tests/kdc/check-kdc.in

   1 #!/bin/sh
   2 #
   3 # Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
   4 # (Royal Institute of Technology, Stockholm, Sweden).
   5 # All rights reserved.
   6 #
   7 # Redistribution and use in source and binary forms, with or without
   8 # modification, are permitted provided that the following conditions
   9 # are met:
  10 #
  11 # 1. Redistributions of source code must retain the above copyright
  12 #    notice, this list of conditions and the following disclaimer.
  13 #
  14 # 2. Redistributions in binary form must reproduce the above copyright
  15 #    notice, this list of conditions and the following disclaimer in the
  16 #    documentation and/or other materials provided with the distribution.
  17 #
  18 # 3. Neither the name of the Institute nor the names of its contributors
  19 #    may be used to endorse or promote products derived from this software
  20 #    without specific prior written permission.
  21 #
  22 # THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  23 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  24 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  25 # ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  26 # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  27 # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  28 # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  29 # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  30 # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  31 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  32 # SUCH DAMAGE.
  33 #
  34 # $Id$
  35 #
  36
  37 srcdir="@srcdir@"
  38 objdir="@objdir@"
  39 EGREP="@EGREP@"
  40
  41 testfailed="echo test failed; cat messages.log; exit 1"
  42
  43 # If there is no useful db support compile in, disable test
  44 ../db/have-db || exit 77
  45
  46 R=TEST.H5L.SE
  47 R2=TEST2.H5L.SE
  48
  49 port=@port@
  50
  51 kadmin="${TESTS_ENVIRONMENT} ../../kadmin/kadmin -l -r $R"
  52 kdc="${TESTS_ENVIRONMENT} ../../kdc/kdc --addresses=localhost -P $port"
  53
  54 server=host/datan.test.h5l.se
  55 server2=host/computer.example.com
  56 serverip=host/10.11.12.13
  57 serveripname=host/ip.test.h5l.org
  58 serveripname2=host/10.11.12.14
  59 alias1=host/datan.example.com
  60 alias2=host/datan
  61 aliaskeytab=host/datan
  62 cache="FILE:${objdir}/cache.krb5"
  63 ocache="FILE:${objdir}/ocache.krb5"
  64 o2cache="FILE:${objdir}/o2cache.krb5"
  65 icache="FILE:${objdir}/icache.krb5"
  66 keytabfile=${objdir}/server.keytab
  67 keytab="FILE:${keytabfile}"
  68 ps="proxy-service@${R}"
  69 aesenctype="aes256-cts-hmac-sha1-96"
  70
  71 kinit="${TESTS_ENVIRONMENT} ../../kuser/kinit -c $cache --no-afslog"
  72 klist="${TESTS_ENVIRONMENT} ../../kuser/klist -c $cache"
  73 kgetcred="${TESTS_ENVIRONMENT} ../../kuser/kgetcred -c $cache"
  74 kgetcred_imp="${TESTS_ENVIRONMENT} ../../kuser/kgetcred -c $cache --out-cache=${ocache}"
  75 kdestroy="${TESTS_ENVIRONMENT} ../../kuser/kdestroy -c $cache --no-unlog"
  76 ktutil="${TESTS_ENVIRONMENT} ../../admin/ktutil"
  77 hxtool="${TESTS_ENVIRONMENT} ../../lib/hx509/hxtool"
  78 kimpersonate="${TESTS_ENVIRONMENT} ../../kuser/kimpersonate -k ${keytab} --ccache=${ocache}"
  79 test_renew="${TESTS_ENVIRONMENT} ../../lib/krb5/test_renew"
  80 test_ap_req="${TESTS_ENVIRONMENT} ../../lib/krb5/test_ap-req"
