From: Andrew Bartlett Date: Thu, 2 May 2024 04:02:58 +0000 (+1200) Subject: python/tests/krb5: Expect AES keys for UF_SMARTCARD_REQUIRED X-Git-Tag: tdb-1.4.11~418 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=504a47ecfd6ddcca421549760caea8e2cd2448d2;p=thirdparty%2Fsamba.git python/tests/krb5: Expect AES keys for UF_SMARTCARD_REQUIRED Windows 2022 at April 2024 has change and now includes the AES keys for accounts with UF_SMARTCARD_REQUIRED, so revert part of the change in b2fe1ea1c6aba116b31a1c803b4e0d36ac1a32ee. (This is an improvement to Windows security). Signed-off-by: Andrew Bartlett Reviewed-by: Jo Sutton --- diff --git a/python/samba/tests/krb5/kdc_base_test.py b/python/samba/tests/krb5/kdc_base_test.py index feb576b8458..8edfb75ff85 100644 --- a/python/samba/tests/krb5/kdc_base_test.py +++ b/python/samba/tests/krb5/kdc_base_test.py @@ -2167,7 +2167,7 @@ class KDCBaseTest(TestCaseInTempDir, RawKerberosTest): # # The NT hash is different, as it is returned to the client in # the PAC so is visible in the network behaviour. - if force_nt4_hash or smartcard_required: + if force_nt4_hash: expected_etypes = {kcrypto.Enctype.RC4} keys = self.get_keys(creds, expected_etypes=expected_etypes) self.creds_set_keys(creds, keys) diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc index 9c83268b205..1395d9b4467 100644 --- a/selftest/knownfail_heimdal_kdc +++ b/selftest/knownfail_heimdal_kdc @@ -73,7 +73,8 @@ # ^samba.tests.krb5.pkinit_tests.samba.tests.krb5.pkinit_tests.PkInitTests.test_pkinit_no_des3.ad_dc ^samba.tests.krb5.pkinit_tests.samba.tests.krb5.pkinit_tests.PkInitTests.test_pkinit_ntlm_from_pac_must_change_now -^samba.tests.krb5.pkinit_tests.samba.tests.krb5.pkinit_tests.PkInitTests.test_pkinit_ntlm_from_pac_smartcard_required_must_change_now +^samba.tests.krb5.pkinit_tests.samba.tests.krb5.pkinit_tests.PkInitTests.test_pkinit_ntlm_from_pac_smartcard_required +^samba.tests.krb5.pkinit_tests.samba.tests.krb5.pkinit_tests.PkInitTests.test_samlogon_smartcard_required # # Windows 2000 PK-INIT tests # diff --git a/selftest/knownfail_mit_kdc_1_20 b/selftest/knownfail_mit_kdc_1_20 index f3c77fc9dd0..74339056213 100644 --- a/selftest/knownfail_mit_kdc_1_20 +++ b/selftest/knownfail_mit_kdc_1_20 @@ -35,6 +35,7 @@ ^samba.tests.krb5.pkinit_tests.samba.tests.krb5.pkinit_tests.PkInitTests.test_pkinit_ntlm_from_pac_smartcard_required_must_change_now ^samba.tests.krb5.pkinit_tests.samba.tests.krb5.pkinit_tests.PkInitTests.test_pkinit_ntlm_from_pac ^samba.tests.krb5.pkinit_tests.samba.tests.krb5.pkinit_tests.PkInitTests.test_pkinit_kpasswd_change +^samba.tests.krb5.pkinit_tests.samba.tests.krb5.pkinit_tests.PkInitTests.test_samlogon_smartcard_required # # PK-INIT Freshness tests #