1 /*
   2  * Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
   3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
   4  *
   5  * This code is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License version 2 only, as
   7  * published by the Free Software Foundation.
   8  *
   9  * This code is distributed in the hope that it will be useful, but WITHOUT
  10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  12  * version 2 for more details (a copy is included in the LICENSE file that
  13  * accompanied this code).
  14  *
  15  * You should have received a copy of the GNU General Public License version
  16  * 2 along with this work; if not, write to the Free Software Foundation,
  17  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
  18  *
  19  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
  20  * or visit www.oracle.com if you need additional information or have any
  21  * questions.
  22  */
  23 
  24 import java.io.File;
  25 import java.util.HashMap;
  26 import java.util.Map;
  27 import jdk.testlibrary.ProcessTools;
  28 import jdk.testlibrary.OutputAnalyzer;
  29 
  30 /*
  31  * @test
  32  * @bug 6857795 8075299
  33  * @summary Checks if kinit uses both krb5 conf file and system properties
  34  * @requires os.family == "windows"
  35  * @library /lib/testlibrary
  36  * @library /sun/security/krb5/auto
  37  * @run main/othervm KinitConfPlusProps
  38  */
  39 public class KinitConfPlusProps {
  40 
  41     private static final String KINIT = System.getProperty("java.home")
  42             + File.separator + "bin" + File.separator + "kinit";
  43     private static final String KLIST = System.getProperty("java.home")
  44             + File.separator + "bin" + File.separator + "klist";
  45     private static final String REALM = "REALM";
  46     private static final String ANOTHER_REALM = "ANOTHER.REALM";
  47     private static final String HOST = "localhost";
  48     private static final String CC_FILENAME = "krb5cc_test";
  49     private static final String USER = "TESTER";
  50     private static final String USER_PRINCIPAL = USER + "@" + REALM;
  51     private static final String KRBTGT_PRINCIPAL = "krbtgt/" + REALM;
  52     private static final String KEYTAB_FILE = "test.keytab";
  53     private static final String KRB5_CONF_FILENAME = "krb5.conf";
  54 
  55     public static void main(String[] args) throws Exception {
  56         // define principals
  57         Map<String, String> principals = new HashMap<>();
  58         principals.put(USER_PRINCIPAL, null);
  59         principals.put(KRBTGT_PRINCIPAL, null);
  60 
  61         System.setProperty("java.security.krb5.conf", KRB5_CONF_FILENAME);
  62 
  63         // start a local KDC instance
  64         KDC kdc = KDC.startKDC(HOST, null, REALM, principals, KEYTAB_FILE,
  65                 KDC.KtabMode.APPEND);
  66         KDC.saveConfig(KRB5_CONF_FILENAME, kdc,
  67                 "forwardable = true", "proxiable = true");
  68 
  69         boolean success = true;
  70 
  71         /*
  72          * kinit should fail since java.security.krb5.kdc
  73          * and java.security.krb5.realm properties override correct values
  74          * in krb5 conf file
  75          */
  76         String[] command = {KINIT, "-k",
  77             "-J-Djava.security.krb5.realm=" + REALM,
  78             "-J-Djava.security.krb5.kdc=" + HOST,   // without port
  79             "-J-Djava.security.krb5.conf=" + KRB5_CONF_FILENAME,
  80             "-t", KEYTAB_FILE,
  81             "-c", CC_FILENAME,
  82             USER
  83         };
  84 
  85         try {
  86             OutputAnalyzer out = ProcessTools.executeCommand(command);
  87             out.shouldHaveExitValue(-1);
  88         } catch(Throwable e) {
  89             System.out.println("Unexpected exception: " + e);
  90             e.printStackTrace(System.out);
  91             success = false;
  92         }
  93 
  94         /*
  95          * kinit should succeed
  96          * since realm should be picked up from principal name
  97          */
  98         command = new String[] {KINIT, "-k",
  99             "-J-Djava.security.krb5.realm=" + ANOTHER_REALM,
 100             "-J-Djava.security.krb5.kdc=" + HOST,
 101             "-J-Djava.security.krb5.conf=" + KRB5_CONF_FILENAME,
 102             "-t", KEYTAB_FILE,
 103             "-c", CC_FILENAME,
 104             USER_PRINCIPAL
 105         };
 106 
 107         try {
 108             OutputAnalyzer out = ProcessTools.executeCommand(command);
 109             out.shouldHaveExitValue(0);
 110             out.shouldContain(CC_FILENAME);
 111         } catch(Throwable e) {
 112             System.out.println("Unexpected exception: " + e);
 113             e.printStackTrace(System.out);
 114             success = false;
 115         }
 116 
 117         success &= checkTicketFlags();
 118 
 119         /*
 120          * kinit should succeed
 121          * since realm should be picked up from principal name,
 122          * and other data should come from krb5 conf file
 123          */
 124         command = new String[] {KINIT, "-k",
 125             "-J-Djava.security.krb5.conf=" + KRB5_CONF_FILENAME,
 126             "-t", KEYTAB_FILE,
 127             "-c", CC_FILENAME,
 128             USER_PRINCIPAL
 129         };
 130 
 131         try {
 132             OutputAnalyzer out = ProcessTools.executeCommand(command);
 133             out.shouldHaveExitValue(0);
 134             out.shouldContain(CC_FILENAME);
 135         } catch(Throwable e) {
 136             System.out.println("Unexpected exception: " + e);
 137             e.printStackTrace(System.out);
 138             success = false;
 139         }
 140 
 141         success &= checkTicketFlags();
 142 
 143         // kinit should succeed even if a principal name doesn't have realm
 144         command = new String[] {KINIT, "-k",
 145             "-J-Djava.security.krb5.conf=" + KRB5_CONF_FILENAME,
 146             "-t", KEYTAB_FILE,
 147             "-c", CC_FILENAME,
 148             USER
 149         };
 150 
 151         try {
 152             OutputAnalyzer out = ProcessTools.executeCommand(command);
 153             out.shouldHaveExitValue(0);
 154             out.shouldContain(CC_FILENAME);
 155         } catch(Throwable e) {
 156             System.out.println("Unexpected exception: " + e);
 157             e.printStackTrace(System.out);
 158             success = false;
 159         }
 160 
 161         success &= checkTicketFlags();
 162 
 163         if (!success) {
 164             throw new RuntimeException("At least one test case failed");
 165         }
 166         System.out.println("Test passed");
 167     }
 168 
 169     // check if a ticket has forwardable and proxiable flags
 170     private static boolean checkTicketFlags() {
 171         String[] command = new String[] {KLIST, "-f", "-c", CC_FILENAME};
 172 
 173         try {
 174             OutputAnalyzer out = ProcessTools.executeCommand(command);
 175             out.shouldHaveExitValue(0);
 176             out.shouldContain("FORWARDABLE");
 177             out.shouldContain("PROXIABLE");
 178         } catch(Throwable e) {
 179             System.out.println("Unexpected exception: " + e);
 180             e.printStackTrace(System.out);
 181             return false;
 182         }
 183 
 184         return true;
 185     }
 186 }