  81 test_gic="${TESTS_ENVIRONMENT} ../../lib/krb5/test_gic"
  82
  83 KRB5_CONFIG="${objdir}/@KDCCONF@"
  84 export KRB5_CONFIG
  85
  86 rm -f ${keytabfile}
  87 rm -f current-db*
  88 rm -f out-*
  89 rm -f mkey.file*
  90
  91 > messages.log
  92
  93 echo Creating database
  94 ${kadmin} \
  95     init \
  96     --realm-max-ticket-life=1day \
  97     --realm-max-renewable-life=1month \
  98     ${R} || exit 1
  99
 100 ${kadmin} \
 101     init \
 102     --realm-max-ticket-life=1day \
 103     --realm-max-renewable-life=1month \
 104     ${R2} || exit 1
 105
 106 ${kadmin} cpw -r krbtgt/${R}@${R} || exit 1
 107 ${kadmin} cpw -r krbtgt/${R}@${R} || exit 1
 108 ${kadmin} cpw -r krbtgt/${R}@${R} || exit 1
 109 ${kadmin} cpw -r krbtgt/${R}@${R} || exit 1
 110
 111 ${kadmin} add -p foo --use-defaults foo@${R} || exit 1
 112 ${kadmin} add -p bar --use-defaults bar@${R} || exit 1
 113 ${kadmin} add -p foo --use-defaults remove@${R} || exit 1
 114 ${kadmin} add -p kaka --use-defaults ${server}@${R} || exit 1
 115 ${kadmin} add -p kaka --use-defaults ${server}-des3@${R} || exit 1
 116 ${kadmin} add -p foo --use-defaults ${ps} || exit 1
 117 ${kadmin} modify --attributes=+trusted-for-delegation ${ps} || exit 1
 118 ${kadmin} modify --constrained-delegation=${server} ${ps} || exit 1
 119 ${kadmin} ext -k ${keytab} ${server}@${R} || exit 1
 120 ${kadmin} ext -k ${keytab} ${ps} || exit 1
 121
 122 ${kadmin} add -p kaka --use-defaults ${server2}@${R2} || exit 1
 123 ${kadmin} ext -k ${keytab} ${server2}@${R2} || exit 1
 124 ${kadmin} add -p kaka --use-defaults ${serverip}@${R} || exit 1
 125 ${kadmin} ext -k ${keytab} ${serverip}@${R} || exit 1
 126 ${kadmin} add -p kaka --use-defaults ${serveripname}@${R} || exit 1
 127 ${kadmin} ext -k ${keytab} ${serveripname}@${R} || exit 1
 128 ${kadmin} modify --alias=${serveripname2}@${R} ${serveripname}@${R}
 129 ${kadmin} add -p foo --use-defaults remove2@${R2} || exit 1
 130
 131 ${kadmin} add -p kaka --use-defaults ${alias1}@${R} || exit 1
 132 ${kadmin} ext -k ${keytab} ${alias1}@${R} || exit 1
 133 ${kadmin} modify --alias=${alias2}@${R} ${alias1}@${R}
 134
 135 ${kadmin} add -p cross1 --use-defaults krbtgt/${R2}@${R} || exit 1
 136 ${kadmin} add -p cross2 --use-defaults krbtgt/${R}@${R2} || exit 1
 137
 138 ${kadmin} add -p foo --use-defaults pw-expire@${R} || exit 1
 139 ${kadmin} modify --pw-expiration-time=+1day  pw-expire@${R} || exit 1
 140
 141 echo "Check parser"
 142 ${kadmin} add -p foo --use-defaults -- -p || exit 1
 143 ${kadmin} delete -- -p || exit 1
 144
 145 echo "Doing database check"
 146 ${kadmin} check ${R} || exit 1
 147 ${kadmin} check ${R2} || exit 1
 148
 149 echo "Extracting enctypes"
 150 ${ktutil} -k ${keytab} list > tempfile || exit 1
 151 ${EGREP} -v '^FILE:' tempfile | ${EGREP} -v '^Vno' | ${EGREP} -v '^$' | \
 152     awk '$1 !~ /1/  { exit 1 }' || exit 1
 153
 154 ${kadmin} get foo@${R} > tempfile || exit 1
 155 enctypes=`grep Keytypes: tempfile | sed 's/(pw-salt)//g' | sed 's/,//g' | sed 's/Keytypes://'`
 156
 157 enctype_sans_aes=`echo $enctypes | sed 's/aes[^ ]*//g'`
 158 enctype_sans_des3=`echo $enctypes | sed 's/des3-cbc-sha1//g'`
 159
 160 echo foo > ${objdir}/foopassword
 161
 162 echo Starting kdc
 163 env MallocStackLogging=1 MallocStackLoggingNoCompact=1 MallocErrorAbort=1 MallocLogFile=${objdir}/malloc-log \
 164 ${kdc} &
 165 kdcpid=$!
