From: Greg Hudson <ghudson@mit.edu>
Date: Mon, 28 Oct 2013 17:34:04 +0000 (-0400)
Subject: Add tests for anonymous kadmin
X-Git-Tag: krb5-1.13-alpha1~333
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7b7e72f66cda405967b2a1da0b5ff8141feb0eb1;p=thirdparty%2Fkrb5.git

Add tests for anonymous kadmin
---

diff --git a/src/tests/t_pkinit.py b/src/tests/t_pkinit.py
index 7b20fa37b7..762e32276b 100644
--- a/src/tests/t_pkinit.py
+++ b/src/tests/t_pkinit.py
@@ -71,6 +71,19 @@ realm.kinit('@%s' % realm.realm, flags=['-n'])
 realm.klist('WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS')
 realm.run([kvno, realm.host_princ])
 
+# Test anonymous kadmin.
+f = open(os.path.join(realm.testdir, 'acl'), 'a')
+f.write('WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS a *')
+f.close()
+realm.start_kadmind()
+out = realm.run([kadmin, '-n', '-q', 'addprinc -pw test testadd'])
+if 'created.' not in out:
+    fail('Could not create principal with anonymous kadmin')
+out = realm.run([kadmin, '-n', '-q', 'getprinc testadd'])
+if "Operation requires ``get'' privilege" not in out:
+    fail('Anonymous kadmin has too much privilege')
+realm.stop_kadmind()
+
 # Test with anonymous restricted; FAST should work but kvno should fail.
 r_env = realm.special_env('restrict', True, kdc_conf=restrictive_kdc_conf)
 realm.stop_kdc()