Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit4c831ae

Browse files
committed
Tests for Kerberos/GSSAPI authentication
Like the LDAP and SSL tests, these are not run by default but can beselected via PG_TEST_EXTRA.Reviewed-by: Thomas Munro <thomas.munro@enterprisedb.com>Reviewed-by: Michael Paquier <michael@paquier.xyz>
1 parentd06aba2 commit4c831ae

File tree

9 files changed

+264
-2
lines changed

9 files changed

+264
-2
lines changed

‎configure

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -709,7 +709,9 @@ with_systemd
709709
with_selinux
710710
with_openssl
711711
with_ldap
712+
with_krb_srvnam
712713
krb_srvtab
714+
with_gssapi
713715
with_python
714716
with_perl
715717
with_tcl
@@ -5788,6 +5790,7 @@ $as_echo "$with_gssapi" >&6; }
57885790

57895791

57905792

5793+
57915794
#
57925795
# Kerberos configuration parameters
57935796
#
@@ -5815,6 +5818,7 @@ fi
58155818

58165819

58175820

5821+
58185822
cat>>confdefs.h<<_ACEOF
58195823
#define PG_KRB_SRVNAM "$with_krb_srvnam"
58205824
_ACEOF

‎configure.in

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -638,6 +638,7 @@ PGAC_ARG_BOOL(with, gssapi, no, [build with GSSAPI support],
638638
krb_srvtab="FILE:\$(sysconfdir)/krb5.keytab"
639639
])
640640
AC_MSG_RESULT([$with_gssapi])
641+
AC_SUBST(with_gssapi)
641642

642643

643644
AC_SUBST(krb_srvtab)
@@ -650,6 +651,7 @@ PGAC_ARG_REQ(with, krb-srvnam,
650651
[NAME], [default service principal name in Kerberos (GSSAPI) [postgres]],
651652
[],
652653
[with_krb_srvnam="postgres"])
654+
AC_SUBST(with_krb_srvnam)
653655
AC_DEFINE_UNQUOTED([PG_KRB_SRVNAM], ["$with_krb_srvnam"],
654656
[Define to the name of the default PostgreSQL service principal in Kerberos (GSSAPI). (--with-krb-srvnam=NAME)])
655657

‎doc/src/sgml/regress.sgml

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -220,10 +220,20 @@ make installcheck-world
220220
<varname>PG_TEST_EXTRA</varname> to a whitespace-separated list, for
221221
example:
222222
<programlisting>
223-
make check-world PG_TEST_EXTRA='ldap ssl'
223+
make check-world PG_TEST_EXTRA='kerberosldap ssl'
224224
</programlisting>
225225
The following values are currently supported:
226226
<variablelist>
227+
<varlistentry>
228+
<term><literal>kerberos</literal></term>
229+
<listitem>
230+
<para>
231+
Runs the test suite under <filename>src/test/kerberos</filename>. This
232+
requires an MIT Kerberos installation and opens TCP/IP listen sockets.
233+
</para>
234+
</listitem>
235+
</varlistentry>
236+
227237
<varlistentry>
228238
<term><literal>ldap</literal></term>
229239
<listitem>

‎src/Makefile.global.in

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,8 @@ with_tcl= @with_tcl@
186186
with_openssl= @with_openssl@
187187
with_selinux= @with_selinux@
188188
with_systemd= @with_systemd@
189+
with_gssapi= @with_gssapi@
190+
with_krb_srvnam= @with_krb_srvnam@
189191
with_ldap= @with_ldap@
190192
with_libxml= @with_libxml@
191193
with_libxslt= @with_libxslt@

‎src/test/Makefile

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,11 @@ SUBDIRS = perl regress isolation modules authentication recovery subscription
1717
# Test suites that are not safe by default but can be run if selected
1818
# by the user via the whitespace-separated list in variable
1919
# PG_TEST_EXTRA:
20+
ifeq ($(with_gssapi),yes)
21+
ifneq (,$(filter kerberos,$(PG_TEST_EXTRA)))
22+
SUBDIRS += kerberos
23+
endif
24+
endif
2025
ifeq ($(with_ldap),yes)
2126
ifneq (,$(filter ldap,$(PG_TEST_EXTRA)))
2227
SUBDIRS += ldap
@@ -32,7 +37,7 @@ endif
3237
# clean" etc to recurse into them. (We must filter out those that we
3338
# have conditionally included into SUBDIRS above, else there will be
3439
# make confusion.)
35-
ALWAYS_SUBDIRS =$(filter-out$(SUBDIRS),examples ldap locale thread ssl)
40+
ALWAYS_SUBDIRS =$(filter-out$(SUBDIRS),exampleskerberosldap locale thread ssl)
3641

3742
# We want to recurse to all subdirs for all standard targets, except that
3843
# installcheck and install should not recurse into the subdirectory "modules".

