testprogs/blackbox/test_pkinit_pac.sh

   1 #!/bin/sh
   2 # Blackbox tests for pkinit and pac verification
   3 #
   4 # Copyright (C) 2006-2008 Stefan Metzmacher
   5 # Copyright (C) 2022      Andreas Schneider
   6
   7 if [ $# -lt 6 ]; then
   8         cat <<EOF
   9 Usage: test_pkinit_pac.sh SERVER USERNAME PASSWORD REALM DOMAIN PREFIX
  10 EOF
  11         exit 1
  12 fi
  13
  14 SERVER=$1
  15 USERNAME=$2
  16 PASSWORD=$3
  17 REALM=$4
  18 DOMAIN=$5
  19 PREFIX=$6
  20 shift 6
  21 failed=0
  22
  23 samba_bindir="$BINDIR"
  24
  25 samba_smbtorture="${samba_bindir}/smbtorture --basedir=$SELFTEST_TMPDIR"
  26
  27 . "$(dirname "$0")"/subunit.sh
  28 . "$(dirname "$0")"/common_test_fns.inc
  29
  30 samba_kinit=$(system_or_builddir_binary kinit "${BINDIR}" samba4kinit)
  31
  32 KRB5CCNAME_PATH="$PREFIX/tmpccache"
  33 rm -f "${KRB5CCNAME_PATH}"
  34 KRB5CCNAME="FILE:$KRB5CCNAME_PATH"
  35 export KRB5CCNAME
  36
  37 USER_PRINCIPAL_NAME="$(echo "${USERNAME}@${REALM}" | tr "[:upper:]" "[:lower:]")"
  38
  39 kbase="$(basename "${samba_kinit}")"
  40 if [ "${kbase}" = "samba4kinit" ]; then
  41         # HEIMDAL
  42         X509_USER_IDENTITY="--pk-user=FILE:${PREFIX}/pkinit/USER-${USER_PRINCIPAL_NAME}-cert.pem,${PREFIX}/pkinit/USER-${USER_PRINCIPAL_NAME}-private-key.pem"
  43         OPTION_RENEWABLE="--renewable"
  44 else
  45         X509_USER_IDENTITY="-X X509_user_identity=FILE:${PREFIX}/pkinit/USER-${USER_PRINCIPAL_NAME}-cert.pem,${PREFIX}/pkinit/USER-${USER_PRINCIPAL_NAME}-private-key.pem"
  46         OPTION_RENEWABLE="-r 1h"
  47 fi
  48 OPTION_REQUEST_PAC="--request-pac"
  49
  50 testit "STEP1 kinit with pkinit (name specified)" \
  51         "${samba_kinit}" "${OPTION_REQUEST_PAC}" "${OPTION_RENEWABLE}" \
  52         "${X509_USER_IDENTITY}" "${USERNAME}@${REALM}" ||
  53         failed=$((failed + 1))
  54 testit "STEP1 remote.pac verification" \
  55         "${samba_smbtorture}" ncacn_np:"${SERVER}" rpc.pac \
  56         --workgroup="${DOMAIN}" -U"${USERNAME}%${PASSWORD}" \
  57         --option=torture:pkinit_ccache="${KRB5CCNAME}" ||
  58         failed=$((failed + 1))
  59
  60 rm -f "${KRB5CCNAME_PATH}"
  61 exit ${failed}