From: Matt Rogers <mrogers@redhat.com>
Date: Mon, 29 Feb 2016 21:41:01 +0000 (-0500)
Subject: Add auth indicator LDAP KDB tests
X-Git-Tag: krb5-1.15-beta1~241
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=18252584fd8cbfb43144337833fc83d4d2d12da5;p=thirdparty%2Fkrb5.git

Add auth indicator LDAP KDB tests

Check the setstr results with an ldapsearch, then verify the getstrs
output.

ticket: 8379
---

diff --git a/src/tests/t_kdb.py b/src/tests/t_kdb.py
index 132869d039..4653a1c2c0 100755
--- a/src/tests/t_kdb.py
+++ b/src/tests/t_kdb.py
@@ -114,8 +114,17 @@ def kldaputil(args, **kw):
 kldaputil(['destroy', '-f'])
 
 ldapmodify = which('ldapmodify')
-if not ldapmodify:
-    skip_rest('some LDAP KDB tests', 'ldapmodify not found')
+ldapsearch = which('ldapsearch')
+if not ldapmodify or not ldapsearch:
+    skip_rest('some LDAP KDB tests', 'ldapmodify or ldapsearch not found')
+
+def ldap_search(args):
+    proc = subprocess.Popen([ldapsearch, '-H', ldap_uri, '-b', top_dn,
+                             '-D', admin_dn, '-w', admin_pw, args],
+                            stdin=subprocess.PIPE, stdout=subprocess.PIPE,
+                            stderr=subprocess.STDOUT)
+    (out, dummy) = proc.communicate()
+    return out
 
 def ldap_modify(ldif, args=[]):
     proc = subprocess.Popen([ldapmodify, '-H', ldap_uri, '-D', admin_dn,
@@ -276,6 +285,20 @@ realm.kinit(realm.user_princ, password('user'))
 realm.run([kvno, realm.host_princ])
 realm.klist(realm.user_princ, realm.host_princ)
 
+# Test auth indicator support
+realm.addprinc('authind', password('authind'))
+realm.run([kadminl, 'setstr', 'authind', 'require_auth', 'otp radius'])
+
+out = ldap_search('(krbPrincipalName=authind*)')
+if 'krbPrincipalAuthInd: otp' not in out:
+    fail('Expected krbPrincipalAuthInd value not in output')
+if 'krbPrincipalAuthInd: radius' not in out:
+    fail('Expected krbPrincipalAuthInd value not in output')
+
+out = realm.run([kadminl, 'getstrs', 'authind'])
+if 'require_auth: otp radius' not in out:
+    fail('Expected auth indicators value not in output')
+
 # Test service principal aliases.
 realm.addprinc('canon', password('canon'))
 ldap_modify('dn: krbPrincipalName=canon@KRBTEST.COM,cn=t1,cn=krb5\n'