Fix expired password tests to work with Heimdal 7.0.1 and later

diff --git a/NEWS b/NEWS
index 4e572e038948cbf98f134d4f4c987e774c34eae2..d5362f57946d53c8f405d9750ef05d71588d51e8 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,8 @@ pam-krb5 4.8 (unreleased)
     Document the test suite configuration files required to run the PKINIT
     tests.
 
+    Fix expired password tests to work with Heimdal 7.0.1 and later.
+
     Rename the script to bootstrap from a Git checkout to bootstrap,
     matching the emerging consensus in the Autoconf world.
 

diff --git a/configure.ac b/configure.ac
index 51736fd93f2c816deee669f71ae8cb88545ce2af..dc47d489541b94c906aceb71a165a8f6369d41f3 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -75,6 +75,7 @@ AC_CHECK_FUNCS([krb5_cc_get_full_name \
     krb5_get_init_creds_opt_set_pa \
     krb5_init_secure_context \
     krb5_principal_get_realm \
+    krb5_principal_set_comp_string \
     krb5_set_password \
     krb5_set_trace_filename \
     krb5_verify_init_creds_opt_init \

diff --git a/tests/data/scripts/expired/basic-heimdal b/tests/data/scripts/expired/basic-heimdal
index 9cb312cc1431312b2fc8c5ee31616b59dd8da96f..6bc5e55910298e23ff049fb3c8ac1e5de8fb0437 100644 (file)
--- a/tests/data/scripts/expired/basic-heimdal
+++ b/tests/data/scripts/expired/basic-heimdal
@@ -1,7 +1,7 @@
 # Test default handling of expired passwords.  -*- conf -*-
 #
 # Written by Russ Allbery <eagle@eyrie.org>
-# Copyright 2014 Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2017 Russ Allbery <eagle@eyrie.org>
 # Copyright 2010, 2011
 #     The Board of Trustees of the Leland Stanford Junior University
 #
@@ -20,6 +20,7 @@
 
 [prompts]
     echo_off = Password: |%p
+    info     = Password has expired
     info     = Your password will expire at %1
     info     = Changing password
     echo_off = New password: |%n

diff --git a/tests/data/scripts/expired/basic-heimdal-debug b/tests/data/scripts/expired/basic-heimdal-debug
index 980f1614c8d5e15fc31c483f194b3c3ea1363ee3..240858eece90759da8360f532be2254321e1cfba 100644 (file)
--- a/tests/data/scripts/expired/basic-heimdal-debug
+++ b/tests/data/scripts/expired/basic-heimdal-debug
@@ -1,7 +1,7 @@
 # Test default handling of expired passwords.  -*- conf -*-
 #
 # Written by Russ Allbery <eagle@eyrie.org>
-# Copyright 2014 Russ Allbery <eagle@eyrie.org>
+# Copyright 2014, 2017 Russ Allbery <eagle@eyrie.org>
 # Copyright 2010, 2011
 #     The Board of Trustees of the Leland Stanford Junior University
 #
@@ -21,6 +21,7 @@
 
 [prompts]
     echo_off = Password: |%p
+    info     = Password has expired
     info     = Your password will expire at %1
     info     = Changing password
     echo_off = New password: |%n

diff --git a/tests/data/scripts/expired/basic-heimdal-old b/tests/data/scripts/expired/basic-heimdal-old
new file mode 100644 (file)
index 0000000..9cb312c
--- /dev/null
+++ b/tests/data/scripts/expired/basic-heimdal-old
@@ -0,0 +1,30 @@
+# Test default handling of expired passwords.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010, 2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# See LICENSE for licensing terms.
+
+[options]
+    auth     = ignore_k5login
+    account  = ignore_k5login
+    password = ignore_k5login
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[prompts]
+    echo_off = Password: |%p
+    info     = Your password will expire at %1
+    info     = Changing password
+    echo_off = New password: |%n
+    echo_off = Repeat new password: |%n
+    info     = Success: Password changed
+
+[output]
+    INFO user %u authenticated as %0

