|
Packit Service |
99d1c0 |
from k5test import *
|
|
Packit Service |
99d1c0 |
import time
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Run kdbtest against the non-LDAP KDB modules.
|
|
Packit Service |
99d1c0 |
for realm in multidb_realms(create_kdb=False):
|
|
Packit Service |
99d1c0 |
realm.run(['./kdbtest'])
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Set up an OpenLDAP test server if we can.
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
if (not os.path.exists(os.path.join(plugins, 'kdb', 'kldap.so')) and
|
|
Packit Service |
99d1c0 |
not os.path.exists(os.path.join(buildtop, 'lib', 'libkdb_ldap.a'))):
|
|
Packit Service |
99d1c0 |
skip_rest('LDAP KDB tests', 'LDAP KDB module not built')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
if 'SLAPD' not in os.environ and not which('slapd'):
|
|
Packit Service |
99d1c0 |
skip_rest('LDAP KDB tests', 'slapd not found')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
slapadd = which('slapadd')
|
|
Packit Service |
99d1c0 |
if not slapadd:
|
|
Packit Service |
99d1c0 |
skip_rest('LDAP KDB tests', 'slapadd not found')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
ldapdir = os.path.abspath('ldap')
|
|
Packit Service |
99d1c0 |
dbdir = os.path.join(ldapdir, 'ldap')
|
|
Packit Service |
99d1c0 |
slapd_conf = os.path.join(ldapdir, 'slapd.d')
|
|
Packit Service |
99d1c0 |
slapd_out = os.path.join(ldapdir, 'slapd.out')
|
|
Packit Service |
99d1c0 |
slapd_pidfile = os.path.join(ldapdir, 'pid')
|
|
Packit Service |
99d1c0 |
ldap_pwfile = os.path.join(ldapdir, 'pw')
|
|
Packit Service |
99d1c0 |
ldap_sock = os.path.join(ldapdir, 'sock')
|
|
Packit Service |
99d1c0 |
ldap_uri = 'ldapi://%s/' % ldap_sock.replace(os.path.sep, '%2F')
|
|
Packit Service |
99d1c0 |
schema = os.path.join(srctop, 'plugins', 'kdb', 'ldap', 'libkdb_ldap',
|
|
Packit Service |
99d1c0 |
'kerberos.openldap.ldif')
|
|
Packit Service |
99d1c0 |
top_dn = 'cn=krb5'
|
|
Packit Service |
99d1c0 |
admin_dn = 'cn=admin,cn=krb5'
|
|
Packit Service |
99d1c0 |
admin_pw = 'admin'
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
shutil.rmtree(ldapdir, True)
|
|
Packit Service |
99d1c0 |
os.mkdir(ldapdir)
|
|
Packit Service |
99d1c0 |
os.mkdir(slapd_conf)
|
|
Packit Service |
99d1c0 |
os.mkdir(dbdir)
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
if 'SLAPD' in os.environ:
|
|
Packit Service |
99d1c0 |
slapd = os.environ['SLAPD']
|
|
Packit Service |
99d1c0 |
else:
|
|
Packit Service |
99d1c0 |
# Some Linux installations have AppArmor or similar restrictions
|
|
Packit Service |
99d1c0 |
# on the slapd binary, which would prevent it from accessing the
|
|
Packit Service |
99d1c0 |
# build directory. Try to defeat this by copying the binary.
|
|
Packit Service |
99d1c0 |
system_slapd = which('slapd')
|
|
Packit Service |
99d1c0 |
slapd = os.path.join(ldapdir, 'slapd')
|
|
Packit Service |
99d1c0 |
shutil.copy(system_slapd, slapd)
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
def slap_add(ldif):
|
|
Packit Service |
99d1c0 |
proc = subprocess.Popen([slapadd, '-b', 'cn=config', '-F', slapd_conf],
|
|
Packit Service |
99d1c0 |
stdin=subprocess.PIPE, stdout=subprocess.PIPE,
|
|
Packit Service |
99d1c0 |
stderr=subprocess.STDOUT, universal_newlines=True)
|
|
Packit Service |
99d1c0 |
(out, dummy) = proc.communicate(ldif)
|
|
Packit Service |
99d1c0 |
output(out)
|
|
Packit Service |
99d1c0 |
return proc.wait()
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Configure the pid file and some authorization rules we will need for
|
|
Packit Service |
99d1c0 |
# SASL testing.
|
|
Packit Service |
99d1c0 |
if slap_add('dn: cn=config\n'
|
|
Packit Service |
99d1c0 |
'objectClass: olcGlobal\n'
|
|
Packit Service |
99d1c0 |
'olcPidFile: %s\n'
|
|
Packit Service |
99d1c0 |
'olcAuthzRegexp: '
|
|
Packit Service |
99d1c0 |
'".*uidNumber=%d,cn=peercred,cn=external,cn=auth" "%s"\n'
|
|
Packit Service |
99d1c0 |
'olcAuthzRegexp: "uid=digestuser,cn=digest-md5,cn=auth" "%s"\n' %
|
|
Packit Service |
99d1c0 |
(slapd_pidfile, os.geteuid(), admin_dn, admin_dn)) != 0:
|
|
Packit Service |
99d1c0 |
skip_rest('LDAP KDB tests', 'slapd basic configuration failed')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Find a working writable database type, trying mdb (added in OpenLDAP
|
|
Packit Service |
99d1c0 |
# 2.4.27) and bdb (deprecated and sometimes not built due to licensing
|
|
Packit Service |
99d1c0 |
# incompatibilities).
|
|
Packit Service |
99d1c0 |
for dbtype in ('mdb', 'bdb'):
