2 # Blackbox tests for kinit and kerberos integration with smbclient etc
3 # Copyright (C) 2006-2007 Jelmer Vernooij <jelmer@samba.org>
4 # Copyright (C) 2006-2008 Andrew Bartlett <abartlet@samba.org>
8 Usage: test_passwords.sh SERVER USERNAME PASSWORD REALM DOMAIN PREFIX
22 samba4bindir="$BUILDDIR/bin"
23 smbclient="$samba4bindir/smbclient$EXEEXT"
24 samba4kinit="$samba4bindir/samba4kinit$EXEEXT"
25 net="$samba4bindir/net$EXEEXT"
26 rkpty="$samba4bindir/rkpty$EXEEXT"
27 samba4kpasswd="$samba4bindir/samba4kpasswd$EXEEXT"
28 enableaccount="$PYTHON `dirname $0`/../../source4/setup/enableaccount"
29 setpassword="$PYTHON `dirname $0`/../../source4/setup/setpassword"
30 newuser="$PYTHON `dirname $0`/../../source4/setup/newuser"
32 . `dirname $0`/subunit.sh
40 $VALGRIND $smbclient //$SERVER/tmp -c "$cmd" -W "$DOMAIN" $@
42 if [ x$status = x0 ]; then
52 testit "create user locally" $VALGRIND $newuser nettestuser $USERPASS $@ || failed=`expr $failed + 1`
54 KRB5CCNAME="$PREFIX/tmpuserccache"
57 echo $USERPASS > $PREFIX/tmpuserpassfile
59 testit "kinit with user password" $samba4kinit --password-file=$PREFIX/tmpuserpassfile --request-pac nettestuser@$REALM || failed=`expr $failed + 1`
61 test_smbclient "Test login with user kerberos ccache" 'ls' -k yes || failed=`expr $failed + 1`
63 NEWUSERPASS=testPaSS@02%
64 testit "change user password with 'net password change' (unforced)" $VALGRIND $net password change -W$DOMAIN -U$DOMAIN\\nettestuser%$USERPASS -k no $NEWUSERPASS $@ || failed=`expr $failed + 1`
66 echo $NEWUSERPASS > ./tmpuserpassfile
67 testit "kinit with user password" $samba4kinit --password-file=./tmpuserpassfile --request-pac nettestuser@$REALM || failed=`expr $failed + 1`
69 test_smbclient "Test login with user kerberos ccache" 'ls' -k yes || failed=`expr $failed + 1`
73 NEWUSERPASS=testPaSS@03%
75 cat > ./tmpkpasswdscript <<EOF
77 password ${USERPASS}\n
85 testit "change user password with kpasswd" $rkpty ./tmpkpasswdscript $samba4kpasswd nettestuser@$REALM || failed=`expr $failed + 1`
87 test_smbclient "Test login with user kerberos (unforced)" 'ls' -k yes -Unettestuser@$REALM%$NEWUSERPASS || failed=`expr $failed + 1`
90 NEWUSERPASS=testPaSS@04%
91 testit "set password on user locally" $VALGRIND $setpassword nettestuser --newpassword=$NEWUSERPASS --must-change-at-next-login $@ || failed=`expr $failed + 1`
94 NEWUSERPASS=testPaSS@05%
95 testit "change user password with 'net password change' (after must change flag set)" $VALGRIND $net password change -W$DOMAIN -U$DOMAIN\\nettestuser%$USERPASS -k no $NEWUSERPASS $@ || failed=`expr $failed + 1`
98 NEWUSERPASS=testPaSS@06%
99 testit "set password on user locally" $VALGRIND $setpassword nettestuser --newpassword=$NEWUSERPASS --must-change-at-next-login $@ || failed=`expr $failed + 1`
100 USERPASS=$NEWUSERPASS
102 NEWUSERPASS=testPaSS@07%
104 cat > ./tmpkpasswdscript <<EOF
106 password ${USERPASS}\n
108 send ${NEWUSERPASS}\n
110 send ${NEWUSERPASS}\n
114 testit "change user password with kpasswd (after must change flag set)" $rkpty ./tmpkpasswdscript $samba4kpasswd nettestuser@$REALM || failed=`expr $failed + 1`
115 USERPASS=$NEWUSERPASS
117 test_smbclient "Test login with user kerberos" 'ls' -k yes -Unettestuser@$REALM%$NEWUSERPASS || failed=`expr $failed + 1`
119 testit "reset password policies" $VALGRIND $samba4bindir/net pwsettings set --configfile=$PREFIX/dc/etc/smb.conf --complexity=default --history-length=default --min-pwd-length=default --min-pwd-age=default --max-pwd-age=default || failed=`expr $failed + 1`
122 testit_expect_failure "try to set a non-complex password (command should not succeed)" $VALGRIND $net password change -W$DOMAIN -U$DOMAIN\\nettestuser%$USERPASS -k no $NEWUSERPASS $@ && failed=`expr $failed + 1`
124 testit "allow non-complex passwords" $VALGRIND $samba4bindir/net pwsettings set --configfile=$PREFIX/dc/etc/smb.conf --complexity=off || failed=`expr $failed + 1`
126 testit "try to set a non-complex password (command should succeed)" $VALGRIND $net password change -W$DOMAIN -U$DOMAIN\\nettestuser%$USERPASS -k no $NEWUSERPASS $@ || failed=`expr $failed + 1`
127 USERPASS=$NEWUSERPASS
129 test_smbclient "test login with non-complex password" 'ls' -k no -Unettestuser@$REALM%$USERPASS || failed=`expr $failed + 1`
132 testit_expect_failure "try to set a short password (command should not succeed)" $VALGRIND $net password change -W$DOMAIN -U$DOMAIN\\nettestuser%$USERPASS -k no $NEWUSERPASS $@ && failed=`expr $failed + 1`
134 testit "allow short passwords (length 1)" $VALGRIND $samba4bindir/net pwsettings set --configfile=$PREFIX/dc/etc/smb.conf --min-pwd-length=1 || failed=`expr $failed + 1`
136 testit "try to set a short password (command should succeed)" $VALGRIND $net password change -W$DOMAIN -U$DOMAIN\\nettestuser%$USERPASS -k no $NEWUSERPASS $@ || failed=`expr $failed + 1`
137 USERPASS=$NEWUSERPASS
139 testit "require minimum password age of 1 day" $VALGRIND $samba4bindir/net pwsettings set --configfile=$PREFIX/dc/etc/smb.conf --min-pwd-age=1 || failed=`expr $failed + 1`
141 NEWUSERPASS=testPaSS@08%
142 testit_expect_failure "try to change password too quickly (command should not succeed)" $VALGRIND $net password change -W$DOMAIN -U$DOMAIN\\nettestuser%$USERPASS -k no $NEWUSERPASS $@ && failed=`expr $failed + 1`
144 testit "reset password policies" $VALGRIND $samba4bindir/net pwsettings set --configfile=$PREFIX/dc/etc/smb.conf --complexity=default --history-length=default --min-pwd-length=default --min-pwd-age=default --max-pwd-age=default || failed=`expr $failed + 1`
146 testit "del user" $VALGRIND $net user delete nettestuser -U"$USERNAME%$PASSWORD" -k no $@ || failed=`expr $failed + 1`
148 rm -f tmpccfile tmppassfile tmpuserpassfile tmpuserccache tmpkpasswdscript