diff --git a/tests/data/scripts/expired/basic-heimdal-old-debug b/tests/data/scripts/expired/basic-heimdal-old-debug
new file mode 100644 (file)
index 0000000..980f161
--- /dev/null
+++ b/tests/data/scripts/expired/basic-heimdal-old-debug
@@ -0,0 +1,43 @@
+# Test default handling of expired passwords.  -*- conf -*-
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014 Russ Allbery <eagle@eyrie.org>
+# Copyright 2010, 2011
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# See LICENSE for licensing terms.
+
+[options]
+    auth     = ignore_k5login debug
+    account  = ignore_k5login debug
+    password = ignore_k5login debug
+    session  = debug
+
+[run]
+    authenticate  = PAM_SUCCESS
+    acct_mgmt     = PAM_SUCCESS
+    open_session  = PAM_SUCCESS
+    close_session = PAM_SUCCESS
+
+[prompts]
+    echo_off = Password: |%p
+    info     = Your password will expire at %1
+    info     = Changing password
+    echo_off = New password: |%n
+    echo_off = Repeat new password: |%n
+    info     = Success: Password changed
+
+[output]
+    DEBUG pam_sm_authenticate: entry
+    DEBUG (user %u) attempting authentication as %0
+    INFO user %u authenticated as %0
+    DEBUG /^\(user %u\) temporarily storing credentials in /tmp/krb5cc_pam_/
+    DEBUG pam_sm_authenticate: exit (success)
+    DEBUG pam_sm_acct_mgmt: entry
+    DEBUG (user %u) retrieving principal from cache
+    DEBUG pam_sm_acct_mgmt: exit (success)
+    DEBUG pam_sm_open_session: entry
+    DEBUG /^\(user %u\) initializing ticket cache FILE:/tmp/krb5cc_/
+    DEBUG pam_sm_open_session: exit (success)
+    DEBUG pam_sm_close_session: entry
+    DEBUG pam_sm_close_session: exit (success)

diff --git a/tests/data/scripts/expired/defer b/tests/data/scripts/expired/defer-mit
similarity index 100%
rename from tests/data/scripts/expired/defer
rename to tests/data/scripts/expired/defer-mit

diff --git a/tests/data/scripts/expired/defer-debug b/tests/data/scripts/expired/defer-mit-debug
similarity index 100%
rename from tests/data/scripts/expired/defer-debug
rename to tests/data/scripts/expired/defer-mit-debug

diff --git a/tests/module/expired-t.c b/tests/module/expired-t.c
index b10f9a22e013e421fc0cb776731483591209a62b..378cc82fb84d6ca7fe9378faa17273efcd18197d 100644 (file)
--- a/tests/module/expired-t.c
+++ b/tests/module/expired-t.c
@@ -75,13 +75,26 @@ main(void)
 
     plan_lazy();
 
-    /* Default behavior. */
+    /*
+     * Default behavior.  We have to distinguish between two versions of
+     * Heimdal for testing because the prompts changed substantially.  Use the
+     * existence of krb5_principal_set_comp_string to distinguish because it
+     * was introduced at the same time.
+     */
 #ifdef HAVE_KRB5_HEIMDAL
+# ifdef HAVE_KRB5_PRINCIPAL_SET_COMP_STRING
     run_script("data/scripts/expired/basic-heimdal", &config);
     config.newpass = krbconf->password;
     config.password = newpass;
     kerberos_expire_password(krbconf->userprinc, now);
     run_script("data/scripts/expired/basic-heimdal-debug", &config);
+# else
+    run_script("data/scripts/expired/basic-heimdal-old", &config);
+    config.newpass = krbconf->password;
+    config.password = newpass;
+    kerberos_expire_password(krbconf->userprinc, now);
+    run_script("data/scripts/expired/basic-heimdal-old-debug", &config);
+# endif
 #else
     run_script("data/scripts/expired/basic-mit", &config);
     config.newpass = krbconf->password;
@@ -122,17 +135,27 @@ main(void)
     run_script("data/scripts/expired/fail", &config);
     run_script("data/scripts/expired/fail-debug", &config);
 
-    /* Defer the error to the account management check. */
+    /*
+     * Defer the error to the account management check.
+     *
+     * Skip this check on Heimdal currently (Heimdal 7.4.0) because its
+     * implementation of krb5_get_init_creds_opt_set_change_password_prompt is
+     * incomplete.  See <https://github.com/heimdal/heimdal/issues/322>.
+     */
+# ifdef HAVE_KRB5_HEIMDAL
+    skip_block(2, "deferring password changes broken in Heimdal");
+# else
     config.newpass = newpass;
     config.password = krbconf->password;
     config.authtok = krbconf->password;
     kerberos_expire_password(krbconf->userprinc, now);
-    run_script("data/scripts/expired/defer", &config);
+    run_script("data/scripts/expired/defer-mit", &config);
     config.newpass = krbconf->password;
     config.password = newpass;
     config.authtok = newpass;
     kerberos_expire_password(krbconf->userprinc, now);
-    run_script("data/scripts/expired/defer-debug", &config);
+    run_script("data/scripts/expired/defer-mit-debug", &config);
+# endif
 
 #else /* !HAVE_KRB5_GET_INIT_CREDS_OPT_SET_CHANGE_PASSWORD_PROMPT */