tests/krb5: Test that the salt for a managed service account is computed correctly

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/python/samba/tests/krb5/salt_tests.py b/python/samba/tests/krb5/salt_tests.py
index b9e82f984b3a67f4761acd0ba46fccf85b2f3d9f..fcda5338d49fca2aca9b88d9d4d65b10128d15cf 100755 (executable)
--- a/python/samba/tests/krb5/salt_tests.py
+++ b/python/samba/tests/krb5/salt_tests.py
@@ -69,6 +69,12 @@ class SaltTests(AsReqBaseTest):
             opts={'name_suffix': 'foo@bar'})
         self._run_as_req_enc_timestamp(client_creds)
 
+    def test_salt_at_managed_service(self):
+        client_creds = self._get_creds(
+            account_type=self.AccountType.MANAGED_SERVICE,
+            opts={'name_suffix': 'foo@bar'})
+        self._run_as_req_enc_timestamp(client_creds)
+
     def test_salt_at_case_user(self):
         client_creds = self._get_creds(
             account_type=self.AccountType.USER,
@@ -81,6 +87,12 @@ class SaltTests(AsReqBaseTest):
             opts={'name_suffix': 'Foo@bar'})
         self._run_as_req_enc_timestamp(client_creds)
 
+    def test_salt_at_case_managed_service(self):
+        client_creds = self._get_creds(
+            account_type=self.AccountType.MANAGED_SERVICE,
+            opts={'name_suffix': 'Foo@bar'})
+        self._run_as_req_enc_timestamp(client_creds)
+
     def test_salt_double_at_user(self):
         client_creds = self._get_creds(
             account_type=self.AccountType.USER,
@@ -93,6 +105,12 @@ class SaltTests(AsReqBaseTest):
             opts={'name_suffix': 'foo@@bar'})
         self._run_as_req_enc_timestamp(client_creds)
 
+    def test_salt_double_at_managed_service(self):
+        client_creds = self._get_creds(
+            account_type=self.AccountType.MANAGED_SERVICE,
+            opts={'name_suffix': 'foo@@bar'})
+        self._run_as_req_enc_timestamp(client_creds)
+
     def test_salt_at_start_user(self):
         client_creds = self._get_creds(
             account_type=self.AccountType.USER,
@@ -105,6 +123,12 @@ class SaltTests(AsReqBaseTest):
             opts={'name_prefix': '@foo'})
         self._run_as_req_enc_timestamp(client_creds)
 
+    def test_salt_at_start_managed_service(self):
+        client_creds = self._get_creds(
+            account_type=self.AccountType.MANAGED_SERVICE,
+            opts={'name_prefix': '@foo'})
+        self._run_as_req_enc_timestamp(client_creds)
+
     def test_salt_at_end_user(self):
         client_creds = self._get_creds(
             account_type=self.AccountType.USER,
@@ -117,6 +141,13 @@ class SaltTests(AsReqBaseTest):
             opts={'name_suffix': 'foo@'})
         self._run_as_req_enc_timestamp(client_creds)
 
+    def test_salt_at_end_managed_service(self):
+        client_creds = self._get_creds(
+            account_type=self.AccountType.MANAGED_SERVICE,
+            opts={'name_suffix': 'foo@',
+                  'add_dollar': True})
+        self._run_as_req_enc_timestamp(client_creds)
+
     def test_salt_at_end_no_dollar_mac(self):
         client_creds = self._get_creds(
             account_type=self.AccountType.COMPUTER,
@@ -124,12 +155,25 @@ class SaltTests(AsReqBaseTest):
                   'add_dollar': False})
         self._run_as_req_enc_timestamp(client_creds)
 
+    def test_salt_at_end_add_dollar_managed_service(self):
+        client_creds = self._get_creds(
+            account_type=self.AccountType.MANAGED_SERVICE,
+            opts={'name_suffix': 'foo@',
+                  'add_dollar': True})
+        self._run_as_req_enc_timestamp(client_creds)
+
     def test_salt_no_dollar_mac(self):
         client_creds = self._get_creds(
             account_type=self.AccountType.COMPUTER,
             opts={'add_dollar': False})
         self._run_as_req_enc_timestamp(client_creds)
 
+    def test_salt_add_dollar_managed_service(self):
+        client_creds = self._get_creds(
+            account_type=self.AccountType.MANAGED_SERVICE,
+            opts={'add_dollar': True})
+        self._run_as_req_enc_timestamp(client_creds)
+
     def test_salt_dollar_mid_mac(self):
         client_creds = self._get_creds(
             account_type=self.AccountType.COMPUTER,
@@ -137,6 +181,13 @@ class SaltTests(AsReqBaseTest):
                   'add_dollar': False})
         self._run_as_req_enc_timestamp(client_creds)
 
