samba.git/python/samba/tests/krb5, branch master

tests:krb5 expired password handling

2026-03-30T23:37:36+00:00

The windows ADDC checks password validity before password expiry. So an
incorrect expired password will return KDC_ERR_PREAUTH_REQUIRED not
KDC_ERR_KEY_EXPIRED.

The KDC behaviour fixes will be made to lorikeet-heimdal and then imported to
samba.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=15746

Signed-off-by: Gary Lockyer 
Reviewed-by: Jennifer Sutton

python:tests/krb5: Make PADATA_PK_AS_REP optional in non-strict mode

2026-03-30T10:41:07+00:00

Commit c1433f821f7 added PADATA_PK_AS_REP (PA-PK-AS-REP, type 17) to
the expected padata list when check_rep_padata sees KDC_ERR_KEY_EXPIRED.
This reflects Samba's Heimdal KDC behaviour, which includes PKINIT hints
in expired-password error responses.

Samba with MIT KDC does not include PADATA_PK_AS_REP in KDC_ERR_KEY_EXPIRED
responses; it returns a METHOD-DATA with just the NTSTATUS payload (type 3) and
the FX-COOKIE (type 133).  This causes test_pw_expired to fail intermittently
when the expired-password code path is exercised against MIT KDC.

Add PADATA_PK_AS_REP to the require_strict set alongside PADATA_PK_AS_REP_19,
so it is treated as optional in non-strict checking mode (STRICT_CHECKING=0)
while still being enforced in strict mode.

Signed-off-by: Andreas Schneider 
Reviewed-by: Jennifer Sutton 

Autobuild-User(master): Andreas Schneider 
Autobuild-Date(master): Mon Mar 30 10:41:07 UTC 2026 on atb-devel-224

test:heimdal:pkinit fixes for SHA1-PUKEY calculation

2026-02-23T20:16:34+00:00

The SHA1 hash for KB5014754 SHA1-PUKEY is calculate over the entire
certificate not just the public key.

BUG https://bugzilla.samba.org/show_bug.cgi?id=16001

Signed-off-by: Gary Lockyer 
Reviewed-by: Jennifer Sutton

s4:kdc:db-glue altSecurityIdentities DN and serial reversed

2026-02-23T20:16:34+00:00

When altSecurityIdentities is set by RSAT / ADUC they store the
Issuer and Subject DN in last to first order i.e.
       CN=Common Name, O=Organization, C=Country
Need to reverse that to first to last order, i.e.
       C=Country, O=Organization, CN=Common name
Which is how they're stored on the X509 certificates.

Also the serial number is stored in reverse order.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=16001

Signed-off-by: Gary Lockyer 
Reviewed-by: Jennifer Sutton

CVE-2026-20833: s4:kdc: Make default domain supported enctypes AES by default

2026-02-18T00:49:34+00:00

If AES keys are available in the domain, assume that service accounts support
AES by default.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15998

Signed-off-by: Jennifer Sutton 
Reviewed-by: Douglas Bagnall

pytest:krb5:as_req: adjust for 'require canonicalization'

2026-01-15T01:48:37+00:00

Signed-off-by: Douglas Bagnall 
Reviewed-by: Gary Lockyer

pytest:krb5:ms_kile: adjust for 'require canonicalization'

2026-01-15T01:48:37+00:00

Signed-off-by: Douglas Bagnall 
Reviewed-by: Gary Lockyer

pytest:krb5: as_canonicalization recognises require canon option

2026-01-15T01:48:37+00:00

If the test is run against a

  require canonicalization = yes

server, requests that do not use the canonicalize flag will be
rejected at the preauth stage, so we check that and nothing more.

Signed-off-by: Douglas Bagnall 
Reviewed-by: Gary Lockyer

pytest:krb5: notice require canonicalization option

2026-01-15T01:48:37+00:00

Signed-off-by: Douglas Bagnall 
Reviewed-by: Gary Lockyer

pytest:krb5 as_canonicalization checks no implicit $ return code

2026-01-15T01:48:37+00:00

We check here instead of selftest/expectedfail.d/* in part because
on MIT some of these cases will fail to fail to ask for preauth.

Signed-off-by: Douglas Bagnall 
Reviewed-by: Gary Lockyer