From 8e3e85e329f5cbd989936b0df8a0ac06906a4824 Mon Sep 17 00:00:00 2001
From: Isaac Boukris <iboukris@gmail.com>
Date: Tue, 14 Apr 2020 16:19:05 +0300
Subject: [PATCH] auth: add SASL/GSSAPI tests

---
 tests/data/krb5.conf              |  32 ++++++
 tests/data/slapd-sasl-gssapi.conf |  65 ++++++++++++
 tests/scripts/conf.sh             |   3 +
 tests/scripts/defines.sh          |   5 +
 tests/scripts/setup_kdc.sh        | 144 +++++++++++++++++++++++++++
 tests/scripts/test077-sasl-gssapi | 159 ++++++++++++++++++++++++++++++
 6 files changed, 408 insertions(+)
 create mode 100644 tests/data/krb5.conf
 create mode 100644 tests/data/slapd-sasl-gssapi.conf
 create mode 100755 tests/scripts/setup_kdc.sh
 create mode 100755 tests/scripts/test077-sasl-gssapi

diff --git a/tests/data/krb5.conf b/tests/data/krb5.conf
new file mode 100644
index 000000000..739113742
--- /dev/null
+++ b/tests/data/krb5.conf
@@ -0,0 +1,32 @@
+[libdefaults]
+  default_realm = @KRB5REALM@
+  dns_lookup_realm = false
+  dns_lookup_kdc = false
+  default_ccache_name = FILE://@TESTDIR@/ccache
+  #udp_preference_limit = 1
+[realms]
+ @KRB5REALM@ = {
+  kdc = @KDCHOST@:@KDCPORT@
+  acl_file = @TESTDIR@/kadm.acl
+  database_name = @TESTDIR@/kdc.db
+  key_stash_file = @TESTDIR@/kdc.stash
+ }
+[kdcdefaults]
+  kdc_ports = @KDCPORT@
+  kdc_tcp_ports = @KDCPORT@
+[logging]
+  kdc = FILE:@TESTDIR@/kdc.log
+  admin_server = FILE:@TESTDIR@/kadm.log
+  default = FILE:@TESTDIR@/krb5.log
+
+#Heimdal
+[kdc]
+ database = {
+  dbname = @TESTDIR@/kdc.db
+  realm = @KRB5REALM@
+  mkey_file = @TESTDIR@/kdc.stash
+  log_file = @TESTDIR@/kdc.log
+  acl_file = @TESTDIR@/kadm.acl
+ }
+[hdb]
+  db-dir = @TESTDIR@
diff --git a/tests/data/slapd-sasl-gssapi.conf b/tests/data/slapd-sasl-gssapi.conf
new file mode 100644
index 000000000..611fc7097
--- /dev/null
+++ b/tests/data/slapd-sasl-gssapi.conf
@@ -0,0 +1,65 @@
+# stand-alone slapd config -- for testing (with indexing)
+# $OpenLDAP$
+## This work is part of OpenLDAP Software <http://www.openldap.org/>.
+##
+## Copyright 1998-2020 The OpenLDAP Foundation.
+## All rights reserved.
+##
+## Redistribution and use in source and binary forms, with or without
+## modification, are permitted only as authorized by the OpenLDAP
+## Public License.
+##
+## A copy of this license is available in the file LICENSE in the
+## top-level directory of the distribution or, alternatively, at
+## <http://www.OpenLDAP.org/license.html>.