‎src/test/kerberos/.gitignore

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# Generated by test suite
2+
/tmp_check/

‎src/test/kerberos/Makefile

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#-------------------------------------------------------------------------
2+
#
3+
# Makefile for src/test/kerberos
4+
#
5+
# Portions Copyright (c) 1996-2018, PostgreSQL Global Development Group
6+
# Portions Copyright (c) 1994, Regents of the University of California
7+
#
8+
# src/test/kerberos/Makefile
9+
#
10+
#-------------------------------------------------------------------------
11+
12+
subdir = src/test/kerberos
13+
top_builddir = ../../..
14+
include$(top_builddir)/src/Makefile.global
15+
16+
exportwith_gssapiwith_krb_srvnam
17+
18+
check:
19+
$(prove_check)
20+
21+
installcheck:
22+
$(prove_installcheck)
23+
24+
cleandistcleanmaintainer-clean:
25+
rm -rf tmp_check

‎src/test/kerberos/README

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
src/test/kerberos/README
2+
3+
Tests for Kerberos/GSSAPI functionality
4+
=======================================
5+
6+
This directory contains a test suite for Kerberos/GSSAPI
7+
functionality. This requires a full MIT Kerberos installation,
8+
including server and client tools, and is therefore kept separate and
9+
not run by default.
10+
11+
Also, this test suite creates a KDC server that listens for TCP/IP
12+
connections on localhost without any real access control, so it is not
13+
safe to run this on a system where there might be untrusted local
14+
users.
15+
16+
Running the tests
17+
=================
18+
19+
make check
20+
21+
or
22+
23+
make installcheck
24+
25+
Requirements
26+
============
27+
28+
MIT Kerberos server and client tools are required. Heimdal is not
29+
supported.
30+
31+
Debian/Ubuntu packages: krb5-admin-server krb5-kdc krb5-user
32+
33+
RHEL/CentOS packages: krb5-server krb5-workstation
34+
35+
FreeBSD port: krb5 (base system has Heimdal)