 166
 167 sh ${srcdir}/wait-kdc.sh
 168 if [ "$?" != 0 ] ; then
 169     kill -9 ${kdcpid}
 170     exit 1
 171 fi
 172
 173 trap "kill -9 ${kdcpid}; echo signal killing kdc; exit 1;" EXIT
 174
 175 ec=0
 176
 177 echo "Getting client initial tickets"; > messages.log
 178 ${kinit} --password-file=${objdir}/foopassword foo@$R || \
 179         { ec=1 ; eval "${testfailed}"; }
 180 echo "Getting tickets"; > messages.log
 181 ${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
 182 echo "Listing tickets"; > messages.log
 183 ${klist} > /dev/null || { ec=1 ; eval "${testfailed}"; }
 184 ${test_ap_req} ${server}@${R} ${keytab} ${cache} || \
 185         { ec=1 ; eval "${testfailed}"; }
 186 ${kdestroy}
 187
 188 echo "Specific enctype"; > messages.log
 189 ${kinit} --password-file=${objdir}/foopassword \
 190     -e ${aesenctype} -e ${aesenctype} \
 191     foo@$R || \
 192         { ec=1 ; eval "${testfailed}"; }
 193
 194 for a in $enctypes; do
 195         echo "Getting client initial tickets ($a)"; > messages.log
 196         ${kinit} --enctype=$a --password-file=${objdir}/foopassword foo@$R || { ec=1 ; eval "${testfailed}"; }
 197         echo "Getting tickets"; > messages.log
 198         ${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
 199         ${test_ap_req} ${server}@${R} ${keytab} ${cache} || { ec=1 ; eval "${testfailed}"; }
 200         ${kdestroy}
 201 done
 202
 203
 204 echo "Getting client initial tickets"; > messages.log
 205 ${kinit} --password-file=${objdir}/foopassword foo@$R || \
 206         { ec=1 ; eval "${testfailed}"; }
 207 for a in $enctypes; do
 208         echo "Getting tickets ($a)"; > messages.log
 209         ${kgetcred} -e $a ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
 210         ${test_ap_req} ${server}@${R} ${keytab} ${cache} || \
 211                 { ec=1 ; eval "${testfailed}"; }
 212         ${kdestroy} --credential=${server}@${R}
 213 done
 214 ${kdestroy}
 215
 216 echo "Getting client initial tickets for cross realm case"; > messages.log
 217 ${kinit} --password-file=${objdir}/foopassword foo@$R || { ec=1 ; eval "${testfailed}"; }
 218 for a in $enctypes; do
 219         echo "Getting cross realm tickets ($a)"; > messages.log
 220         ${kgetcred} -e $a ${server2}@${R2} || { ec=1 ; eval "${testfailed}"; }
 221         echo "  checking we we got back right ticket"
 222         ${klist} | grep ${server2}@ > /dev/null || { ec=1 ; eval "${testfailed}"; }
 223         echo "  checking if ticket is useful"
 224         ${test_ap_req} ${server2}@${R2} ${keytab} ${cache} || \
 225                 { ec=1 ; eval "${testfailed}"; }
 226         ${kdestroy} --credential=${server2}@${R2}
 227 done
 228 ${kdestroy}
 229
 230 echo "try all permutations"; > messages.log
 231 for a in $enctypes; do
 232         echo "Getting client initial tickets ($a)"; > messages.log
 233         ${kinit} --enctype=$a --password-file=${objdir}/foopassword foo@$R || \
 234                 { ec=1 ; eval "${testfailed}"; }
 235         for b in $enctypes; do
 236                 echo "Getting tickets ($a ->  $b)"; > messages.log
 237                 ${kgetcred} -e $b ${server}@${R} || \
 238                         { ec=1 ; eval "${testfailed}"; }
 239                 ${test_ap_req} ${server}@${R} ${keytab} ${cache} || \
 240                         { ec=1 ; eval "${testfailed}"; }
 241                 ${kdestroy} --credential=${server}@${R}
 242         done
 243         ${kdestroy}
 244 done
 245
 246 echo "Getting client initial tickets ip based name"; > messages.log
 247 ${kinit} --password-file=${objdir}/foopassword foo@$R || { ec=1 ; eval "${testfailed}"; }
 248 echo "Getting ip based name tickets"; > messages.log
 249 ${kgetcred} ${serverip}@${R} || { ec=1 ; eval "${testfailed}"; }
 250 echo "  checking we we got back right ticket"
 251 ${klist} | grep ${serverip}@ > /dev/null || { ec=1 ; eval "${testfailed}"; }
 252 echo "  checking if ticket is useful"
 253 ${test_ap_req} ${serverip}@${R} ${keytab} ${cache} || \
 254         { ec=1 ; eval "${testfailed}"; }
 255 ${kdestroy}
 256
 257 echo "Getting client initial tickets ip based name (alias)"; > messages.log
 258 ${kinit} --password-file=${objdir}/foopassword foo@$R || { ec=1 ; eval "${testfailed}"; }
 259 for a in ${serveripname} ${serveripname2} ; do
 260     echo "Getting ip based name tickets (alias) $a"; > messages.log
 261     ${kgetcred} ${a}@${R} || { ec=1 ; eval "${testfailed}"; }
 262     echo "  checking we we got back right ticket"
 263     ${klist} | grep ${a}@ > /dev/null || { ec=1 ; eval "${testfailed}"; }
 264     echo "  checking if ticket is useful"
 265     ${test_ap_req} --server-any ${a}@${R} ${keytab} ${cache} || \
 266         { ec=1 ; eval "${testfailed}"; }
 267 done
 268 ${kdestroy}
 269
 270 echo "Getting server initial tickets"; > messages.log
 271 ${kinit} --keytab=${keytab} ${server}@$R || { ec=1 ; eval "${testfailed}"; }
 272 echo "Listing tickets"; > messages.log
 273 ${klist} | grep "Principal: ${server}" > /dev/null || \
 274         { ec=1 ; eval "${testfailed}"; }
 275 ${kdestroy}
 276
 277 echo "initial tickets for deleted user test case"; > messages.log
 278 ${kinit} --password-file=${objdir}/foopassword remove@$R || \
 279         { ec=1 ; eval "${testfailed}"; }
 280 ${kadmin} delete remove@${R} || { ec=1 ; eval "${testfailed}"; }
 281 echo "try getting ticket with deleted user"; > messages.log
 282 ${kgetcred} ${server}@${R} 2> /dev/null && { ec=1 ; eval "${testfailed}"; }
 283 ${kdestroy}
 284
 285 echo "cross realm case (deleted user)"; > messages.log
 286 ${kinit} --password-file=${objdir}/foopassword remove2@$R2 || \
 287         { ec=1 ; eval "${testfailed}"; }
 288 ${kgetcred} krbtgt/${R}@${R2} 2> /dev/null || \
 289         { ec=1 ; eval "${testfailed}"; }
 290 ${kadmin} delete remove2@${R2} || exit 1
 291 ${kgetcred} ${server}@${R} 2> /dev/null || \
 292         { ec=1 ; eval "${testfailed}"; }
 293 ${kdestroy}
 294
 295 echo "rename user"; > messages.log
 296 ${kadmin} add -p foo --use-defaults rename@${R} || exit 1
 297 ${kinit} --password-file=${objdir}/foopassword rename@${R} || \
 298         { ec=1 ; eval "${testfailed}"; }
 299 ${kadmin} rename rename@${R} rename2@${R} || exit 1
 300 ${kinit} --password-file=${objdir}/foopassword rename2@${R} || \
 301         { ec=1 ; eval "${testfailed}"; }
 302 ${kdestroy}
 303 ${kadmin} delete rename2@${R} || exit 1
 304
 305 echo "rename user to another realm"; > messages.log
 306 ${kadmin} add -p foo --use-defaults rename@${R} || exit 1
 307 ${kinit} --password-file=${objdir}/foopassword rename@${R} || \
 308         { ec=1 ; eval "${testfailed}"; }
 309 ${kadmin} rename rename@${R} rename@${R2} || exit 1
 310 ${kinit} --password-file=${objdir}/foopassword rename@${R2} || \
 311         { ec=1 ; eval "${testfailed}"; }
 312 ${kdestroy}
 313 ${kadmin} delete rename@${R2} || exit 1
 314
 315 echo deleting all but aes enctypes on krbtgt
 316 ${kadmin} del_enctype krbtgt/${R}@${R} ${enctype_sans_aes} || exit 1
 317
 318 echo deleting all but des enctypes on server-des3
 319 ${kadmin} del_enctype ${server}-des3@${R} ${enctype_sans_des3} || exit 1
 320 ${kadmin} ext -k ${keytab} ${server}-des3@${R} || exit 1
 321
 322 echo "try all permutations (only aes)"; > messages.log
 323 for a in $enctypes; do
 324         echo "Getting client initial tickets ($a)"; > messages.log
 325         ${kinit} --enctype=$a --password-file=${objdir}/foopassword foo@${R} ||\
 326                 { ec=1 ; eval "${testfailed}"; }
 327         for b in $enctypes; do
 328                 echo "Getting tickets ($a ->  $b)"; > messages.log
 329                 ${kgetcred} -e $b ${server}@${R} || \
 330                         { ec=1 ; eval "${testfailed}"; }
 331                 ${test_ap_req} ${server}@${R} ${keytab} ${cache} || \
 332                         { ec=1 ; eval "${testfailed}"; }
 333
 334                 echo "Getting tickets ($a ->  $b) (server des3 only)"; > messages.log
 335                 ${kgetcred} ${server}-des3@${R} || \
 336                         { ec=1 ; eval "${testfailed}"; }
 337                 ${test_ap_req} ${server}-des3@${R} ${keytab} ${cache} || \
 338                         { ec=1 ; eval "${testfailed}"; }
 339
 340                 ${kdestroy} --credential=${server}@${R}
 341                 ${kdestroy} --credential=${server}-des3@${R}
 342         done
 343         ${kdestroy}
 344 done
 345
 346 echo deleting all enctypes on krbtgt
 347 ${kadmin} del_enctype krbtgt/${R}@${R} aes256-cts-hmac-sha1-96 || \
 348         { ec=1 ; eval "${testfailed}"; }
 349 echo "try initial ticket w/o and keys on krbtgt"
 350 ${kinit} --password-file=${objdir}/foopassword foo@${R} 2>/dev/null && \
 351         { ec=1 ; eval "${testfailed}"; }
 352 echo "adding random aes key"
 353 ${kadmin} add_enctype -r krbtgt/${R}@${R} aes256-cts-hmac-sha1-96 || \
 354         { ec=1 ; eval "${testfailed}"; }
 355 echo "try initial ticket with random aes key on krbtgt"
 356 ${kinit} --password-file=${objdir}/foopassword foo@${R} || \
 357         { ec=1 ; eval "${testfailed}"; }
 358 ${kdestroy}
 359
 360 rsa=yes
 361 pkinit=no
 362 if ${hxtool} info | grep 'rsa: hx509 null RSA' > /dev/null ; then
 363     rsa=no
 364 fi
 365 if ${hxtool} info | grep 'rand: not available' > /dev/null ; then
 366     rsa=no
 367 fi
 368 if ${kinit} --help 2>&1 | grep "CA certificates" > /dev/null; then
 369     pkinit=yes
 370 fi
 371
 372 # If we support pkinit and have RSA, lets try that
 373 if test "$pkinit" = yes -a "$rsa" = yes ; then
 374
 375     base="${srcdir}/../../lib/hx509/data"
 376
 377     echo "try anonymous pkinit"; > messages.log
 378     ${kinit} --anonymous ${R} || \
 379         { ec=1 ; eval "${testfailed}"; }
 380     ${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
 381     ${kdestroy}
 382
 383     for type in "" "--pk-use-enckey"; do
