s4:selftest: test ntvfs.cifs with s4u2proxy

[kai/samba.git] / selftest / target / Samba4.pm

diff --git a/selftest/target/Samba4.pm b/selftest/target/Samba4.pm
index 2a3fe65e74f387848d51333f450cdf9a601ed08e..70e3cf7b1b795764ccf9c5932e6a3e27374faf8c 100644 (file)
--- a/selftest/target/Samba4.pm
+++ b/selftest/target/Samba4.pm
@@ -736,10 +736,11 @@ sub provision($$$$$$$$$)
 
        max xmit = 32K
        server max protocol = SMB2
-        $extra_smbconf_options
        host msdfs = $msdfs
        lanman auth = yes
 
+       $extra_smbconf_options
+
 [tmp]
        path = $ctx->{tmpdir}
        read only = no
@@ -766,8 +767,10 @@ sub provision($$$$$$$$$)
        ntvfs handler = cifs
        cifs:server = $ctx->{netbiosname}
        cifs:share = tmp
-#There is no username specified here, instead the client is expected
-#to log in with kerberos, and the serverwill use delegated credentials.
+       cifs:use-s4u2proxy = yes
+       # There is no username specified here, instead the client is expected
+       # to log in with kerberos, and the serverwill use delegated credentials.
+       # Or the server tries s4u2self/s4u2proxy to impersonate the client
 
 [simple]
        path = $ctx->{tmpdir}
@@ -877,9 +880,23 @@ sub provision_rpc_proxy($$$)
        my ($self, $prefix, $dcvars) = @_;
        print "PROVISIONING RPC PROXY...";
 
-       my $extra_smbconf_options = "dcerpc_remote:binding = ncacn_ip_tcp:$dcvars->{SERVER}
-       dcerpc endpoint servers = epmapper, remote
-       dcerpc_remote:interfaces = rpcecho
+       my $extra_smbconf_options = "
+
+       # rpc_proxy
+       dcerpc_remote:binding = ncacn_ip_tcp:$dcvars->{SERVER}
+       dcerpc endpoint servers = epmapper, remote
+       dcerpc_remote:interfaces = rpcecho
+
+[cifs_to_dc]
+       read only = no
+       ntvfs handler = cifs
+       cifs:server = $dcvars->{SERVER}
+       cifs:share = cifs
+       cifs:use-s4u2proxy = yes
+       # There is no username specified here, instead the client is expected
+       # to log in with kerberos, and the serverwill use delegated credentials.
+       # Or the server tries s4u2self/s4u2proxy to impersonate the client
+
 ";
 
        my $ret = $self->provision($prefix,
@@ -898,6 +915,8 @@ sub provision_rpc_proxy($$$)
        }
 
        my $samba_tool =  Samba::bindir_path($self, "samba-tool");
+
+       # The joind runs in the context of the rpc_proxy/member for now
        my $cmd = "";
        $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$ret->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
        $cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
@@ -909,6 +928,30 @@ sub provision_rpc_proxy($$$)
                return undef;
        }
 
+       # Setting up delegation runs in the context of the DC for now
+       my $cmd = "";
+       $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$dcvars->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
+       $cmd .= "KRB5_CONFIG=\"$dcvars->{KRB5_CONFIG}\" ";
+       $cmd .= "$samba_tool delegation for-any-protocol '$ret->{NETBIOSNAME}\$' on";
+       $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD} $dcvars->{CONFIGURATION}";
+
+       unless (system($cmd) == 0) {
+               warn("Delegation failed\n$cmd");
+               return undef;
+       }
+
+       # Setting up delegation runs in the context of the DC for now
+       my $cmd = "";
+       $cmd .= "SOCKET_WRAPPER_DEFAULT_IFACE=\"$dcvars->{SOCKET_WRAPPER_DEFAULT_IFACE}\" ";
+       $cmd .= "KRB5_CONFIG=\"$dcvars->{KRB5_CONFIG}\" ";
+       $cmd .= "$samba_tool delegation add-service '$ret->{NETBIOSNAME}\$' cifs/$dcvars->{SERVER}";
+       $cmd .= " -U$dcvars->{DC_USERNAME}\%$dcvars->{DC_PASSWORD} $dcvars->{CONFIGURATION}";
+
+       unless (system($cmd) == 0) {
+               warn("Delegation failed\n$cmd");
+               return undef;
+       }
+
        $ret->{RPC_PROXY_SERVER} = $ret->{SERVER};
        $ret->{RPC_PROXY_SERVER_IP} = $ret->{SERVER_IP};
        $ret->{RPC_PROXY_NETBIOSNAME} = $ret->{NETBIOSNAME};