|
|
Packit Service |
99d1c0 |
# Try to load the module. This could fail if OpenLDAP is built
|
|
Packit Service |
99d1c0 |
# without module support, so ignore errors.
|
|
Packit Service |
99d1c0 |
slap_add('dn: cn=module,cn=config\n'
|
|
Packit Service |
99d1c0 |
'objectClass: olcModuleList\n'
|
|
Packit Service |
99d1c0 |
'olcModuleLoad: back_%s\n' % dbtype)
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
dbclass = 'olc%sConfig' % dbtype.capitalize()
|
|
Packit Service |
99d1c0 |
if slap_add('dn: olcDatabase=%s,cn=config\n'
|
|
Packit Service |
99d1c0 |
'objectClass: olcDatabaseConfig\n'
|
|
Packit Service |
99d1c0 |
'objectClass: %s\n'
|
|
Packit Service |
99d1c0 |
'olcSuffix: %s\n'
|
|
Packit Service |
99d1c0 |
'olcRootDN: %s\n'
|
|
Packit Service |
99d1c0 |
'olcRootPW: %s\n'
|
|
Packit Service |
99d1c0 |
'olcDbDirectory: %s\n' %
|
|
Packit Service |
99d1c0 |
(dbtype, dbclass, top_dn, admin_dn, admin_pw, dbdir)) == 0:
|
|
Packit Service |
99d1c0 |
break
|
|
Packit Service |
99d1c0 |
else:
|
|
Packit Service |
99d1c0 |
skip_rest('LDAP KDB tests', 'could not find working slapd db type')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
if slap_add('include: file://%s\n' % schema) != 0:
|
|
Packit Service |
99d1c0 |
skip_rest('LDAP KDB tests', 'failed to load Kerberos schema')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Load the core schema if we can.
|
|
Packit Service |
99d1c0 |
ldap_homes = ['/etc/ldap', '/etc/openldap', '/usr/local/etc/openldap',
|
|
Packit Service |
99d1c0 |
'/usr/local/etc/ldap']
|
|
Packit Service |
99d1c0 |
local_schema_path = '/schema/core.ldif'
|
|
Packit Service |
99d1c0 |
core_schema = next((i for i in map(lambda x:x+local_schema_path, ldap_homes)
|
|
Packit Service |
99d1c0 |
if os.path.isfile(i)), None)
|
|
Packit Service |
99d1c0 |
if core_schema:
|
|
Packit Service |
99d1c0 |
if slap_add('include: file://%s\n' % core_schema) != 0:
|
|
Packit Service |
99d1c0 |
core_schema = None
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
slapd_pid = -1
|
|
Packit Service |
99d1c0 |
def kill_slapd():
|
|
Packit Service |
99d1c0 |
global slapd_pid
|
|
Packit Service |
99d1c0 |
if slapd_pid != -1:
|
|
Packit Service |
99d1c0 |
os.kill(slapd_pid, signal.SIGTERM)
|
|
Packit Service |
99d1c0 |
slapd_pid = -1
|
|
Packit Service |
99d1c0 |
atexit.register(kill_slapd)
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
out = open(slapd_out, 'w')
|
|
Packit Service |
99d1c0 |
subprocess.call([slapd, '-h', ldap_uri, '-F', slapd_conf], stdout=out,
|
|
Packit Service |
99d1c0 |
stderr=out, universal_newlines=True)
|
|
Packit Service |
99d1c0 |
out.close()
|
|
Packit Service |
99d1c0 |
pidf = open(slapd_pidfile, 'r')
|
|
Packit Service |
99d1c0 |
slapd_pid = int(pidf.read())
|
|
Packit Service |
99d1c0 |
pidf.close()
|
|
Packit Service |
99d1c0 |
output('*** Started slapd (pid %d, output in %s)\n' % (slapd_pid, slapd_out))
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# slapd detaches before it finishes setting up its listener sockets
|
|
Packit Service |
99d1c0 |
# (they are bound but listen() has not been called). Give it a second
|
|
Packit Service |
99d1c0 |
# to finish.
|
|
Packit Service |
99d1c0 |
time.sleep(1)
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Run kdbtest against the LDAP module.
|
|
Packit Service |
99d1c0 |
conf = {'realms': {'$realm': {'database_module': 'ldap'}},
|
|
Packit Service |
99d1c0 |
'dbmodules': {'ldap': {'db_library': 'kldap',
|
|
Packit Service |
99d1c0 |
'ldap_kerberos_container_dn': top_dn,
|
|
Packit Service |
99d1c0 |
'ldap_kdc_dn': admin_dn,
|
|
Packit Service |
99d1c0 |
'ldap_kadmind_dn': admin_dn,
|
|
Packit Service |
99d1c0 |
'ldap_service_password_file': ldap_pwfile,
|
|
Packit Service |
99d1c0 |
'ldap_servers': ldap_uri}}}
|
|
Packit Service |
99d1c0 |
realm = K5Realm(create_kdb=False, kdc_conf=conf)
|
|
Packit Service |
99d1c0 |
input = admin_pw + '\n' + admin_pw + '\n'
|
|
Packit Service |
99d1c0 |
realm.run([kdb5_ldap_util, 'stashsrvpw', admin_dn], input=input)
|
|
Packit Service |
99d1c0 |
realm.run(['./kdbtest'])
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Run a kdb5_ldap_util command using the test server's admin DN and password.
|
|
Packit Service |
99d1c0 |
def kldaputil(args, **kw):
|
|
Packit Service |
99d1c0 |
return realm.run([kdb5_ldap_util, '-D', admin_dn, '-w', admin_pw] + args,
|
|
Packit Service |
99d1c0 |
**kw)
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# kdbtest can't currently clean up after itself since the LDAP module
