticket"; > messages.log
 578 echo "Start tracing kdc, then hit return"
 579 ${kgetcred} ${server2}@${R2} || { ec=1 ; eval "${testfailed}"; }
 580 ${kdestroy}
 581
 582 echo "try all permutations"; > messages.log
 583 for a in $enctypes; do
 584         echo "Getting client initial tickets ($a)"; > messages.log
 585         ${kinit} --enctype=$a --password-file=${objdir}/foopassword foo@$R || \
 586                 { ec=1 ; eval "${testfailed}"; }
 587         for b in $enctypes; do
 588                 echo "Getting tickets ($a ->  $b)"; > messages.log
 589                 ${kgetcred} -e $b ${server}@${R} || \
 590                         { ec=1 ; eval "${testfailed}"; }
 591                 ${test_ap_req} ${server}@${R} ${keytab} ${cache} || \
 592                         { ec=1 ; eval "${testfailed}"; }
 593                 ${kdestroy} --credential=${server}@${R}
 594         done
 595         ${kdestroy}
 596 done
 597
 598 echo "Getting client initial tickets ip based name"; > messages.log
 599 ${kinit} --password-file=${objdir}/foopassword foo@$R || { ec=1 ; eval "${testfailed}"; }
 600 echo "Getting ip based name tickets"; > messages.log
 601 ${kgetcred} ${serverip}@${R} || { ec=1 ; eval "${testfailed}"; }
 602 echo "  checking we we got back right ticket"
 603 ${klist} | grep ${serverip}@ > /dev/null || { ec=1 ; eval "${testfailed}"; }
 604 echo "  checking if ticket is useful"
 605 ${test_ap_req} ${serverip}@${R} ${keytab} ${cache} || \
 606         { ec=1 ; eval "${testfailed}"; }
 607 ${kdestroy}
 608
 609 echo "Getting client initial tickets ip based name (alias)"; > messages.log
 610 ${kinit} --password-file=${objdir}/foopassword foo@$R || { ec=1 ; eval "${testfailed}"; }
 611 for a in ${serveripname} ${serveripname2} ; do
 612     echo "Getting ip based name tickets (alias) $a"; > messages.log
 613     ${kgetcred} ${a}@${R} || { ec=1 ; eval "${testfailed}"; }
 614     echo "  checking we we got back right ticket"
 615     ${klist} | grep ${a}@ > /dev/null || { ec=1 ; eval "${testfailed}"; }
 616     echo "  checking if ticket is useful"
 617     ${test_ap_req} --server-any ${a}@${R} ${keytab} ${cache} || \
 618         { ec=1 ; eval "${testfailed}"; }
 619 done
 620 ${kdestroy}
 621
 622 echo "Getting server initial tickets"; > messages.log
 623 ${kinit} --keytab=${keytab} ${server}@$R || { ec=1 ; eval "${testfailed}"; }
 624 echo "Listing tickets"; > messages.log
 625 ${klist} | grep "Principal: ${server}" > /dev/null || \
 626         { ec=1 ; eval "${testfailed}"; }
 627 ${kdestroy}
 628
 629 echo "Getting key for key that are a subset in keytab compared to kdb"
 630 ${kinit} --keytab=${keytab} kt-des3@${R}
 631 ${klist} | grep "Principal: kt-des3" > /dev/null || \
 632         { ec=1 ; eval "${testfailed}"; }
 633 ${kdestroy}
 634
 635 echo "initial tickets for deleted user test case"; > messages.log
 636 ${kinit} --password-file=${objdir}/foopassword remove@$R || \
 637         { ec=1 ; eval "${testfailed}"; }
 638 ${kadmin} delete remove@${R} || { ec=1 ; eval "${testfailed}"; }
 639 echo "try getting ticket with deleted user"; > messages.log
 640 ${kgetcred} ${server}@${R} 2> /dev/null && { ec=1 ; eval "${testfailed}"; }
 641 ${kdestroy}
 642
 643 echo "cross realm case (deleted user)"; > messages.log
 644 ${kinit} --password-file=${objdir}/foopassword remove2@$R2 || \
 645         { ec=1 ; eval "${testfailed}"; }
 646 ${kgetcred} krbtgt/${R}@${R2} 2> /dev/null || \
 647         { ec=1 ; eval "${testfailed}"; }
 648 ${kadmin} delete remove2@${R2} || exit 1
 649 ${kgetcred} ${server}@${R} 2> /dev/null || \
 650         { ec=1 ; eval "${testfailed}"; }
 651 ${kdestroy}
 652
 653 echo "rename user"; > messages.log
