tests/krb5: Adjust expected error codes

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

diff --git a/python/samba/tests/krb5/fast_tests.py b/python/samba/tests/krb5/fast_tests.py
index 6a6fdfa786e0938eab04cef9cb59deb699106a6e..dbd4e4e4ce24888e7d4e171a29d52f23cf57d3d6 100755 (executable)
--- a/python/samba/tests/krb5/fast_tests.py
+++ b/python/samba/tests/krb5/fast_tests.py
@@ -605,7 +605,8 @@ class FAST_Tests(KDCBaseTest):
         self._run_test_sequence([
             {
                 'rep_type': KRB_AS_REP,
-                'expected_error_mode': KDC_ERR_POLICY,
+                'expected_error_mode': (KDC_ERR_POLICY,
+                                        KDC_ERR_S_PRINCIPAL_UNKNOWN),
                 'use_fast': True,
                 'fast_armor': FX_FAST_ARMOR_AP_REQUEST,
                 'gen_armor_tgt_fn': self.get_user_service_ticket
@@ -620,7 +621,8 @@ class FAST_Tests(KDCBaseTest):
         self._run_test_sequence([
             {
                 'rep_type': KRB_AS_REP,
-                'expected_error_mode': KDC_ERR_POLICY,
+                'expected_error_mode': (KDC_ERR_POLICY,
+                                        KDC_ERR_S_PRINCIPAL_UNKNOWN),
                 'use_fast': True,
                 'fast_armor': FX_FAST_ARMOR_AP_REQUEST,
                 'gen_armor_tgt_fn': self.get_mach_service_ticket
@@ -637,7 +639,8 @@ class FAST_Tests(KDCBaseTest):
         self._run_test_sequence([
             {
                 'rep_type': KRB_AS_REP,
-                'expected_error_mode': KDC_ERR_POLICY,
+                'expected_error_mode': (KDC_ERR_POLICY,
+                                        KDC_ERR_S_PRINCIPAL_UNKNOWN),
                 'use_fast': True,
                 'fast_armor': FX_FAST_ARMOR_AP_REQUEST,
                 'gen_armor_tgt_fn': self.get_service_ticket_invalid_checksum
@@ -657,7 +660,8 @@ class FAST_Tests(KDCBaseTest):
             },
             {
                 'rep_type': KRB_AS_REP,
-                'expected_error_mode': KDC_ERR_PREAUTH_REQUIRED,
+                'expected_error_mode': (KDC_ERR_PREAUTH_REQUIRED,
+                                        KDC_ERR_POLICY),
                 'use_fast': True,
                 'gen_padata_fn': self.generate_enc_timestamp_padata,
                 'fast_armor': FX_FAST_ARMOR_AP_REQUEST,

diff --git a/python/samba/tests/krb5/kdc_tgs_tests.py b/python/samba/tests/krb5/kdc_tgs_tests.py
index b418a087df808d4e58745ea867be8c63157aefb2..df95523144fe9eb4d16aabca9684c3cb2278f331 100755 (executable)
--- a/python/samba/tests/krb5/kdc_tgs_tests.py
+++ b/python/samba/tests/krb5/kdc_tgs_tests.py
@@ -1644,7 +1644,7 @@ class KdcTgsTests(KDCBaseTest):
         self._user2user(service_ticket, creds,
                         expected_error=(KDC_ERR_MODIFIED, KDC_ERR_POLICY))
 
-    # Expected to fail against Windows, which does not produce a policy error.
+    # Expected to fail against Windows, which does not produce an error.
     def test_fast_service_ticket(self):
         creds = self._get_creds()
         tgt = self._get_tgt(creds)
@@ -1653,7 +1653,8 @@ class KdcTgsTests(KDCBaseTest):
         service_ticket = self.get_service_ticket(tgt, service_creds)
 
         self._fast(service_ticket, creds,
-                   expected_error=KDC_ERR_POLICY)
+                   expected_error=(KDC_ERR_POLICY,
+                                   KDC_ERR_S_PRINCIPAL_UNKNOWN))
 
     def test_pac_attrs_none(self):
         creds = self._get_creds()

diff --git a/python/samba/tests/krb5/raw_testcase.py b/python/samba/tests/krb5/raw_testcase.py
index 1496ff961cd862511d3b8013b330dea4241fc99b..7054dc543aa6e2da766b9a7d03209ef440a2c33b 100644 (file)
--- a/python/samba/tests/krb5/raw_testcase.py
+++ b/python/samba/tests/krb5/raw_testcase.py
@@ -47,6 +47,7 @@ from samba.tests.krb5.rfc4120_constants import (
     AD_WIN2K_PAC,
     FX_FAST_ARMOR_AP_REQUEST,
     KDC_ERR_GENERIC,
+    KDC_ERR_POLICY,
     KDC_ERR_PREAUTH_FAILED,
     KDC_ERR_SKEW,
     KDC_ERR_UNKNOWN_CRITICAL_FAST_OPTIONS,
@@ -2958,7 +2959,8 @@ class RawKerberosTest(TestCaseInTempDir):
             if len(expect_etype_info2) != 0:
                 expected_patypes += (PADATA_ETYPE_INFO2,)
 
-            if error_code not in (KDC_ERR_PREAUTH_FAILED, KDC_ERR_SKEW):
+            if error_code not in (KDC_ERR_PREAUTH_FAILED, KDC_ERR_SKEW,
+                                  KDC_ERR_POLICY):
                 if sent_fast:
                     expected_patypes += (PADATA_ENCRYPTED_CHALLENGE,)
                 else: