summaryrefslogtreecommitdiff
path: root/python/samba
AgeCommit message (Collapse)AuthorFilesLines
2023-07-19tests/krb5: Allow passing a pre-created certificate into _pkinit_req()Joseph Sutton1-6/+8
BUG: https://bugzilla.samba.org/show_bug.cgi?id=9612 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-19tests/krb5: Have the caller of create_certificate() fetch the CA certificate ↵Joseph Sutton1-4/+11
and private key These are useful to keep around for other purposes. BUG: https://bugzilla.samba.org/show_bug.cgi?id=9612 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-19tests/krb5: Factor out a method to fetch the CA certificate and private keyJoseph Sutton1-6/+11
BUG: https://bugzilla.samba.org/show_bug.cgi?id=9612 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-19tests/krb5: Factor out a method to create a certificateJoseph Sutton1-25/+34
BUG: https://bugzilla.samba.org/show_bug.cgi?id=9612 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-19tests/krb5: Test Windows 2000 variant of PK-INITJoseph Sutton2-37/+155
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-19tests/krb5: Add ASN.1 definitions for Windows 2000 PK-INITJoseph Sutton2-1/+103
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-19tests/krb5: Add tests for PK-INIT Freshness Extension (RFC 8070)Joseph Sutton3-6/+452
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-19tests/krb5: Remove unused methodsJoseph Sutton1-6/+0
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-19tests/krb5: Check PAC_TYPE_CREDENTIAL_INFO PAC bufferJoseph Sutton1-0/+46
When PK-INIT is performed, check that the buffer is as expected and contains the correct NT hash. The PK-INIT tests now pass against Windows Server 2019. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14985 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-19tests/krb5: Add PK-INIT testing frameworkJoseph Sutton3-13/+1074
To run these tests standalone, you will need the certificate and private key of the Certificate Authority. These can be specified together in the same file with the environment variable CA_CERT, or the private key may be specified in its own file with CA_PRIVATE_KEY. If either of these files are encrypted, you can specify the password in the environment variable CA_PASS. These tests create a new certificate for the user account, signed with the private key of the Certificate Authority. We negotiate the reply key with either of the public-key and Diffie-Hellman PK-INIT variants, and use the reply key to decrypt the enc-part in the response. We also check that the KDC’s signatures are valid. Most of the failures with the Heimdal KDC are due to the wrong nonce being returned in the reply compared to Windows, which issue is simple enough to correct. An example command line for manual testing against Windows: SMB_CONF_PATH=ad_dc.conf KRB5_CONFIG=krb5.conf SERVICE_USERNAME=win2k19-dc.example.com ADMIN_USERNAME=Administrator ADMIN_PASSWORD=locDCpass ADMIN_KVNO=1 FOR_USER=Administrator USERNAME=Administrator PASSWORD=locDCpass DC_SERVER=win2k19-dc.example.com SERVER=win2k19-dc.example.com DOMAIN=example REALM=example.com PYTHONPATH=bin/python STRICT_CHECKING=1 FAST_SUPPORT=1 CLAIMS_SUPPORT=1 COMPOUND_ID_SUPPORT=1 TKT_SIG_SUPPORT=1 FULL_SIG_SUPPORT=1 GNUTLS_PBKDF2_SUPPORT=1 EXPECT_PAC=1 EXPECT_EXTRA_PAC_BUFFERS=1 CHECK_CNAME=1 CHECK_PADATA=1 KADMIN_IS_TGS=0 FORCED_RC4=1 DEFAULT_ETYPES=36 CA_CERT=./win2k19-ca.pfx CA_PASS=1234 python3 python/samba/tests/krb5/pkinit_tests.py To set up windows for this I first installed an Certificate Authority with an Enterprise CA. Then I exported the private key and certificate of the CA: 1. go into the Certification Authority snap-in for the relevant computer, 2. right-clicking the CA 3. clicking ‘All Tasks’ → ‘Back up CA...’ 4. and exporting the private key and CA certificate. (I downloaded the resulting file via smbclient). After setting up an Enterprise CA, I also needed to edit the domain controller GPO to enable auto-enrollment, otherwise Windows would refuse to accept as legitimate any certificates provided by the client. That can be done by first enabling the policy: ‘Computer Configuration/Policies/Windows Settings/Security Settings/Public Key Policies/Certificate Services Client — Auto-Enrollment’, and then ticking both ‘Renew expired certificates…’ and ‘Update certificates…’) Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-19tests/krb5: Allow KerberosCredentials to have associated RSA private keyJoseph Sutton1-1/+17
This is needed for PK-INIT testing. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-19tests/krb5: Add helper methods for PK-INIT testingJoseph Sutton1-0/+418
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-19tests/krb5: Refactor encryption type selectionJoseph Sutton1-22/+36
Add and use some methods to calculate the highest supported AES and RC4 encryption types, respectively. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-19tests/krb5: Add PK-INIT ASN1 definitions and include licenceJoseph Sutton2-2/+2508
Reviewed-by: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-07-19tests/krb5: Add PKINIT pre-authentication typesJoseph Sutton1-0/+4
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-19tests/krb5: Add PKINIT typed data errorsJoseph Sutton1-0/+5
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-19tests/krb5: Add PKINIT error codesJoseph Sutton1-0/+12
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-19tests/krb5: Remove unused variablesJoseph Sutton1-13/+0
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-07-13python:tests: Fix code spellingAndreas Schneider1-1/+1
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Martin Schwenke <mschwenke@ddn.com>
2023-07-13python: Fix code spellingAndreas Schneider1-1/+1
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Martin Schwenke <mschwenke@ddn.com>
2023-07-05python:tests: Fix code spellingAndreas Schneider1-1/+1
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-30crypto: Rely on GnuTLS 3.6.13 and gnutls_pbkdf2()Andrew Bartlett3-27/+1
This removes a lot of inline #ifdef and means this feature is always tested. We can do this as we have chosen GnuTLS 3.6.13 as the new minimum version. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2023-06-27tests/krb5: Adjust authentication policy RBCD tests to expect appropriate ↵Joseph Sutton1-15/+25
failure statuses Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2023-06-27tests/krb5: Be less strict regarding acceptable delegation error codesJoseph Sutton1-12/+24
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2023-06-26tests/krb5: Test that client policies are not enforced with S4UJoseph Sutton1-0/+227