 654 ${kadmin} add -p foo --use-defaults rename@${R} || exit 1
 655 ${kinit} --password-file=${objdir}/foopassword rename@${R} || \
 656         { ec=1 ; eval "${testfailed}"; }
 657 ${kadmin} rename rename@${R} rename2@${R} || exit 1
 658 ${kinit} --password-file=${objdir}/foopassword rename2@${R} || \
 659         { ec=1 ; eval "${testfailed}"; }
 660 ${kdestroy}
 661 ${kadmin} delete rename2@${R} || exit 1
 662
 663 echo "rename user to another realm"; > messages.log
 664 ${kadmin} add -p foo --use-defaults rename@${R} || exit 1
 665 ${kinit} --password-file=${objdir}/foopassword rename@${R} || \
 666         { ec=1 ; eval "${testfailed}"; }
 667 ${kadmin} rename rename@${R} rename@${R2} || exit 1
 668 ${kinit} --password-file=${objdir}/foopassword rename@${R2} || \
 669         { ec=1 ; eval "${testfailed}"; }
 670 ${kdestroy}
 671 ${kadmin} delete rename@${R2} || exit 1
 672
 673 echo deleting all but aes enctypes on krbtgt
 674 ${kadmin} del_enctype krbtgt/${R}@${R} ${enctype_sans_aes} || exit 1
 675
 676 echo deleting all but des enctypes on server-des3
 677 ${kadmin} del_enctype ${server}-des3@${R} ${enctype_sans_des3} || exit 1
 678 ${kadmin} ext -k ${keytab} ${server}-des3@${R} || exit 1
 679
 680 echo "try all permutations (only aes)"; > messages.log
 681 for a in $enctypes; do
 682         echo "Getting client initial tickets ($a)"; > messages.log
 683         ${kinit} --enctype=$a --password-file=${objdir}/foopassword foo@${R} ||\
 684                 { ec=1 ; eval "${testfailed}"; }
 685         for b in $enctypes; do
 686                 echo "Getting tickets ($a ->  $b)"; > messages.log
 687                 ${kgetcred} -e $b ${server}@${R} || \
 688                         { ec=1 ; eval "${testfailed}"; }
 689                 ${test_ap_req} ${server}@${R} ${keytab} ${cache} || \
 690                         { ec=1 ; eval "${testfailed}"; }
 691
 692                 echo "Getting tickets ($a ->  $b) (server des3 only)"; > messages.log
 693                 ${kgetcred} ${server}-des3@${R} || \
 694                         { ec=1 ; eval "${testfailed}"; }
 695                 ${test_ap_req} ${server}-des3@${R} ${keytab} ${cache} || \
 696                         { ec=1 ; eval "${testfailed}"; }
 697
 698                 ${kdestroy} --credential=${server}@${R}
 699                 ${kdestroy} --credential=${server}-des3@${R}
 700         done
 701         ${kdestroy}
 702 done
 703
 704 echo deleting all enctypes on krbtgt
 705 ${kadmin} del_enctype krbtgt/${R}@${R} aes256-cts-hmac-sha1-96 || \
 706         { ec=1 ; eval "${testfailed}"; }
 707 echo "try initial ticket w/o and keys on krbtgt"
 708 ${kinit} --password-file=${objdir}/foopassword foo@${R} 2>/dev/null && \
 709         { ec=1 ; eval "${testfailed}"; }
 710 echo "adding random aes key"
 711 ${kadmin} add_enctype -r krbtgt/${R}@${R} aes256-cts-hmac-sha1-96 || \
 712         { ec=1 ; eval "${testfailed}"; }
 713 echo "try initial ticket with random aes key on krbtgt"
 714 ${kinit} --password-file=${objdir}/foopassword foo@${R} || \
 715         { ec=1 ; eval "${testfailed}"; }
 716 ${kdestroy}
 717
 718 rsa=yes
 719 ecdsa=yes
 720 pkinit=no
 721 if ${hxtool} info | grep 'rsa: hx509 null RSA' > /dev/null ; then
 722     rsa=no
 723 fi
 724 if ${hxtool} info | grep 'rand: not available' > /dev/null ; then
 725     rsa=no
 726 fi
 727 if ${kinit} --help 2>&1 | grep "CA certificates" > /dev/null; then
 728     pkinit=yes
 729 fi
 730
 731 if ${hxtool} info | grep 'ecdsa: hcrypto null' > /dev/null ; then
 732     ecdsa=no
 733 fi
 734
 735
 736 # If we support pkinit and have RSA, lets try that
 737 if test "$pkinit" = yes -a "$rsa" = yes ; then
 738
 739     echo "try anonymous pkinit"; > messages.log