‎src/test/kerberos/t/001_auth.pl

Lines changed: 177 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,177 @@
1+
use strict;
2+
use warnings;
3+
use TestLib;
4+
use PostgresNode;
5+
use Test::More;
6+
7+
if ($ENV{with_gssapi}eq'yes')
8+
{
9+
plantests=> 4;
10+
}
11+
else
12+
{
13+
planskip_all=>'GSSAPI/Kerberos not supported by this build';
14+
}
15+
16+
my ($krb5_bin_dir,$krb5_sbin_dir);
17+
18+
if ($^Oeq'darwin')
19+
{
20+
$krb5_bin_dir ='/usr/local/opt/krb5/bin';
21+
$krb5_sbin_dir ='/usr/local/opt/krb5/sbin';
22+
}
23+
elsif ($^Oeq'freebsd')
24+
{
25+
$krb5_bin_dir ='/usr/local/bin';
26+
$krb5_sbin_dir ='/usr/local/sbin';
27+
}
28+
elsif ($^Oeq'linux')
29+
{
30+
$krb5_sbin_dir ='/usr/sbin';
31+
}
32+
33+
my$krb5_config ='krb5-config';
34+
my$kinit ='kinit';
35+
my$kdb5_util ='kdb5_util';
36+
my$kadmin_local ='kadmin.local';
37+
my$krb5kdc ='krb5kdc';
38+
39+
if ($krb5_bin_dir &&-d$krb5_bin_dir)
40+
{
41+
$krb5_config =$krb5_bin_dir .'/' .$krb5_config;
42+
$kinit =$krb5_bin_dir .'/' .$kinit;
43+
}
44+
if ($krb5_sbin_dir &&-d$krb5_sbin_dir)
45+
{
46+
$kdb5_util =$krb5_sbin_dir .'/' .$kdb5_util;
47+
$kadmin_local =$krb5_sbin_dir .'/' .$kadmin_local;
48+
$krb5kdc =$krb5_sbin_dir .'/' .$krb5kdc;
49+
}
50+
51+
my$realm ='EXAMPLE.COM';
52+
53+
my$krb5_conf ="${TestLib::tmp_check}/krb5.conf";
54+
my$kdc_conf ="${TestLib::tmp_check}/kdc.conf";
55+
my$krb5_log ="${TestLib::tmp_check}/krb5libs.log";
56+
my$kdc_log ="${TestLib::tmp_check}/krb5kdc.log";
57+
my$kdc_port =int(rand() * 16384) + 49152;
58+
my$kdc_datadir ="${TestLib::tmp_check}/krb5kdc";
59+
my$kdc_pidfile ="${TestLib::tmp_check}/krb5kdc.pid";
60+
my$keytab ="${TestLib::tmp_check}/krb5.keytab";
61+
62+
note"setting up Kerberos";
63+
64+
my ($stdout,$krb5_version);
65+
run_log [$krb5_config,'--version' ],'>', \$stdoutor BAIL_OUT("could not execute krb5-config");
66+
BAIL_OUT("Heimdal is not supported")if$stdout =~m/heimdal/;
67+
$stdout =~m/Kerberos 5 release ([0-9]+\.[0-9]+)/or BAIL_OUT("could not get Kerberos version");
68+
$krb5_version =$1;
69+
70+
append_to_file($krb5_conf,
71+
qq![logging]
72+
default = FILE:$krb5_log
73+
kdc = FILE:$kdc_log
74+
75+
[libdefaults]
76+
default_realm =$realm
77+
78+
[realms]
79+
$realm = {
80+
kdc = localhost:$kdc_port
81+
}!);
82+
83+
append_to_file($kdc_conf,
84+
qq![kdcdefaults]
85+
!);
86+
# For new-enough versions of krb5, use the _listen settings rather
87+
# than the _ports settings so that we can bind to localhost only.
88+
if ($krb5_version >= 1.15)
89+
{
90+
append_to_file($kdc_conf,
91+
qq!kdc_listen = localhost:$kdc_port
92+
kdc_tcp_listen = localhost:$kdc_port
93+
!);
94+
}
95+
else
96+
{
97+
append_to_file($kdc_conf,
98+
qq!kdc_ports =$kdc_port
99+
kdc_tcp_ports =$kdc_port
100+
!);
101+
}
102+
append_to_file($kdc_conf,
103+
qq!
104+
[realms]
105+
$realm = {
106+
database_name =$kdc_datadir/principal
107+
admin_keytab = FILE:$kdc_datadir/kadm5.keytab
108+
acl_file =$kdc_datadir/kadm5.acl
109+
key_stash_file =$kdc_datadir/_k5.$realm
110+
}!);
111+
112+
mkdir$kdc_datadirordie;
113+
114+
$ENV{'KRB5_CONFIG'} =$krb5_conf;
115+
$ENV{'KRB5_KDC_PROFILE'} =$kdc_conf;
116+
117+
my$service_principal ="$ENV{with_krb_srvnam}/localhost";
118+
119+
system_or_bail$kdb5_util,'create','-s','-P','secret0';
120+
121+
my$test1_password ='secret1';
122+
system_or_bail$kadmin_local,'-q',"addprinc -pw$test1_password test1";
123+
124+
system_or_bail$kadmin_local,'-q',"addprinc -randkey$service_principal";
125+
system_or_bail$kadmin_local,'-q',"ktadd -k$keytab$service_principal";
126+
127+
system_or_bail$krb5kdc,'-P',$kdc_pidfile;
128+
129+
END
130+
{
131+
kill'INT',`cat$kdc_pidfile`if-f$kdc_pidfile;
132+
}
133+
134+
note"setting up PostgreSQL instance";
135+
136+
my$node = get_new_node('node');
137+
$node->init;
138+
$node->append_conf('postgresql.conf',"listen_addresses = 'localhost'");
139+
$node->append_conf('postgresql.conf',"krb_server_keyfile = '$keytab'");
140+
$node->start;
141+
142+
$node->safe_psql('postgres','CREATE USER test1;');
143+
144+
note"running tests";
145+
146+
subtest_access
147+
{
148+
my ($node,$role,$expected_res,$test_name) =@_;
149+
150+
# need to connect over TCP/IP for Kerberos
151+
my$res =$node->psql('postgres','SELECT 1',
152+
extra_params=> ['-d',$node->connstr('postgres').' host=localhost',
153+
'-U',$role ]);
154+
is($res,$expected_res,$test_name);
155+
}
156+
157+
unlink($node->data_dir .'/pg_hba.conf');
158+
$node->append_conf('pg_hba.conf',qq{host all all localhost gss map=mymap});
159+
$node->restart;
160+
161+
test_access($node,'test1', 2,'fails without ticket');
162+
163+
run_log [$kinit,'test1' ], \$test1_passwordor BAIL_OUT($?);
164+
165+
test_access($node,'test1', 2,'fails without mapping');
166+
167+
$node->append_conf('pg_ident.conf',qq{mymap /^(.*)\@$realm\$\\1});
168+
$node->restart;
169+
170+
test_access($node,'test1', 0,'succeeds with mapping');
171+
172+
truncate($node->data_dir .'/pg_ident.conf', 0);
173+
unlink($node->data_dir .'/pg_hba.conf');
174+
$node->append_conf('pg_hba.conf',qq{host all all localhost gss include_realm=0});
175+
$node->restart;
176+
177+
test_access($node,'test1', 0,'succeeds with include_realm=0');

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp