From: Joseph Sutton <josephsutton@catalyst.net.nz>
Date: Tue, 17 Oct 2023 01:03:33 +0000 (+1300)
Subject: tests/krb5: Expect a status code with policy errors
X-Git-Tag: talloc-2.4.2~1282
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=52ea480543b53173b9f92550b844224d17c14c51;p=thirdparty%2Fsamba.git

tests/krb5: Expect a status code with policy errors

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
---

diff --git a/python/samba/tests/krb5/conditional_ace_tests.py b/python/samba/tests/krb5/conditional_ace_tests.py
index 4d006d5bc5a..cb8fce74efd 100755
--- a/python/samba/tests/krb5/conditional_ace_tests.py
+++ b/python/samba/tests/krb5/conditional_ace_tests.py
@@ -2404,6 +2404,9 @@ class ConditionalAceTests(ConditionalAceBaseTests):
                   client_sids=client_sids,
                   expected_groups=client_sids,
                   code=KDC_ERR_POLICY,
+                  status=ntstatus.NT_STATUS_AUTHENTICATION_FIREWALL_FAILED,
+                  event=AuditEvent.KERBEROS_SERVER_RESTRICTION,
+                  reason=AuditReason.ACCESS_DENIED,
                   edata=self.expect_padata_outer)
 
     def test_tgs_without_aa_asserted_identity_device_from_rodc(self):
@@ -2507,6 +2510,9 @@ class ConditionalAceTests(ConditionalAceBaseTests):
                   client_sids=client_sids,
                   expected_groups=client_sids,
                   code=KDC_ERR_POLICY,
+                  status=ntstatus.NT_STATUS_AUTHENTICATION_FIREWALL_FAILED,
+                  event=AuditEvent.KERBEROS_SERVER_RESTRICTION,
+                  reason=AuditReason.ACCESS_DENIED,
                   edata=self.expect_padata_outer)
 
     def test_tgs_without_service_asserted_identity_device_from_rodc(self):
@@ -2610,6 +2616,9 @@ class ConditionalAceTests(ConditionalAceBaseTests):
                   client_sids=client_sids,
                   expected_groups=client_sids,
                   code=KDC_ERR_POLICY,
+                  status=ntstatus.NT_STATUS_AUTHENTICATION_FIREWALL_FAILED,
+                  event=AuditEvent.KERBEROS_SERVER_RESTRICTION,
+                  reason=AuditReason.ACCESS_DENIED,
                   edata=self.expect_padata_outer)
 
     def test_tgs_without_claims_valid_device_from_rodc(self):
diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc
index 143206a450a..15f1ba75d3e 100644
--- a/selftest/knownfail_heimdal_kdc
+++ b/selftest/knownfail_heimdal_kdc
@@ -150,10 +150,8 @@
 ^samba.tests.krb5.conditional_ace_tests.samba.tests.krb5.conditional_ace_tests.ConditionalAceTests.test_tgs_without_aa_asserted_identity_client_from_rodc\(ad_dc\)
 ^samba.tests.krb5.conditional_ace_tests.samba.tests.krb5.conditional_ace_tests.ConditionalAceTests.test_tgs_without_aa_asserted_identity_device_from_rodc\(ad_dc\)
 ^samba.tests.krb5.conditional_ace_tests.samba.tests.krb5.conditional_ace_tests.ConditionalAceTests.test_tgs_without_claims_valid_both_from_rodc\(ad_dc\)
-^samba.tests.krb5.conditional_ace_tests.samba.tests.krb5.conditional_ace_tests.ConditionalAceTests.test_tgs_without_claims_valid_client_from_rodc\(ad_dc\)
 ^samba.tests.krb5.conditional_ace_tests.samba.tests.krb5.conditional_ace_tests.ConditionalAceTests.test_tgs_without_claims_valid_device_from_rodc\(ad_dc\)
 ^samba.tests.krb5.conditional_ace_tests.samba.tests.krb5.conditional_ace_tests.ConditionalAceTests.test_tgs_without_service_asserted_identity_both_from_rodc\(ad_dc\)
-^samba.tests.krb5.conditional_ace_tests.samba.tests.krb5.conditional_ace_tests.ConditionalAceTests.test_tgs_without_service_asserted_identity_client_from_rodc\(ad_dc\)
 ^samba.tests.krb5.conditional_ace_tests.samba.tests.krb5.conditional_ace_tests.ConditionalAceTests.test_tgs_without_service_asserted_identity_device_from_rodc\(ad_dc\)
 #
 # Conditional ACE device restrictions