|
|
Packit Service |
99d1c0 |
# doesn't support krb5_db_destroy. So clean up after it with
|
|
Packit Service |
99d1c0 |
# kdb5_ldap_util before proceeding.
|
|
Packit Service |
99d1c0 |
kldaputil(['destroy', '-f'])
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
ldapmodify = which('ldapmodify')
|
|
Packit Service |
99d1c0 |
ldapsearch = which('ldapsearch')
|
|
Packit Service |
99d1c0 |
if not ldapmodify or not ldapsearch:
|
|
Packit Service |
99d1c0 |
skip_rest('some LDAP KDB tests', 'ldapmodify or ldapsearch not found')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
def ldap_search(args):
|
|
Packit Service |
99d1c0 |
proc = subprocess.Popen([ldapsearch, '-H', ldap_uri, '-b', top_dn,
|
|
Packit Service |
99d1c0 |
'-D', admin_dn, '-w', admin_pw, args],
|
|
Packit Service |
99d1c0 |
stdin=subprocess.PIPE, stdout=subprocess.PIPE,
|
|
Packit Service |
99d1c0 |
stderr=subprocess.STDOUT, universal_newlines=True)
|
|
Packit Service |
99d1c0 |
(out, dummy) = proc.communicate()
|
|
Packit Service |
99d1c0 |
return out
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
def ldap_modify(ldif, args=[]):
|
|
Packit Service |
99d1c0 |
proc = subprocess.Popen([ldapmodify, '-H', ldap_uri, '-D', admin_dn,
|
|
Packit Service |
99d1c0 |
'-x', '-w', admin_pw] + args,
|
|
Packit Service |
99d1c0 |
stdin=subprocess.PIPE, stdout=subprocess.PIPE,
|
|
Packit Service |
99d1c0 |
stderr=subprocess.STDOUT, universal_newlines=True)
|
|
Packit Service |
99d1c0 |
(out, dummy) = proc.communicate(ldif)
|
|
Packit Service |
99d1c0 |
output(out)
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
def ldap_add(dn, objectclass, attrs=[]):
|
|
Packit Service |
99d1c0 |
in_data = 'dn: %s\nobjectclass: %s\n' % (dn, objectclass)
|
|
Packit Service |
99d1c0 |
in_data += '\n'.join(attrs) + '\n'
|
|
Packit Service |
99d1c0 |
ldap_modify(in_data, ['-a'])
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Create krbContainer objects for use as subtrees.
|
|
Packit Service |
99d1c0 |
ldap_add('cn=t1,cn=krb5', 'krbContainer')
|
|
Packit Service |
99d1c0 |
ldap_add('cn=t2,cn=krb5', 'krbContainer')
|
|
Packit Service |
99d1c0 |
ldap_add('cn=x,cn=t1,cn=krb5', 'krbContainer')
|
|
Packit Service |
99d1c0 |
ldap_add('cn=y,cn=t2,cn=krb5', 'krbContainer')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Create a realm, exercising all of the realm options.
|
|
Packit Service |
99d1c0 |
kldaputil(['create', '-s', '-P', 'master', '-subtrees', 'cn=t2,cn=krb5',
|
|
Packit Service |
99d1c0 |
'-containerref', 'cn=t2,cn=krb5', '-sscope', 'one',
|
|
Packit Service |
99d1c0 |
'-maxtktlife', '5min', '-maxrenewlife', '10min', '-allow_svr'])
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Modify the realm, exercising overlapping subtree pruning.
|
|
Packit Service |
99d1c0 |
kldaputil(['modify', '-subtrees',
|
|
Packit Service |
99d1c0 |
'cn=x,cn=t1,cn=krb5:cn=t1,cn=krb5:cn=t2,cn=krb5:cn=y,cn=t2,cn=krb5',
|
|
Packit Service |
99d1c0 |
'-containerref', 'cn=t1,cn=krb5', '-sscope', 'sub',
|
|
Packit Service |
99d1c0 |
'-maxtktlife', '5hour', '-maxrenewlife', '10hour', '+allow_svr'])
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
out = kldaputil(['list'])
|
|
Packit Service |
99d1c0 |
if out != 'KRBTEST.COM\n':
|
|
Packit Service |
99d1c0 |
fail('Unexpected kdb5_ldap_util list output')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Create a principal at a specified DN. This is a little dodgy
|
|
Packit Service |
99d1c0 |
# because we're sticking a krbPrincipalAux objectclass onto a subtree
|
|
Packit Service |
99d1c0 |
# krbContainer, but it works and it avoids having to load core.schema
|
|
Packit Service |
99d1c0 |
# in the test LDAP server.
|
|
Packit Service |
99d1c0 |
mark('LDAP specified dn')
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'ank', '-randkey', '-x', 'dn=cn=krb5', 'princ1'],
|
|
Packit Service |
99d1c0 |
expected_code=1, expected_msg='DN is out of the realm subtree')
|
|
Packit Service |
99d1c0 |
# Check that the DN container check is a hierarchy test, not a simple
|
|
Packit Service |
99d1c0 |
# suffix match (CVE-2018-5730). We expect this operation to fail
|
|
Packit Service |
99d1c0 |
# either way (because "xcn" isn't a valid DN tag) but the container
|
|
Packit Service |
99d1c0 |
# check should happen before the DN is parsed.
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'ank', '-randkey', '-x', 'dn=xcn=t1,cn=krb5', 'princ1'],
|
|
Packit Service |
99d1c0 |
expected_code=1, expected_msg='DN is out of the realm subtree')
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'ank', '-randkey', '-x', 'dn=cn=t2,cn=krb5', 'princ1'])
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'getprinc', 'princ1'], expected_msg='Principal: princ1')
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'ank', '-randkey', '-x', 'dn=cn=t2,cn=krb5', 'again'],
|
|
Packit Service |
99d1c0 |
expected_code=1, expected_msg='ldap object is already kerberized')
|
|
Packit Service |
99d1c0 |
# Check that we can't set linkdn on a non-standalone object.
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'modprinc', '-x', 'linkdn=cn=t1,cn=krb5', 'princ1'],
|
|
Packit Service |
99d1c0 |
expected_code=1, expected_msg='link information can not be set')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Create a principal with a specified linkdn.
|
|
Packit Service |
99d1c0 |
mark('LDAP specified linkdn')
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'ank', '-randkey', '-x', 'linkdn=cn=krb5', 'princ2'],
|
|
Packit Service |
99d1c0 |
expected_code=1, expected_msg='DN is out of the realm subtree')
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'ank', '-randkey', '-x', 'linkdn=cn=t1,cn=krb5', 'princ2'])
|
|
Packit Service |
99d1c0 |
# Check that we can't reset linkdn.
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'modprinc', '-x', 'linkdn=cn=t2,cn=krb5', 'princ2'],
|
|
Packit Service |
99d1c0 |
expected_code=1, expected_msg='kerberos principal is already linked')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Create a principal with a specified containerdn.
