python/tests/krb5: Prepare for PKINIT tests with UF_SMARTCARD_REQUIRED

[anoopcs/samba-autobuild/.git] / python / samba / tests / krb5 / raw_testcase.py

diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py
index 7fe11387bac02fa6d595e24be058124b949931ee..72e5f41cfaa935a9219957e8055d8e357a1921b7 100644 (file)
--- a/python/samba/tests/krb5/raw_testcase.py
+++ b/python/samba/tests/krb5/raw_testcase.py
@@ -54,7 +54,9 @@ from samba.dcerpc.misc import (
     SEC_CHAN_WKSTA,
     SEC_CHAN_BDC,
 )
-
+from samba.dsdb import (
+    UF_SMARTCARD_REQUIRED
+)
 import samba.tests
 from samba.tests import TestCase
 
@@ -408,6 +410,7 @@ class KerberosCredentials(Credentials):
         'spn',
         'tgs_supported_enctypes',
         'upn',
+        'user_account_control'
     ]
 
     non_etype_bits = (
@@ -439,6 +442,8 @@ class KerberosCredentials(Credentials):
         self.sid = None
         self.account_type = None
 
+        self.user_account_control = None
+
         self._private_key = None
 
     def set_as_supported_enctypes(self, value):
@@ -450,6 +455,9 @@ class KerberosCredentials(Credentials):
     def set_ap_supported_enctypes(self, value):
         self.ap_supported_enctypes = int(value)
 
+    def set_user_account_control(self, value):
+        self.user_account_control = int(value)
+
     etype_map = collections.OrderedDict([
         (kcrypto.Enctype.AES256,
             security.KERB_ENCTYPE_AES256_CTS_HMAC_SHA1_96),
@@ -4772,7 +4780,10 @@ class RawKerberosTest(TestCase):
 
                 creds = kdc_exchange_dict['creds']
                 nt_password = bytes(ntlm_package.nt_password.hash)
-                self.assertEqual(creds.get_nt_hash(), nt_password)
+                if creds.user_account_control & UF_SMARTCARD_REQUIRED:
+                    self.assertNotEqual(creds.get_nt_hash(), nt_password)
+                else:
+                    self.assertEqual(creds.get_nt_hash(), nt_password)
 
                 lm_password = bytes(ntlm_package.lm_password.hash)
                 self.assertEqual(bytes(16), lm_password)