tests/krb5: Verify tickets obtained with get_service_ticket()

We only require the ticket checksum with Heimdal, because MIT currently
doesn't add it.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py
index 93951586cc7a78a4e49de59cd81faecede09af35..8a5e12bbed45a82a5cbc2c5dcf2309f59b157f38 100644 (file)
--- a/python/samba/tests/krb5/kdc_base_test.py
+++ b/python/samba/tests/krb5/kdc_base_test.py
@@ -1287,6 +1287,14 @@ class KDCBaseTest(RawKerberosTest):
                                                    sname=sname,
                                                    decryption_key=target_key)
 
+        if to_rodc:
+            krbtgt_creds = self.get_rodc_krbtgt_creds()
+        else:
+            krbtgt_creds = self.get_krbtgt_creds()
+        krbtgt_key = self.TicketDecryptionKey_from_creds(krbtgt_creds)
+        self.verify_ticket(service_ticket_creds, krbtgt_key,
+                           expect_ticket_checksum=self.tkt_sig_support)
+
         self.tkt_cache[cache_key] = service_ticket_creds
 
         return service_ticket_creds