diff options
author | Sumit Bose <sbose@redhat.com> | 2012-10-18 16:14:40 +0200 |
---|---|---|
committer | Jakub Hrozek <jhrozek@redhat.com> | 2012-11-05 00:14:05 +0100 |
commit | c0680269167475aa9172b20d13ec3ace721a37ff (patch) | |
tree | ee3034c1e7a3479e59963c0fc5c5b4bccf00eda0 /src/tests | |
parent | 74254ab3c4d6b9ca63488245bc88db7cf7689084 (diff) | |
download | sssd-c0680269167475aa9172b20d13ec3ace721a37ff.tar.gz sssd-c0680269167475aa9172b20d13ec3ace721a37ff.tar.xz sssd-c0680269167475aa9172b20d13ec3ace721a37ff.zip |
krb5_auth: check if principal belongs to a different realm
Add a flag if the principal used for authentication does not belong
to our realm. This can be used to act differently for users from other
realms.
Diffstat (limited to 'src/tests')
-rw-r--r-- | src/tests/krb5_utils-tests.c | 45 |
1 files changed, 45 insertions, 0 deletions
diff --git a/src/tests/krb5_utils-tests.c b/src/tests/krb5_utils-tests.c index 5fee4544b..636bcd403 100644 --- a/src/tests/krb5_utils-tests.c +++ b/src/tests/krb5_utils-tests.c @@ -673,6 +673,47 @@ START_TEST(test_no_substitution) } END_TEST +START_TEST(test_compare_principal_realm) +{ + int ret; + bool different_realm; + + ret = compare_principal_realm(NULL, "a", &different_realm); + fail_unless(ret == EINVAL, "NULL upn does not cause EINVAL."); + + ret = compare_principal_realm("a", NULL, &different_realm); + fail_unless(ret == EINVAL, "NULL realm does not cause EINVAL."); + + ret = compare_principal_realm("a", "b", NULL); + fail_unless(ret == EINVAL, "NULL different_realmbool " \ + "does not cause EINVAL."); + + ret = compare_principal_realm("", "a", &different_realm); + fail_unless(ret == EINVAL, "Empty upn does not cause EINVAL."); + + ret = compare_principal_realm("a", "", &different_realm); + fail_unless(ret == EINVAL, "Empty realm does not cause EINVAL."); + + ret = compare_principal_realm("ABC", "ABC", &different_realm); + fail_unless(ret == EINVAL, "Short UPN does not cause EINVAL."); + + ret = compare_principal_realm("userABC", "ABC", &different_realm); + fail_unless(ret == EINVAL, "Missing '@' does not cause EINVAL."); + + fail_unless(different_realm == false, "Same realm but " \ + "different_realm is not false."); + ret = compare_principal_realm("user@ABC", "ABC", &different_realm); + fail_unless(ret == EOK, "Failure with same realm"); + fail_unless(different_realm == false, "Same realm but " \ + "different_realm is not false."); + + ret = compare_principal_realm("user@ABC", "DEF", &different_realm); + fail_unless(ret == EOK, "Failure with different realm"); + fail_unless(different_realm == true, "Different realm but " \ + "different_realm is not true."); +} +END_TEST + Suite *krb5_utils_suite (void) { Suite *s = suite_create ("krb5_utils"); @@ -713,6 +754,10 @@ Suite *krb5_utils_suite (void) } suite_add_tcase (s, tc_create_dir); + TCase *tc_krb5_helpers = tcase_create("Helper functions"); + tcase_add_test(tc_krb5_helpers, test_compare_principal_realm); + suite_add_tcase(s, tc_krb5_helpers); + return s; } |