From d06650f7ef98408be426c2dcf16ac1554e3a1fd2 Mon Sep 17 00:00:00 2001 From: Noel Power Date: Thu, 23 Nov 2017 15:55:21 +0000 Subject: [PATCH 1/3] s3:libads: net ads keytab list fails with "Key table name malformed" When keytab_name is NULL don't call smb_krb5_kt_open use ads_keytab_open instead, this function will determine the correct keytab to use. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13166 Signed-off-by: Noel Power Reviewed-by: Andreas Schneider Reviewed-by: Ralph Boehme (cherry picked from commit 3048ae318fc8b4d1b7663826972306372430a463) --- source3/libads/kerberos_keytab.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/source3/libads/kerberos_keytab.c b/source3/libads/kerberos_keytab.c index ff12ec04af6..ffd100c5636 100644 --- a/source3/libads/kerberos_keytab.c +++ b/source3/libads/kerberos_keytab.c @@ -639,7 +639,11 @@ int ads_keytab_list(const char *keytab_name) return ret; } - ret = smb_krb5_kt_open(context, keytab_name, False, &keytab); + if (keytab_name == NULL) { + ret = ads_keytab_open(context, &keytab); + } else { + ret = smb_krb5_kt_open(context, keytab_name, False, &keytab); + } if (ret) { DEBUG(1, ("smb_krb5_kt_open failed (%s)\n", error_message(ret))); -- 2.12.3 From ae27a410d8b277acacc29610ee8489e11c6602e1 Mon Sep 17 00:00:00 2001 From: Noel Power Date: Fri, 24 Nov 2017 07:06:27 +0000 Subject: [PATCH 2/3] testprogs: Test net ads keytab list Test that correct keytab is picked up. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13166 Signed-off-by: Noel Power Reviewed-by: Andreas Schneider Reviewed-by: Ralph Boehme (cherry picked from commit 4be05c835e9d8b8f13856d592aaf42b40ce397c2) --- testprogs/blackbox/test_net_ads.sh | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/testprogs/blackbox/test_net_ads.sh b/testprogs/blackbox/test_net_ads.sh index bbd99b676bd..c5dbaf69ba2 100755 --- a/testprogs/blackbox/test_net_ads.sh +++ b/testprogs/blackbox/test_net_ads.sh @@ -46,6 +46,19 @@ testit "testjoin (dedicated keytab)" $VALGRIND $net_tool ads testjoin -kP || fai testit "changetrustpw (dedicated keytab)" $VALGRIND $net_tool ads changetrustpw || failed=`expr $failed + 1` testit "leave (dedicated keytab)" $VALGRIND $net_tool ads leave -U$DC_USERNAME%$DC_PASSWORD || failed=`expr $failed + 1` + +# if there is no keytab, try and create it +if [ ! -f $dedicated_keytab_file ]; then + if [ $(command -v ktutil) >/dev/null ]; then + printf "addent -password -p $DC_USERNAME@$REALM -k 1 -e rc4-hmac\n$DC_PASSWORD\nwkt $dedicated_keytab_file\n" | ktutil + fi +fi + +if [ -f $dedicated_keytab_file ]; then + testit "keytab list (dedicated keytab)" $VALGRIND $net_tool ads keytab list --option="kerberosmethod=dedicatedkeytab" --option="dedicatedkeytabfile=$dedicated_keytab_file" || failed=`expr $failed + 1` + testit "keytab list keytab specified on cmdline" $VALGRIND $net_tool ads keytab list $dedicated_keytab_file || failed=`expr $failed + 1` +fi + rm -f $dedicated_keytab_file testit_expect_failure "testjoin(not joined)" $VALGRIND $net_tool ads testjoin -kP || failed=`expr $failed + 1` -- 2.12.3 From 1588bab6b9886e870374eb0db9e85d4e5b5951b1 Mon Sep 17 00:00:00 2001 From: Noel Power Date: Wed, 29 Nov 2017 13:52:32 +0100 Subject: [PATCH 3/3] testprogs: Fix a typo in the net ads test Signed-off-by: Noel Power Reviewed-by: Andreas Schneider Reviewed-by: Ralph Boehme Autobuild-User(master): Andreas Schneider Autobuild-Date(master): Thu Nov 30 01:47:24 CET 2017 on sn-devel-144 (cherry picked from commit 9f9c5d33c434b192d38a9758067fb0513041c0f0) --- testprogs/blackbox/test_net_ads.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/testprogs/blackbox/test_net_ads.sh b/testprogs/blackbox/test_net_ads.sh index c5dbaf69ba2..16f77f5e672 100755 --- a/testprogs/blackbox/test_net_ads.sh +++ b/testprogs/blackbox/test_net_ads.sh @@ -39,7 +39,7 @@ testit "leave" $VALGRIND $net_tool ads leave -U$DC_USERNAME%$DC_PASSWORD || fail # Test with kerberos method = secrets and keytab dedicated_keytab_file="$PREFIX_ABS/test_net_ads_dedicated_krb5.keytab" -testit "join (decicated keytab)" $VALGRIND $net_tool ads join -U$DC_USERNAME%$DC_PASSWORD --option="kerberosmethod=dedicatedkeytab" --option="dedicatedkeytabfile=$dedicated_keytab_file" || failed=`expr $failed + 1` +testit "join (dedicated keytab)" $VALGRIND $net_tool ads join -U$DC_USERNAME%$DC_PASSWORD --option="kerberosmethod=dedicatedkeytab" --option="dedicatedkeytabfile=$dedicated_keytab_file" || failed=`expr $failed + 1` testit "testjoin (dedicated keytab)" $VALGRIND $net_tool ads testjoin -kP || failed=`expr $failed + 1` -- 2.12.3