1from k5test import * 2 3# Unfortunately, we can't reliably test the k5login module. We can control 4# the directory where k5login files are read, but we can't suppress the UID 5# validity check, which might fail in some filesystems for a .k5login file 6# we create. 7conf = {'plugins': {'localauth': { 'disable': 'k5login'}}} 8realm = K5Realm(create_kdb=False, krb5_conf=conf) 9 10def test_an2ln(env, aname, result, msg): 11 out = realm.run(['./localauth', aname], env=env) 12 if out != result + '\n': 13 fail(msg) 14 15def test_an2ln_err(env, aname, err, msg): 16 realm.run(['./localauth', aname], env=env, expected_code=1, 17 expected_msg=err) 18 19def test_userok(env, aname, lname, ok, msg): 20 out = realm.run(['./localauth', aname, lname], env=env) 21 if ((ok and out != 'yes\n') or 22 (not ok and out != 'no\n')): 23 fail(msg) 24 25# The default an2ln method works only in the default realm, and works 26# for a single-component principal or a two-component principal where 27# the second component is the default realm. 28mark('default') 29test_an2ln(None, 'user@KRBTEST.COM', 'user', 'default rule 1') 30test_an2ln(None, 'user/KRBTEST.COM@KRBTEST.COM', 'user', 'default rule 2') 31test_an2ln_err(None, 'user/KRBTEST.COM/x@KRBTEST.COM', 'No translation', 32 'default rule (3)') 33test_an2ln_err(None, 'user/X@KRBTEST.COM', 'No translation', 34 'default rule comp mismatch') 35test_an2ln_err(None, 'user@X', 'No translation', 'default rule realm mismatch') 36 37# auth_to_local_names matches ignore the realm but are case-sensitive. 38mark('auth_to_local_names') 39conf_names1 = {'realms': {'$realm': {'auth_to_local_names': {'user': 'abcd'}}}} 40names1 = realm.special_env('names1', False, conf_names1) 41test_an2ln(names1, 'user@KRBTEST.COM', 'abcd', 'auth_to_local_names match') 42test_an2ln(names1, 'user@X', 'abcd', 'auth_to_local_names out-of-realm match') 43test_an2ln(names1, 'x@KRBTEST.COM', 'x', 'auth_to_local_names mismatch') 44test_an2ln(names1, 'User@KRBTEST.COM', 'User', 'auth_to_local_names case') 45 46# auth_to_local_names values must be in the default realm's section. 47conf_names2 = {'realms': {'X': {'auth_to_local_names': {'user': 'abcd'}}}} 48names2 = realm.special_env('names2', False, conf_names2) 49test_an2ln_err(names2, 'user@X', 'No translation', 50 'auth_to_local_names section mismatch') 51 52# Return a realm environment containing an auth_to_local value (or list). 53def a2l_realm(name, values): 54 conf = {'realms': {'$realm': {'auth_to_local': values}}} 55 return realm.special_env(name, False, conf) 56 57# Test explicit use of default method. 58mark('explicit default') 59auth1 = a2l_realm('auth1', 'DEFAULT') 60test_an2ln(auth1, 'user@KRBTEST.COM', 'user', 'default rule') 61 62# Test some invalid auth_to_local values. 63mark('auth_to_local invalid') 64auth2 = a2l_realm('auth2', 'RULE') 65test_an2ln_err(auth2, 'user@X', 'Improper format', 'null rule') 66auth3 = a2l_realm('auth3', 'UNRECOGNIZED:stuff') 67test_an2ln_err(auth3, 'user@X', 'Improper format', 'null rule') 68 69# An empty rule has the default selection string (unparsed principal 70# without realm) and no match or substitutions. 71mark('rule (empty)') 72rule1 = a2l_realm('rule1', 'RULE:') 73test_an2ln(rule1, 'user@KRBTEST.COM', 'user', 'empty rule') 74test_an2ln(rule1, 'user@X', 'user', 'empty rule (foreign realm)') 75test_an2ln(rule1, 'a/b/c@X', 'a/b/c', 'empty rule (multi-component)') 76 77# Test explicit selection string. Also test that the default method 78# is suppressed when auth_to_local values are present. 79mark('rule (selection string)') 80rule2 = a2l_realm('rule2', 'RULE:[2:$$0.