summaryrefslogtreecommitdiff
path: root/python/samba/tests/krb5/group_tests.py
AgeCommit message (Collapse)AuthorFilesLines
2023-09-27tests/krb5: Match filter after transforming test nameJoseph Sutton1-1/+1
If you just want to rerun a single test that failed, this removes the need to successfully guess its untransformed name. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-14tests/krb5: Make use of KerberosCredentials.get_sid()Joseph Sutton1-4/+4
KerberosCredentials objects now keep track of their account’s SID, which removes the need to look it up with KDCBaseTest.get_objectSid(). Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-05-05tests/krb5: Generify protected users test methodsJoseph Sutton1-3/+0
We can reuse them to test accounts restricted authentication in some form or another. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-05-05tests/krb5: Handle NT hashes being disabledJoseph Sutton1-1/+1
If NT hashes are disabled, we should not expect the RC4 enctype to be available for non-computer accounts. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-05-05tests/krb5: Pass client credentials down into kdc_exchange_dictJoseph Sutton1-0/+2
These are useful inside the test infrastructure. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-08tests/krb5: Make arguments to get_target() keyword argumentsJoseph Sutton1-2/+4
This avoids mistakes by ensuring that passed-in arguments go to their intended destinations. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-03tests/krb5: Add tests adding a user to a group prior to a TGS-REQJoseph Sutton1-0/+115
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-03tests/krb5: Move ticket_with_sids() to base classJoseph Sutton1-160/+1
We need to use this in another test. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-03tests/krb5: Move some utility functions from group_tests to base classJoseph Sutton1-177/+2
We'll want to make use of them later. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-03tests/krb5: Remove unused constantJoseph Sutton1-4/+0
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-03tests/krb5: Refactor setup_groups() to admit multiple preexisting principals ↵Joseph Sutton1-22/+29
and primary groups instead of hardcoded user and trust user principals, and a single primary group. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-03tests/krb5: Fix typoJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-03tests/krb5: Fix typoJoseph Sutton1-1/+1
'of', not 'on'. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-03tests/krb5: Move get_target() to base classJoseph Sutton1-29/+0
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-03-03tests/krb5: Remove client_as_etypes parameterJoseph Sutton1-1/+0
The client_as_etypes parameter previously indicated which etypes we thought the client supported. In practice, this was rarely specified, so we simply assumed that all three main enctypes were supported. Now that we have removed this parameter, rewrite the etype-info padata checking code to be simpler, and no longer to contain loops. Use get_default_enctypes() to determine which enctypes are supported. For tests that inherit from KDCBaseTest, this is based on the domain functional level, and will be more correct for tests that previously passed in client_as_etypes=None. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-02-08tests/krb5: Test groups returned by SamLogonJoseph Sutton1-0/+224
Levels NetlogonValidationSamInfo2 and NetlogonValidationSamInfo4 behave as might be expected, so we pass those tests. NetlogonValidationSamInfo returns no resource groups and doesn't set the NETLOGON_EXTRA_SIDS flag, and we fail its test. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-02-08tests/krb5: Add tests for the primary groupJoseph Sutton1-2/+582
Primary groups are handled differently from normal groups of which a user is simply a member. Of particular note is the case where a domain-local group is made a primary group; a case normally disallowed by Windows, but not by Samba. Therefore we want tests for it. Our testing framework must be able to set the user's primary group, and to clean up afterwards; to set the primary group RID of a PAC; and to check that the primary group RID is as expected in the PAC returned to us. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-02-08auth: Shorten long SID flags combinationsJoseph Sutton1-3/+1
The combination MANDATORY | ENABLED_BY_DEFAULT | ENABLED is very commonly used, and introducing a shorter alias for it makes the code clearer. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-02-08tests/krb5: Add tests of NETLOGON_RESOURCE_GROUPS flag handlingJoseph Sutton1-0/+47
This lets us test what happens in TGS-REQ exchanges to the KDC, when the flags and resource groups are simply passed through into the new PAC, regardless of what value the flags hold. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-02-08tests/krb5: Allow setting or resetting PAC flagsJoseph Sutton1-4/+40
This lets us test what happens when the flags in the PAC, such as NETLOGON_RESOURCE_GROUPS, are given "interesting" values. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-02-08tests/krb5: Add group tests simulating PACs from a trusted domainJoseph Sutton1-7/+113
Crucially, in these tests the user's domain and its SID are different from our domain and its SID. These tests will assert that in such a case resource groups are added to the PAC and handled correctly. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-02-08tests/krb5: Allow changing the SID of a user's PACJoseph Sutton1-12/+63
This lets us simulate a ticket of a user from another domain. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-02-08tests/krb5: Add some more test cases for PAC group handlingJoseph Sutton1-6/+52
Change some of the attributes in TGS-REQ PACs to ensure they are handled correctly. Add a test of a PAC containing resource SIDs for a service without resource SID compression support, ensuring the SIDs are correctly removed. Add a Samba 4.17 compatibility test for a service with resource SID compression support. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-02-08tests/krb5: Improve assertion failure messageJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-02-08tests/krb5: Remove tests of KDCs without resource SID compression supportJoseph Sutton1-87/+4
As part of mitigations of CVE-2022-37966, we no longer regard the msDS-SupportedEncryptionTypes attribute of the KDC when determining its supported encryption types. Thus, these tests that try to disable SID compression support by setting this attribute run to no purpose. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-02-08tests/krb5: Declare supported encryption types of service accountJoseph Sutton1-0/+3
If SID compression support is disabled for a created account, msDS-SupportedEncryptionTypes will be set to a value that includes the RESOURCE_SID_COMPRESSION_DISABLED bit, but no actual encryption type bits. Since stricter encryption type handling was introduced to address CVE-2022-37966, this combination has been interpreted as an expression of no encryption type support, and trying to make a Kerberos request to a service with such a combination of bits will fail with ERR_ETYPE_NOSUPP. To allow us to make Kerberos requests to test service accounts again, we must set some actual encryption type bits. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-12-13CVE-2022-37966 python:/tests/krb5: call sys.path.insert(0, "bin/python") ↵Stefan Metzmacher1-4/+5
before any other imports This allows the tests to be executed without an explicit PYTHONPATH="bin/python". BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Tue Dec 13 14:06:14 UTC 2022 on sn-devel-184
2022-11-08tests/krb5: Add tests of PAC group handlingJoseph Sutton1-0/+1203
In which we make AS and TGS requests and verify the SIDs we expect are returned in the PAC. Example command to test against Windows Server 2019 functional level 2016 with FAST enabled: ADMIN_USERNAME=Administrator ADMIN_PASSWORD=locDCpass1 \ CLAIMS_SUPPORT=1 COMPOUND_ID_SUPPORT=1 DC_SERVER=ADDC.EXAMPLE.COM \ DOMAIN=EXAMPLE EXPECT_PAC=1 FAST_SUPPORT=1 KRB5_CONFIG=krb5.conf \ PYTHONPATH=bin/python REALM=EXAMPLE.COM SERVER=ADDC.EXAMPLE.COM \ SKIP_INVALID=1 SMB_CONF_PATH=smb.conf STRICT_CHECKING=1 \ TKT_SIG_SUPPORT=1 python3 python/samba/tests/krb5/group_tests.py Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Tue Nov 8 03:37:37 UTC 2022 on sn-devel-184
generated by cgit v1.2.3 (git 2.25.1) at 2026-06-10 22:44:39 +0000