nixos/tests/kerberos/mit.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

import ../make-test.nix ({pkgs, ...}: {
  name = "kerberos_server-mit";
  machine = { config, libs, pkgs, ...}:
  { services.kerberos_server =
    { enable = true;
      realms = {
        "FOO.BAR".acl = [{principal = "admin"; access = ["add" "cpw"];}];
      };
    };
    krb5 = {
      enable = true;
      kerberos = pkgs.krb5Full;
      libdefaults = {
        default_realm = "FOO.BAR";
      };
      realms = {
        "FOO.BAR" = {
          admin_server = "machine";
          kdc = "machine";
        };
      };
    };
    users.extraUsers.alice = { isNormalUser = true; };
  };

  testScript = ''
    $machine->start;

    $machine->succeed(
      "kdb5_util create -s -r FOO.BAR -P master_key"
    );

    $machine->succeed("systemctl restart kadmind.service kdc.service");
    $machine->waitForUnit("kadmind.service");
    $machine->waitForUnit("kdc.service");

    $machine->succeed(
      "kadmin.local add_principal -pw admin_pw admin"
    );
    $machine->succeed(
      "kadmin -p admin -w admin_pw addprinc -pw alice_pw alice"
    );
    $machine->succeed("echo alice_pw | sudo -u alice kinit");
  '';
})