3 # Create a pair of realms, where KRBTEST1.COM can authenticate to
4 # REFREALM and has a domain-realm mapping for 'd' pointing to it.
5 drealm = {'domain_realm': {'d': 'REFREALM'}}
6 realm, refrealm = cross_realms(2, xtgts=((0,1),),
7 args=({'kdc_conf': drealm},
9 'create_user': False}),
11 refrealm.addprinc('a/x.d')
13 savefile = os.path.join(realm.testdir, 'ccache.copy')
14 os.rename(realm.ccache, savefile)
16 # Get credentials and check that we got a referral to REFREALM.
17 def testref(realm, nametype):
18 shutil.copyfile(savefile, realm.ccache)
19 realm.run(['./gcred', nametype, 'a/x.d@'])
20 out = realm.run([klist]).split('\n')
22 fail('unexpected number of lines in klist output')
23 if out[5].split()[4] != 'a/x.d@' or out[6].split()[4] != 'a/x.d@REFREALM':
24 fail('unexpected service principals in klist output')
26 # Get credentials and check that we get an error, not a referral.
27 def testfail(realm, nametype):
28 shutil.copyfile(savefile, realm.ccache)
29 realm.run(['./gcred', nametype, 'a/x.d@'], expected_code=1,
30 expected_msg='not found in Kerberos database')
32 # Create a modified KDC environment and restart the KDC.
33 def restart_kdc(realm, kdc_conf):
34 env = realm.special_env('extravars', True, kdc_conf=kdc_conf)
36 realm.start_kdc(env=env)
38 # With no KDC configuration besides [domain_realm], we should get a
39 # referral for a NT-SRV-HST or NT-SRV-INST server name, but not an
40 # NT-UNKNOWN or NT-PRINCIPAL server name.
41 mark('[domain-realm] only')
42 testref(realm, 'srv-hst')
43 testref(realm, 'srv-inst')
44 testfail(realm, 'principal')
45 testfail(realm, 'unknown')
47 # With host_based_services matching the first server name component
48 # ("a"), we should get a referral for an NT-UNKNOWN server name.
49 # host_based_services can appear in either [kdcdefaults] or the realm
50 # section, with the realm values supplementing the kdcdefaults values.
51 # NT-SRV-HST server names should be unaffected by host_based_services,
52 # and NT-PRINCIPAL server names shouldn't get a referral regardless.
53 mark('host_based_services')
54 restart_kdc(realm, {'kdcdefaults': {'host_based_services': '*'}})
55 testref(realm, 'unknown')
56 testfail(realm, 'principal')
57 restart_kdc(realm, {'kdcdefaults': {'host_based_services': ['b', 'a,c']}})
58 testref(realm, 'unknown')
59 restart_kdc(realm, {'realms': {'$realm': {'host_based_services': 'a b c'}}})
60 testref(realm, 'unknown')
61 restart_kdc(realm, {'kdcdefaults': {'host_based_services': 'a'},
62 'realms': {'$realm': {'host_based_services': 'b c'}}})
63 testref(realm, 'unknown')
64 restart_kdc(realm, {'kdcdefaults': {'host_based_services': 'b,c'},
65 'realms': {'$realm': {'host_based_services': 'a,b'}}})
66 testref(realm, 'unknown')
67 restart_kdc(realm, {'kdcdefaults': {'host_based_services': 'b,c'}})
68 testfail(realm, 'unknown')
69 testref(realm, 'srv-hst')
71 # With no_host_referrals matching the first server name component, we
72 # should not get a referral even for NT-SRV-HOST server names
73 mark('no_host_referral')
74 restart_kdc(realm, {'kdcdefaults': {'no_host_referral': '*'}})
75 testfail(realm, 'srv-hst')
76 restart_kdc(realm, {'kdcdefaults': {'no_host_referral': ['b', 'a,c']}})
77 testfail(realm, 'srv-hst')
78 restart_kdc(realm, {'realms': {'$realm': {'no_host_referral': 'a b c'}}})
79 testfail(realm, 'srv-hst')
80 restart_kdc(realm, {'kdcdefaults': {'no_host_referral': 'a'},
81 'realms': {'$realm': {'no_host_referral': 'b c'}}})
82 testfail(realm, 'srv-hst')
83 restart_kdc(realm, {'kdcdefaults': {'no_host_referral': 'b,c'},
84 'realms': {'$realm': {'no_host_referral': 'a,b'}}})
85 testfail(realm, 'srv-hst')
86 restart_kdc(realm, {'kdcdefaults': {'no_host_referral': 'b,c'}})
87 testref(realm, 'srv-hst')
89 # no_host_referrals should override host_based_services for NT-UNKNWON
91 restart_kdc(realm, {'kdcdefaults': {'no_host_referral': '*',
92 'host_based_services': '*'}})
93 testfail(realm, 'unknown')
98 # Regression test for #7483: a KDC should not return a host referral
100 mark('#7483 regression test')
101 drealm = {'domain_realm': {'d': 'KRBTEST.COM'}}
102 realm = K5Realm(kdc_conf=drealm, create_host=False)
103 tracefile = os.path.join(realm.testdir, 'trace')
104 realm.run(['env', 'KRB5_TRACE=' + tracefile, './gcred', 'srv-hst', 'a/x.d@'],
106 f = open(tracefile, 'r')
109 if 'back to same realm' in trace:
110 fail('KDC returned referral to service realm')
113 # Test client referrals. Use the test KDB module for KRBTEST1.COM to
114 # simulate referrals since our built-in modules do not support them.
115 # No cross-realm TGTs are necessary.
116 mark('client referrals')
117 kdcconf = {'realms': {'$realm': {'database_module': 'test'}},
118 'dbmodules': {'test': {'db_library': 'test',
119 'alias': {'user': '@KRBTEST2.COM',
120 'abc@XYZ': '@KRBTEST2.COM'}}}}
121 r1, r2 = cross_realms(2, xtgts=(),
122 args=({'kdc_conf': kdcconf, 'create_kdb': False}, None),
124 r2.addprinc('abc\@XYZ', 'pw')
126 r1.kinit('user', expected_code=1,
127 expected_msg='not found in Kerberos database')
128 r1.kinit('user', password('user'), ['-C'])
129 r1.klist('user@KRBTEST2.COM', 'krbtgt/KRBTEST2.COM')
130 r1.kinit('abc@XYZ', 'pw', ['-E'])
131 r1.klist('abc\@XYZ@KRBTEST2.COM', 'krbtgt/KRBTEST2.COM')
133 # Test that disable_encrypted_timestamp persists across client
134 # referrals. (This test relies on SPAKE not being enabled by default
136 r2.run([kadminl, 'modprinc', '+preauth', 'user'])
137 msgs = ('Encrypted timestamp (for ')
138 r1.kinit('user', password('user'), ['-C'], expected_trace=msgs)
139 dconf = {'realms': {'$realm': {'disable_encrypted_timestamp': 'true'}}}
140 denv = r1.special_env('disable_encts', False, krb5_conf=dconf)
141 msgs = ('Ignoring encrypted timestamp because it is disabled',
142 '/Encrypted timestamp is disabled')
143 r1.kinit('user', None, ['-C'], env=denv, expected_code=1, expected_trace=msgs,
144 expected_msg='Encrypted timestamp is disabled')
146 success('KDC host referral tests')