 740     ${kinit} -n @${R} || \
 741         { ec=1 ; eval "${testfailed}"; }
 742     ${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
 743     ${kdestroy}
 744
 745     for type in "" "--pk-use-enckey"; do
 746         echo "Trying pk-init (principal in certificate) $type"; > messages.log
 747         ${kinit} $type -C FILE:${hx509_data}/pkinit.crt,${hx509_data}/pkinit.key bar@${R} || \
 748                 { ec=1 ; eval "${testfailed}"; }
 749         ${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
 750         ${kdestroy}
 751
 752         echo "Trying pk-init (principal in pki-mapping) $type"; > messages.log
 753         ${kinit} $type -C FILE:${hx509_data}/pkinit.crt,${hx509_data}/pkinit.key foo@${R} || \
 754                 { ec=1 ; eval "${testfailed}"; }
 755         ${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
 756         ${kdestroy}
 757
 758         echo "Trying pk-init (password protected key) $type"; > messages.log
 759         ${kinit} $type -C FILE:${hx509_data}/pkinit.crt,${hx509_data}/pkinit-pw.key --password-file=${objdir}/foopassword foo@${R} || \
 760                 { ec=1 ; eval "${testfailed}"; }
 761         ${kgetcred} ${server}@${R} || \
 762         { ec=1 ; eval "${testfailed}"; }
 763         ${kdestroy}
 764
 765         echo "Trying pk-init (proxy cert) $type"; > messages.log
 766         ${kinit} $type -C FILE:${hx509_data}/pkinit-proxy-chain.crt,${hx509_data}/pkinit-proxy.key foo@${R} || \
 767                 { ec=1 ; eval "${testfailed}"; }
 768         ${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
 769         ${kdestroy}
 770
 771     done
 772
 773     if test "$ecdsa" = yes > /dev/null ; then
 774         echo "Trying pk-init (ec certificate)"
 775         > messages.log
 776         ${kinit} -C FILE:${hx509_data}/pkinit-ec.crt,${hx509_data}/pkinit-ec.key bar@${R} || \
 777             { ec=1 ; eval "${testfailed}"; }
 778         ${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
 779         ${kdestroy}
 780         grep 'PK-INIT using ecdh' messages.log > /dev/null || \
 781             { ec=1 ; eval "${testfailed}"; }
 782     fi
 783
 784 else
 785         echo "no pkinit (pkinit: $pkinit, rsa: $rsa)"; > messages.log
 786 fi
 787
 788 echo "tickets for impersonate test case"; > messages.log
 789 ${kinit} --forwardable --password-file=${objdir}/foopassword ${ps} || \
 790         { ec=1 ; eval "${testfailed}"; }
 791 ${kgetcred_imp} --impersonate=bar@${R} ${ps} || \
 792         { ec=1 ; eval "${testfailed}"; }
 793 ${test_ap_req} ${ps} ${keytab} ${ocache} || \
 794         { ec=1 ; eval "${testfailed}"; }
 795 echo "  negative check"
 796 ${kgetcred_imp} --impersonate=bar@${R} foo@${R} 2>/dev/null && \
 797         { ec=1 ; eval "${testfailed}"; }
 798
 799 echo "test constrained delegation"; > messages.log
 800 ${kgetcred_imp} --forward --impersonate=bar@${R} ${ps} || \
 801         { ec=1 ; eval "${testfailed}"; }
 802 ${kgetcred} \
 803         --out-cache=${o2cache} \
 804         --delegation-credential-cache=${ocache} \
 805         ${server}@${R} || \
 806         { ec=1 ; eval "${testfailed}"; }
 807 echo "  try using the credential"
 808 ${test_ap_req} ${server}@${R} ${keytab} ${o2cache} || \
 809         { ec=1 ; eval "${testfailed}"; }
 810 echo "  negative check"
 811 ${kgetcred} \
 812         --out-cache=${o2cache} \
 813         --delegation-credential-cache=${ocache} \
 814         bar@${R} 2>/dev/null && \
 815         { ec=1 ; eval "${testfailed}"; }
 816
 817 echo "test constrained delegation impersonation (non forward)"; > messages.log
 818 rm -f ocache.krb5
 819 ${kimpersonate} -s ${ps} -c bar@${R} -t ${aesenctype} || \
 820         { ec=1 ; eval "${testfailed}"; }
