1#!/bin/sh
2# Copyright (C) 2015 Stefan Metzmacher <metze@samba.org>
3
4if [ $# -lt 13 ]; then
5cat <<EOF
6Usage: test_kinit_trusts.sh SERVER USERNAME PASSWORD REALM DOMAIN TRUST_USERNAME TRUST_PASSWORD TRUST_REALM TRUST_DOMAIN PREFIX TYPE ENCTYPE
7EOF
8exit 1;
9fi
10
11SERVER=$1
12USERNAME=$2
13PASSWORD=$3
14REALM=$4
15DOMAIN=$5
16shift 5
17TRUST_SERVER=$1
18TRUST_USERNAME=$2
19TRUST_PASSWORD=$3
20TRUST_REALM=$4
21TRUST_DOMAIN=$5
22shift 5
23PREFIX=$1
24TYPE=$2
25ENCTYPE=$3
26shift 3
27failed=0
28
29samba4bindir="$BINDIR"
30samba4kinit=kinit
31if test -x $samba4bindir/samba4kinit; then
32	samba4kinit=$samba4bindir/samba4kinit
33fi
34
35smbclient="$samba4bindir/smbclient"
36wbinfo="$samba4bindir/wbinfo"
37rpcclient="$samba4bindir/rpcclient"
38samba_tool="$samba4bindir/samba-tool"
39
40. `dirname $0`/subunit.sh
41. `dirname $0`/common_test_fns.inc
42
43unc="//$SERVER.$REALM/tmp"
44
45enctype="-e $ENCTYPE"
46
47KRB5CCNAME_PATH="$PREFIX/tmpccache"
48KRB5CCNAME="FILE:$KRB5CCNAME_PATH"
49export KRB5CCNAME
50rm -rf $KRB5CCNAME_PATH
51
52echo $TRUST_PASSWORD > $PREFIX/tmppassfile
53testit "kinit with password" $samba4kinit $enctype --password-file=$PREFIX/tmppassfile --request-pac $TRUST_USERNAME@$TRUST_REALM   || failed=`expr $failed + 1`
54test_smbclient "Test login with user kerberos ccache" 'ls' "$unc" -k yes || failed=`expr $failed + 1`
55rm -rf $KRB5CCNAME_PATH
56
57# Test with smbclient4
58smbclient="$samba4bindir/smbclient4"
59testit "kinit with password" $samba4kinit $enctype --password-file=$PREFIX/tmppassfile --request-pac $TRUST_USERNAME@$TRUST_REALM   || failed=`expr $failed + 1`
60test_smbclient "Test login with user kerberos ccache (smbclient4)" 'ls' "$unc" -k yes || failed=`expr $failed + 1`
61rm -rf $KRB5CCNAME_PATH
62
63testit "kinit with password (enterprise style)" $samba4kinit $enctype --enterprise --password-file=$PREFIX/tmppassfile --request-pac $TRUST_USERNAME@$TRUST_REALM   || failed=`expr $failed + 1`
64smbclient="$samba4bindir/smbclient"
65test_smbclient "Test login with user kerberos ccache" 'ls' "$unc" -k yes || failed=`expr $failed + 1`
66
67if test x"${TYPE}" = x"forest" ;then
68	testit "kinit with password (upn enterprise style)" $samba4kinit $enctype --enterprise --password-file=$PREFIX/tmppassfile --request-pac testdenied_upn@${TRUST_REALM}.upn   || failed=`expr $failed + 1`
69	test_smbclient "Test login with user kerberos ccache" 'ls' "$unc" -k yes || failed=`expr $failed + 1`
70fi
71
72testit "kinit with password (windows style)" $samba4kinit $enctype  --renewable --windows --password-file=$PREFIX/tmppassfile --request-pac $TRUST_USERNAME@$TRUST_REALM   || failed=`expr $failed + 1`
73test_smbclient "Test login with user kerberos ccache" 'ls' "$unc" -k yes || failed=`expr $failed + 1`
74
75testit "kinit renew ticket" $samba4kinit $enctype --request-pac -R
76
77test_smbclient "Test login with kerberos ccache" 'ls' "$unc" -k yes || failed=`expr $failed + 1`
78
79testit "check time with kerberos ccache" $VALGRIND $PYTHON $samba_tool time $SERVER.$REALM $CONFIGURATION -k yes $@ || failed=`expr $failed + 1`
80
81lowerrealm=$(echo $TRUST_REALM | tr '[A-Z]' '[a-z]')
82test_smbclient "Test login with user kerberos lowercase realm" 'ls' "$unc" -k yes -U$TRUST_USERNAME@$lowerrealm%$TRUST_PASSWORD || failed=`expr $failed + 1`
83test_smbclient "Test login with user kerberos lowercase realm 2" 'ls' "$unc" -k yes -U$TRUST_USERNAME@$TRUST_REALM%$TRUST_PASSWORD --realm=$lowerrealm || failed=`expr $failed + 1`
84
85# Test the outgoing direction
86SMBCLIENT_UNC="//$TRUST_SERVER.$TRUST_REALM/tmp"
87test_smbclient "Test user login with the first outgoing secret" 'ls' "$unc" -k yes -U$USERNAME@$REALM%$PASSWORD || failed=`expr $failed + 1`
88
89testit_expect_failure "setpassword should not work" $VALGRIND $PYTHON $samba_tool user setpassword "${TRUST_DOMAIN}\$" --random-password || failed=`expr $failed + 1`
90
91testit "wbinfo ping dc" $VALGRIND $wbinfo --ping-dc --domain=$TRUST_DOMAIN || failed=`expr $failed + 1`
92testit "wbinfo change outgoing trust pw" $VALGRIND $wbinfo --change-secret --domain=$TRUST_DOMAIN || failed=`expr $failed + 1`
93testit "wbinfo check outgoing trust pw" $VALGRIND $wbinfo --check-secret --domain=$TRUST_DOMAIN || failed=`expr $failed + 1`
94
95test_smbclient "Test user login with the changed outgoing secret" 'ls' "$unc" -k yes -U$USERNAME@$REALM%$PASSWORD || failed=`expr $failed + 1`
96
97rm -f $PREFIX/tmpccache tmpccfile tmppassfile tmpuserpassfile tmpuserccache
98exit $failed
99