1from k5test import * 2from datetime import datetime 3import re 4 5conf = {'realms': {'$realm': {'max_life': '20h', 'max_renewable_life': '20h'}}} 6realm = K5Realm(create_host=False, get_creds=False, kdc_conf=conf) 7 8# We will be scraping timestamps from klist to compute lifetimes, so 9# use a time zone with no daylight savings time. 10realm.env['TZ'] = 'UTC' 11 12def test(testname, life, rlife, exp_life, exp_rlife, env=None): 13 global realm 14 flags = ['-l', life] 15 if rlife is not None: 16 flags += ['-r', rlife] 17 realm.kinit(realm.user_princ, password('user'), flags=flags, env=env) 18 out = realm.run([klist, '-f']) 19 20 if ('Default principal: %s\n' % realm.user_princ) not in out: 21 fail('%s: did not get tickets' % testname) 22 23 # Extract flags and check the renewable flag against expectations. 24 flags = re.findall(r'Flags: ([a-zA-Z]*)', out)[0] 25 if exp_rlife is None and 'R' in flags: 26 fail('%s: ticket unexpectedly renewable' % testname) 27 if exp_rlife is not None and 'R' not in flags: 28 fail('%s: ticket unexpectedly non-renewable' % testname) 29 30 # Extract the start time, end time, and renewable end time if present. 31 times = re.findall(r'\d\d/\d\d/\d\d \d\d:\d\d:\d\d', out) 32 times = [datetime.strptime(t, '%m/%d/%y %H:%M:%S') for t in times] 33 starttime = times[0] 34 endtime = times[1] 35 rtime = times[2] if len(times) >= 3 else None 36 37 # Check the ticket lifetime against expectations. If the lifetime 38 # was determined by the request, there may be a small error 39 # because KDC requests contain an end time rather than a lifetime. 40 life = (endtime - starttime).seconds 41 if abs(life - exp_life) > 5: 42 fail('%s: expected life %d, got %d' % (testname, exp_life, life)) 43 44 # Check the ticket renewable lifetime against expectations. 45 if exp_rlife is None and rtime is not None: 46 fail('%s: ticket has unexpected renew_till' % testname) 47 if exp_rlife is not None and rtime is None: 48 fail('%s: ticket is renewable but has no renew_till' % testname) 49 if rtime is not None: 50 rlife = (rtime - starttime).seconds 51 if abs(rlife - exp_rlife) > 5: 52 fail('%s: expected rlife %d, got %d' % 53 (testname, exp_rlife, rlife)) 54 55# Get renewable tickets. 56test('simple', '1h', '2h', 3600, 7200) 57 58# Renew twice, to test that renewed tickets are renewable. 59mark('renew twice') 60realm.kinit(realm.user_princ, flags=['-R']) 61realm.kinit(realm.user_princ, flags=['-R']) 62realm.klist(realm.user_princ) 63 64# Make sure we can use a renewed ticket. 65realm.run([kvno, realm.user_princ]) 66 67# Make sure we can't renew non-renewable tickets. 68mark('non-renewable') 69test('non-renewable', '1h', None, 3600, None) 70realm.kinit(realm.user_princ, flags=['-R'], expected_code=1, 71 expected_msg="KDC can't fulfill requested option") 72 73# Test that -allow_renewable on the client principal works. 74mark('allow_renewable (client)') 75realm.run([kadminl, 'modprinc', '-allow_renewable', 'user']) 76test('disallowed client', '1h', '2h', 3600, None) 77realm.run([kadminl, 'modprinc', '+allow_renewable', 'user']) 78 79# Test that -allow_renewable on the server principal works. 80mark('allow_renewable (server)') 81realm.run([kadminl, 'modprinc', '-allow_renewable', realm.krbtgt_princ]) 82test('disallowed server', '1h', '2h', 3600, None) 83realm.run([kadminl, 'modprinc', '+allow_renewable', realm.krbtgt_princ]) 84 85# Test that trivially renewable tickets are issued if renew_till <= 86# till. (Our client code bumps up the requested renewable life to the 87# requested life.) 88mark('trivially renewable') 89test('short', '2h', '1h', 7200, 7200) 90 91# Test that renewable tickets are issued if till > max life by 92# default, but not if we configure away the RENEWABLE-OK option. 93mark('renewable-ok') 94no_opts_conf = {'libdefaults': {'kdc_default_options': '0'}} 95no_opts = realm.special_env('no_opts', False, krb5_conf=no_opts_conf) 96realm.run([kadminl, 'modprinc', '-maxlife', '10 hours', 'user']) 97test('long', '15h', None, 10 * 3600, 15 * 3600) 98test('long noopts', '15h', None, 10 * 3600, None, env=no_opts) 99realm.run([kadminl, 'modprinc', '-maxlife', '20 hours', 'user']) 100 101# Test maximum renewable life on the client principal. 102mark('maxrenewlife (client)') 103realm.run([kadminl, 'modprinc', '-maxrenewlife', '5 hours', 'user']) 104test('maxrenewlife client 1', '4h', '5h', 4 * 3600, 5 * 3600) 105test('maxrenewlife client 2', '6h', '10h', 6 * 3600, 5 * 3600) 106 107# Test maximum renewable life on the server principal. 108mark('maxrenewlife (server)') 109realm.run([kadminl, 'modprinc', '-maxrenewlife', '3 hours', 110 realm.krbtgt_princ]) 111test('maxrenewlife server 1', '2h', '3h', 2 * 3600, 3 * 3600) 112test('maxrenewlife server 2', '4h', '8h', 4 * 3600, 3 * 3600) 113 114# Test realm maximum life. 115mark('realm maximum life') 116realm.run([kadminl, 'modprinc', '-maxrenewlife', '40 hours', 'user']) 117realm.run([kadminl, 'modprinc', '-maxrenewlife', '40 hours', 118 realm.krbtgt_princ]) 119test('maxrenewlife realm 1', '10h', '20h', 10 * 3600, 20 * 3600) 120test('maxrenewlife realm 2', '21h', '40h', 20 * 3600, 20 * 3600) 121 122success('Renewing credentials') 123