|
|
Packit Service |
99d1c0 |
mark('LDAP specified containerdn')
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'ank', '-randkey', '-x', 'containerdn=cn=krb5', 'princ3'],
|
|
Packit Service |
99d1c0 |
expected_code=1, expected_msg='DN is out of the realm subtree')
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'ank', '-randkey', '-x', 'containerdn=cn=t1,cn=krb5',
|
|
Packit Service |
99d1c0 |
'princ3'])
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'modprinc', '-x', 'containerdn=cn=t2,cn=krb5', 'princ3'],
|
|
Packit Service |
99d1c0 |
expected_code=1, expected_msg='containerdn option not supported')
|
|
Packit Service |
99d1c0 |
# Verify that containerdn is checked when linkdn is also supplied
|
|
Packit Service |
99d1c0 |
# (CVE-2018-5730).
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'ank', '-randkey', '-x', 'containerdn=cn=krb5',
|
|
Packit Service |
99d1c0 |
'-x', 'linkdn=cn=t2,cn=krb5', 'princ4'], expected_code=1,
|
|
Packit Service |
99d1c0 |
expected_msg='DN is out of the realm subtree')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
mark('LDAP ticket policy')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Create and modify a ticket policy.
|
|
Packit Service |
99d1c0 |
kldaputil(['create_policy', '-maxtktlife', '3hour', '-maxrenewlife', '6hour',
|
|
Packit Service |
99d1c0 |
'-allow_forwardable', 'tktpol'])
|
|
Packit Service |
99d1c0 |
kldaputil(['modify_policy', '-maxtktlife', '4hour', '-maxrenewlife', '8hour',
|
|
Packit Service |
99d1c0 |
'+requires_preauth', 'tktpol'])
|
|
Packit Service |
99d1c0 |
out = kldaputil(['view_policy', 'tktpol'])
|
|
Packit Service |
99d1c0 |
if ('Ticket policy: tktpol\n' not in out or
|
|
Packit Service |
99d1c0 |
'Maximum ticket life: 0 days 04:00:00\n' not in out or
|
|
Packit Service |
99d1c0 |
'Maximum renewable life: 0 days 08:00:00\n' not in out or
|
|
Packit Service |
99d1c0 |
'Ticket flags: DISALLOW_FORWARDABLE REQUIRES_PRE_AUTH' not in out):
|
|
Packit Service |
99d1c0 |
fail('Unexpected kdb5_ldap_util view_policy output')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
out = kldaputil(['list_policy'])
|
|
Packit Service |
99d1c0 |
if out != 'tktpol\n':
|
|
Packit Service |
99d1c0 |
fail('Unexpected kdb5_ldap_util list_policy output')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Associate the ticket policy to a principal.
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'ank', '-randkey', '-x', 'tktpolicy=tktpol', 'princ4'])
|
|
Packit Service |
99d1c0 |
out = realm.run([kadminl, 'getprinc', 'princ4'])
|
|
Packit Service |
99d1c0 |
if ('Maximum ticket life: 0 days 04:00:00\n' not in out or
|
|
Packit Service |
99d1c0 |
'Maximum renewable life: 0 days 08:00:00\n' not in out or
|
|
Packit Service |
99d1c0 |
'Attributes: DISALLOW_FORWARDABLE REQUIRES_PRE_AUTH\n' not in out):
|
|
Packit Service |
99d1c0 |
fail('Unexpected getprinc output with ticket policy')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Destroying the policy should fail while a principal references it.
|
|
Packit Service |
99d1c0 |
kldaputil(['destroy_policy', '-force', 'tktpol'], expected_code=1)
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Dissociate the ticket policy from the principal.
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'modprinc', '-x', 'tktpolicy=', 'princ4'])
|
|
Packit Service |
99d1c0 |
out = realm.run([kadminl, 'getprinc', 'princ4'])
|
|
Packit Service |
99d1c0 |
if ('Maximum ticket life: 0 days 05:00:00\n' not in out or
|
|
Packit Service |
99d1c0 |
'Maximum renewable life: 0 days 10:00:00\n' not in out or
|
|
Packit Service |
99d1c0 |
'Attributes:\n' not in out):
|
|
Packit Service |
99d1c0 |
fail('Unexpected getprinc output without ticket policy')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Destroy the ticket policy.
|
|
Packit Service |
99d1c0 |
kldaputil(['destroy_policy', '-force', 'tktpol'])
|
|
Packit Service |
99d1c0 |
kldaputil(['view_policy', 'tktpol'], expected_code=1)
|
|
Packit Service |
99d1c0 |
out = kldaputil(['list_policy'])
|
|
Packit Service |
99d1c0 |
if out:
|
|
Packit Service |
99d1c0 |
fail('Unexpected kdb5_ldap_util list_policy output after destroy')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Create another ticket policy to be destroyed with the realm.
|
|
Packit Service |
99d1c0 |
kldaputil(['create_policy', 'tktpol2'])
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Try to create a password policy conflicting with a ticket policy.
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'addpol', 'tktpol2'], expected_code=1,
|
|
Packit Service |
99d1c0 |
expected_msg='Already exists while creating policy "tktpol2"')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Try to create a ticket policy conflicting with a password policy.
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'addpol', 'pwpol'])
|
|
Packit Service |
99d1c0 |
out = kldaputil(['create_policy', 'pwpol'], expected_code=1)
|
|
Packit Service |
99d1c0 |
if 'Already exists while creating policy object' not in out:
|
|
Packit Service |
99d1c0 |
fail('Expected error not seen in kdb5_ldap_util output')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Try to use a password policy as a ticket policy.
