samba.git/python/samba/tests/krb5/test_ldap.py, branch talloc-2.3.4

CVE-2020-25719 tests/krb5: Add tests for using a ticket with a renamed account

2021-11-09T19:45:34+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14561

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

CVE-2020-25719 CVE-2020-25717 tests/krb5: Adapt tests for connecting without a PAC to new error codes

2021-11-09T19:45:32+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14799
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14561
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

Signed-off-by: Joseph Sutton 
Reviewed-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

CVE-2020-25719 CVE-2020-25717 tests/krb5: Add tests for connecting to services anonymously and without a PAC

2021-11-09T19:45:32+00:00

At the end of the patchset we assume NT_STATUS_NO_IMPERSONATION_TOKEN if
no PAC is available.

For now we want to look for ACCESS_DENIED as this allows
the test to pass (showing that gensec:require_pac = true
is a useful partial mitigation).

This will also help others doing backports that do not
take the full patch set.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14801
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14799
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14561
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

CVE-2020-25719 CVE-2020-25717 tests/krb5: Refactor create_ccache_with_user() to take credentials of target service

2021-11-09T19:45:32+00:00

This allows us to use get_tgt() and get_service_ticket() to obtain
tickets, which simplifies the logic.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14799
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14561

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

tests/krb5: Disable debugging output for tests

2021-10-14T18:59:31+00:00

This reduces the time spent running the tests in a testenv.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

tests/krb5/kdc_base_test.py: Create loadparm only when needed

2021-07-01T17:46:31+00:00

Now the .conf file is only loaded on its first use, which means that
SMB_CONF_PATH need not be defined for tests that don't make use of it.

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett 
Reviewed-by: Stefan Metzmacher

tests/krb5/kdc_base_test.py: Create database connection only when needed

2021-07-01T17:46:31+00:00

Now the database connection is only created on its first use, which
means database credentials are no longer required for tests that don't
make use of it.

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett 
Reviewed-by: Stefan Metzmacher

python: Add LDAP credentials cache test

2021-05-19T01:32:34+00:00

Test that we can use a credentials cache with a user's service ticket
obtained with our Python code to connect to a service through LDAP.

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett 
Reviewed-by: Douglas Bagnall