Skip to content

Commit

Permalink
tests/krb5: Add tests for validation with requester SID PAC buffer
Browse files Browse the repository at this point in the history 
Signed-off-by: Joseph Sutton <[email protected]>
Reviewed-by: Andrew Bartlett <[email protected]>
  • Loading branch information
@jsutton24 @abartlet
jsutton24 authored and abartlet committed Nov 30, 2021
1 parent ebc9137 commit ca80c47
Show file tree
Hide file tree
Showing 3 changed files with 74 additions and 0 deletions.
67 changes: 67 additions & 0 deletions python/samba/tests/krb5/kdc_tgs_tests.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1726,6 +1726,73 @@ def test_tgs_requester_sid_missing_rodc_renew(self):

self._renew_tgt(tgt, expected_error=KDC_ERR_TGT_REVOKED)

def test_tgs_requester_sid_validate(self):
creds = self._get_creds()

samdb = self.get_samdb()
sid = self.get_objectSid(samdb, creds.get_dn())

tgt = self.get_tgt(creds, pac_request=None,
expect_pac=True,
expected_sid=sid,
expect_requester_sid=True)
tgt = self._modify_tgt(tgt, invalid=True)

self._validate_tgt(tgt, expected_error=0, expect_pac=True,
expect_pac_attrs=True,
expect_pac_attrs_pac_request=None,
expected_sid=sid,
expect_requester_sid=True)

def test_tgs_requester_sid_rodc_validate(self):
creds = self._get_creds(replication_allowed=True,
revealed_to_rodc=True)

samdb = self.get_samdb()
sid = self.get_objectSid(samdb, creds.get_dn())

tgt = self.get_tgt(creds, pac_request=None,
expect_pac=True,
expected_sid=sid,
expect_requester_sid=True)
tgt = self._modify_tgt(tgt, from_rodc=True, invalid=True)

self._validate_tgt(tgt, expected_error=0, expect_pac=True,
expect_pac_attrs=False,
expected_sid=sid,
expect_requester_sid=True)

def test_tgs_requester_sid_missing_validate(self):
creds = self._get_creds()

samdb = self.get_samdb()
sid = self.get_objectSid(samdb, creds.get_dn())

tgt = self.get_tgt(creds, pac_request=None,
expect_pac=True,
expected_sid=sid,
expect_requester_sid=True)
tgt = self._modify_tgt(tgt, invalid=True,
remove_requester_sid=True)

self._validate_tgt(tgt, expected_error=KDC_ERR_TGT_REVOKED)

def test_tgs_requester_sid_missing_rodc_validate(self):
creds = self._get_creds(replication_allowed=True,
revealed_to_rodc=True)

samdb = self.get_samdb()
sid = self.get_objectSid(samdb, creds.get_dn())

tgt = self.get_tgt(creds, pac_request=None,
expect_pac=True,
expected_sid=sid,
expect_requester_sid=True)
tgt = self._modify_tgt(tgt, from_rodc=True, invalid=True,
remove_requester_sid=True)

self._validate_tgt(tgt, expected_error=KDC_ERR_TGT_REVOKED)

def test_tgs_pac_request_none(self):
creds = self._get_creds()
tgt = self.get_tgt(creds, pac_request=None)
Expand Down
3 changes: 3 additions & 0 deletions selftest/knownfail_heimdal_kdc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -158,7 +158,10 @@
^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid(?!_)
^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_renew
^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_rodc_renew
^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_rodc_validate
^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_validate
^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_rodc_renew
^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_rodc_validate
^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_logon_info_only_sid_mismatch_existing
^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_logon_info_only_sid_mismatch_nonexisting
^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_pac_request_false
Expand Down
4 changes: 4 additions & 0 deletions selftest/knownfail_mit_kdc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -512,8 +512,12 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_
^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid
^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_renew
^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_rodc_renew
^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_rodc_validate
^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_validate
^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_renew
^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_rodc_renew
^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_rodc_validate
^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_validate
^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_logon_info_only_sid_mismatch_existing
^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_logon_info_only_sid_mismatch_nonexisting
^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_logon_info_sid_mismatch_existing
Expand Down

0 comments on commit ca80c47

Please sign in to comment.