Omit start time in common AS requests

MIT and Heimdal KDCs ignore the start time for non-postdated ticket
requests, but AD yields an error if the start time is in the KDC's
future, defeating the kdc_timesync option.  Omit the start time if the
caller did not specify a start time offset.

This change reenables the client check for too much clock skew in the
KDC reply in the non-timesync configuration.  That check had been
unintentionally suppressed since the introduction of the
get_init_creds interfaces.  Adjust the t_skew test script to expect
the new error behavior.

Code changes from stefw@gnome.org with slight modifications.

ticket: 7130

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25864 dc483132-0cff-0310-8789-dd5450dbe970

1 files changed, 24 insertions, 10 deletions

diff --git a/src/tests/t_skew.py b/src/tests/t_skew.py
index 668e553a1..18bd92287 100644
--- a/src/tests/t_skew.py
+++ b/src/tests/t_skew.py
@@ -28,17 +28,31 @@ conf = {'all': {'libdefaults': {'kdc_timesync': '0'}}}
 realm = K5Realm(start_kdc=False, krb5_conf=conf)
 realm.start_kdc(['-T', '-3600'])
 
-# kinit (no preauth) should work, but kvno should not.  kinit with
-# FAST should also fail since the armor AP-REQ won't be valid.
-realm.kinit(realm.user_princ, password('user'))
-realm.run_as_client([kvno, realm.host_princ], expected_code=1)
-realm.kinit(realm.user_princ, password('user'), flags=['-T', realm.ccache],
-            expected_code=1)
-
-# kinit (with preauth) should fail, with or without FAST.
+# Get tickets to use for FAST kinit tests.  The start time offset is
+# ignored by the KDC since we aren't getting postdatable tickets, but
+# serves to suppress the client clock skew check on the KDC reply.
+fast_cache = realm.ccache + '.fast'
+realm.kinit(realm.user_princ, password('user'),
+            flags=['-s', '-3600s', '-c', fast_cache])
+
+# kinit should detect too much skew in the KDC response.  kinit with
+# FAST should fail from the KDC since the armor AP-REQ won't be valid.
+out = realm.kinit(realm.user_princ, password('user'), expected_code=1)
+if 'Clock skew too great in KDC reply' not in out:
+    fail('Expected error message not seen in kinit skew case')
+out = realm.kinit(realm.user_princ, password('user'), flags=['-T', fast_cache],
+                  expected_code=1)
+if 'Clock skew too great while' not in out:
+    fail('Expected error message not seen in kinit FAST skew case')
+
+# kinit (with preauth) should fail from the KDC, with or without FAST.
 realm.run_kadminl('modprinc +requires_preauth user')
-realm.kinit(realm.user_princ, password('user'), expected_code=1)
-realm.kinit(realm.user_princ, password('user'), flags=['-T', realm.ccache],
+out = realm.kinit(realm.user_princ, password('user'), expected_code=1)
+if 'Clock skew too great while' not in out:
+    fail('Expected error message not seen in kinit skew case (preauth)')
+realm.kinit(realm.user_princ, password('user'), flags=['-T', fast_cache],
             expected_code=1)
+if 'Clock skew too great while' not in out:
+    fail('Expected error message not seen in kinit FAST skew case (preauth)')
 
 success('Clock skew tests')