+
+#
+include		@SCHEMADIR@/core.schema
+include		@SCHEMADIR@/cosine.schema
+#
+include		@SCHEMADIR@/corba.schema
+include		@SCHEMADIR@/java.schema
+include		@SCHEMADIR@/inetorgperson.schema
+include		@SCHEMADIR@/misc.schema
+include		@SCHEMADIR@/nis.schema
+include		@SCHEMADIR@/openldap.schema
+#
+include		@SCHEMADIR@/duaconf.schema
+include		@SCHEMADIR@/dyngroup.schema
+
+#
+pidfile		@TESTDIR@/slapd.1.pid
+argsfile	@TESTDIR@/slapd.1.args
+
+# SSL configuration
+TLSCACertificateFile @TESTDIR@/tls/ca/certs/testsuiteCA.crt
+TLSCertificateKeyFile @TESTDIR@/tls/private/localhost.key
+TLSCertificateFile @TESTDIR@/tls/certs/localhost.crt
+
+#
+rootdse 	@DATADIR@/rootdse.ldif
+
+#mod#modulepath	../servers/slapd/back-@BACKEND@/
+#mod#moduleload	back_@BACKEND@.la
+#monitormod#modulepath ../servers/slapd/back-monitor/
+#monitormod#moduleload back_monitor.la
+
+
+#######################################################################
+# database definitions
+#######################################################################
+
+database	@BACKEND@
+suffix          "dc=example,dc=com"
+rootdn          "cn=Manager,dc=example,dc=com"
+rootpw          secret
+#~null~#directory	@TESTDIR@/db.1.a
+#indexdb#index		objectClass eq
+#indexdb#index		mail eq
+#ndb#dbname db_1_a
+#ndb#include @DATADIR@/ndb.conf
+
+#monitor#database	monitor
+
+sasl-realm	@KRB5REALM@
+sasl-host	localhost
diff --git a/tests/scripts/conf.sh b/tests/scripts/conf.sh
index 2a859d89d..5b477ed93 100755
--- a/tests/scripts/conf.sh
+++ b/tests/scripts/conf.sh
@@ -97,4 +97,7 @@ sed -e "s/@BACKEND@/${BACKEND}/"			\
 	-e "s;@TESTWD@;${TESTWD};"			\
 	-e "s;@DATADIR@;${DATADIR};"			\
 	-e "s;@SCHEMADIR@;${SCHEMADIR};"		\
+	-e "s;@KRB5REALM@;${KRB5REALM};"		\
+	-e "s;@KDCHOST@;${KDCHOST};"			\
+	-e "s;@KDCPORT@;${KDCPORT};"			\
 	-e "/^#/d"
diff --git a/tests/scripts/defines.sh b/tests/scripts/defines.sh
index 26dab1bae..78dc1f8ae 100755
--- a/tests/scripts/defines.sh
+++ b/tests/scripts/defines.sh
@@ -108,6 +108,7 @@ REFCONSUMERCONF=$DATADIR/slapd-ref-consumer.conf
 SCHEMACONF=$DATADIR/slapd-schema.conf
 TLSCONF=$DATADIR/slapd-tls.conf
 TLSSASLCONF=$DATADIR/slapd-tls-sasl.conf
+SASLGSSAPICONF=$DATADIR/slapd-sasl-gssapi.conf
 GLUECONF=$DATADIR/slapd-glue.conf
 REFINTCONF=$DATADIR/slapd-refint.conf
 RETCODECONF=$DATADIR/slapd-retcode.conf
@@ -214,6 +215,7 @@ PORT3=`expr $BASEPORT + 3`
 PORT4=`expr $BASEPORT + 4`
 PORT5=`expr $BASEPORT + 5`
 PORT6=`expr $BASEPORT + 6`
+KDCPORT=`expr $BASEPORT + 7`
 URI1="ldap://${LOCALHOST}:$PORT1/"
 URIP1="ldap://${LOCALIP}:$PORT1/"
 URI2="ldap://${LOCALHOST}:$PORT2/"
@@ -239,6 +241,9 @@ SURIP5="ldaps://${LOCALIP}:$PORT5/"
 SURI6="ldaps://${LOCALHOST}:$PORT6/"
 SURIP6="ldaps://${LOCALIP}:$PORT6/"
 
+KRB5REALM="K5.REALM"
+KDCHOST=$LOCALHOST
+
 # LDIF
 LDIF=$DATADIR/test.ldif
 LDIFADD1=$DATADIR/do_add.1
diff --git a/tests/scripts/setup_kdc.sh b/tests/scripts/setup_kdc.sh
new file mode 100755
index 000000000..1cb784075
--- /dev/null
+++ b/tests/scripts/setup_kdc.sh
@@ -0,0 +1,144 @@
+#! /bin/sh
+# $OpenLDAP$
+## This work is part of OpenLDAP Software <http://www.openldap.org/>.