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'modprinc', '-x', 'tktpolicy=pwpol', 'princ4'],
|
|
Packit Service |
99d1c0 |
expected_code=1, expected_msg='Object class violation')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Use a ticket policy as a password policy (CVE-2014-5353). This
|
|
Packit Service |
99d1c0 |
# works with a warning; use kadmin.local -q so the warning is shown.
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, '-q', 'modprinc -policy tktpol2 princ4'],
|
|
Packit Service |
99d1c0 |
expected_msg='WARNING: policy "tktpol2" does not exist')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Do some basic tests with a KDC against the LDAP module, exercising the
|
|
Packit Service |
99d1c0 |
# db_args processing code.
|
|
Packit Service |
99d1c0 |
mark('LDAP KDC operation')
|
|
Packit Service |
99d1c0 |
realm.start_kdc(['-x', 'nconns=3', '-x', 'host=' + ldap_uri,
|
|
Packit Service |
99d1c0 |
'-x', 'binddn=' + admin_dn, '-x', 'bindpwd=' + admin_pw])
|
|
Packit Service |
99d1c0 |
realm.addprinc(realm.user_princ, password('user'))
|
|
Packit Service |
99d1c0 |
realm.addprinc(realm.host_princ)
|
|
Packit Service |
99d1c0 |
realm.extract_keytab(realm.host_princ, realm.keytab)
|
|
Packit Service |
99d1c0 |
realm.kinit(realm.user_princ, password('user'))
|
|
Packit Service |
99d1c0 |
realm.run([kvno, realm.host_princ])
|
|
Packit Service |
99d1c0 |
realm.klist(realm.user_princ, realm.host_princ)
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
mark('LDAP auth indicator')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Test require_auth normalization.
|
|
Packit Service |
99d1c0 |
realm.addprinc('authind', password('authind'))
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'setstr', 'authind', 'require_auth', 'otp radius'])
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Check that krbPrincipalAuthInd attributes are set when the string
|
|
Packit Service |
99d1c0 |
# attribute it set.
|
|
Packit Service |
99d1c0 |
out = ldap_search('(krbPrincipalName=authind*)')
|
|
Packit Service |
99d1c0 |
if 'krbPrincipalAuthInd: otp' not in out:
|
|
Packit Service |
99d1c0 |
fail('Expected krbPrincipalAuthInd value not in output')
|
|
Packit Service |
99d1c0 |
if 'krbPrincipalAuthInd: radius' not in out:
|
|
Packit Service |
99d1c0 |
fail('Expected krbPrincipalAuthInd value not in output')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Check that the string attribute still appears when the principal is
|
|
Packit Service |
99d1c0 |
# loaded.
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'getstrs', 'authind'],
|
|
Packit Service |
99d1c0 |
expected_msg='require_auth: otp radius')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Modify the LDAP attributes and check that the change is reflected in
|
|
Packit Service |
99d1c0 |
# the string attribute.
|
|
Packit Service |
99d1c0 |
ldap_modify('dn: krbPrincipalName=authind@KRBTEST.COM,cn=t1,cn=krb5\n'
|
|
Packit Service |
99d1c0 |
'changetype: modify\n'
|
|
Packit Service |
99d1c0 |
'replace: krbPrincipalAuthInd\n'
|
|
Packit Service |
99d1c0 |
'krbPrincipalAuthInd: radius\n'
|
|
Packit Service |
99d1c0 |
'krbPrincipalAuthInd: pkinit\n')
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'getstrs', 'authind'],
|
|
Packit Service |
99d1c0 |
expected_msg='require_auth: radius pkinit')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Regression test for #8877: remove the string attribute and check
|
|
Packit Service |
99d1c0 |
# that it is reflected in the LDAP attributes and by getstrs.
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'delstr', 'authind', 'require_auth'])
|
|
Packit Service |
99d1c0 |
out = ldap_search('(krbPrincipalName=authind*)')
|
|
Packit Service |
99d1c0 |
if 'krbPrincipalAuthInd' in out:
|
|
Packit Service |
99d1c0 |
fail('krbPrincipalAuthInd attribute still present after delstr')
|
|
Packit Service |
99d1c0 |
out = realm.run([kadminl, 'getstrs', 'authind'])
|
|
Packit Service |
99d1c0 |
if 'require_auth' in out:
|
|
Packit Service |
99d1c0 |
fail('require_auth string attribute still visible after delstr')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
mark('LDAP service principal aliases')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Test service principal aliases.
|
|
Packit Service |
99d1c0 |
realm.addprinc('canon', password('canon'))
|
|
Packit Service |
99d1c0 |
ldap_modify('dn: krbPrincipalName=canon@KRBTEST.COM,cn=t1,cn=krb5\n'
|
|
Packit Service |
99d1c0 |
'changetype: modify\n'
|
|
Packit Service |
99d1c0 |
'add: krbPrincipalName\n'
|
|
Packit Service |
99d1c0 |
'krbPrincipalName: alias@KRBTEST.COM\n'
|
|
Packit Service |
99d1c0 |
'krbPrincipalName: ent@abc@KRBTEST.COM\n'
|
|
Packit Service |
99d1c0 |
'-\n'
|
|
Packit Service |
99d1c0 |
'add: krbCanonicalName\n'
|
|
Packit Service |
99d1c0 |
'krbCanonicalName: canon@KRBTEST.COM\n')
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'getprinc', 'alias'],
|
|
Packit Service |
99d1c0 |
expected_msg='Principal: canon@KRBTEST.COM\n')
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'getprinc', 'ent\@abc'],
|
|
Packit Service |
99d1c0 |
expected_msg='Principal: canon@KRBTEST.COM\n')
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'getprinc', 'canon'],
|
|
Packit Service |
99d1c0 |
expected_msg='Principal: canon@KRBTEST.COM\n')
|
|
Packit Service |
99d1c0 |
realm.run([kvno, 'alias', 'canon'])
|
|
Packit Service |
99d1c0 |
out = realm.run([klist])
|
|
Packit Service |
99d1c0 |
if 'alias@KRBTEST.COM\n' not in out or 'canon@KRBTEST.COM' not in out:
|
|
Packit Service |
99d1c0 |
fail('After fetching alias and canon, klist is missing one or both')
|
|
Packit Service |
99d1c0 |
realm.kinit(realm.user_princ, password('user'), ['-S', 'alias'])
|
|
Packit Service |
99d1c0 |
realm.klist(realm.user_princ, 'alias@KRBTEST.COM')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Make sure an alias to the local TGS is still treated like an alias.
|
|
Packit Service |
99d1c0 |
ldap_modify('dn: krbPrincipalName=krbtgt/KRBTEST.COM@KRBTEST.COM,'
|
|
Packit Service |
99d1c0 |
'cn=KRBTEST.COM,cn=krb5\n'
|
|
Packit Service |
99d1c0 |
'changetype: modify\n'
|
|
Packit Service |
99d1c0 |
'add:krbPrincipalName\n'
|
|
Packit Service |
99d1c0 |
'krbPrincipalName: tgtalias@KRBTEST.COM\n'
|
|
Packit Service |
99d1c0 |
'-\n'
|
|
Packit Service |
99d1c0 |
'add: krbCanonicalName\n'
|
|
Packit Service |
99d1c0 |
'krbCanonicalName: krbtgt/KRBTEST.COM@KRBTEST.COM\n')
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'getprinc', 'tgtalias'],
|
|
Packit Service |
99d1c0 |
expected_msg='Principal: krbtgt/KRBTEST.COM@KRBTEST.COM')
|
|
Packit Service |
99d1c0 |
realm.kinit(realm.user_princ, password('user'))
|
|
Packit Service |
99d1c0 |
realm.run([kvno, 'tgtalias'])
|
|
Packit Service |
99d1c0 |
realm.klist(realm.user_princ, 'tgtalias@KRBTEST.COM')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Make sure aliases work in header tickets.
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'modprinc', '-maxrenewlife', '3 hours', 'user'])
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'modprinc', '-maxrenewlife', '3 hours',
|
|
Packit Service |
99d1c0 |
'krbtgt/KRBTEST.COM'])
|
|
Packit Service |
99d1c0 |
realm.kinit(realm.user_princ, password('user'), ['-l', '1h', '-r', '2h'])
|
|
Packit Service |
99d1c0 |
realm.run([kvno, 'alias'])
|
|
Packit Service |
99d1c0 |
realm.kinit(realm.user_princ, flags=['-R', '-S', 'alias'])
|
|
Packit Service |
99d1c0 |
realm.klist(realm.user_princ, 'alias@KRBTEST.COM')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Test client principal aliases, with and without preauth.
|
|
Packit Service |
99d1c0 |
realm.kinit('canon', password('canon'))
|
|
Packit Service |
99d1c0 |
realm.kinit('alias', password('canon'))
|
|
Packit Service |
99d1c0 |
realm.run([kvno, 'alias'])
|
|
Packit Service |
99d1c0 |
realm.klist('alias@KRBTEST.COM', 'alias@KRBTEST.COM')
|
|
Packit Service |
99d1c0 |
realm.kinit('alias', password('canon'), ['-C'])
|
|
Packit Service |
99d1c0 |
realm.run([kvno, 'alias'])
|
|
Packit Service |
99d1c0 |
realm.klist('canon@KRBTEST.COM', 'alias@KRBTEST.COM')
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'modprinc', '+requires_preauth', 'canon'])
|
|
Packit Service |
99d1c0 |
realm.kinit('canon', password('canon'))
|
|
Packit Service |
99d1c0 |
realm.kinit('alias', password('canon'), ['-C'])
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Test enterprise alias with and without canonicalization.
|
|
Packit Service |
99d1c0 |
realm.kinit('ent@abc', password('canon'), ['-E', '-C'])
|
|
Packit Service |
99d1c0 |
realm.run([kvno, 'alias'])
|
|
Packit Service |
99d1c0 |
realm.klist('canon@KRBTEST.COM', 'alias@KRBTEST.COM')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
realm.kinit('ent@abc', password('canon'), ['-E'])
|
|
Packit Service |
99d1c0 |
realm.run([kvno, 'alias'])
|
|
Packit Service |
99d1c0 |
realm.klist('ent\@abc@KRBTEST.COM', 'alias@KRBTEST.COM')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Test client name canonicalization in non-krbtgt AS reply
|
|
Packit Service |
99d1c0 |
realm.kinit('alias', password('canon'), ['-C', '-S', 'kadmin/changepw'])
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
mark('LDAP password history')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Test password history.
|
|
Packit Service |
99d1c0 |
def test_pwhist(nhist):
|
|
Packit Service |
99d1c0 |
def cpw(n, **kwargs):
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'cpw', '-pw', str(n), princ], **kwargs)
|
|
Packit Service |
99d1c0 |
def cpw_fail(n):
|
|
Packit Service |
99d1c0 |
cpw(n, expected_code=1)
|
|
Packit Service |
99d1c0 |
output('*** Testing password history of size %d\n' % nhist)
|
|
Packit Service |
99d1c0 |
princ = 'pwhistprinc' + str(nhist)
|
|
Packit Service |
99d1c0 |
pol = 'pwhistpol' + str(nhist)
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'addpol', '-history', str(nhist), pol])
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'addprinc', '-policy', pol, '-nokey', princ])
|
|
Packit Service |
99d1c0 |
for i in range(nhist):
|
|
Packit Service |
99d1c0 |
# Set a password, then check that all previous passwords fail.
|
|
Packit Service |
99d1c0 |
cpw(i)
|
|
Packit Service |
99d1c0 |
for j in range(i + 1):
|
|
Packit Service |
99d1c0 |
cpw_fail(j)
|
|
Packit Service |
99d1c0 |
# Set one more new password, and make sure the oldest key is
|
|
Packit Service |
99d1c0 |
# rotated out.
|
|
Packit Service |
99d1c0 |
cpw(nhist)
|
|
Packit Service |
99d1c0 |
cpw_fail(1)
|
|
Packit Service |
99d1c0 |
cpw(0)
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
for n in (1, 2, 3, 4, 5):
|
|
Packit Service |
99d1c0 |
test_pwhist(n)
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Regression test for #8193: test password character class requirements.
