From b1f54d6b0a24a91ac3ef8b99b22ff68c2d0ca13d Mon Sep 17 00:00:00 2001 From: Noel Power Date: Thu, 23 Nov 2017 15:55:21 +0000 Subject: [PATCH 1/2] s3:libads: net ads keytab list fails with "Key table name malformed" When keytab_name is NULL don't call smb_krb5_kt_open use ads_keytab_open instead, this function will determine the correct keytab to use. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13166 Signed-off-by: Noel Power Reviewed-by: Andreas Schneider Reviewed-by: Ralph Boehme (cherry picked from commit 3048ae318fc8b4d1b7663826972306372430a463) --- source3/libads/kerberos_keytab.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/source3/libads/kerberos_keytab.c b/source3/libads/kerberos_keytab.c index ff12ec04af6..ffd100c5636 100644 --- a/source3/libads/kerberos_keytab.c +++ b/source3/libads/kerberos_keytab.c @@ -639,7 +639,11 @@ int ads_keytab_list(const char *keytab_name) return ret; } - ret = smb_krb5_kt_open(context, keytab_name, False, &keytab); + if (keytab_name == NULL) { + ret = ads_keytab_open(context, &keytab); + } else { + ret = smb_krb5_kt_open(context, keytab_name, False, &keytab); + } if (ret) { DEBUG(1, ("smb_krb5_kt_open failed (%s)\n", error_message(ret))); -- 2.15.0 From 6e067b990a8cbb0589d3a83e699aa766a6fee939 Mon Sep 17 00:00:00 2001 From: Noel Power Date: Fri, 24 Nov 2017 07:06:27 +0000 Subject: [PATCH 2/2] testprogs: Test net ads keytab list Test that correct keytab is picked up. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13166 Signed-off-by: Noel Power Reviewed-by: Andreas Schneider Reviewed-by: Ralph Boehme (cherry picked from commit 4be05c835e9d8b8f13856d592aaf42b40ce397c2) --- testprogs/blackbox/test_net_ads.sh | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/testprogs/blackbox/test_net_ads.sh b/testprogs/blackbox/test_net_ads.sh index bbd99b676bd..c5dbaf69ba2 100755 --- a/testprogs/blackbox/test_net_ads.sh +++ b/testprogs/blackbox/test_net_ads.sh @@ -46,6 +46,19 @@ testit "testjoin (dedicated keytab)" $VALGRIND $net_tool ads testjoin -kP || fai testit "changetrustpw (dedicated keytab)" $VALGRIND $net_tool ads changetrustpw || failed=`expr $failed + 1` testit "leave (dedicated keytab)" $VALGRIND $net_tool ads leave -U$DC_USERNAME%$DC_PASSWORD || failed=`expr $failed + 1` + +# if there is no keytab, try and create it +if [ ! -f $dedicated_keytab_file ]; then + if [ $(command -v ktutil) >/dev/null ]; then + printf "addent -password -p $DC_USERNAME@$REALM -k 1 -e rc4-hmac\n$DC_PASSWORD\nwkt $dedicated_keytab_file\n" | ktutil + fi +fi + +if [ -f $dedicated_keytab_file ]; then + testit "keytab list (dedicated keytab)" $VALGRIND $net_tool ads keytab list --option="kerberosmethod=dedicatedkeytab" --option="dedicatedkeytabfile=$dedicated_keytab_file" || failed=`expr $failed + 1` + testit "keytab list keytab specified on cmdline" $VALGRIND $net_tool ads keytab list $dedicated_keytab_file || failed=`expr $failed + 1` +fi + rm -f $dedicated_keytab_file testit_expect_failure "testjoin(not joined)" $VALGRIND $net_tool ads testjoin -kP || failed=`expr $failed + 1` -- 2.15.0