+##
+## Copyright 1998-2020 The OpenLDAP Foundation.
+## All rights reserved.
+##
+## Redistribution and use in source and binary forms, with or without
+## modification, are permitted only as authorized by the OpenLDAP
+## Public License.
+##
+## A copy of this license is available in the file LICENSE in the
+## top-level directory of the distribution or, alternatively, at
+## <http://www.OpenLDAP.org/license.html>.
+
+export KRB5_TRACE=$TESTDIR/k5_trace
+export KRB5_CONFIG=$TESTDIR/krb5.conf
+export KRB5_KDC_PROFILE=$KRB5_CONFIG
+export KRB5_KTNAME=$TESTDIR/server.kt
+export KRB5_CLIENT_KTNAME=$TESTDIR/client.kt
+export KRB5CCNAME=$TESTDIR/client.ccache
+
+KDCLOG=$TESTDIR/setup_kdc.log
+KSERVICE=ldap/$LOCALHOST
+KUSER=kuser
+
+. $CONFFILTER < $DATADIR/krb5.conf > $KRB5_CONFIG
+
+PATH=${PATH}:/usr/lib/heimdal-servers:/usr/sbin:/usr/local/sbin
+
+echo "Trying Heimdal KDC..."
+
+kdc --version 2>&1 | grep Heimdal > $KDCLOG 2>&1
+RC=$?
+if test $RC = 0 ; then
+
+	kstash --random-key > $KDCLOG 2>&1
+	RC=$?
+	if test $RC != 0 ; then
+		echo "Heimdal: kstash failed, skipping GSSAPI tests"
+		exit 0
+	fi
+
+	flags="--realm-max-ticket-life=1h --realm-max-renewable-life=1h"
+	kadmin -l init $flags $KRB5REALM > $KDCLOG 2>&1
+	RC=$?
+	if test $RC != 0 ; then
+		echo "Heimdal: kadmin init failed, skipping GSSAPI tests"
+		exit 0
+	fi
+
+	kadmin -l add --random-key --use-defaults $KSERVICE > $KDCLOG 2>&1
+	RC=$?
+	if test $RC != 0 ; then
+		echo "Heimdal: kadmin add failed, skipping GSSAPI tests"
+		exit 0
+	fi
+
+	kadmin -l ext -k $KRB5_KTNAME $KSERVICE > $KDCLOG 2>&1
+	RC=$?
+	if test $RC != 0 ; then
+		echo "Heimdal: kadmin ext failed, skipping GSSAPI tests"
+		exit 0
+	fi
+
+	kadmin -l add --random-key --use-defaults $KUSER > $KDCLOG 2>&1
+	RC=$?
+	if test $RC != 0 ; then
+		echo "Heimdal: kadmin add failed, skipping GSSAPI tests"
+		exit 0
+	fi
+
+	kadmin -l ext -k $KRB5_CLIENT_KTNAME $KUSER > $KDCLOG 2>&1
+	RC=$?
+	if test $RC != 0 ; then
+		echo "Heimdal: kadmin ext failed, skipping GSSAPI tests"
+		exit 0
+	fi
+
+	kdc --addresses=$LOCALIP --ports="$KDCPORT/udp" > $KDCLOG 2>&1 &
+else
+	echo "Trying MIT KDC..."
+
+	kdb5_util create -r $KRB5REALM -s -P password > $KDCLOG 2>&1
+	RC=$?
