sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-25 23:21:54 +03:00
Code
980ce21a5b
samba-mirror/testprogs/blackbox/test_pkinit.sh

75 lines
2.2 KiB
Bash
Raw Normal View History

s4:selftest Split out PKINIT tests from test_kinit.sh and test enc types This allows us to run the PKINIT tests only against the main DC (for which the certificates were generated), while testing the available encryption types in each functional level. In particular, we need to assert that AES encryption is available in the 2008 functional level. Andrew Bartlett
2010-06-24 03:42:40 +04:00
#!/bin/sh
# Blackbox tests for kinit and kerberos integration with smbclient etc
# Copyright (C) 2006-2007 Jelmer Vernooij <jelmer@samba.org>
# Copyright (C) 2006-2008 Andrew Bartlett <abartlet@samba.org>
if [ $# -lt 5 ]; then
cat <<EOF
s4:selftest: change the blackbox.pkinit test to use a binary mapping for smbclient
2012-05-30 14:16:49 +04:00
Usage: test_kinit.sh SERVER USERNAME PASSWORD REALM DOMAIN PREFIX ENCTYPE SMBCLINET
s4:selftest Split out PKINIT tests from test_kinit.sh and test enc types This allows us to run the PKINIT tests only against the main DC (for which the certificates were generated), while testing the available encryption types in each functional level. In particular, we need to assert that AES encryption is available in the 2008 functional level. Andrew Bartlett
2010-06-24 03:42:40 +04:00
EOF
exit 1;
fi
SERVER=$1
USERNAME=$2
PASSWORD=$3
REALM=$4
DOMAIN=$5
PREFIX=$6
ENCTYPE=$7
s4:selftest: change the blackbox.pkinit test to use a binary mapping for smbclient
2012-05-30 14:16:49 +04:00
smbclient=$8
shift 8
s4:selftest Split out PKINIT tests from test_kinit.sh and test enc types This allows us to run the PKINIT tests only against the main DC (for which the certificates were generated), while testing the available encryption types in each functional level. In particular, we need to assert that AES encryption is available in the 2008 functional level. Andrew Bartlett
2010-06-24 03:42:40 +04:00
failed=0
selftest: Remove duplication between BUILDIR and BINDIR Just have BINDIR, and have it default to ./bin Andrew Bartlett
2011-04-15 06:41:22 +04:00
samba4bindir="$BINDIR"
blackbox: removed assumption of build directory this fixes the blackbox tests for a top level build Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2011-02-03 09:30:53 +03:00
samba4srcdir="$SRCDIR/source4"
selftest: Remove unused support for --exeext
2012-01-26 02:42:27 +04:00
samba4kinit="$samba4bindir/samba4kinit"
samba_tool="$samba4bindir/samba-tool"
rkpty="$samba4bindir/rkpty"
samba4kpasswd="$samba4bindir/samba4kpasswd"
samba-tool: update tests for new 'user enable' syntax Autobuild-User: Andrew Tridgell <tridge@samba.org> Autobuild-Date: Wed Jun 1 10:37:50 CEST 2011 on sn-devel-104
2011-06-01 11:22:15 +04:00
enableaccount="$samba_tool user enable"
blackbox: removed assumption of build directory this fixes the blackbox tests for a top level build Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2011-02-03 09:30:53 +03:00
machineaccountccache="$samba4srcdir/scripting/bin/machineaccountccache"
s4:selftest Split out PKINIT tests from test_kinit.sh and test enc types This allows us to run the PKINIT tests only against the main DC (for which the certificates were generated), while testing the available encryption types in each functional level. In particular, we need to assert that AES encryption is available in the 2008 functional level. Andrew Bartlett
2010-06-24 03:42:40 +04:00
testprogs: Fix pkinit test with system ldb. Reviewed-by: Alexander Bokovoy <ab@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Fri Feb 21 17:58:24 CET 2014 on sn-devel-104
2014-02-21 18:55:22 +04:00
ldbmodify="ldbmodify"
if [ -x "$samba4bindir/ldbmodify" ]; then
ldbmodify="$samba4bindir/ldbmodify"
fi
ldbsearch="ldbsearch"
if [ -x "$samba4bindir/ldbsearch" ]; then
ldbsearch="$samba4bindir/ldbsearch"
fi
s4:selftest Split out PKINIT tests from test_kinit.sh and test enc types This allows us to run the PKINIT tests only against the main DC (for which the certificates were generated), while testing the available encryption types in each functional level. In particular, we need to assert that AES encryption is available in the 2008 functional level. Andrew Bartlett
2010-06-24 03:42:40 +04:00
. `dirname $0`/subunit.sh
test_smbclient() {
name="$1"
cmd="$2"
shift
shift
echo "test: $name"
s4-selftest When testing for a credentials cache, do not specify a domain If we specify a domain, then we indicate that we must use that domain which overrides the credentials cache we found in the environment. Andrew Bartlett
2011-10-18 03:03:21 +04:00
$VALGRIND $smbclient $CONFIGURATION //$SERVER/tmp -c "$cmd" $@
s4:selftest Split out PKINIT tests from test_kinit.sh and test enc types This allows us to run the PKINIT tests only against the main DC (for which the certificates were generated), while testing the available encryption types in each functional level. In particular, we need to assert that AES encryption is available in the 2008 functional level. Andrew Bartlett
2010-06-24 03:42:40 +04:00
status=$?
if [ x$status = x0 ]; then
echo "success: $name"
else
echo "failure: $name"
fi
return $status
}
enctype="-e $ENCTYPE"
KRB5CCNAME="$PREFIX/tmpccache"
export KRB5CCNAME
testit "kinit with pkinit (name specified)" $samba4kinit $enctype --request-pac --renewable --pk-user=FILE:$PREFIX/dc/private/tls/admincert.pem,$PREFIX/dc/private/tls/adminkey.pem $USERNAME@$REALM || failed=`expr $failed + 1`
testit "kinit with pkinit (enterprise name specified)" $samba4kinit $enctype --request-pac --renewable --pk-user=FILE:$PREFIX/dc/private/tls/admincert.pem,$PREFIX/dc/private/tls/adminkey.pem --enterprise $USERNAME@$REALM || failed=`expr $failed + 1`
testit "kinit with pkinit (enterprise name in cert)" $samba4kinit $enctype --request-pac --renewable --pk-user=FILE:$PREFIX/dc/private/tls/admincertupn.pem,$PREFIX/dc/private/tls/adminkey.pem --pk-enterprise || failed=`expr $failed + 1`
testit "kinit renew ticket" $samba4kinit --request-pac -R
test_smbclient "Test login with kerberos ccache" 'ls' -k yes || failed=`expr $failed + 1`
rm -f $PREFIX/tmpccache
exit $failed
Copy Permalink