1#!/bin/sh 2# Copyright (C) 2015 Stefan Metzmacher <metze@samba.org> 3 4if [ $# -lt 13 ]; then 5cat <<EOF 6Usage: test_kinit_trusts.sh SERVER USERNAME PASSWORD REALM DOMAIN TRUST_USERNAME TRUST_PASSWORD TRUST_REALM TRUST_DOMAIN PREFIX TYPE ENCTYPE 7EOF 8exit 1; 9fi 10 11SERVER=$1 12USERNAME=$2 13PASSWORD=$3 14REALM=$4 15DOMAIN=$5 16shift 5 17TRUST_SERVER=$1 18TRUST_USERNAME=$2 19TRUST_PASSWORD=$3 20TRUST_REALM=$4 21TRUST_DOMAIN=$5 22shift 5 23PREFIX=$1 24TYPE=$2 25ENCTYPE=$3 26shift 3 27failed=0 28 29samba4bindir="$BINDIR" 30samba4kinit=kinit 31if test -x $samba4bindir/samba4kinit; then 32 samba4kinit=$samba4bindir/samba4kinit 33fi 34 35smbclient="$samba4bindir/smbclient" 36wbinfo="$samba4bindir/wbinfo" 37rpcclient="$samba4bindir/rpcclient" 38samba_tool="$samba4bindir/samba-tool" 39 40. `dirname $0`/subunit.sh 41. `dirname $0`/common_test_fns.inc 42 43unc="//$SERVER.$REALM/tmp" 44 45enctype="-e $ENCTYPE" 46 47KRB5CCNAME_PATH="$PREFIX/tmpccache" 48KRB5CCNAME="FILE:$KRB5CCNAME_PATH" 49export KRB5CCNAME 50rm -rf $KRB5CCNAME_PATH 51 52echo $TRUST_PASSWORD > $PREFIX/tmppassfile 53testit "kinit with password" $samba4kinit $enctype --password-file=$PREFIX/tmppassfile --request-pac $TRUST_USERNAME@$TRUST_REALM || failed=`expr $failed + 1` 54test_smbclient "Test login with user kerberos ccache" 'ls' "$unc" -k yes || failed=`expr $failed + 1` 55rm -rf $KRB5CCNAME_PATH 56 57# Test with smbclient4 58smbclient="$samba4bindir/smbclient4" 59testit "kinit with password" $samba4kinit $enctype --password-file=$PREFIX/tmppassfile --request-pac $TRUST_USERNAME@$TRUST_REALM || failed=`expr $failed + 1` 60test_smbclient "Test login with user kerberos ccache (smbclient4)" 'ls' "$unc" -k yes || failed=`expr $failed + 1` 61rm -rf $KRB5CCNAME_PATH 62 63testit "kinit with password (enterprise style)" $samba4kinit $enctype --enterprise --password-file=$PREFIX/tmppassfile --request-pac $TRUST_USERNAME@$TRUST_REALM || failed=`expr $failed + 1` 64smbclient="$samba4bindir/smbclient" 65test_smbclient "Test login with user kerberos ccache" 'ls' "$unc" -k yes || failed=`expr $failed + 1` 66 67if test x"${TYPE}" = x"forest" ;then 68 testit "kinit with password (upn enterprise style)" $samba4kinit $enctype --enterprise --password-file=$PREFIX/tmppassfile --request-pac testdenied_upn@${TRUST_REALM}.upn || failed=`expr $failed + 1` 69 test_smbclient "Test login with user kerberos ccache" 'ls' "$unc" -k yes || failed=`expr $failed + 1` 70fi 71 72testit "kinit with password (windows style)" $samba4kinit $enctype --renewable --windows --password-file=$PREFIX/tmppassfile --request-pac $TRUST_USERNAME@$TRUST_REALM || failed=`expr $failed + 1` 73test_smbclient "Test login with user kerberos ccache" 'ls' "$unc" -k yes || failed=`expr $failed + 1` 74 75testit "kinit renew ticket" $samba4kinit $enctype --request-pac -R 76 77test_smbclient "Test login with kerberos ccache" 'ls' "$unc" -k yes || failed=`expr $failed + 1` 78 79testit "check time with kerberos ccache" $VALGRIND $PYTHON $samba_tool time $SERVER.$REALM $CONFIGURATION -k yes $@ || failed=`expr $failed + 1` 80 81lowerrealm=$(echo $TRUST_REALM | tr '[A-Z]' '[a-z]') 82test_smbclient "Test login with user kerberos lowercase realm" 'ls' "$unc" -k yes -U$TRUST_USERNAME@$lowerrealm%$TRUST_PASSWORD || failed=`expr $failed + 1` 83test_smbclient "Test login with user kerberos lowercase realm 2" 'ls' "$unc" -k yes -U$TRUST_USERNAME@$TRUST_REALM%$TRUST_PASSWORD --realm=$lowerrealm || failed=`expr $failed + 1` 84 85# Test the outgoing direction 86SMBCLIENT_UNC="//$TRUST_SERVER.$TRUST_REALM/tmp" 87test_smbclient "Test user login with the first outgoing secret" 'ls' "$unc" -k yes -U$USERNAME@$REALM%$PASSWORD || failed=`expr $failed + 1` 88 89testit_expect_failure "setpassword should not work" $VALGRIND $PYTHON $samba_tool user setpassword "${TRUST_DOMAIN}\$" --random-password || failed=`expr $failed + 1` 90 91testit "wbinfo ping dc" $VALGRIND $wbinfo --ping-dc --domain=$TRUST_DOMAIN || failed=`expr $failed + 1` 92testit "wbinfo change outgoing trust pw" $VALGRIND $wbinfo --change-secret --domain=$TRUST_DOMAIN || failed=`expr $failed + 1` 93testit "wbinfo check outgoing trust pw" $VALGRIND $wbinfo --check-secret --domain=$TRUST_DOMAIN || failed=`expr $failed + 1` 94 95test_smbclient "Test user login with the changed outgoing secret" 'ls' "$unc" -k yes -U$USERNAME@$REALM%$PASSWORD || failed=`expr $failed + 1` 96 97rm -f $PREFIX/tmpccache tmpccfile tmppassfile tmpuserpassfile tmpuserccache 98exit $failed 99