+	if test $RC != 0 ; then
+		echo "MIT: kdb5_util create failed, skipping GSSAPI tests"
+		exit 0
+	fi
+
+	kadmin.local -q "addprinc -randkey $KSERVICE" > $KDCLOG 2>&1
+	RC=$?
+	if test $RC != 0 ; then
+		echo "MIT: admin addprinc failed, skipping GSSAPI tests"
+		exit 0
+	fi
+
+	kadmin.local -q "ktadd -k $KRB5_KTNAME $KSERVICE" > $KDCLOG 2>&1
+	RC=$?
+	if test $RC != 0 ; then
+		echo "MIT: kadmin ktadd failed, skipping GSSAPI tests"
+		exit 0
+	fi
+
+	kadmin.local -q "addprinc -randkey $KUSER" > $KDCLOG 2>&1
+	RC=$?
+	if test $RC != 0 ; then
+		echo "MIT: kadmin addprinc failed, skipping GSSAPI tests"
+		exit 0
+	fi
+
+	kadmin.local -q "ktadd -k $KRB5_CLIENT_KTNAME $KUSER" > $KDCLOG 2>&1
+	RC=$?
+	if test $RC != 0 ; then
+		echo "MIT: kadmin ktadd failed, skipping GSSAPI tests"
+		exit 0
+	fi
+
+	krb5kdc -n > $KDCLOG 2>&1 &
+fi
+
+KDCPROC=$!
+sleep 1
+
+kinit -kt $KRB5_CLIENT_KTNAME $KUSER > $KDCLOG 2>&1
+RC=$?
+if test $RC != 0 ; then
+	kill $KDCPROC
+	echo "SASL/GSSAPI: kinit failed, skipping GSSAPI tests"
+	exit 0
+fi
+
+pluginviewer -m GSSAPI > $TESTDIR/plugin_out 2>/dev/null
+RC=$?
+if test $RC != 0 ; then
+
+	saslpluginviewer -m GSSAPI > $TESTDIR/plugin_out 2>/dev/null
+	RC=$?
+	if test $RC != 0 ; then
+		kill $KDCPROC
+		echo "cyrus-sasl has no GSSAPI support, test skipped"
+		exit 0
+	fi
+fi
diff --git a/tests/scripts/test077-sasl-gssapi b/tests/scripts/test077-sasl-gssapi
new file mode 100755
index 000000000..64abe16fe
--- /dev/null
+++ b/tests/scripts/test077-sasl-gssapi
@@ -0,0 +1,159 @@
+#! /bin/sh
+# $OpenLDAP$
+## This work is part of OpenLDAP Software <http://www.openldap.org/>.
+##
+## Copyright 1998-2020 The OpenLDAP Foundation.
+## All rights reserved.
+##
+## Redistribution and use in source and binary forms, with or without
+## modification, are permitted only as authorized by the OpenLDAP
+## Public License.
+##
+## A copy of this license is available in the file LICENSE in the
+## top-level directory of the distribution or, alternatively, at
+## <http://www.OpenLDAP.org/license.html>.
+
+echo "running defines.sh"
+. $SRCDIR/scripts/defines.sh
+
+if test $WITH_SASL = no ; then
+        echo "SASL support not available, test skipped"
+        exit 0
+fi
+
+mkdir -p $TESTDIR $DBDIR1
+cp -r $DATADIR/tls $TESTDIR
+
+cd $TESTWD
+
+
+echo "Starting KDC for SASL/GSSAPI tests..."
+. $SRCDIR/scripts/setup_kdc.sh
+
+echo "Running slapadd to build slapd database..."
+. $CONFFILTER $BACKEND $MONITORDB < $SASLGSSAPICONF > $CONF1
+$SLAPADD -f $CONF1 -l $LDIFORDERED
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	kill $KDCPROC
+	exit $RC
+fi
+
+echo "Starting ldap:/// slapd on TCP/IP port $PORT1 and ldaps:/// slapd on $PORT2..."
