--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/jdk/test/sun/security/krb5/auto/tools/KinitConfPlusProps.java Fri Sep 11 13:44:30 2015 +0300
@@ -0,0 +1,188 @@
+/*
+ * Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+import java.io.File;
+import java.net.PortUnreachableException;
+import java.util.HashMap;
+import java.util.Map;
+import jdk.testlibrary.ProcessTools;
+import jdk.testlibrary.OutputAnalyzer;
+
+/*
+ * @test
+ * @bug 6857795 8075299
+ * @summary Checks if kinit uses both krb5 conf file and system properties
+ * @requires os.family == "windows"
+ * @library /lib/testlibrary
+ * @library /sun/security/krb5/auto
+ * @run main/othervm KinitConfPlusProps
+ */
+public class KinitConfPlusProps {
+
+ private static final String KINIT = System.getProperty("java.home")
+ + File.separator + "bin" + File.separator + "kinit";
+ private static final String KLIST = System.getProperty("java.home")
+ + File.separator + "bin" + File.separator + "klist";
+ private static final String REALM = "REALM";
+ private static final String ANOTHER_REALM = "ANOTHER.REALM";
+ private static final String HOST = "localhost";
+ private static final String CC_FILENAME = "krb5cc_test";
+ private static final String USER = "TESTER";
+ private static final String USER_PRINCIPAL = USER + "@" + REALM;
+ private static final String KRBTGT_PRINCIPAL = "krbtgt/" + REALM;
+ private static final String KEYTAB_FILE = "test.keytab";
+ private static final String KRB5_CONF_FILENAME = "krb5.conf";
+
+ public static void main(String[] args) throws Exception {
+ // define principals
+ Map<String, String> principals = new HashMap<>();
+ principals.put(USER_PRINCIPAL, null);
+ principals.put(KRBTGT_PRINCIPAL, null);
+
+ System.setProperty("java.security.krb5.conf", KRB5_CONF_FILENAME);
+
+ // start a local KDC instance
+ KDC kdc = KDC.startKDC(HOST, null, REALM, principals, KEYTAB_FILE,
+ KDC.KtabMode.APPEND);
+ KDC.saveConfig(KRB5_CONF_FILENAME, kdc,
+ "forwardable = true", "proxiable = true");
+
+ boolean success = true;
+
+ /*
+ * kinit should fail since java.security.krb5.kdc
+ * and java.security.krb5.realm properties override correct values
+ * in krb5 conf file
+ */
+ String[] command = {KINIT, "-k",
+ "-J-Djava.security.krb5.realm=" + REALM,
+ "-J-Djava.security.krb5.kdc=" + HOST, // without port
+ "-J-Djava.security.krb5.conf=" + KRB5_CONF_FILENAME,
+ "-t", KEYTAB_FILE,
+ "-c", CC_FILENAME,
+ USER
+ };
+
+ try {
+ OutputAnalyzer out = ProcessTools.executeCommand(command);
+ out.shouldHaveExitValue(-1);
+ out.shouldContain(PortUnreachableException.class.getName());
+ } catch(Throwable e) {
+ System.out.println("Unexpected exception: " + e);
+ e.printStackTrace(System.out);
+ success = false;
+ }
+
+ /*
+ * kinit should succeed
+ * since realm should be picked up from principal name
+ */
+ command = new String[] {KINIT, "-k",
+ "-J-Djava.security.krb5.realm=" + ANOTHER_REALM,
+ "-J-Djava.security.krb5.kdc=" + HOST,
+ "-J-Djava.security.krb5.conf=" + KRB5_CONF_FILENAME,
+ "-t", KEYTAB_FILE,
+ "-c", CC_FILENAME,
+ USER_PRINCIPAL
+ };
+
+ try {
+ OutputAnalyzer out = ProcessTools.executeCommand(command);
+ out.shouldHaveExitValue(0);
+ out.shouldContain(CC_FILENAME);
+ } catch(Throwable e) {
+ System.out.println("Unexpected exception: " + e);
+ e.printStackTrace(System.out);
+ success = false;
+ }
+
+ success &= checkTicketFlags();
+
+ /*
+ * kinit should succeed
+ * since realm should be picked up from principal name,
+ * and other data should come from krb5 conf file
+ */
+ command = new String[] {KINIT, "-k",
+ "-J-Djava.security.krb5.conf=" + KRB5_CONF_FILENAME,
+ "-t", KEYTAB_FILE,
+ "-c", CC_FILENAME,
+ USER_PRINCIPAL
+ };
+
+ try {
+ OutputAnalyzer out = ProcessTools.executeCommand(command);
+ out.shouldHaveExitValue(0);
+ out.shouldContain(CC_FILENAME);
+ } catch(Throwable e) {
+ System.out.println("Unexpected exception: " + e);
+ e.printStackTrace(System.out);
+ success = false;
+ }
+
+ success &= checkTicketFlags();
+
+ // kinit should succeed even if a principal name doesn't have realm
+ command = new String[] {KINIT, "-k",
+ "-J-Djava.security.krb5.conf=" + KRB5_CONF_FILENAME,
+ "-t", KEYTAB_FILE,
+ "-c", CC_FILENAME,
+ USER
+ };
+
+ try {
+ OutputAnalyzer out = ProcessTools.executeCommand(command);
+ out.shouldHaveExitValue(0);
+ out.shouldContain(CC_FILENAME);
+ } catch(Throwable e) {
+ System.out.println("Unexpected exception: " + e);
+ e.printStackTrace(System.out);
+ success = false;
+ }
+
+ success &= checkTicketFlags();
+
+ if (!success) {
+ throw new RuntimeException("At least one test case failed");
+ }
+ System.out.println("Test passed");
+ }
+
+ // check if a ticket has forwardable and proxiable flags
+ private static boolean checkTicketFlags() {
+ String[] command = new String[] {KLIST, "-f", "-c", CC_FILENAME};
+
+ try {
+ OutputAnalyzer out = ProcessTools.executeCommand(command);
+ out.shouldHaveExitValue(0);
+ out.shouldContain("FORWARDABLE");
+ out.shouldContain("PROXIABLE");
+ } catch(Throwable e) {
+ System.out.println("Unexpected exception: " + e);
+ e.printStackTrace(System.out);
+ return false;
+ }
+
+ return true;
+ }
+}