From d9fc8dc0d4b775e9b17ef8c5b7aee504ca3fafe7 Mon Sep 17 00:00:00 2001
From: =?utf8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
Date: Sun, 20 Jul 2025 17:59:37 +0200
Subject: [PATCH] s3-selftest: add tests for "net ads kerberos" commands

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15840

Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit 18d0574a0fe4b5fd468f949cfaa507ab4519c9e6)
---
 selftest/knownfail                            |   3 +
 source3/script/tests/test_net_ads_kerberos.sh | 158 ++++++++++++++++++
 source3/selftest/tests.py                     |  12 ++
 3 files changed, 173 insertions(+)
 create mode 100755 source3/script/tests/test_net_ads_kerberos.sh

diff --git a/selftest/knownfail b/selftest/knownfail
index 5f64e4edad0..802567c2404 100644
--- a/selftest/knownfail
+++ b/selftest/knownfail
@@ -344,3 +344,6 @@
 # We currently don't send referrals for LDAP modify of non-replicated attrs
 ^samba4.ldap.rodc.python\(rodc\).__main__.RodcTests.test_modify_nonreplicated.*
 
+# net ads kerberos
+samba3.blackbox.net_ads_kerberos.*net_ads_kerberos_kinit.*
+samba3.blackbox.net_ads_kerberos.*net_ads_kerberos_renew.*
diff --git a/source3/script/tests/test_net_ads_kerberos.sh b/source3/script/tests/test_net_ads_kerberos.sh
new file mode 100755
index 00000000000..8a3c9ef2bc7
--- /dev/null
+++ b/source3/script/tests/test_net_ads_kerberos.sh
@@ -0,0 +1,158 @@
+#!/bin/sh
+
+if [ $# -lt 5 ]; then
+	cat <<EOF
+Usage: test_net_ads_kerberos.sh USERNAME REALM PASSWORD PREFIX
+EOF
+	exit 1
+fi
+
+USERNAME="$1"
+REALM="$2"
+PASSWORD="$3"
+PREFIX="$4"
+shift 4
+ADDARGS="$*"
+
+incdir=$(dirname "$0")/../../../testprogs/blackbox
+. "$incdir"/subunit.sh
+
+mkdir -p "$PREFIX"/private
+PACFILE=$PREFIX/private/pacsave.$$
+
+KRB5CCNAME_PATH="$PREFIX/net_ads_kerberos_krb5ccache"
+rm -f "$KRB5CCNAME_PATH"
+
+KRB5CCNAME="FILE:$KRB5CCNAME_PATH"
+
+
+#################################################
+## Test "net ads kerberos kinit" variants
+#################################################
+
+testit "net_ads_kerberos_kinit" \
+	"$VALGRIND" "$BINDIR"/net ads kerberos kinit \
+	-U"$USERNAME"%"$PASSWORD" "$ADDARGS" \
+	|| failed=$((failed + 1))
+
+export KRB5CCNAME="$KRB5CCNAME_PATH"
+testit "net_ads_kerberos_kinit (KRB5CCNAME env set)" \
+	"$VALGRIND" "$BINDIR"/net ads kerberos kinit \
+	-U"$USERNAME"%"$PASSWORD" "$ADDARGS" \
+	|| failed=$((failed + 1))
+unset KRB5CCNAME
+rm -f "$KRB5CCNAME_PATH"
+
+# --use-krb5-ccache is not working
+#testit "net_ads_kerberos_kinit (with --use-krb5-ccache)" \
+#	$VALGRIND $BINDIR/net ads kerberos kinit \
+#	-U$USERNAME%$PASSWORD $ADDARGS \
+#	--use-krb5-ccache=${KRB5CCNAME} \
+#	|| failed=$((failed + 1))
+
+testit "net_ads_kerberos_kinit (-P)" \
+	"$VALGRIND" "$BINDIR"/net ads kerberos kinit \
+	-P "$ADDARGS" \
+	|| failed=$((failed + 1))
+
+export KRB5CCNAME="$KRB5CCNAME_PATH"
+testit "net_ads_kerberos_kinit (-P and KRB5CCNAME env set)" \
+	"$VALGRIND" "$BINDIR"/net ads kerberos kinit \
+	-P "$ADDARGS" \
+	|| failed=$((failed + 1))
+unset KRB5CCNAME
+rm -f "$KRB5CCNAME_PATH"
+
+# --use-krb5-ccache is not working
+#testit "net_ads_kerberos_kinit (-P with --use-krb5-ccache)" \
+#	$VALGRIND $BINDIR/net ads kerberos kinit \
+#	-P $ADDARGS \
+#	--use-krb5-ccache=${KRB5CCNAME} \
+#	|| failed=$((failed + 1))
+
+
+#################################################
+## Test "net ads kerberos renew" variants
+#################################################
+
+#testit "net_ads_kerberos_renew" \
+#	$VALGRIND $BINDIR/net ads kerberos renew \
+#	-U$USERNAME%$PASSWORD $ADDARGS \
+#	|| failed=$((failed + 1))
+#
+#export KRB5CCNAME=$KRB5CCNAME_PATH
+#testit "net_ads_kerberos_renew (KRB5CCNAME env)" \
+#	$VALGRIND $BINDIR/net ads kerberos renew \
+#	-U$USERNAME%$PASSWORD $ADDARGS \
+#	|| failed=$((failed + 1))
+#unset KRB5CCNAME
+#rm -f $KRB5CCNAME_PATH
+#
+# renew only succeeds with pre-kinit
+export KRB5CCNAME="$KRB5CCNAME_PATH"
+testit "net_ads_kerberos_kinit (KRB5CCNAME env set)" \
+	"$VALGRIND" "$BINDIR"/net ads kerberos kinit \
+	-U"$USERNAME"%"$PASSWORD" "$ADDARGS" \
+	|| failed=$((failed + 1))
+
+testit "net_ads_kerberos_renew" \
+	"$VALGRIND" "$BINDIR"/net ads kerberos renew \
+	-U"$USERNAME"%"$PASSWORD" "$ADDARGS" \
+	|| failed=$((failed + 1))
+unset KRB5CCNAME
+rm -f "$KRB5CCNAME_PATH"
+
+
+#################################################
+## Test "net ads kerberos pac" variants
+#################################################
+
+testit "net_ads_kerberos_pac_dump" \
+	"$VALGRIND" "$BINDIR"/net ads kerberos pac dump \
+	-U"$USERNAME"%"$PASSWORD" "$ADDARGS" \
+	|| failed=$((failed + 1))
+
+testit "net_ads_kerberos_pac_dump (-P)" \
+	"$VALGRIND" "$BINDIR"/net ads kerberos pac dump \
+	-P "$ADDARGS" \
+	|| failed=$((failed + 1))
+
+IMPERSONATE_PRINC="alice@$REALM"
+
+#testit "net_ads_kerberos_pac_dump (impersonate)" \
+#	$VALGRIND $BINDIR/net ads kerberos pac dump \
+#	-U$USERNAME%$PASSWORD \
+#	impersonate=$IMPERSONATE_PRINC $ADDARGS \
+#	|| failed=$((failed + 1))
+
+testit "net_ads_kerberos_pac_dump (impersonate and -P)" \
+	"$VALGRIND" "$BINDIR"/net ads kerberos pac dump \
+	-P \
+	impersonate="$IMPERSONATE_PRINC" "$ADDARGS" \
+	|| failed=$((failed + 1))
+
+# no clue why this doesn't work...
+#
+#testit_expect_failure "net_ads_kerberos_pac_save (without filename)"
+#	$VALGRIND $BINDIR/net ads kerberos pac save \
+#	-U$USERNAME%$PASSWORD $ADDARGS \
+#	|| failed=$((failed + 1))
+
+testit "net_ads_kerberos_pac_save" \
+	"$VALGRIND" "$BINDIR"/net ads kerberos pac save \
+	-U"$USERNAME"%"$PASSWORD" "$ADDARGS" \
+	filename="$PACFILE" \
+	|| failed=$((failed + 1))
+
+rm -f "$PACFILE"
+
+testit "net_ads_kerberos_pac_save (-P)" \
+	"$VALGRIND" "$BINDIR"/net ads kerberos pac save \
+	-P "$ADDARGS" \
+	filename="$PACFILE" \
+	|| failed=$((failed + 1))
+
+rm -f "$PACFILE"
+rm -f "$KRB5CCNAME_PATH"
+
+testok "$0" "$failed"
diff --git a/source3/selftest/tests.py b/source3/selftest/tests.py
index fe67a4df896..86d660800dc 100755
--- a/source3/selftest/tests.py
+++ b/source3/selftest/tests.py
@@ -1887,6 +1887,18 @@ plantestsuite(
      "bin/samba-tool",
      '$DNSNAME'])
 
+for auth in ["$DC_USERNAME", "$DOMAIN\\\\$DC_USERNAME", "$DC_USERNAME@$REALM" ]:
+    plantestsuite(
+        "samba3.blackbox.net_ads_kerberos (%s)" % auth,
+        "ad_member:local",
+        [os.path.join(samba3srcdir,
+                      "script/tests/test_net_ads_kerberos.sh"),
+         auth,
+         '$REALM',
+         '$DC_PASSWORD',
+         '$PREFIX',
+         configuration])
+
 plantestsuite("samba3.blackbox.force-user-unlink",
               "maptoguest:local",
               [os.path.join(samba3srcdir,
-- 
2.47.2