 384         echo "Trying pk-init (principal in certificate) $type"; > messages.log
 385         ${kinit} $type -C FILE:${base}/pkinit.crt,${base}/pkinit.key bar@${R} || \
 386                 { ec=1 ; eval "${testfailed}"; }
 387         ${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
 388         ${kdestroy}
 389
 390         echo "Trying pk-init (principal in pki-mapping) $type"; > messages.log
 391         ${kinit} $type -C FILE:${base}/pkinit.crt,${base}/pkinit.key foo@${R} || \
 392                 { ec=1 ; eval "${testfailed}"; }
 393         ${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
 394         ${kdestroy}
 395
 396         echo "Trying pk-init (password protected key) $type"; > messages.log
 397         ${kinit} $type -C FILE:${base}/pkinit.crt,${base}/pkinit-pw.key --password-file=${objdir}/foopassword foo@${R} || \
 398                 { ec=1 ; eval "${testfailed}"; }
 399         ${kgetcred} ${server}@${R} || \
 400         { ec=1 ; eval "${testfailed}"; }
 401         ${kdestroy}
 402
 403         echo "Trying pk-init (proxy cert) $type"; > messages.log
 404         ${kinit} $type -C FILE:${base}/pkinit-proxy-chain.crt,${base}/pkinit-proxy.key foo@${R} || \
 405                 { ec=1 ; eval "${testfailed}"; }
 406         ${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
 407         ${kdestroy}
 408
 409     done
 410
 411     if ${hxtool} info | grep 'ecdsa:' > /dev/null ; then
 412         echo "Trying pk-init (ec certificate)"
 413         > messages.log
 414         ${kinit} -C FILE:${base}/pkinit-ec.crt,${base}/pkinit-ec.key bar@${R} || \
 415             { ec=1 ; eval "${testfailed}"; }
 416         ${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
 417         ${kdestroy}
 418         grep 'PK-INIT using ecdh' messages.log > /dev/null || \
 419             { ec=1 ; eval "${testfailed}"; }
 420     fi
 421
 422 else
 423         echo "no pkinit (pkinit: $pkinit, rsa: $rsa)"; > messages.log
 424 fi
 425
 426 echo "tickets for impersonate test case"; > messages.log
 427 ${kinit} --forwardable --password-file=${objdir}/foopassword ${ps} || \
 428         { ec=1 ; eval "${testfailed}"; }
 429 ${kgetcred_imp} --impersonate=bar@${R} ${ps} || \
 430         { ec=1 ; eval "${testfailed}"; }
 431 ${test_ap_req} ${ps} ${keytab} ${ocache} || \
 432         { ec=1 ; eval "${testfailed}"; }
 433 echo "  negative check"
 434 ${kgetcred_imp} --impersonate=bar@${R} foo@${R} 2>/dev/null && \
 435         { ec=1 ; eval "${testfailed}"; }
 436
 437 echo "test constrained delegation"; > messages.log
 438 ${kgetcred_imp} --forward --impersonate=bar@${R} ${ps} || \
 439         { ec=1 ; eval "${testfailed}"; }
 440 ${kgetcred} \
 441         --out-cache=${o2cache} \
 442         --delegation-credential-cache=${ocache} \
 443         ${server}@${R} || \
 444         { ec=1 ; eval "${testfailed}"; }
 445 echo "  try using the credential"
 446 ${test_ap_req} ${server}@${R} ${keytab} ${o2cache} || \
 447         { ec=1 ; eval "${testfailed}"; }
 448 echo "  negative check"
 449 ${kgetcred} \
 450         --out-cache=${o2cache} \
 451         --delegation-credential-cache=${ocache} \
 452         bar@${R} 2>/dev/null && \
 453         { ec=1 ; eval "${testfailed}"; }
 454
