2027aa11ed
Use --detach in tests to avoid waiting
2016-12-07 19:52:29 -06:00
8735d47d8b
Add missing tests/gss env setup
2016-12-06 22:44:34 -06:00
a59bb7132f
When building a princ name pick a sane def type
...
This is part of the fix to #173 . MSFT RODCs insist on the name type for
krbtgt principals be set to KRB5_NT_SRV_INST.
Commentary from Jeffrey Altman <jaltman@secure-endpoints.com >
As reported by David Mulder of Dell's Quest, Active Directory will
return a BAD_INTEGRITY error when a request for a krbtgt service
ticket is received with principal type NT-PRINCIPAL instead of NT-SRV-INST
as required by RFC 4120.
[Nico: RFC4120 does not require this. See the description of the
name-type field of PrincipalName on page 55.]
ERROR: VAS_ERR_KRB5: Failed to obtain credentials.
Client: SLED10-32$@F.QAS ,
Service: SLED10-32$@F.QAS , Server: ad2-f.f.qas
Caused by: KRB5KRB_AP_ERR_BAD_INTEGRITY (-1765328353): Decrypt integrity check failed
Microsoft began enforcing principal type checking for RODCs in 2008R2.
Microsoft does state that ALL krgtgt/REALM tickets SHOULD be sent using
principal name type of KRB5_NT_SRV_INST instead of KRB5_NT_PRINCIPAL.
From Microsoft:
"I believe we discovered the problem. There isn't a bug in Windows.
There's been a code change to address another issue which puts in additional
checks for Kerberos tickets. The problem is with the Unix clients when the
client request a TGT. The Unix clients are using Name-type Principal
[KRB_NT_PRINCIPAL (1)] instead of using Name-type Service and Instance
[KRB_NT_SRV_INST (2)]...."
This change assigns the NT-SRV-INST principal type each time a krbtgt
service principal is created. Unlike Microsoft, the Heimdal mostly does
not care about the name-type of any principals, with the exception of
referrals, where the name type is needed to decide how to find a
next-hop realm.
2016-11-14 21:29:47 -06:00
95a2ba6aea
Test gss_acquire_cred_with_password()
2015-04-15 12:37:51 -05:00
612e5c2a12
Test name canon rules via GSS and put kdc tests last
...
Put kdc last in tests/Makefile.am. There's two tests in tests/kdc
that have been failing for a long time, and that causes the
remaining tests to not be run. By putting kdc last those tests do
run.
2011-10-22 14:54:27 -05:00
fda076962d
check prefixed keytab too
2011-04-09 18:28:15 -07:00
86da42df1d
abstract out --no-afslog and --no-unlog
2010-06-01 14:42:16 -07:00
a2378f6b82
log what the error string say too
2009-12-14 23:15:56 -08:00
3a42c1f7cb
More debug logging
2009-12-14 22:43:37 -08:00
36566c31a0
sprinkle more 'echo "test failed"'
2009-12-14 22:12:29 -08:00
45260b1fda
sprinkle 'echo "test failed"'
2009-12-14 22:11:19 -08:00
baf9c1c85b
in sh, equal compare is really = for strings, not ==
2009-12-14 18:25:04 -08:00
01a1e1baef
check that gss_krb5_set_allowable_enctypes works
2009-11-30 17:19:13 -08:00
8052362e92
test spnegoiov
2009-08-29 09:03:46 -07:00
2f1a370cd3
hack for gss-wrap-iov to it work
...
Signed-off-by: Love Hornquist Astrand <lha@h5l.org >
2009-08-28 13:31:12 -07:00
fa502c6648
Add support for gss_{import,export}_cred() as requested by metze
...
Works for krb5 and SPNEGO mechanisms. Kerberos credentials are passed as
credential cache names, or if there are memory based credentials, inband in the protocol. This means that the credentials buffers must be keep secret.
As documented by IBM (they have the wrong prototype though)
and GGF (GSS-API Extensions) back in 2001
2009-07-29 13:36:02 +02:00
c99b2003e2
Implement gss_wrap_iov, gss_unwrap_iov for CFX type encryption types.
...
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@25286 ec53bebd-3082-4978-b11e-865c3cabbd6b
2009-06-22 17:56:41 +00:00
dfebb92702
test wrapunwrap
...
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@24784 ec53bebd-3082-4978-b11e-865c3cabbd6b
2009-02-22 23:26:27 +00:00
e172367898
switch to utf8 encoding of all files
...