+$SLAPD -f $CONF1 -h "$URI1 $SURI2" -d $LVL $TIMING > $LOG1 2>&1 &
+PID=$!
+if test $WAIT != 0 ; then
+    echo PID $PID
+    read foo
+fi
+KILLPIDS="$PID"
+
+sleep 1
+
+for i in 0 1 2 3 4 5; do
+	$LDAPSEARCH -s base -b "" -H $URI1 \
+		'objectclass=*' > /dev/null 2>&1
+        RC=$?
+        if test $RC = 0 ; then
+                break
+        fi
+        echo "Waiting 5 seconds for slapd to start..."
+        sleep 5
+done
+
+if test $RC != 0 ; then
+	echo "ldapsearch failed ($RC)!"
+	kill $KDCPROC
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
+	exit $RC
+fi
+
+$LDAPSEARCH -x -H $URI1 -s "base" -b "" supportedSASLMechanisms > $TESTOUT 2>&1
+RC=$?
+if test $RC != 0 ; then
+	echo "ldapsearch failed ($RC)!"
+	kill $KDCPROC
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
+	exit $RC
+fi
+
+grep GSSAPI $TESTOUT
+RC=$?
+if test $RC != 0 ; then
+	echo "failed: GSSAPI mechanism not in supportedSASLMechanisms."
+	kill $KDCPROC
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
+	exit $RC
+fi
+
+echo -n "Using ldapwhoami with SASL/GSSAPI: "
+$LDAPSASLWHOAMI -N -Y GSSAPI -H $URI1 > $TESTOUT 2>&1
+RC=$?
+if test $RC != 0 ; then
+	echo "ldapwhoami failed ($RC)!"
+	kill $KDCPROC
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
+	exit $RC
+else
+	echo "success"
+fi
+
+echo -n "Validating mapped SASL/GSSAPI ID: "
+echo "dn:uid=$KUSER,cn=$KRB5REALM,cn=gssapi,cn=auth" > $TESTDIR/dn.out
+$CMP $TESTDIR/dn.out $TESTOUT > $CMPOUT
+RC=$?
+if test $RC != 0 ; then
+	echo "Comparison failed"
+	kill $KDCPROC
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
+	exit $RC
+else
+	echo "success"
+fi
+
+if test $WITH_TLS = no ; then
+        echo "SASL/GSSAPI: TLS support not available, skipping TLS part."
+else
+	echo -n "Using ldapwhoami with SASL/GSSAPI with start-tls: "
+	$LDAPSASLWHOAMI -N -Y GSSAPI -H $URI1 -ZZ -o tls_reqcert=allow	\
+		-o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt	\
+		> $TESTOUT 2>&1
+	RC=$?
+	if test $RC != 0 ; then
+		echo "ldapwhoami failed ($RC)!"
+		kill $KDCPROC
+		test $KILLSERVERS != no && kill -HUP $KILLPIDS
+		exit $RC
+	else
+		echo "success"
+	fi
+
+	echo -n "Using ldapwhoami with SASL/GSSAPI with ldaps: "
+	$LDAPSASLWHOAMI -N -Y GSSAPI -H $SURI2 -o tls_reqcert=allow	\
+		-o tls_cacert=$TESTDIR/tls/ca/certs/testsuiteCA.crt	\
+		> $TESTOUT 2>&1
+	RC=$?
+	if test $RC != 0 ; then
+		echo "ldapwhoami failed ($RC)!"
+		kill $KDCPROC
+		test $KILLSERVERS != no && kill -HUP $KILLPIDS
+		exit $RC
+	else
+		echo "success"
+	fi
+fi
+
+kill $KDCPROC
+test $KILLSERVERS != no && kill -HUP $KILLPIDS
+
+if test $RC != 0 ; then
+	echo ">>>>> Test failed"
+else
+	echo ">>>>> Test succeeded"
+	RC=0
+fi
+
+test $KILLSERVERS != no && wait
+
+exit $RC
-- 
2.29.2