|
|
Packit Service |
99d1c0 |
princ = 'charclassprinc'
|
|
Packit Service |
99d1c0 |
pol = 'charclasspol'
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'addpol', '-minclasses', '3', pol])
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'addprinc', '-policy', pol, '-nokey', princ])
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'cpw', '-pw', 'abcdef', princ], expected_code=1)
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'cpw', '-pw', 'Abcdef', princ], expected_code=1)
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'cpw', '-pw', 'Abcdef1', princ])
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Test principal renaming and make sure last modified is changed
|
|
Packit Service |
99d1c0 |
def get_princ(princ):
|
|
Packit Service |
99d1c0 |
out = realm.run([kadminl, 'getprinc', princ])
|
|
Packit Service |
99d1c0 |
return dict(map(str.strip, x.split(":", 1)) for x in out.splitlines())
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
mark('LDAP principal renaming')
|
|
Packit Service |
99d1c0 |
realm.addprinc("rename", password('rename'))
|
|
Packit Service |
99d1c0 |
renameprinc = get_princ("rename")
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, '-p', 'fake@KRBTEST.COM', 'renprinc', 'rename', 'renamed'])
|
|
Packit Service |
99d1c0 |
renamedprinc = get_princ("renamed")
|
|
Packit Service |
99d1c0 |
if renameprinc['Last modified'] == renamedprinc['Last modified']:
|
|
Packit Service |
99d1c0 |
fail('Last modified data not updated when principal was renamed')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Regression test for #7980 (fencepost when dividing keys up by kvno).
|
|
Packit Service |
99d1c0 |
mark('#7980 regression test')
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'addprinc', '-randkey', '-e', 'aes256-cts,aes128-cts',
|
|
Packit Service |
99d1c0 |
'kvnoprinc'])
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'cpw', '-randkey', '-keepold', '-e',
|
|
Packit Service |
99d1c0 |
'aes256-cts,aes128-cts', 'kvnoprinc'])
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'getprinc', 'kvnoprinc'], expected_msg='Number of keys: 4')
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'cpw', '-randkey', '-keepold', '-e',
|
|
Packit Service |
99d1c0 |
'aes256-cts,aes128-cts', 'kvnoprinc'])
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'getprinc', 'kvnoprinc'], expected_msg='Number of keys: 6')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Regression test for #8041 (NULL dereference on keyless principals).
|
|
Packit Service |
99d1c0 |
mark('#8041 regression test')
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'addprinc', '-nokey', 'keylessprinc'])
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'getprinc', 'keylessprinc'],
|
|
Packit Service |
99d1c0 |
expected_msg='Number of keys: 0')
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'cpw', '-randkey', '-e', 'aes256-cts,aes128-cts',
|
|
Packit Service |
99d1c0 |
'keylessprinc'])
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'cpw', '-randkey', '-keepold', '-e',
|
|
Packit Service |
99d1c0 |
'aes256-cts,aes128-cts', 'keylessprinc'])
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'getprinc', 'keylessprinc'],
|
|
Packit Service |
99d1c0 |
expected_msg='Number of keys: 4')
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'purgekeys', '-all', 'keylessprinc'])
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'getprinc', 'keylessprinc'],
|
|
Packit Service |
99d1c0 |
expected_msg='Number of keys: 0')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Test for 8354 (old password history entries when -keepold is used)
|
|
Packit Service |
99d1c0 |
mark('#8354 regression test')
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'addpol', '-history', '2', 'keepoldpasspol'])
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'addprinc', '-policy', 'keepoldpasspol', '-pw', 'aaaa',
|
|
Packit Service |
99d1c0 |
'keepoldpassprinc'])
|
|
Packit Service |
99d1c0 |
for p in ('bbbb', 'cccc', 'aaaa'):
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'cpw', '-keepold', '-pw', p, 'keepoldpassprinc'])
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
if runenv.sizeof_time_t <= 4:
|
|
Packit Service |
99d1c0 |
skipped('y2038 LDAP test', 'platform has 32-bit time_t')
|
|
Packit Service |
99d1c0 |
else:
|
|
Packit Service |
99d1c0 |
# Test storage of timestamps after y2038.
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'modprinc', '-pwexpire', '2040-02-03', 'user'])
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'getprinc', 'user'], expected_msg=' 2040\n')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Regression test for #8861 (pw_expiration policy enforcement).
|
|
Packit Service |
99d1c0 |
mark('pw_expiration propogation')
|
|
Packit Service |
99d1c0 |
# Create a policy with a max life and verify its application.
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'addpol', '-maxlife', '1s', 'pw_e'])
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'addprinc', '-policy', 'pw_e', '-pw', 'password',
|
|
Packit Service |
99d1c0 |
'pwuser'])
|
|
Packit Service |
99d1c0 |
out = realm.run([kadminl, 'getprinc', 'pwuser'],
|
|
Packit Service |
99d1c0 |
expected_msg='Password expiration date: ')
|
|
Packit Service |
99d1c0 |
if 'Password expiration date: [never]' in out:
|
|
Packit Service |
99d1c0 |
fail('pw_expiration not applied at principal creation')
|
|
Packit Service |
99d1c0 |
# Unset the policy max life and verify its application during password
|
|
Packit Service |
99d1c0 |
# change.
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'modpol', '-maxlife', '0', 'pw_e'])
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'cpw', '-pw', 'password_', 'pwuser'])
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, 'getprinc', 'pwuser'],
|
|
Packit Service |
99d1c0 |
expected_msg='Password expiration date: [never]')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
realm.stop()
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Briefly test dump and load.
|
|
Packit Service |
99d1c0 |
mark('LDAP dump and load')
|
|
Packit Service |
99d1c0 |
dumpfile = os.path.join(realm.testdir, 'dump')
|
|
Packit Service |
99d1c0 |
realm.run([kdb5_util, 'dump', dumpfile])
|
|
Packit Service |
99d1c0 |
realm.run([kdb5_util, 'load', dumpfile], expected_code=1,
|
|
Packit Service |
99d1c0 |
expected_msg='KDB module requires -update argument')
|
|
Packit Service |
99d1c0 |
realm.run([kdb5_util, 'load', '-update', dumpfile])
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Destroy the realm.
