|
 |
a99c7c |
From 294ae35a61e6ca8816b261c57508e4be21221864 Mon Sep 17 00:00:00 2001
|
|
|
a99c7c |
From: Julien Rische <jrische@redhat.com>
|
|
|
a99c7c |
Date: Tue, 1 Feb 2022 19:38:29 +0100
|
|
|
a99c7c |
Subject: [PATCH] ipatests: add case for hardened-only ticket policy
|
|
|
a99c7c |
|
|
|
a99c7c |
Signed-off-by: Julien Rische <jrische@redhat.com>
|
|
|
a99c7c |
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
a99c7c |
Reviewed-By: Francisco Trivino <ftrivino@redhat.com>
|
|
|
a99c7c |
---
|
|
|
a99c7c |
ipatests/test_integration/test_krbtpolicy.py | 30 ++++++++++++++++++--
|
|
|
a99c7c |
1 file changed, 28 insertions(+), 2 deletions(-)
|
|
|
a99c7c |
|
|
|
a99c7c |
diff --git a/ipatests/test_integration/test_krbtpolicy.py b/ipatests/test_integration/test_krbtpolicy.py
|
|
|
a99c7c |
index 63e75ae67f493352b1d3a611e7b079d914a7b253..9489fbc97b7836aecf491b57627f254d4849eb56 100644
|
|
|
a99c7c |
--- a/ipatests/test_integration/test_krbtpolicy.py
|
|
|
a99c7c |
+++ b/ipatests/test_integration/test_krbtpolicy.py
|
|
|
a99c7c |
@@ -103,8 +103,8 @@ class TestPWPolicy(IntegrationTest):
|
|
|
a99c7c |
result = master.run_command('klist | grep krbtgt')
|
|
|
a99c7c |
assert maxlife_within_policy(result.stdout_text, MAXLIFE) is True
|
|
|
a99c7c |
|
|
|
a99c7c |
- def test_krbtpolicy_hardended(self):
|
|
|
a99c7c |
- """Test a hardened kerberos ticket policy with 10 min tickets"""
|
|
|
a99c7c |
+ def test_krbtpolicy_password_and_hardended(self):
|
|
|
a99c7c |
+ """Test a pwd and hardened kerberos ticket policy with 10min tickets"""
|
|
|
a99c7c |
master = self.master
|
|
|
a99c7c |
master.run_command(['ipa', 'user-mod', USER1,
|
|
|
a99c7c |
'--user-auth-type', 'password',
|
|
|
a99c7c |
@@ -131,6 +131,32 @@ class TestPWPolicy(IntegrationTest):
|
|
|
a99c7c |
result = master.run_command('klist | grep krbtgt')
|
|
|
a99c7c |
assert maxlife_within_policy(result.stdout_text, MAXLIFE) is True
|
|
|
a99c7c |
|
|
|
a99c7c |
+ def test_krbtpolicy_hardended(self):
|
|
|
a99c7c |
+ """Test a hardened kerberos ticket policy with 30min tickets"""
|
|
|
a99c7c |
+ master = self.master
|
|
|
a99c7c |
+ master.run_command(['ipa', 'user-mod', USER1,
|
|
|
a99c7c |
+ '--user-auth-type', 'hardened'])
|
|
|
a99c7c |
+ master.run_command(['ipa', 'config-mod',
|
|
|
a99c7c |
+ '--user-auth-type', 'hardened'])
|
|
|
a99c7c |
+ master.run_command(['ipa', 'krbtpolicy-mod', USER1,
|
|
|
a99c7c |
+ '--hardened-maxlife', '1800'])
|
|
|
a99c7c |
+
|
|
|
a99c7c |
+ tasks.kdestroy_all(master)
|
|
|
a99c7c |
+
|
|
|
a99c7c |
+ master.run_command(['kinit', USER1],
|
|
|
a99c7c |
+ stdin_text=PASSWORD + '\n')
|
|
|
a99c7c |
+ result = master.run_command('klist | grep krbtgt')
|
|
|
a99c7c |
+ assert maxlife_within_policy(result.stdout_text, 1800,
|
|
|
a99c7c |
+ slush=1800) is True
|
|
|
a99c7c |
+
|
|
|
a99c7c |
+ tasks.kdestroy_all(master)
|
|
|
a99c7c |
+
|
|
|
a99c7c |
+ # Verify that the short policy only applies to USER1
|
|
|
a99c7c |
+ master.run_command(['kinit', USER2],
|
|
|
a99c7c |
+ stdin_text=PASSWORD + '\n')
|
|
|
a99c7c |
+ result = master.run_command('klist | grep krbtgt')
|
|
|
a99c7c |
+ assert maxlife_within_policy(result.stdout_text, MAXLIFE) is True
|
|
|
a99c7c |
+
|
|
|
a99c7c |
def test_krbtpolicy_password(self):
|
|
|
a99c7c |
"""Test the kerberos ticket policy which issues 20 min tickets"""
|
|
|
a99c7c |
master = self.master
|
|
|
a99c7c |
--
|
|
|
a99c7c |
2.34.1
|
|
|
a99c7c |
|