python:tests/krb5: Make PADATA_PK_AS_REP optional in non-strict mode

Commit c1433f821f7 added PADATA_PK_AS_REP (PA-PK-AS-REP, type 17) to
the expected padata list when check_rep_padata sees KDC_ERR_KEY_EXPIRED.
This reflects Samba's Heimdal KDC behaviour, which includes PKINIT hints
in expired-password error responses.

Samba with MIT KDC does not include PADATA_PK_AS_REP in KDC_ERR_KEY_EXPIRED
responses; it returns a METHOD-DATA with just the NTSTATUS payload (type 3) and
the FX-COOKIE (type 133).  This causes test_pw_expired to fail intermittently
when the expired-password code path is exercised against MIT KDC.

Add PADATA_PK_AS_REP to the require_strict set alongside PADATA_PK_AS_REP_19,
so it is treated as optional in non-strict checking mode (STRICT_CHECKING=0)
while still being enforced in strict mode.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Mon Mar 30 10:41:07 UTC 2026 on atb-devel-224

diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py
index 498f107cf132785b4b234c9da683bf44143c3e7c..1fab00eaf95c1b6b8a5398155726f325db8c66d7 100644 (file)
--- a/python/samba/tests/krb5/raw_testcase.py
+++ b/python/samba/tests/krb5/raw_testcase.py
@@ -5379,6 +5379,7 @@ class RawKerberosTest(TestCase):
             require_strict = {PADATA_FX_COOKIE,
                               PADATA_FX_FAST,
                               PADATA_PAC_OPTIONS,
+                              PADATA_PK_AS_REP,
                               PADATA_PK_AS_REP_19,
                               PADATA_PK_AS_REQ,
                               PADATA_PKINIT_KX,

diff --git a/selftest/knownfail_mit_kdc.d/as-req b/selftest/knownfail_mit_kdc.d/as-req
index aa29a482d58efca97bf7435816bba66508432fe6..c2f1aa366cb70ddaa07c184c0d4850c9e69a2d08 100644 (file)
--- a/selftest/knownfail_mit_kdc.d/as-req
+++ b/selftest/knownfail_mit_kdc.d/as-req
@@ -38,7 +38,6 @@
 ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_pac_False\(fl2003dc\)
 ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_pac_None\(fl2003dc\)
 ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_as_req_no_preauth_dummy_aes128_aes256_pac_True\(fl2003dc\)
-^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_pw_expired_wrong_password\(fl2008r2dc\)
 ^samba.tests.krb5.as_req_tests.samba.tests.krb5.as_req_tests.AsReqKerberosTests.test_pw_expired_wrong_password\(fl2003dc\)
 #
 # MIT currently fails some as_req_no_preauth tests.

diff --git a/selftest/knownfail_mit_kdc.d/no-implicit-dollar-canonicalization b/selftest/knownfail_mit_kdc.d/no-implicit-dollar-canonicalization
index af3910af71b3e7080053125e6f020f12af68aa9f..93d7ec4bb99ce5a1e7dd62732344c0e5bf9d3983 100644 (file)
--- a/selftest/knownfail_mit_kdc.d/no-implicit-dollar-canonicalization
+++ b/selftest/knownfail_mit_kdc.d/no-implicit-dollar-canonicalization
@@ -1,10 +1,8 @@
 ^samba\.tests\.krb5\.as_req_tests\.samba\.tests\.krb5\.as_req_tests\.AsReqKerberosTests\.test_logon_hours\(ad_dc_ntvfs\)
 ^samba\.tests\.krb5\.as_req_tests\.samba\.tests\.krb5\.as_req_tests\.AsReqKerberosTests\.test_logon_hours_wrong_password\(ad_dc_ntvfs\)
-^samba\.tests\.krb5\.as_req_tests\.samba\.tests\.krb5\.as_req_tests\.AsReqKerberosTests\.test_pw_expired_wrong_password\(ad_dc_ntvfs\)
 ^samba\.tests\.krb5\.alias_tests\.samba\.tests\.krb5\.alias_tests\.AliasTests\.test_create_alias_delete\(ad_dc_ntvfs\)
 ^samba\.tests\.krb5\.alias_tests\.samba\.tests\.krb5\.alias_tests\.AliasTests\.test_create_alias_rename\(ad_dc_ntvfs\)
 ^samba\.tests\.krb5\.alias_tests\.samba\.tests\.krb5\.alias_tests\.AliasTests\.test_dc_alias_delete\(ad_dc_ntvfs\)
 ^samba\.tests\.krb5\.alias_tests\.samba\.tests\.krb5\.alias_tests\.AliasTests\.test_dc_alias_rename\(ad_dc_ntvfs\)
 ^samba\.tests\.krb5\.as_req_tests\.samba\.tests\.krb5\.as_req_tests\.AsReqKerberosTests\.test_logon_hours\(ad_dc_ntvfs\)
 ^samba\.tests\.krb5\.as_req_tests\.samba\.tests\.krb5\.as_req_tests\.AsReqKerberosTests\.test_logon_hours_wrong_password\(ad_dc_ntvfs\)
-^samba\.tests\.krb5\.as_req_tests\.samba\.tests\.krb5\.as_req_tests\.AsReqKerberosTests\.test_pw_expired_wrong_password\(ad_dc_ntvfs\)