174 lines
6.5 KiB
Diff
174 lines
6.5 KiB
Diff
--- a/ipatests/test_integration/test_commands.py 2025-09-17 10:36:00.180673487 -0300
|
|
+++ b/ipatests/test_integration/test_commands.py 2025-09-17 10:37:31.294681273 -0300
|
|
@@ -1554,80 +1554,6 @@
|
|
assert result.returncode == 1
|
|
assert 'cannot be deleted or disabled' in result.stderr_text
|
|
|
|
- def test_unique_krbcanonicalname(self):
|
|
- """Verify that the uniqueness for krbcanonicalname is working"""
|
|
- master = self.master
|
|
-
|
|
- base_dn = str(master.domain.basedn)
|
|
- hostname = master.hostname
|
|
- realm = master.domain.realm
|
|
- principal = f'test/{hostname}@{realm}'
|
|
- entry_ldif_template = textwrap.dedent("""
|
|
- dn: krbprincipalname={principal},cn=services,cn=accounts,{base_dn}
|
|
- changetype: add
|
|
- ipakrbprincipalalias: test/{hostname}@{realm}
|
|
- krbprincipalname: {principal}
|
|
- objectclass: ipakrbprincipal
|
|
- objectclass: ipaobject
|
|
- objectclass: ipaservice
|
|
- objectclass: krbprincipal
|
|
- objectclass: krbprincipalaux
|
|
- objectclass: top
|
|
- krbcanonicalname: {user}@{realm}
|
|
- managedby: fqdn={hostname},cn=computers,cn=accounts,{base_dn}
|
|
- """)
|
|
- entry_ldif = entry_ldif_template.format(
|
|
- base_dn=base_dn,
|
|
- hostname=hostname,
|
|
- principal=principal,
|
|
- realm=realm,
|
|
- user='admin')
|
|
- tasks.kdestroy_all(master)
|
|
- master.run_command(
|
|
- ['kinit', '-kt', '/etc/krb5.keytab', f'host/{hostname}@{realm}'])
|
|
- args = [
|
|
- 'ldapmodify',
|
|
- '-Y',
|
|
- 'GSSAPI'
|
|
- ]
|
|
- result = master.run_command(args, stdin_text=entry_ldif,
|
|
- raiseonerr=False)
|
|
- assert "entry with the same attribute value" in result.stderr_text
|
|
-
|
|
- # Now try with root@realm instead of admin@realm
|
|
- entry_ldif = entry_ldif_template.format(
|
|
- base_dn=base_dn,
|
|
- hostname=hostname,
|
|
- principal=principal,
|
|
- realm=realm,
|
|
- user='root')
|
|
- args = [
|
|
- 'ldapmodify',
|
|
- '-Y',
|
|
- 'GSSAPI'
|
|
- ]
|
|
- result = master.run_command(args, stdin_text=entry_ldif,
|
|
- raiseonerr=False)
|
|
- assert "entry with the same attribute value" in result.stderr_text
|
|
- tasks.kdestroy_all(master)
|
|
-
|
|
- def test_no_request_pac(self):
|
|
- # Try to use a TGT obtained without PAC
|
|
- # Should fail as the presence of the PAC when processing TGTs
|
|
- # provided by TGS-REQ is now enforced.
