1/*
2 * Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4 *
5 * This code is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License version 2 only, as
7 * published by the Free Software Foundation.
8 *
9 * This code is distributed in the hope that it will be useful, but WITHOUT
10 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
12 * version 2 for more details (a copy is included in the LICENSE file that
13 * accompanied this code).
14 *
15 * You should have received a copy of the GNU General Public License version
16 * 2 along with this work; if not, write to the Free Software Foundation,
17 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
18 *
19 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
20 * or visit www.oracle.com if you need additional information or have any
21 * questions.
22 */
23
24import java.io.File;
25import java.util.HashMap;
26import java.util.Map;
27import jdk.testlibrary.ProcessTools;
28import jdk.testlibrary.OutputAnalyzer;
29
30/*
31 * @test
32 * @bug 6857795 8075299
33 * @summary Checks if kinit uses both krb5 conf file and system properties
34 * @requires os.family == "windows"
35 * @library /lib/testlibrary
36 * @library /sun/security/krb5/auto
37 * @run main/othervm KinitConfPlusProps
38 */
39public class KinitConfPlusProps {
40
41    private static final String KINIT = System.getProperty("java.home")
42            + File.separator + "bin" + File.separator + "kinit";
43    private static final String KLIST = System.getProperty("java.home")
44            + File.separator + "bin" + File.separator + "klist";
45    private static final String REALM = "REALM";
46    private static final String ANOTHER_REALM = "ANOTHER.REALM";
47    private static final String HOST = "localhost";
48    private static final String CC_FILENAME = "krb5cc_test";
49    private static final String USER = "TESTER";
50    private static final String USER_PRINCIPAL = USER + "@" + REALM;
51    private static final String KRBTGT_PRINCIPAL = "krbtgt/" + REALM;
52    private static final String KEYTAB_FILE = "test.keytab";
53    private static final String KRB5_CONF_FILENAME = "krb5.conf";
54
55    public static void main(String[] args) throws Exception {
56        // define principals
57        Map<String, String> principals = new HashMap<>();
58        principals.put(USER_PRINCIPAL, null);
59        principals.put(KRBTGT_PRINCIPAL, null);
60
61        System.setProperty("java.security.krb5.conf", KRB5_CONF_FILENAME);
62
63        // start a local KDC instance
64        KDC kdc = KDC.startKDC(HOST, null, REALM, principals, KEYTAB_FILE,
65                KDC.KtabMode.APPEND);
66        KDC.saveConfig(KRB5_CONF_FILENAME, kdc,
67                "forwardable = true", "proxiable = true");
68
69        boolean success = true;
70
71        /*
72         * kinit should fail since java.security.krb5.kdc
73         * and java.security.krb5.realm properties override correct values
74         * in krb5 conf file
75         */
76        String[] command = {KINIT, "-k",
77            "-J-Djava.security.krb5.realm=" + REALM,
78            "-J-Djava.security.krb5.kdc=" + HOST,   // without port
79            "-J-Djava.security.krb5.conf=" + KRB5_CONF_FILENAME,
80            "-t", KEYTAB_FILE,
81            "-c", CC_FILENAME,
82            USER
83        };
84
85        try {
86            OutputAnalyzer out = ProcessTools.executeCommand(command);
87            out.shouldHaveExitValue(-1);
88        } catch(Throwable e) {
89            System.out.println("Unexpected exception: " + e);
90            e.printStackTrace(System.out);
91            success = false;
92        }
93
94        /*
95         * kinit should succeed
96         * since realm should be picked up from principal name
97         */
98        command = new String[] {KINIT, "-k",
99            "-J-Djava.security.krb5.realm=" + ANOTHER_REALM,
100            "-J-Djava.security.krb5.kdc=" + HOST,
101            "-J-Djava.security.krb5.conf=" + KRB5_CONF_FILENAME,
102            "-t", KEYTAB_FILE,
103            "-c", CC_FILENAME,
104            USER_PRINCIPAL
105        };
106
107        try {
108            OutputAnalyzer out = ProcessTools.executeCommand(command);
109            out.shouldHaveExitValue(0);
110            out.shouldContain(CC_FILENAME);
111        } catch(Throwable e) {
112            System.out.println("Unexpected exception: " + e);
113            e.printStackTrace(System.out);
114            success = false;
115        }
116
117        success &= checkTicketFlags();
118
119        /*
120         * kinit should succeed
121         * since realm should be picked up from principal name,
122         * and other data should come from krb5 conf file
123         */
124        command = new String[] {KINIT, "-k",
125            "-J-Djava.security.krb5.conf=" + KRB5_CONF_FILENAME,
126            "-t", KEYTAB_FILE,
127            "-c", CC_FILENAME,
128            USER_PRINCIPAL
129        };
130
131        try {
132            OutputAnalyzer out = ProcessTools.executeCommand(command);
133            out.shouldHaveExitValue(0);
134            out.shouldContain(CC_FILENAME);
135        } catch(Throwable e) {
136            System.out.println("Unexpected exception: " + e);
137            e.printStackTrace(System.out);
138            success = false;
139        }
140
141        success &= checkTicketFlags();
142
143        // kinit should succeed even if a principal name doesn't have realm
144        command = new String[] {KINIT, "-k",
145            "-J-Djava.security.krb5.conf=" + KRB5_CONF_FILENAME,
146            "-t", KEYTAB_FILE,
147            "-c", CC_FILENAME,
148            USER
149        };
150
151        try {
152            OutputAnalyzer out = ProcessTools.executeCommand(command);
153            out.shouldHaveExitValue(0);
154            out.shouldContain(CC_FILENAME);
155        } catch(Throwable e) {
156            System.out.println("Unexpected exception: " + e);
157            e.printStackTrace(System.out);
158            success = false;
159        }
160
161        success &= checkTicketFlags();
162
163        if (!success) {
164            throw new RuntimeException("At least one test case failed");
165        }
166        System.out.println("Test passed");
167    }
168
169    // check if a ticket has forwardable and proxiable flags
170    private static boolean checkTicketFlags() {
171        String[] command = new String[] {KLIST, "-f", "-c", CC_FILENAME};
172
173        try {
174            OutputAnalyzer out = ProcessTools.executeCommand(command);
175            out.shouldHaveExitValue(0);
176            out.shouldContain("FORWARDABLE");
177            out.shouldContain("PROXIABLE");
178        } catch(Throwable e) {
179            System.out.println("Unexpected exception: " + e);
180            e.printStackTrace(System.out);
181            return false;
182        }
183
184        return true;
185    }
186}
187