1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
|
# Authors:
# Rob Crittenden <rcritten@redhat.com>
#
# Copyright (C) 2010 Red Hat
# see file 'COPYING' for use and warranty information
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License as
# published by the Free Software Foundation; version 2 only
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
"""
Test `ipa-getkeytab`
"""
import os
import shutil
from cmdline import cmdline_test
from ipalib import api
from ipalib import errors
import tempfile
from ipapython import ipautil
import nose
import tempfile
import krbV
from ipaserver.plugins.ldap2 import ldap2
def use_keytab(principal, keytab):
try:
tmpdir = tempfile.mkdtemp(prefix = "tmp-")
ccache_file = 'FILE:%s/ccache' % tmpdir
krbcontext = krbV.default_context()
principal = str(principal)
keytab = krbV.Keytab(name=keytab, context=krbcontext)
principal = krbV.Principal(name=principal, context=krbcontext)
os.environ['KRB5CCNAME'] = ccache_file
ccache = krbV.CCache(name=ccache_file, context=krbcontext, primary_principal=principal)
ccache.init(principal)
ccache.init_creds_keytab(keytab=keytab, principal=principal)
conn = ldap2(shared_instance=False, ldap_uri=api.env.ldap_uri, base_dn=api.env.basedn)
conn.connect(ccache=ccache.name)
conn.disconnect()
except krbV.Krb5Error, e:
raise StandardError('Unable to bind to LDAP. Error initializing principal %s in %s: %s' % (principal.name, keytab, str(e)))
finally:
del os.environ['KRB5CCNAME']
if tmpdir:
shutil.rmtree(tmpdir)
class test_ipagetkeytab(cmdline_test):
"""
Test `ipa-getkeytab`.
"""
host_fqdn = u'ipatest.%s' % api.env.domain
service_princ = u'test/%s@%s' % (host_fqdn, api.env.realm)
subject = 'CN=%s,O=IPA' % host_fqdn
[keytabfd, keytabname] = tempfile.mkstemp()
os.close(keytabfd)
def test_0_setup(self):
"""
Create a host to test against.
"""
# Create the service
try:
api.Command['host_add'](self.host_fqdn)
except errors.DuplicateEntry:
# it already exists, no problem
pass
def test_1_run(self):
"""
Create a keytab with `ipa-getkeytab` for a non-existent service.
"""
new_args = ["ipa-client/ipa-getkeytab",
"-s", api.env.host,
"-p", "test/notfound.example.com",
"-k", self.keytabname,
]
(out, err, rc) = ipautil.run(new_args, stdin=None, raiseonerr=False)
assert err == 'Operation failed! PrincipalName not found.\n\n'
def test_2_run(self):
"""
Create a keytab with `ipa-getkeytab` for an existing service.
"""
# Create the service
try:
api.Command['service_add'](self.service_princ)
except errors.DuplicateEntry:
# it already exists, no problem
pass
os.unlink(self.keytabname)
new_args = ["ipa-client/ipa-getkeytab",
"-s", api.env.host,
"-p", self.service_princ,
"-k", self.keytabname,
]
try:
(out, err, rc) = ipautil.run(new_args, None)
assert err == 'Keytab successfully retrieved and stored in: %s\n' % self.keytabname
except ipautil.CalledProcessError, e:
assert (False)
def test_3_use(self):
"""
Try to use the service keytab.
"""
use_keytab(self.service_princ, self.keytabname)
def test_4_disable(self):
"""
Disable a kerberos principal
"""
# Verify that it has a principal key
entry = api.Command['service_show'](self.service_princ)['result']
assert(entry['has_keytab'] == True)
# Disable it
api.Command['service_disable'](self.service_princ)
# Verify that it looks disabled
entry = api.Command['service_show'](self.service_princ)['result']
assert(entry['has_keytab'] == False)
def test_5_use_disabled(self):
"""
Try to use the disabled keytab
"""
try:
use_keytab(self.service_princ, self.keytabname)
except StandardError, errmsg:
assert('Unable to bind to LDAP. Error initializing principal' in str(errmsg))
def test_9_cleanup(self):
"""
Clean up test data
"""
# First create the host that will use this policy
os.unlink(self.keytabname)
api.Command['host_del'](self.host_fqdn)
|