 455 echo "test constrained delegation impersonation (non forward)"; > messages.log
 456 rm -f ocache.krb5
 457 ${kimpersonate} -s ${ps} -c bar@${R} -t ${aesenctype} || \
 458         { ec=1 ; eval "${testfailed}"; }
 459 ${kgetcred} --out-cache=${o2cache} --delegation-credential-cache=${ocache} ${server}@${R} > /dev/null 2>/dev/null && \
 460         { ec=1 ; eval "${testfailed}"; }
 461
 462 echo "test constrained delegation impersonation (missing KRB5SignedPath)"; > messages.log
 463 rm -f ocache.krb5
 464 ${kimpersonate} -s ${ps} -c bar@${R} -t ${aesenctype} -f forwardable || \
 465         { ec=1 ; eval "${testfailed}"; }
 466 ${kgetcred} --out-cache=${o2cache} --delegation-credential-cache=${ocache} ${server}@${R} > /dev/null 2>/dev/null && \
 467         { ec=1 ; eval "${testfailed}"; }
 468
 469 ${kdestroy}
 470
 471 echo "check renewing" > messages.log
 472 ${kinit} --renewable --password-file=${objdir}/foopassword foo@$R || \
 473         { ec=1 ; eval "${testfailed}"; }
 474 echo "kinit -R"
 475 ${kinit} -R || \
 476         { ec=1 ; eval "${testfailed}"; }
 477 echo "check renewing MIT interface" > messages.log
 478 ${kinit} --renewable --password-file=${objdir}/foopassword foo@$R || \
 479         { ec=1 ; eval "${testfailed}"; }
 480 echo "test_renew"
 481 env KRB5CCNAME=${cache} ${test_renew} || \
 482         { ec=1 ; eval "${testfailed}"; }
 483 ${kdestroy}
 484
 485 echo "checking server aliases"; > messages.log
 486 ${kinit} --password-file=${objdir}/foopassword foo@$R || \
 487         { ec=1 ; eval "${testfailed}"; }
 488 echo "Getting tickets"; > messages.log
 489 ${kgetcred} ${alias1}@${R} || { ec=1 ; eval "${testfailed}"; }
 490 ${kgetcred} ${alias2}@${R} || { ec=1 ; eval "${testfailed}"; }
 491 echo "   verify entry in keytab"
 492 ${test_ap_req} ${alias1}@${R} ${keytab} ${cache} || \
 493         { ec=1 ; eval "${testfailed}"; }
 494 echo "   verify entry in keytab with any"
 495 ${test_ap_req} --server-any ${alias1}@${R} ${keytab} ${cache} || \
 496         { ec=1 ; eval "${testfailed}"; }
 497 echo "   verify failure with alias entry"
 498 ${test_ap_req} ${alias2}@${R} ${keytab} ${cache} 2>/dev/null && \
 499         { ec=1 ; eval "${testfailed}"; }
 500 echo "   verify alias entry in keytab with any"
 501 ${test_ap_req} --server-any ${alias2}@${R} ${keytab} ${cache} || \
 502         { ec=1 ; eval "${testfailed}"; }
 503 ${kdestroy}
 504
 505 echo "testing removal of keytab"
 506 ${ktutil} -k ${keytab} destroy || { ec=1 ; eval "${testfailed}"; }
 507 test -f ${keytabfile} && { ec=1 ; eval "${testfailed}"; }
 508
 509 echo "Getting client pw expire"; > messages.log
 510 ${kinit} --password-file=${objdir}/foopassword \
 511         pw-expire@${R} 2>kinit-log.tmp|| \
 512         { ec=1 ; eval "${testfailed}"; }
 513 grep 'Your password will expire' kinit-log.tmp > /dev/null || \
 514         { ec=1 ; eval "${testfailed}"; }
 515 echo "   kinit passes"
 516 ${test_gic} --client=pw-expire@${R} --password=foo > kinit-log.tmp 2>/dev/null
 517 ${EGREP} "^e type: 6" kinit-log.tmp > /dev/null  || \
 518         { ec=1 ; eval "${testfailed}"; }
 519 echo "   test_gic passes"
 520 ${kdestroy}
 521
 522 echo "killing kdc (${kdcpid})"
 523 sh ${srcdir}/leaks-kill.sh kdc $kdcpid || exit 1
 524
 525 trap "" EXIT
 526
 527 exit $ec