From 08434e413faaa142b9f9fb1f1b75822249fb81a9 Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn@samba.org>
Date: Mon, 10 May 2021 12:52:18 +0200
Subject: [PATCH] testprogs: Add test for offline logon support

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
---
 selftest/knownfail.d/offline_logon       |  4 +++
 source4/selftest/tests.py                | 10 ++++++
 testprogs/blackbox/test_offline_logon.sh | 43 ++++++++++++++++++++++++
 3 files changed, 57 insertions(+)
 create mode 100644 selftest/knownfail.d/offline_logon
 create mode 100755 testprogs/blackbox/test_offline_logon.sh

diff --git a/selftest/knownfail.d/offline_logon b/selftest/knownfail.d/offline_logon
new file mode 100644
index 00000000000..ec258dedd1c
--- /dev/null
+++ b/selftest/knownfail.d/offline_logon
@@ -0,0 +1,4 @@
+samba.blackbox.offline_logon.wbinfo.pam_logon_alice\(ad_member_offline_logon\)
+samba.blackbox.offline_logon.wbinfo.pam_logon_bob\(ad_member_offline_logon\)
+samba.blackbox.offline_logon.wbinfo.kerberos_logon_alice\(ad_member_offline_logon\)
+samba.blackbox.offline_logon.wbinfo.kerberos_logon_bob\(ad_member_offline_logon\)
diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py
index cdaced0e1c1..f686754fa53 100755
--- a/source4/selftest/tests.py
+++ b/source4/selftest/tests.py
@@ -1348,6 +1348,16 @@ planoldpythontestsuite("chgdcpass:local", "samba.tests.blackbox.samba_dnsupdate"
 for env in ["ad_dc_ntvfs", "s4member", "rodc", "promoted_dc", "ad_dc", "ad_member"]:
     plantestsuite("samba.blackbox.wbinfo(%s:local)" % env, "%s:local" % env, [os.path.join(samba4srcdir, "../nsswitch/tests/test_wbinfo.sh"), '$DOMAIN', '$DC_USERNAME', '$DC_PASSWORD', env])
 
+# Offline logon (ad_member)
+plantestsuite("samba.blackbox.offline_logon",
+              "ad_member_offline_logon",
+              [os.path.join(bbdir, "test_offline_logon.sh"),
+               '$DOMAIN',
+               'alice', 'Secret007',
+               'bob', 'Secret007',
+               'jane', 'Secret007',
+               'joe', 'Secret007'])
+
 #
 # KDC Tests
 #
diff --git a/testprogs/blackbox/test_offline_logon.sh b/testprogs/blackbox/test_offline_logon.sh
new file mode 100755
index 00000000000..6b54a387371
--- /dev/null
+++ b/testprogs/blackbox/test_offline_logon.sh
@@ -0,0 +1,43 @@
+#!/bin/sh
+# Blackbox tests for winbind offline logon support
+# Copyright (c) 2021 Andreas Schneider <asn@samba.org>
+
+if [ $# -lt 9 ]; then
+cat <<EOF
+Usage: test_offline_logon.sh DOMAIN CACHED_USER_NAME_1 CACHED_USER_PASS_1 CACHED_USER_NAME_2 CACHED_USER_PASS_2 ONLINE_USER_NAME_1 ONLINE_USER_PASS_1 ONLINE_USER_NAME_2 ONLINE_USER_PASS_2
+EOF
+    exit 1;
+fi
+
+DOMAIN=$1
+CACHED_USER_NAME_1=$2
+CACHED_USER_PASS_1=$3
+CACHED_USER_NAME_2=$4
+CACHED_USER_PASS_2=$5
+ONLINE_USER_NAME_1=$6
+ONLINE_USER_PASS_1=$7
+ONLINE_USER_NAME_2=$8
+ONLINE_USER_PASS_2=$9
+shift 9
+
+. `dirname $0`/subunit.sh
+
+samba_bindir="$BINDIR"
+wbinfo="$samba_bindir/wbinfo"
+
+# Check that the DC is offline
+testit_expect_failure "wbinfo.ping-dc" $VALGRIND $wbinfo --ping-dc || failed=`expr $failed + 1`
+
+# We should have cached credentials for alice and bob
+# --pam-logon sets always the WBFLAG_PAM_CACHED_LOGIN flag
+testit "wbinfo.pam_logon_$CACHED_USER_NAME_1" $VALGRIND $wbinfo --pam-logon=$DOMAIN/$CACHED_USER_NAME_1%$CACHED_USER_PASS_1 || failed=`expr $failed + 1`
+testit "wbinfo.kerberos_logon_$CACHED_USER_NAME_1" $VALGRIND $wbinfo --krb5auth=$DOMAIN/$CACHED_USER_NAME_2%$CACHED_USER_PASS_2 || failed=`expr $failed + 1`
+
+testit "wbinfo.pam_logon_$CACHED_USER_NAME_2" $VALGRIND $wbinfo --pam-logon=$DOMAIN/$CACHED_USER_NAME_2%$CACHED_USER_PASS_2 || failed=`expr $failed + 1`
+testit "wbinfo.kerberos_logon_$CACHED_USER_NAME_2" $VALGRIND $wbinfo --krb5auth=$DOMAIN/$CACHED_USER_NAME_2%$CACHED_USER_PASS_2 || failed=`expr $failed + 1`
+
+# We should not be able to auth with jane or joe
+testit_expect_failure "wbinfo.pam_logon_$ONLINE_USER_NAME_1" $VALGRIND $wbinfo --pam-logon=$DOMAIN/$ONLINE_USER_NAME_1%$ONLINE_USER_PASS_1 || failed=`expr $failed + 1`
+testit_expect_failure "wbinfo.pam_logon_$ONLINE_USER_NAME_2" $VALGRIND $wbinfo --pam-logon=$DOMAIN/$ONLINE_USER_NAME_2%$ONLINE_USER_PASS_2 || failed=`expr $failed + 1`
+
+exit $failed