+    def test_salt_dollar_mid_managed_service(self):
+        client_creds = self._get_creds(
+            account_type=self.AccountType.MANAGED_SERVICE,
+            opts={'name_suffix': 'foo$bar',
+                  'add_dollar': True})
+        self._run_as_req_enc_timestamp(client_creds)
+
     def test_salt_dollar_user(self):
         client_creds = self._get_creds(
             account_type=self.AccountType.USER,
@@ -149,6 +200,12 @@ class SaltTests(AsReqBaseTest):
             opts={'name_suffix': 'foo$bar'})
         self._run_as_req_enc_timestamp(client_creds)
 
+    def test_salt_dollar_managed_service(self):
+        client_creds = self._get_creds(
+            account_type=self.AccountType.MANAGED_SERVICE,
+            opts={'name_suffix': 'foo$bar'})
+        self._run_as_req_enc_timestamp(client_creds)
+
     def test_salt_dollar_end_user(self):
         client_creds = self._get_creds(
             account_type=self.AccountType.USER,
@@ -161,6 +218,12 @@ class SaltTests(AsReqBaseTest):
             opts={'name_suffix': 'foo$'})
         self._run_as_req_enc_timestamp(client_creds)
 
+    def test_salt_dollar_end_managed_service(self):
+        client_creds = self._get_creds(
+            account_type=self.AccountType.MANAGED_SERVICE,
+            opts={'name_suffix': 'foo$'})
+        self._run_as_req_enc_timestamp(client_creds)
+
     def test_salt_upn_user(self):
         client_creds = self._get_creds(
             account_type=self.AccountType.USER,
@@ -173,6 +236,12 @@ class SaltTests(AsReqBaseTest):
             opts={'upn': 'foo1'})
         self._run_as_req_enc_timestamp(client_creds)
 
+    def test_salt_upn_managed_service(self):
+        client_creds = self._get_creds(
+            account_type=self.AccountType.MANAGED_SERVICE,
+            opts={'upn': 'foo24'})
+        self._run_as_req_enc_timestamp(client_creds)
+
     def test_salt_upn_host_user(self):
         client_creds = self._get_creds(
             account_type=self.AccountType.USER,
@@ -185,6 +254,12 @@ class SaltTests(AsReqBaseTest):
             opts={'upn': 'host/foo3'})
         self._run_as_req_enc_timestamp(client_creds)
 
+    def test_salt_upn_host_managed_service(self):
+        client_creds = self._get_creds(
+            account_type=self.AccountType.MANAGED_SERVICE,
+            opts={'upn': 'host/foo25'})
+        self._run_as_req_enc_timestamp(client_creds)
+
     def test_salt_upn_realm_user(self):
         realm = self.get_samdb().domain_dns_name()
         client_creds = self._get_creds(
@@ -199,6 +274,13 @@ class SaltTests(AsReqBaseTest):
             opts={'upn': 'foo5@' + realm})
         self._run_as_req_enc_timestamp(client_creds)
 
+    def test_salt_upn_realm_managed_service(self):
+        realm = self.get_samdb().domain_dns_name()
+        client_creds = self._get_creds(
+            account_type=self.AccountType.MANAGED_SERVICE,
+            opts={'upn': 'foo26@' + realm})
+        self._run_as_req_enc_timestamp(client_creds)
+
     def test_salt_upn_host_realm_user(self):
         realm = self.get_samdb().domain_dns_name()
         client_creds = self._get_creds(
@@ -213,6 +295,13 @@ class SaltTests(AsReqBaseTest):
             opts={'upn': 'host/foo7@' + realm})
         self._run_as_req_enc_timestamp(client_creds)
 
+    def test_salt_upn_host_realm_managed_service(self):
+        realm = self.get_samdb().domain_dns_name()
+        client_creds = self._get_creds(
+            account_type=self.AccountType.MANAGED_SERVICE,
+            opts={'upn': 'host/foo27@' + realm})
+        self._run_as_req_enc_timestamp(client_creds)
+
     def test_salt_upn_dollar_realm_user(self):
         realm = self.get_samdb().domain_dns_name()
         client_creds = self._get_creds(
@@ -227,6 +316,13 @@ class SaltTests(AsReqBaseTest):
             opts={'upn': 'foo9$@' + realm})
         self._run_as_req_enc_timestamp(client_creds)
 