 821 ${kgetcred} --out-cache=${o2cache} --delegation-credential-cache=${ocache} ${server}@${R} > /dev/null 2>/dev/null && \
 822         { ec=1 ; eval "${testfailed}"; }
 823
 824 echo "test constrained delegation impersonation (missing KRB5SignedPath)"; > messages.log
 825 rm -f ocache.krb5
 826 ${kimpersonate} -s ${ps} -c bar@${R} -t ${aesenctype} -f forwardable || \
 827         { ec=1 ; eval "${testfailed}"; }
 828 ${kgetcred} --out-cache=${o2cache} --delegation-credential-cache=${ocache} ${server}@${R} > /dev/null 2>/dev/null && \
 829         { ec=1 ; eval "${testfailed}"; }
 830
 831 ${kdestroy}
 832
 833 echo "check renewing" > messages.log
 834 ${kinit} --renewable --password-file=${objdir}/foopassword foo@$R || \
 835         { ec=1 ; eval "${testfailed}"; }
 836 echo "kinit -R"
 837 ${kinit} -R || \
 838         { ec=1 ; eval "${testfailed}"; }
 839 echo "check renewing MIT interface" > messages.log
 840 ${kinit} --renewable --password-file=${objdir}/foopassword foo@$R || \
 841         { ec=1 ; eval "${testfailed}"; }
 842 echo "test_renew"
 843 env KRB5CCNAME=${cache} ${test_renew} || \
 844         { ec=1 ; eval "${testfailed}"; }
 845 ${kdestroy}
 846
 847 echo "checking server aliases"; > messages.log
 848 ${kinit} --password-file=${objdir}/foopassword foo@$R || \
 849         { ec=1 ; eval "${testfailed}"; }
 850 echo "Getting tickets"; > messages.log
 851 ${kgetcred} ${alias1}@${R} || { ec=1 ; eval "${testfailed}"; }
 852 ${kgetcred} ${alias2}@${R} || { ec=1 ; eval "${testfailed}"; }
 853 echo "   verify entry in keytab"
 854 ${test_ap_req} ${alias1}@${R} ${keytab} ${cache} || \
 855         { ec=1 ; eval "${testfailed}"; }
 856 echo "   verify entry in keytab with any"
 857 ${test_ap_req} --server-any ${alias1}@${R} ${keytab} ${cache} || \
 858         { ec=1 ; eval "${testfailed}"; }
 859 echo "   verify failure with alias entry"
 860 ${test_ap_req} ${alias2}@${R} ${keytab} ${cache} 2>/dev/null && \
 861         { ec=1 ; eval "${testfailed}"; }
 862 echo "   verify alias entry in keytab with any"
 863 ${test_ap_req} --server-any ${alias2}@${R} ${keytab} ${cache} || \
 864         { ec=1 ; eval "${testfailed}"; }
 865 ${kdestroy}
 866
 867 echo "testing removal of keytab"
 868 ${ktutil} -k ${keytab} destroy || { ec=1 ; eval "${testfailed}"; }
 869 test -f ${keytabfile} && { ec=1 ; eval "${testfailed}"; }
 870
 871 echo "Checking client pw expire"; > messages.log
 872 ${kinit} --password-file=${objdir}/foopassword \
 873         pw-expire@${R} 2>kinit-log.tmp|| \
 874         { ec=1 ; eval "${testfailed}"; }
 875 grep 'Your password will expire' kinit-log.tmp > /dev/null || \
 876         { ec=1 ; eval "${testfailed}"; }
 877 echo "   kinit passes"
 878 ${test_gic} --client=pw-expire@${R} --password=foo > kinit-log.tmp 2>/dev/null
 879 ${EGREP} "^e type: 6" kinit-log.tmp > /dev/null  || \
 880         { ec=1 ; eval "${testfailed}"; }
 881 echo "   test_gic passes"
 882 ${kdestroy}
 883
 884 echo "Checking password expiration" ; > messages.log
 885
 886 kinitpty=${objdir}/foopassword.rkpty
 887 cat > ${kinitpty} <<EOF
 888 expect Password
 889 password foo\n
 890 expect Password has expired
 891 expect New password
 892 password Foobar11\n
 893 expect password
 894 password Foobar11\n
 895 expect Success: Password changed
 896 EOF
 897
 898 echo "Checking client pw expire"; > messages.log
 899 ${rkpty} ${kinitpty} ${kinit} pw-expired@${R}|| \
 900         { ec=1 ; eval "${testfailed}"; }
 901
 902 ${kdestroy}
 903
 904
 905 echo "killing kdc (${kdcpid}) kpasswdd (${kpasswddpid})"
 906 sh ${leaks_kill} kdc $kdcpid || exit 1
 907 sh ${leaks_kill} kpasswdd $kpasswddpid || exit 1
 908
 909 trap "" EXIT
 910
 911 exit $ec