|
|
- hostname = self.master.hostname
|
|
- realm = self.master.domain.realm
|
|
- self.master.run_command([
|
|
- 'kinit', '-kt', '/etc/krb5.keytab', f'host/{hostname}@{realm}',
|
|
- '--no-request-pac'
|
|
- ])
|
|
- result = self.master.run_command(
|
|
- ['kvno', f'ldap/{hostname}@{realm}'],
|
|
- raiseonerr=False
|
|
- )
|
|
- assert result.returncode == 1
|
|
- assert "PAC_ENFORCEMENT_TGT_WITHOUT_PAC" in result.stderr_text
|
|
-
|
|
|
|
class TestIPACommandWithoutReplica(IntegrationTest):
|
|
"""
|
|
@@ -1749,7 +1675,7 @@
|
|
api.bootstrap_with_global_options(context='server')
|
|
api.finalize()
|
|
api.Backend.ldap2.connect()
|
|
-
|
|
+
|
|
api.Command["group_add"]("testgroup1", external=True)
|
|
api.Command["group_add"]("testgroup2", external=False)
|
|
result1 = api.Command["group_show"]("testgroup1", all=True)["result"] # noqa: E501
|
|
@@ -1794,6 +1720,80 @@
|
|
'/tmp/reproducer2_code.py'])
|
|
assert "missing attribute" not in result.stdout_text
|
|
|
|
+ def test_unique_krbcanonicalname(self):
|
|
+ """Verify that the uniqueness for krbcanonicalname is working"""
|
|
+ master = self.master
|
|
+
|
|
+ base_dn = str(master.domain.basedn)
|
|
+ hostname = master.hostname
|
|
+ realm = master.domain.realm
|
|
+ principal = f'test/{hostname}@{realm}'
|
|
+ entry_ldif_template = textwrap.dedent("""
|
|
+ dn: krbprincipalname={principal},cn=services,cn=accounts,{base_dn}
|
|
+ changetype: add
|
|
+ ipakrbprincipalalias: test/{hostname}@{realm}
|
|
+ krbprincipalname: {principal}
|
|
+ objectclass: ipakrbprincipal
|
|
+ objectclass: ipaobject
|
|
+ objectclass: ipaservice
|
|
+ objectclass: krbprincipal
|
|
+ objectclass: krbprincipalaux
|
|
+ objectclass: top
|
|
+ krbcanonicalname: {user}@{realm}
|
|
+ managedby: fqdn={hostname},cn=computers,cn=accounts,{base_dn}
|
|
+ """)
|
|
+ entry_ldif = entry_ldif_template.format(
|
|
+ base_dn=base_dn,
|
|
+ hostname=hostname,
|
|
+ principal=principal,
|
|
+ realm=realm,
|
|
+ user='admin')
|
|
+ tasks.kdestroy_all(master)
|
|
+ master.run_command(
|
|
+ ['kinit', '-kt', '/etc/krb5.keytab', f'host/{hostname}@{realm}'])
|
|
+ args = [
|
|
+ 'ldapmodify',
|
|
+ '-Y',
|
|
+ 'GSSAPI'
|
|
+ ]
|
|
+ result = master.run_command(args, stdin_text=entry_ldif,
|
|
+ raiseonerr=False)
|
|
+ assert "entry with the same attribute value" in result.stderr_text
|
|
+
|
|
+ # Now try with root@realm instead of admin@realm
|
|
+ entry_ldif = entry_ldif_template.format(
|
|
+ base_dn=base_dn,
|
|
+ hostname=hostname,
|
|
+ principal=principal,
|
|
+ realm=realm,
|
|
+ user='root')
|
|
+ args = [
|
|
+ 'ldapmodify',
|
|
+ '-Y',
|
|
+ 'GSSAPI'
|
|
+ ]
|
|
+ result = master.run_command(args, stdin_text=entry_ldif,
|
|
+ raiseonerr=False)
|
|
+ assert "entry with the same attribute value" in result.stderr_text
|
|
+ tasks.kdestroy_all(master)
|
|
+
|
|
+ def test_no_request_pac(self):
|
|
+ # Try to use a TGT obtained without PAC
|
|
+ # Should fail as the presence of the PAC when processing TGTs
|
|
+ # provided by TGS-REQ is now enforced.
|
|
+ hostname = self.master.hostname
|
|
+ realm = self.master.domain.realm
|
|
+ self.master.run_command([
|
|
+ 'kinit', '-kt', '/etc/krb5.keytab', f'host/{hostname}@{realm}',
|
|
+ '--no-request-pac'
|
|
+ ])
|
|
+ result = self.master.run_command(
|
|
+ ['kvno', f'ldap/{hostname}@{realm}'],
|
|
+ raiseonerr=False
|
|
+ )
|
|
+ assert result.returncode == 1
|
|
+ assert "PAC_ENFORCEMENT_TGT_WITHOUT_PAC" in result.stderr_text
|
|
+
|
|
|
|
class TestIPAautomount(IntegrationTest):
|
|
@classmethod
|