diff options
| author | Greg Hudson <ghudson@mit.edu> | 2017-02-07 13:12:24 -0500 |
|---|---|---|
| committer | Greg Hudson <ghudson@mit.edu> | 2017-02-09 11:05:00 -0500 |
| commit | 0963fa5f0d01d81d3c4088088b94c455f033e921 (patch) | |
| tree | 226af753279f5a281727ef2e36dfdd395cf750e5 /src/tests/t_pkinit.py | |
| parent | a1dc81d22304e77edaa8388c7d7d75cade81dc80 (diff) | |
| download | krb5-0963fa5f0d01d81d3c4088088b94c455f033e921.zip krb5-0963fa5f0d01d81d3c4088088b94c455f033e921.tar.gz krb5-0963fa5f0d01d81d3c4088088b94c455f033e921.tar.bz2 | |
Avoid draft 9 fallback after PKINIT failure
If a KDC offers both RFC 4556 and draft 9 PKINIT, and we experience a
client-side failure trying RFC 4556 PKINIT (e.g. due to the user
entering the wrong PKCS #11 PIN), do not try to use draft 9 PKINIT.
ticket: 8544
Diffstat (limited to 'src/tests/t_pkinit.py')
| -rwxr-xr-x | src/tests/t_pkinit.py | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/src/tests/t_pkinit.py b/src/tests/t_pkinit.py index c8111d5..2dc057f 100755 --- a/src/tests/t_pkinit.py +++ b/src/tests/t_pkinit.py @@ -320,6 +320,14 @@ realm.kinit(realm.user_princ, realm.klist(realm.user_princ) realm.run([kvno, realm.host_princ]) +# Supply the wrong PIN, and verify that we ignore the draft9 padata offer +# in the KDC method data after RFC 4556 PKINIT fails. +expected_trace = ('PKINIT client has no configured identity; giving up', + 'PKINIT client ignoring draft 9 offer from RFC 4556 KDC') +realm.kinit(realm.user_princ, + flags=['-X', 'X509_user_identity=%s' % p11_identity], + password='wrong', expected_code=1, expected_trace=expected_trace) + # PKINIT with PKCS11: identity, with a PIN supplied by the responder. # Supply the response in raw form. realm.run(['./responder', '-x', 'pkinit={"%s": 0}' % p11_token_identity, |