tests/krb5: Don't specify extra enctypes for the krbtgt

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/python/samba/tests/krb5/claims_tests.py b/python/samba/tests/krb5/claims_tests.py
index 9f637acbafe9663680b14302dd324da0baf8074f..85ab04086cd40ff392f61083e2b4da5efd664b0c 100755 (executable)
--- a/python/samba/tests/krb5/claims_tests.py
+++ b/python/samba/tests/krb5/claims_tests.py
@@ -485,9 +485,13 @@ class ClaimsTests(KDCBaseTest):
                                 b'tgsarmor')
         armor_key = Krb5EncryptionKey(armor_key, None)
 
+        if to_krbtgt:
+            extra_enctypes = None
+        else:
+            extra_enctypes = security.KERB_ENCTYPE_COMPOUND_IDENTITY_SUPPORTED
         target_creds, sname = self.get_target(
             to_krbtgt,
-            extra_enctypes=security.KERB_ENCTYPE_COMPOUND_IDENTITY_SUPPORTED)
+            extra_enctypes=extra_enctypes)
         srealm = target_creds.get_realm()
 
         decryption_key = self.TicketDecryptionKey_from_creds(
@@ -588,9 +592,13 @@ class ClaimsTests(KDCBaseTest):
                                 b'tgsarmor')
         armor_key = Krb5EncryptionKey(armor_key, None)
 
+        if to_krbtgt:
+            extra_enctypes = None
+        else:
+            extra_enctypes = security.KERB_ENCTYPE_COMPOUND_IDENTITY_SUPPORTED
         target_creds, sname = self.get_target(
             to_krbtgt,
-            extra_enctypes=security.KERB_ENCTYPE_COMPOUND_IDENTITY_SUPPORTED)
+            extra_enctypes=extra_enctypes)
         srealm = target_creds.get_realm()
 
         decryption_key = self.TicketDecryptionKey_from_creds(

diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py
index 3d9059b351096fde88803641956830bf4e8fe74d..9b528eba7f29fced5c5263fd35f29c3940a0c4da 100644 (file)
--- a/python/samba/tests/krb5/kdc_base_test.py
+++ b/python/samba/tests/krb5/kdc_base_test.py
@@ -1854,6 +1854,9 @@ class KDCBaseTest(RawKerberosTest):
             self.assertIsNone(compression,
                               "it's no good specifying compression support "
                               "for the krbtgt")
+            self.assertFalse(extra_enctypes,
+                             "it's no good specifying extra enctypes "
+                             "for the krbtgt")
             creds = self.get_krbtgt_creds()
             sname = self.get_krbtgt_sname()
         else: