diff options
| author | Greg Hudson <ghudson@mit.edu> | 2012-07-01 14:19:56 -0400 |
|---|---|---|
| committer | Greg Hudson <ghudson@mit.edu> | 2012-07-01 14:19:56 -0400 |
| commit | 18b02f3e839c007fff54fc9b693f479b7563ec73 (patch) | |
| tree | 61d65744e6be89453f1fb28280a9d446c3c49e5c /src/tests/t_keytab.py | |
| parent | 61078fb49d3cf1e761541d10febeb0f27cdf543c (diff) | |
| download | krb5-18b02f3e839c007fff54fc9b693f479b7563ec73.tar.gz krb5-18b02f3e839c007fff54fc9b693f479b7563ec73.tar.xz krb5-18b02f3e839c007fff54fc9b693f479b7563ec73.zip | |
Try harder to make keytab-based AS requests work
When making a keytab-based AS request, a client has to choose between
sending its reply key enctype preference list (the enctypes it has in
the keytab) and its session key enctype preference list (all of the
enctypes it supports). Heimdal and MIT krb5 1.11 clients send the
reply key preference list. If this list doesn't overlap with the
server principal keys (say, because the krbtgt principal has only a
DES key), then the AS request will fail.
Try to make this work by making the KDC optimistically pick the first
permitted enctype in the request as the session key, even though it
can't be certain that other KDCs in the realm support that enctype.
Make sure to exercise this case in t_keytab.py by doing a multipass
keytab kinit test.
ticket: 7190 (new)
Diffstat (limited to 'src/tests/t_keytab.py')
| -rw-r--r-- | src/tests/t_keytab.py | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/src/tests/t_keytab.py b/src/tests/t_keytab.py index f56c7bba35..ef303f1975 100644 --- a/src/tests/t_keytab.py +++ b/src/tests/t_keytab.py @@ -1,10 +1,11 @@ #!/usr/bin/python from k5test import * -realm = K5Realm() +for realm in multipass_realms(create_user=False): + # Test kinit with a keytab. + realm.kinit(realm.host_princ, flags=['-k']) -# Test kinit with a keytab. -realm.kinit(realm.host_princ, flags=['-k']) +realm = K5Realm(get_creds=False) # Test kinit with a partial keytab. pkeytab = realm.keytab + '.partial' |