diff options
Diffstat (limited to 'tests')
| -rw-r--r-- | tests/httpd.conf | 16 | ||||
| -rwxr-xr-x | tests/magtests.py | 29 | ||||
| -rwxr-xr-x | tests/t_spnego_negotiate_once.py | 37 | ||||
| -rwxr-xr-x | tests/t_spnego_no_auth.py | 21 |
4 files changed, 103 insertions, 0 deletions
diff --git a/tests/httpd.conf b/tests/httpd.conf index 1e249ec..f10a7ca 100644 --- a/tests/httpd.conf +++ b/tests/httpd.conf @@ -137,6 +137,22 @@ CoreDumpDirectory /tmp Require valid-user </Location> +<Location /spnego_negotiate_once> + AuthType GSSAPI + AuthName "Login Negotiate Once" + GssapiSSLonly Off + GssapiUseSessions On + Session On + SessionCookieName gssapi_session path=/spnego_negotiate_once;httponly + GssapiCredStore ccache:${HTTPROOT}/tmp/httpd_krb5_ccache + GssapiCredStore client_keytab:${HTTPROOT}/http.keytab + GssapiCredStore keytab:${HTTPROOT}/http.keytab + GssapiBasicAuth Off + GssapiAllowedMech krb5 + GssapiNegotiateOnce On + Require valid-user +</Location> + <Location /basic_auth_krb5> Options +Includes AddOutputFilter INCLUDES .html diff --git a/tests/magtests.py b/tests/magtests.py index 8075197..5abede0 100755 --- a/tests/magtests.py +++ b/tests/magtests.py @@ -283,6 +283,34 @@ def test_spnego_auth(testdir, testenv, testlog): else: sys.stderr.write('SPNEGO Proxy Auth: SUCCESS\n') + with (open(testlog, 'a')) as logfile: + spnego = subprocess.Popen(["tests/t_spnego_no_auth.py"], + stdout=logfile, stderr=logfile, + env=testenv, preexec_fn=os.setsid) + spnego.wait() + if spnego.returncode != 0: + sys.stderr.write('SPNEGO No Auth: FAILED\n') + else: + sys.stderr.write('SPNEGO No Auth: SUCCESS\n') + + +def test_spnego_negotiate_once(testdir, testenv, testlog): + + spnego_negotiate_once_dir = os.path.join(testdir, 'httpd', 'html', + 'spnego_negotiate_once') + os.mkdir(spnego_negotiate_once_dir) + shutil.copy('tests/index.html', spnego_negotiate_once_dir) + + with (open(testlog, 'a')) as logfile: + spnego = subprocess.Popen(["tests/t_spnego_negotiate_once.py"], + stdout=logfile, stderr=logfile, + env=testenv, preexec_fn=os.setsid) + spnego.wait() + if spnego.returncode != 0: + sys.stderr.write('SPNEGO Negotiate Once: FAILED\n') + else: + sys.stderr.write('SPNEGO Negotiate Once: SUCCESS\n') + def test_basic_auth_krb5(testdir, testenv, testlog): @@ -358,6 +386,7 @@ if __name__ == '__main__': test_spnego_auth(testdir, testenv, testlog) + test_spnego_negotiate_once(testdir, testenv, testlog) testenv = {'MAG_USER_NAME': USR_NAME, 'MAG_USER_PASSWORD': USR_PWD, diff --git a/tests/t_spnego_negotiate_once.py b/tests/t_spnego_negotiate_once.py new file mode 100755 index 0000000..7c7179a --- /dev/null +++ b/tests/t_spnego_negotiate_once.py @@ -0,0 +1,37 @@ +#!/usr/bin/python +# Copyright (C) 2015 - mod_auth_gssapi contributors, see COPYING for license. + +import os +import requests +from requests_kerberos import HTTPKerberosAuth, OPTIONAL + + +if __name__ == '__main__': + sess = requests.Session() + url = 'http://%s/spnego_negotiate_once/' % ( + os.environ['NSS_WRAPPER_HOSTNAME']) + + # ensure a 401 with the appropriate WWW-Authenticate header is returned + # when no auth is provided + r = sess.get(url) + if r.status_code != 401: + raise ValueError('Spnego Negotiate Once failed - 401 expected') + if not (r.headers.get("WWW-Authenticate") and + r.headers.get("WWW-Authenticate").startswith("Negotiate")): + raise ValueError('Spnego Negotiate Once failed - WWW-Authenticate ' + 'Negotiate header missing') + + # test sending a bad Authorization header with GssapiNegotiateOnce enabled + r = sess.get(url, headers={"Authorization": "Negotiate badvalue"}) + if r.status_code != 401: + raise ValueError('Spnego Negotiate Once failed - 401 expected') + if r.headers.get("WWW-Authenticate"): + raise ValueError('Spnego Negotiate Once failed - WWW-Authenticate ' + 'Negotiate present but GssapiNegotiateOnce is ' + 'enabled') + + # ensure a 200 is returned when valid auth is provided + r = sess.get(url, auth=HTTPKerberosAuth()) + if r.status_code != 200: + raise ValueError('Spnego Negotiate Once failed') + diff --git a/tests/t_spnego_no_auth.py b/tests/t_spnego_no_auth.py new file mode 100755 index 0000000..34a6481 --- /dev/null +++ b/tests/t_spnego_no_auth.py @@ -0,0 +1,21 @@ +#!/usr/bin/python +# Copyright (C) 2015 - mod_auth_gssapi contributors, see COPYING for license. + +import os +import requests +from requests_kerberos import HTTPKerberosAuth, OPTIONAL + + +if __name__ == '__main__': + sess = requests.Session() + url = 'http://%s/spnego/' % os.environ['NSS_WRAPPER_HOSTNAME'] + + r = sess.get(url) + if r.status_code != 401: + raise ValueError('Spnego failed - 401 expected') + + if not (r.headers.get("WWW-Authenticate") and + r.headers.get("WWW-Authenticate").startswith("Negotiate")): + raise ValueError('Spnego failed - WWW-Authenticate Negotiate header ' + 'missing') + |