|
|
Packit Service |
99d1c0 |
kldaputil(['destroy', '-f'])
|
|
Packit Service |
99d1c0 |
out = kldaputil(['list'])
|
|
Packit Service |
99d1c0 |
if out:
|
|
Packit Service |
99d1c0 |
fail('Unexpected kdb5_ldap_util list output after destroy')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
if not core_schema:
|
|
Packit Service |
99d1c0 |
skip_rest('LDAP SASL tests', 'core schema not found')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
if runenv.have_sasl != 'yes':
|
|
Packit Service |
99d1c0 |
skip_rest('LDAP SASL tests', 'SASL support not built')
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Test SASL EXTERNAL auth. Remove the DNs and service password file
|
|
Packit Service |
99d1c0 |
# from the DB module config.
|
|
Packit Service |
99d1c0 |
mark('LDAP SASL EXTERNAL auth')
|
|
Packit Service |
99d1c0 |
os.remove(ldap_pwfile)
|
|
Packit Service |
99d1c0 |
dbmod = conf['dbmodules']['ldap']
|
|
Packit Service |
99d1c0 |
dbmod['ldap_kdc_sasl_mech'] = dbmod['ldap_kadmind_sasl_mech'] = 'EXTERNAL'
|
|
Packit Service |
99d1c0 |
del dbmod['ldap_service_password_file']
|
|
Packit Service |
99d1c0 |
del dbmod['ldap_kdc_dn'], dbmod['ldap_kadmind_dn']
|
|
Packit Service |
99d1c0 |
realm = K5Realm(create_kdb=False, kdc_conf=conf)
|
|
Packit Service |
99d1c0 |
realm.run([kdb5_ldap_util, 'create', '-s', '-P', 'master'])
|
|
Packit Service |
99d1c0 |
realm.start_kdc()
|
|
Packit Service |
99d1c0 |
realm.addprinc(realm.user_princ, password('user'))
|
|
Packit Service |
99d1c0 |
realm.kinit(realm.user_princ, password('user'))
|
|
Packit Service |
99d1c0 |
realm.stop()
|
|
Packit Service |
99d1c0 |
realm.run([kdb5_ldap_util, 'destroy', '-f'])
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# Test SASL DIGEST-MD5 auth. We need to set a clear-text password for
|
|
Packit Service |
99d1c0 |
# the admin DN, so create a person entry (requires the core schema).
|
|
Packit Service |
99d1c0 |
# Restore the service password file in the config and set authcids.
|
|
Packit Service |
99d1c0 |
mark('LDAP SASL DIGEST-MD5 auth')
|
|
Packit Service |
99d1c0 |
ldap_add('cn=admin,cn=krb5', 'person',
|
|
Packit Service |
99d1c0 |
['sn: dummy', 'userPassword: admin'])
|
|
Packit Service |
99d1c0 |
dbmod['ldap_kdc_sasl_mech'] = dbmod['ldap_kadmind_sasl_mech'] = 'DIGEST-MD5'
|
|
Packit Service |
99d1c0 |
dbmod['ldap_kdc_sasl_authcid'] = 'digestuser'
|
|
Packit Service |
99d1c0 |
dbmod['ldap_kadmind_sasl_authcid'] = 'digestuser'
|
|
Packit Service |
99d1c0 |
dbmod['ldap_service_password_file'] = ldap_pwfile
|
|
Packit Service |
99d1c0 |
realm = K5Realm(create_kdb=False, kdc_conf=conf)
|
|
Packit Service |
99d1c0 |
input = admin_pw + '\n' + admin_pw + '\n'
|
|
Packit Service |
99d1c0 |
realm.run([kdb5_ldap_util, 'stashsrvpw', 'digestuser'], input=input)
|
|
Packit Service |
99d1c0 |
realm.run([kdb5_ldap_util, 'create', '-s', '-P', 'master'])
|
|
Packit Service |
99d1c0 |
realm.start_kdc()
|
|
Packit Service |
99d1c0 |
realm.addprinc(realm.user_princ, password('user'))
|
|
Packit Service |
99d1c0 |
realm.kinit(realm.user_princ, password('user'))
|
|
Packit Service |
99d1c0 |
realm.stop()
|
|
Packit Service |
99d1c0 |
# Exercise DB options, which should cause binding to fail.
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, '-x', 'sasl_authcid=ab', 'getprinc', 'user'],
|
|
Packit Service |
99d1c0 |
expected_code=1, expected_msg='Cannot bind to LDAP server')
|
|
Packit Service |
99d1c0 |
realm.run([kadminl, '-x', 'bindpwd=wrong', 'getprinc', 'user'],
|
|
Packit Service |
99d1c0 |
expected_code=1, expected_msg='Cannot bind to LDAP server')
|
|
Packit Service |
99d1c0 |
realm.run([kdb5_ldap_util, 'destroy', '-f'])
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
# We could still use tests to exercise:
|
|
Packit Service |
99d1c0 |
# * DB arg handling in krb5_ldap_create
|
|
Packit Service |
99d1c0 |
# * krbAllowedToDelegateTo attribute processing
|
|
Packit Service |
99d1c0 |
# * A load operation overwriting a standalone principal entry which
|
|
Packit Service |
99d1c0 |
# already exists but doesn't have a krbPrincipalName attribute
|
|
Packit Service |
99d1c0 |
# matching the principal name.
|
|
Packit Service |
99d1c0 |
# * A bunch of invalid-input error conditions
|
|
Packit Service |
99d1c0 |
#
|
|
Packit Service |
99d1c0 |
# There is no coverage for the following because it would be difficult:
|
|
Packit Service |
99d1c0 |
# * Out-of-memory error conditions
|
|
Packit Service |
99d1c0 |
# * Handling of failures from slapd (including krb5_retry_get_ldap_handle)
|
|
Packit Service |
99d1c0 |
# * Handling of servers which don't support mod-increment
|
|
Packit Service |
99d1c0 |
# * krb5_ldap_delete_krbcontainer (only happens if krb5_ldap_create fails)
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
success('LDAP and DB2 KDB tests')
|