+    def test_salt_upn_dollar_realm_managed_service(self):
+        realm = self.get_samdb().domain_dns_name()
+        client_creds = self._get_creds(
+            account_type=self.AccountType.MANAGED_SERVICE,
+            opts={'upn': 'foo28$@' + realm})
+        self._run_as_req_enc_timestamp(client_creds)
+
     def test_salt_upn_host_dollar_realm_user(self):
         realm = self.get_samdb().domain_dns_name()
         client_creds = self._get_creds(
@@ -241,6 +337,13 @@ class SaltTests(AsReqBaseTest):
             opts={'upn': 'host/foo11$@' + realm})
         self._run_as_req_enc_timestamp(client_creds)
 
+    def test_salt_upn_host_dollar_realm_managed_service(self):
+        realm = self.get_samdb().domain_dns_name()
+        client_creds = self._get_creds(
+            account_type=self.AccountType.MANAGED_SERVICE,
+            opts={'upn': 'host/foo29$@' + realm})
+        self._run_as_req_enc_timestamp(client_creds)
+
     def test_salt_upn_other_realm_user(self):
         client_creds = self._get_creds(
             account_type=self.AccountType.USER,
@@ -253,6 +356,12 @@ class SaltTests(AsReqBaseTest):
             opts={'upn': 'foo13@other.realm'})
         self._run_as_req_enc_timestamp(client_creds)
 
+    def test_salt_upn_other_realm_managed_service(self):
+        client_creds = self._get_creds(
+            account_type=self.AccountType.MANAGED_SERVICE,
+            opts={'upn': 'foo30@other.realm'})
+        self._run_as_req_enc_timestamp(client_creds)
+
     def test_salt_upn_host_other_realm_user(self):
         client_creds = self._get_creds(
             account_type=self.AccountType.USER,
@@ -265,6 +374,12 @@ class SaltTests(AsReqBaseTest):
             opts={'upn': 'host/foo15@other.realm'})
         self._run_as_req_enc_timestamp(client_creds)
 
+    def test_salt_upn_host_other_realm_managed_service(self):
+        client_creds = self._get_creds(
+            account_type=self.AccountType.MANAGED_SERVICE,
+            opts={'upn': 'host/foo31@other.realm'})
+        self._run_as_req_enc_timestamp(client_creds)
+
     def test_salt_upn_case_user(self):
         client_creds = self._get_creds(
             account_type=self.AccountType.USER,
@@ -277,6 +392,12 @@ class SaltTests(AsReqBaseTest):
             opts={'upn': 'Foo17'})
         self._run_as_req_enc_timestamp(client_creds)
 
+    def test_salt_upn_case_managed_service(self):
+        client_creds = self._get_creds(
+            account_type=self.AccountType.MANAGED_SERVICE,
+            opts={'upn': 'Foo32'})
+        self._run_as_req_enc_timestamp(client_creds)
+
     def test_salt_upn_dollar_mid_realm_user(self):
         realm = self.get_samdb().domain_dns_name()
         client_creds = self._get_creds(
@@ -291,6 +412,13 @@ class SaltTests(AsReqBaseTest):
             opts={'upn': 'foo$19@' + realm})
         self._run_as_req_enc_timestamp(client_creds)
 
+    def test_salt_upn_dollar_mid_realm_managed_service(self):
+        realm = self.get_samdb().domain_dns_name()
+        client_creds = self._get_creds(
+            account_type=self.AccountType.MANAGED_SERVICE,
+            opts={'upn': 'foo$33@' + realm})
+        self._run_as_req_enc_timestamp(client_creds)
+
     def test_salt_upn_host_dollar_mid_realm_user(self):
         realm = self.get_samdb().domain_dns_name()
         client_creds = self._get_creds(
@@ -305,6 +433,13 @@ class SaltTests(AsReqBaseTest):
             opts={'upn': 'host/foo$21@' + realm})
         self._run_as_req_enc_timestamp(client_creds)
 
+    def test_salt_upn_host_dollar_mid_realm_managed_service(self):
+        realm = self.get_samdb().domain_dns_name()
+        client_creds = self._get_creds(
+            account_type=self.AccountType.MANAGED_SERVICE,
+            opts={'upn': 'host/foo$34@' + realm})
+        self._run_as_req_enc_timestamp(client_creds)
+
     def test_salt_upn_at_realm_user(self):
         realm = self.get_samdb().domain_dns_name()
         client_creds = self._get_creds(
@@ -319,6 +454,13 @@ class SaltTests(AsReqBaseTest):
             opts={'upn': 'foo23@bar@' + realm})
         self._run_as_req_enc_timestamp(client_creds)
 
+    def test_salt_upn_at_realm_managed_service(self):
+        realm = self.get_samdb().domain_dns_name()
+        client_creds = self._get_creds(
+            account_type=self.AccountType.MANAGED_SERVICE,
+            opts={'upn': 'foo35@bar@' + realm})
+        self._run_as_req_enc_timestamp(client_creds)
+
 
 if __name__ == "__main__":
     global_asn1_print = False