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23814 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-09-13 08:53:55 +00:00
b43a607fb7
fail on error
...
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23685 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-08-26 12:34:37 +00:00
17d8a114ea
test aliases
...
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23684 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-08-25 11:12:06 +00:00
ab4ce491b0
test use referrals
...
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23677 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-08-25 02:34:11 +00:00
a19b9d161e
fix errors
...
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23544 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-08-16 22:59:54 +00:00
5948792004
make quiet
...
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23535 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-08-16 22:58:20 +00:00
dfb1db9505
delegate policy
...
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23486 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-08-11 09:58:24 +00:00
d0d20c1128
remove lefterover debug message
...
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23426 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-07-26 18:39:59 +00:00
ebffab1aee
check max loop, pretty status messages
...
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23424 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-07-26 18:39:12 +00:00
ad59df40ae
remove gbd
...
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23423 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-07-26 18:38:50 +00:00
becaa9d9f9
check client code
...
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23421 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-07-26 18:38:14 +00:00
39fe446983
Support parsing KRB-ERROR passed back from windows server when the time is out of sync, modify krb5_cc_[sg]et_config interface to handle principals too, add tests for this
...
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23420 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-07-26 18:37:48 +00:00
d461bb4ce8
test --ok-as-delgate and not
...
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23406 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-07-26 18:31:24 +00:00
ffa6d8121c
remove stray bash
...
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23384 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-07-24 20:03:52 +00:00
c16610f924
Need to use mutual to make this work.
...
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23383 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-07-24 20:03:29 +00:00
8f92cc94b4
Build a service without aes, build context and see that we still got
...
an aes session key thanks to EtypeList.
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@23382 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-07-24 20:03:13 +00:00
2f58fa6ccb
Test gsskrb5_register_acceptor_identity.
...
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@22683 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-03-14 21:12:55 +00:00
bafd4055b8
Don't test the chmod 0'ed keytab, since that test doesn't work for root
...
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@22659 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-02-26 13:19:52 +00:00
91c2002f8e
Check spnego error messages too.
...
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@22601 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-02-21 12:58:14 +00:00
51c0537eef
Does not work yet error case.
...
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@22567 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-02-03 18:19:32 +00:00
a0caf44c41
Test unreadable/non existant keytab and its error message.
...
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@22536 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-01-27 12:20:33 +00:00
6479b98f70
Quoting.
...
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@22425 ec53bebd-3082-4978-b11e-865c3cabbd6b
2008-01-13 09:46:01 +00:00
cc3de997ab
empty messages.log
...
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@21844 ec53bebd-3082-4978-b11e-865c3cabbd6b
2007-08-08 06:54:22 +00:00
913b06b055
disable dns canon on test, break on some buildfarm hosts.
...
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@21263 ec53bebd-3082-4978-b11e-865c3cabbd6b
2007-06-22 07:34:34 +00:00
ea808c9c0e
use diffrent port, 49188, and hope that it isnt used, help on solaris where the help services runs on port 8888
...
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@20202 ec53bebd-3082-4978-b11e-865c3cabbd6b
2007-02-08 00:59:47 +00:00
a9e71ed195
don't need to set GSSAPI_SPNEGO_NAME any longer
...
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@19436 ec53bebd-3082-4978-b11e-865c3cabbd6b
2006-12-19 12:11:05 +00:00
e94890aa89
Define GSSAPI_SPNEGO_NAME and re-add spnego
...
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@19433 ec53bebd-3082-4978-b11e-865c3cabbd6b
2006-12-18 22:50:24 +00:00
489a126759
disable spnego test for now
...
k
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@19432 ec53bebd-3082-4978-b11e-865c3cabbd6b
2006-12-18 22:12:41 +00:00
cd91aac791
add trap, remove allow-digest, pretty print.
...
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@19430 ec53bebd-3082-4978-b11e-865c3cabbd6b
2006-12-18 21:59:42 +00:00
8f4072982a
Add dce-style context building test.
...
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@19041 ec53bebd-3082-4978-b11e-865c3cabbd6b
2006-11-15 08:49:28 +00:00
0f08e9941a
test more combination of context building
...
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@19040 ec53bebd-3082-4978-b11e-865c3cabbd6b
2006-11-15 08:45:51 +00:00
c1fc563b38
switch to test.h5l.se
...
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@19026 ec53bebd-3082-4978-b11e-865c3cabbd6b
2006-11-13 10:09:12 +00:00
Nicolas Williams