$$2.$$1]') 81test_an2ln(rule2, 'aaron/burr@REALM', 'REALM.burr.aaron', 'selection string') 82test_an2ln_err(rule2, 'user@KRBTEST.COM', 'No translation', 'suppress default') 83 84# Test match string. 85mark('rule (match string)') 86rule3 = a2l_realm('rule3', 'RULE:(.*tail)') 87test_an2ln(rule3, 'withtail@X', 'withtail', 'rule match 1') 88test_an2ln(rule3, 'x/withtail@X', 'x/withtail', 'rule match 2') 89test_an2ln_err(rule3, 'tails@X', 'No translation', 'rule anchor mismatch') 90 91# Test substitutions. 92mark('rule (substitutions)') 93rule4 = a2l_realm('rule4', 'RULE:s/birds/bees/') 94test_an2ln(rule4, 'thebirdsbirdsbirds@X', 'thebeesbirdsbirds', 'subst 1') 95rule5 = a2l_realm('rule4', 'RULE:s/birds/bees/g s/bees/birds/') 96test_an2ln(rule4, 'the/birdsbirdsbirds@x', 'the/birdsbeesbees', 'subst 2') 97 98# Test a bunch of auth_to_local values and rule features in combination. 99mark('rule (combo)') 100combo = a2l_realm('combo', ['RULE:[1:$$1-$$0](fred.*)s/-/ /g', 101 'DEFAULT', 102 'RULE:[3:$$1](z.*z)']) 103test_an2ln(combo, 'fred@X', 'fred X', 'combo 1') 104test_an2ln(combo, 'fred-too@X', 'fred too X', 'combo 2') 105test_an2ln(combo, 'fred@KRBTEST.COM', 'fred KRBTEST.COM', 'combo 3') 106test_an2ln(combo, 'user@KRBTEST.COM', 'user', 'combo 4') 107test_an2ln(combo, 'zazz/b/c@X', 'zazz', 'combo 5') 108test_an2ln_err(combo, 'a/b@KRBTEST.COM', 'No translation', 'combo 6') 109 110# Test the an2ln userok method with the combo environment. 111mark('userok (an2ln)') 112test_userok(combo, 'fred@X', 'fred X', True, 'combo userok 1') 113test_userok(combo, 'user@KRBTEST.COM', 'user', True, 'combo userok 2') 114test_userok(combo, 'user@KRBTEST.COM', 'X', False, 'combo userok 3') 115test_userok(combo, 'a/b@KRBTEST.COM', 'a/b', False, 'combo userok 4') 116 117mark('test modules') 118 119# Register the two test modules and set up some auth_to_local and 120# auth_to_local_names entries. 121modpath = os.path.join(buildtop, 'plugins', 'localauth', 'test', 122 'localauth_test.so') 123conf = {'plugins': {'localauth': { 'module': [ 124 'test1:' + modpath, 125 'test2:' + modpath]}}, 126 'realms': {'$realm': {'auth_to_local': [ 127 'RULE:(test/rulefirst)s/.*/rule/', 128 'TYPEA', 129 'DEFAULT', 130 'TYPEB:resid']}, 131 'auth_to_local_names': {'test/a/b': 'name'}}} 132mod = realm.special_env('mod', False, conf) 133 134# test1's untyped an2ln method should come before the names method, mapping 135# test/a/b@X to its realm name (superseding auth_to_local_names). 136test_an2ln(mod, 'test/a/b@X', 'X', 'mod untyped an2ln') 137 138# Match the auth_to_local values in order. test2's TYPEA should map 139# test/notrule to its second component, and its TYPEB should map 140# anything which gets there to the residual string. 141test_an2ln(mod, 'test/rulefirst@X', 'rule', 'mod auth_to_local 1') 142test_an2ln(mod, 'test/notrule', 'notrule', 'mod auth_to_local 2') 143test_an2ln(mod, 'user@KRBTEST.COM', 'user', 'mod auth_to_local 3') 144test_an2ln(mod, 'xyz@X', 'resid', 'mod auth_to_local 4') 145 146# test2's userok module should succeed when the number of components 147# is equal to the length of the local name, should pass if the first 148# component is 'pass', and should reject otherwise. 149test_userok(mod, 'a/b/c/d@X', 'four', True, 'mod userok 1') 150test_userok(mod, 'x/y/z@X', 'four', False, 'mod userok 2') 151test_userok(mod, 'pass@KRBTEST.COM', 'pass', True, 'mod userok 3') 152test_userok(mod, 'user@KRBTEST.COM', 'user', False, 'mod userok 4') 153 154success('krb5_kuserok and krb5_aname_to_localname tests') 155