tests/krb5: Test viewing gMSA passwords after performing simple binds

Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/python/samba/tests/krb5/gmsa_tests.py b/python/samba/tests/krb5/gmsa_tests.py
index 1ce6add528460961a652b2b715a7e9523301e4f7..f1d1e6020c5f025f2ee502aeaac967286a4596cf 100755 (executable)
--- a/python/samba/tests/krb5/gmsa_tests.py
+++ b/python/samba/tests/krb5/gmsa_tests.py
@@ -812,6 +812,39 @@ class GmsaTests(GkdiBaseTest, KDCBaseTest):
             expected_werror=werror.WERR_DS_CONFIDENTIALITY_REQUIRED,
         )
 
+    def test_retrieving_password_after_encrypted_simple_bind(self):
+        """Test retrieving the managed password using a simple bind with encryption."""
+        admin_sid = self.get_samdb().get_admin_sid()
+
+        creds = self.insta_creds(template=self.get_admin_creds())
+        creds.set_bind_dn(admin_sid)
+        samdb = SamDB(
+            url=f"ldaps://{self.dc_host}", credentials=creds, lp=self.get_lp()
+        )
+
+        self.check_managed_password_access(
+            self.gmsa_account(), samdb=samdb, expect_access=True
+        )
+
+    def test_retrieving_password_after_unencrypted_simple_bind(self):
+        """Test retrieving the managed password using a simple bind without encryption."""
+        admin_sid = self.get_samdb().get_admin_sid()
+
+        creds = self.insta_creds(template=self.get_admin_creds())
+        creds.set_bind_dn(admin_sid)
+        try:
+            samdb = SamDB(
+                url=f"ldap://{self.dc_host}", credentials=creds, lp=self.get_lp()
+            )
+        except ldb.LdbError:
+            self.fail("failed to perform simple bind")
+
+        self.check_managed_password_access(
+            self.gmsa_account(),
+            samdb=samdb,
+            expected_werror=werror.WERR_DS_CONFIDENTIALITY_REQUIRED,
+        )
+
     def future_gkid(self) -> Gkid:
         """Return (6333, 26, 5)—an arbitrary GKID far enough in the future that
         it’s situated beyond any reasonable rollover period. But not so far in

diff --git a/selftest/knownfail.d/gmsa b/selftest/knownfail.d/gmsa
index a046c6a6a2f5a7d0b257ee4267bf12084f5ffc45..ea22b85acf86dfaa408d14b3541280db8741a402 100644 (file)
--- a/selftest/knownfail.d/gmsa
+++ b/selftest/knownfail.d/gmsa
@@ -1 +1,4 @@
 ^samba\.tests\.krb5\.gmsa_tests\.samba\.tests\.krb5\.gmsa_tests\.GmsaTests\.test_gmsa_cannot_perform_gensec_ntlmssp_logon_with_previous_password_five_minutes_apart\(ad_dc:local\)$
+# The unencrypted simple bind fails because the ad_dc environment sets ‘ldap
+# server require strong auth = yes’.
+^samba\.tests\.krb5\.gmsa_tests\.samba\.tests\.krb5\.gmsa_tests\.GmsaTests\.test_retrieving_password_after_unencrypted_simple_bind\(ad_dc:local\)$