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2023-06-26tests/krb5: Fix RBCD commentsJoseph Sutton1-6/+6
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2023-06-26tests/krb5: Don’t unnecessarily specify ‘id’Joseph Sutton1-9/+0
In tests where we have multiple accounts of the same type, we use the ‘id’ parameter to ensure that these accounts are all different, as some restrictions are bypassed if an account authenticates to the selfsame account. However, this is unnecessary if we already specify (with ‘use_cache=False’) that the cache is not to be used. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2023-06-26tests/krb5: Add test for authenticating with disabled account and wrong passwordJoseph Sutton2-3/+51
This shows us that the client’s access is checked prior to passwords being checked. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2023-06-26tests/auth_log_pass_change: Fix flapping testJoseph Sutton1-2/+8
It appears that discardMessages() is still not entirely reliable. Ensure that we filter out any messages from the Administrator’s authentication. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2023-06-26netcmd: domain: Fix typoJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2023-06-25auth: Add functionality to log client and server policy informationJoseph Sutton1-2/+2
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-25python:tests: Fix typosJoseph Sutton1-2/+2
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-25netcmd: domain: Fix typoJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-25tests/krb5: Test authentication policy audit loggingJoseph Sutton1-1/+1826
For each test, we check the authentication logs and ensure the messages are as we expect. We only test AS-REQs and TGS-REQs with the Heimdal KDC at the moment, assuming that MIT doesn’t support logging for those cases. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-25tests/krb5: Test more authentication logging of TGT lifetimesJoseph Sutton1-2/+6
It is useful to test a combination of device restrictions and TGT lifetime restrictions so that we can check what TGT lifetime values end up in the logs. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-25tests/krb5: Improve authentication policy creationJoseph Sutton3-769/+342
Don’t require passing in an ID to create an authentication policy. Instead, have create_authn_policy() generate one for us. We now return an actual AuthenticationPolicy object rather than just a DN. This will give the tests more details to work with about the policies. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-06-25netcmd: domain: add error handling to domain claims commandsRob van der Linde2-15/+42
Similar to the auth commands commit prior to this. Where we wre catching LdbError before we now catch ModelError, all exceptions that are known and handled in the model layer will have a user-friendly error message. Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: domain: add error handling to domain auth commandsRob van der Linde5-54/+118
Where we wre catching LdbError before we now catch ModelError, all exceptions that are known and handled in the model layer will have a user-friendly error message. Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: domain: add model exceptions and error handlingRob van der Linde3-15/+88
* Only handle what we know, otherwise raise the existing LdbError * Cutom messages added in the model layer so we don't have to do it in the commands themselves Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: domain: model stores ldb message for saveRob van der Linde1-3/+9
The message is stored in self._apply which also gets called by self.refresh() This is the better thing to do than fetching in save. Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: domain: silo member command testsRob van der Linde2-0/+147
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: domain: model field testsRob van der Linde1-0/+332
Add tests for model fields to ensure they behave as expected when calling from_db_value and to_db_value methods. Add a base class for the tests themselves via a mixin as unittest doesn't support abstract test case classes. For each field, from_db_value and to_db_value must either be a list or a property that returns a list. The list contains input values and expected values, the expected value can also be a callback for more complex comparison, this is used for the possible claim values xml. It is important that singular values and list values are tested, and also None to ensure that fields properly get unset when a model is saved. Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: domain: silo member add and remove does not write whole listRob van der Linde2-22/+49
Writing the whole list at once can lead to data loss if multiple administrators are doing this at the same time. Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: domain: remove parse_guid and parse_text as they are no longer usedRob van der Linde1-15/+1
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: domain: claims: base class is no longer requiredRob van der Linde3-70/+34
base.py has been removed as this has all been moved to the model layer as the auth commands ldb is now just a local variable Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: domain: claims: move claim value type lookup by attribute to modelRob van der Linde2-34/+41
Also, there was no need for the cached property previously in the command, as the command only calls this once. Fetching all value types seems excessive now with the new model layer, we just fetch the one we need and get a model object back. Use the method lookup, it's consistent with the rest, and raise either LookupError or ValueError. Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: domain: claims: make use of AttributeSchema and ClassSchema modelsRob van der Linde2-44/+10
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: domain: add models for ClassSchema and AttributeSchemaRob van der Linde2-0/+125
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: auth silos: remove base classRob van der Linde4-107/+72
There is no point to the base class anymore. And since the model layer has dramatically simplified the code in the commands, ldb can just be a local variable. Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-06-25netcmd: domain: add test for silo if policy is a dnRob van der Linde1-0/+17
Signed-off-by: Rob van der Linde <rob@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-13 19:55:26 +0000