2 # Blackbox tests for kinit and kerberos integration with smbclient etc
3 # Copyright (C) 2006-2007 Jelmer Vernooij <jelmer@samba.org>
4 # Copyright (C) 2006-2008 Andrew Bartlett <abartlet@samba.org>
8 Usage: test_kinit.sh SERVER USERNAME REALM DOMAIN PREFIX SMBCLIENT
24 samba4bindir="$BINDIR"
25 samba4srcdir="$SRCDIR/source4"
27 samba4kinit_binary=kinit
29 if test -x $BINDIR/samba4kinit; then
31 samba4kinit_binary=bin/samba4kinit
34 machineaccountccache="$samba4srcdir/scripting/bin/machineaccountccache"
38 . $(dirname $0)/subunit.sh
39 . $(dirname $0)/common_test_fns.inc
48 echo $VALGRIND $PYTHON $samba4bindir/samba-tool drs $function $SERVER -k yes "$@"
49 $VALGRIND $PYTHON $samba4bindir/samba-tool drs $function $SERVER -k yes "$@"
51 if [ x$status = x0 ]; then
61 KRB5CCNAME="$PREFIX/tmpccache"
62 samba4kinit="$samba4kinit_binary -c $KRB5CCNAME"
66 if [ $heimdal -eq 1 ]; then
67 testit "kinit with keytab" $samba4kinit $enctype -t $PROVDIR/private/secrets.keytab --use-keytab $USERNAME || failed=$(expr $failed + 1)
69 testit "kinit with keytab" $samba4kinit -k -t $PROVDIR/private/secrets.keytab $USERNAME || failed=$(expr $failed + 1)
72 #This is important because it puts the ticket for the old KVNO and password into a local ccache
73 test_smbclient "Test login with kerberos ccache before password change" 'ls' "$unc" --use-krb5-ccache=$KRB5CCNAME || failed=$(expr $failed + 1)
75 #check that drs bind works before we change the password (prime the ccache)
76 test_drs bind "Test drs bind with with kerberos ccache" || failed=$(expr $failed + 1)
78 #check that drs options works before we change the password (prime the ccache)
79 test_drs options "Test drs options with with kerberos ccache" || failed=$(expr $failed + 1)
81 testit "change dc password" $PYTHON $samba4srcdir/scripting/devel/chgtdcpass --configfile=$PROVDIR/etc/smb.conf || failed=$(expr $failed + 1)
83 #This is important because it shows that the old ticket remains valid (as it must) for incoming connections after the DC password is changed
84 test_smbclient "Test login with kerberos ccache after password change" 'ls' "$unc" --use-krb5-ccache=$KRB5CCNAME || failed=$(expr $failed + 1)
86 #check that drs bind works after we change the password
87 test_drs bind "Test drs bind with new password" || failed=$(expr $failed + 1)
89 #check that drs options works after we change the password
90 test_drs options "Test drs options with new password" || failed=$(expr $failed + 1)
92 testit "change dc password (2nd time)" $PYTHON $samba4srcdir/scripting/devel/chgtdcpass --configfile=$PROVDIR/etc/smb.conf || failed=$(expr $failed + 1)
94 # This is important because it shows that the old ticket is discarded if the server rejects it (as it must) after the password was changed twice in succession.
95 # This also ensures we handle the case where the domain is re-provisioned etc
96 test_smbclient "Test login with kerberos ccache after 2nd password change" 'ls' "$unc" --use-krb5-ccache=$KRB5CCNAME || failed=$(expr $failed + 1)
98 #check that drs bind works after we change the password a 2nd time
99 test_drs bind "Test drs bind after 2nd password change" || failed=$(expr $failed + 1)
101 #check that drs options works after we change the password a 2nd time
102 test_drs options "Test drs options after 2nd password change" || failed=$(expr $failed + 1)
104 #This confirms that the DC password is valid for a kinit too
105 if [ $heimdal -eq 1 ]; then
106 testit "kinit with keytab" $samba4kinit $enctype -t $PROVDIR/private/secrets.keytab --use-keytab $USERNAME || failed=$(expr $failed + 1)
108 testit "kinit with keytab" $samba4kinit -k -t $PROVDIR/private/secrets.keytab $USERNAME || failed=$(expr $failed + 1)
110 test_smbclient "Test login with kerberos ccache with fresh kinit" 'ls' "$unc" --use-krb5-ccache=$KRB5CCNAME || failed=$(expr $failed + 1)
114 rm -f $PREFIX/tmpccache tmpccfile tmppassfile tmpuserpassfile tmpuserccache