tests/krb5: Allow specifying KDC options when requesting a TGT

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/python/samba/tests/krb5/authn_policy_tests.py b/python/samba/tests/krb5/authn_policy_tests.py
index 3e695b232e32657a1020398c9d4d5467f55db596..c8d254981824e4d5e89cf635067cc782293ee190 100755 (executable)
--- a/python/samba/tests/krb5/authn_policy_tests.py
+++ b/python/samba/tests/krb5/authn_policy_tests.py
@@ -990,6 +990,9 @@ class AuthnPolicyBaseTests(AuthLogTestBase, KdcTgsBaseTests):
     def _get_tgt(self, creds, *,
                  armor_tgt=None,
                  till=None,
+                 kdc_options=None,
+                 expected_flags=None,
+                 unexpected_flags=None,
                  expected_error=0,
                  expect_status=None,
                  expected_status=None):
@@ -1017,10 +1020,11 @@ class AuthnPolicyBaseTests(AuthLogTestBase, KdcTgsBaseTests):
 
         expected_etypes = krbtgt_creds.tgs_supported_enctypes
 
-        kdc_options = str(krb5_asn1.KDCOptions('renewable'))
-        # Contrary to Microsoft’s documentation, the returned ticket is
-        # renewable.
-        expected_flags = krb5_asn1.TicketFlags('renewable')
+        if kdc_options is None:
+            kdc_options = str(krb5_asn1.KDCOptions('renewable'))
+            # Contrary to Microsoft’s documentation, the returned ticket is
+            # renewable.
+            expected_flags = krb5_asn1.TicketFlags('renewable')
 
         preauth_key = self.PasswordKey_from_creds(creds,
                                                   kcrypto.Enctype.AES256)
@@ -1086,6 +1090,7 @@ class AuthnPolicyBaseTests(AuthLogTestBase, KdcTgsBaseTests):
             expected_sname=expected_sname,
             expected_salt=salt,
             expected_flags=expected_flags,
+            unexpected_flags=unexpected_flags,
             expected_supported_etypes=expected_etypes,
             generate_padata_fn=generate_padata_fn,
             generate_fast_padata_fn=generate_fast_padata_fn,