rkerberos 0.2.3 → 0.3.0

data/spec/credentials_cache_spec.rb

@@ -36,43 +36,74 @@ RSpec.describe Kerberos::Krb5::CredentialsCache do
     end
 
     it 'creates a cache with a principal' do
-      expect { described_class.new(princ) }.not_to raise_error
+      expect { described_class.new(principal: princ) }.not_to raise_error
       expect(File.exist?(cfile)).to be true
       expect(cache_found?).to be true
     end
 
     it 'accepts an explicit cache name' do
-      expect { described_class.new(princ, cfile) }.not_to raise_error
-      expect { described_class.new(nil, cfile) }.not_to raise_error
+      expect { described_class.new(principal: princ, cache_name: cfile) }.not_to raise_error
+      expect { described_class.new(cache_name: cfile) }.not_to raise_error
     end
 
-    it 'raises error for non-string argument' do
-      expect { described_class.new(true) }.to raise_error(TypeError)
+    it 'raises error for non-string principal' do
+      expect { described_class.new(principal: true) }.to raise_error(TypeError)
     end
 
-    it 'accepts only up to two arguments' do
-      expect { described_class.new(princ, cfile, cfile) }.to raise_error(ArgumentError)
+    it 'accepts Principal objects (duck-typed as #principal)' do
+      obj = Kerberos::Krb5::Principal.new(name: princ)
+      expect { described_class.new(principal: obj) }.not_to raise_error
+      expect(described_class.new(principal: obj).primary_principal).to eq(princ)
+    end
+
+    it 'raises error for positional arguments' do
+      expect { described_class.new(princ) }.to raise_error(ArgumentError)
+    end
+
+    it 'rejects unknown keywords' do
+      expect { described_class.new(unknown: true) }.to raise_error(ArgumentError, /unknown keyword/)
+    end
+
+    it 'accepts a context option' do
+      ctx = Kerberos::Krb5::Context.new
+      expect { described_class.new(principal: princ, context: ctx) }.not_to raise_error
+    end
+
+    it 'uses the context when provided' do
+      ctx = Kerberos::Krb5::Context.new
+      c = described_class.new(principal: princ, context: ctx)
+      expect(c.primary_principal).to eq(princ)
+    end
+
+    it 'raises TypeError for non-Context context argument' do
+      expect { described_class.new(context: "bad") }.to raise_error(TypeError)
+    end
+
+    it 'raises error for a closed context' do
+      ctx = Kerberos::Krb5::Context.new
+      ctx.close
+      expect { described_class.new(context: ctx) }.to raise_error(Kerberos::Krb5::Exception)
     end
   end
 
   describe '#close' do
     it 'responds to close' do
-      expect(described_class.new(princ)).to respond_to(:close)
+      expect(described_class.new(principal: princ)).to respond_to(:close)
     end
 
     it 'does not delete credentials cache' do
-      c = described_class.new(princ)
+      c = described_class.new(principal: princ)
       expect { c.close }.not_to raise_error
       expect(cache_found?).to be true
     end
 
     it 'can be called multiple times without error' do
-      c = described_class.new(princ)
+      c = described_class.new(principal: princ)
       expect { 3.times { c.close } }.not_to raise_error
     end
 
     it 'raises error when calling method on closed object' do
-      c = described_class.new(princ)
+      c = described_class.new(principal: princ)
       c.close
       expect { c.default_name }.to raise_error(Kerberos::Krb5::Exception)
     end
@@ -80,20 +111,20 @@ RSpec.describe Kerberos::Krb5::CredentialsCache do
 
   describe '#default_name' do
     it 'responds to default_name' do
-      c = described_class.new(princ)
+      c = described_class.new(principal: princ)
       expect(c).to respond_to(:default_name)
       expect { c.default_name }.not_to raise_error
     end
 
     it 'returns a string' do
-      c = described_class.new(princ)
+      c = described_class.new(principal: princ)
       expect(c.default_name).to be_a(String)
     end
   end
 
   describe '#cache_name and #cache_type' do
     it 'returns the ccache name and type' do
-      c = described_class.new(princ)
+      c = described_class.new(principal: princ)
       expect(c).to respond_to(:cache_name)
       expect(c).to respond_to(:cache_type)
 
@@ -108,7 +139,7 @@ RSpec.describe Kerberos::Krb5::CredentialsCache do
 
   describe '#principal' do
     it 'is an alias for primary_principal' do
-      c = described_class.new(princ)
+      c = described_class.new(principal: princ)
       expect(c).to respond_to(:principal)
       expect(c.principal).to eq(c.primary_principal)
     end
@@ -116,13 +147,13 @@ RSpec.describe Kerberos::Krb5::CredentialsCache do
 
   describe '#primary_principal' do
     it 'responds to primary_principal' do
-      c = described_class.new(princ)
+      c = described_class.new(principal: princ)
       expect(c).to respond_to(:primary_principal)
       expect { c.primary_principal }.not_to raise_error
     end
 
     it 'returns expected results' do
-      c = described_class.new(princ)
+      c = described_class.new(principal: princ)
       expect(c.primary_principal).to be_a(String)
       expect(c.primary_principal.size).to be > 0
       expect(c.primary_principal).to include('@')
@@ -131,18 +162,18 @@ RSpec.describe Kerberos::Krb5::CredentialsCache do
 
   describe '#destroy' do
     it 'responds to destroy' do
-      c = described_class.new(princ)
+      c = described_class.new(principal: princ)
       expect(c).to respond_to(:destroy)
     end
 
     it 'deletes credentials cache' do
-      c = described_class.new(princ)
+      c = described_class.new(principal: princ)
       expect { c.destroy }.not_to raise_error
       expect(cache_found?).to be false
     end
 
     it 'delete is an alias for destroy' do
-      c = described_class.new(princ)
+      c = described_class.new(principal: princ)
       expect(c).to respond_to(:delete)
       expect(c.method(:delete)).to eq(c.method(:destroy))
     end
@@ -153,20 +184,20 @@ RSpec.describe Kerberos::Krb5::CredentialsCache do
     end
 
     it 'raises error when calling method on destroyed object' do
-      c = described_class.new(princ)
+      c = described_class.new(principal: princ)
       c.destroy
       expect { c.default_name }.to raise_error(Kerberos::Krb5::Exception)
     end
 
     it 'does not accept arguments' do
-      c = described_class.new(princ)
+      c = described_class.new(principal: princ)
       expect { c.destroy(true) }.to raise_error(ArgumentError)
     end
   end
 
   describe '#dup' do
     it 'returns a new cache object with the same properties' do
-      c = described_class.new(princ)
+      c = described_class.new(principal: princ)
       c2 = c.dup
       expect(c2).to be_a(described_class)
       expect(c2.default_name).to eq(c.default_name)
@@ -174,23 +205,45 @@ RSpec.describe Kerberos::Krb5::CredentialsCache do
     end
 
     it 'closing original does not affect duplicate' do
-      c = described_class.new(princ)
+      c = described_class.new(principal: princ)
       c2 = c.dup
       c.close
       expect { c2.default_name }.not_to raise_error
     end
 
     it 'closing duplicate does not affect original' do
-      c = described_class.new(princ)
+      c = described_class.new(principal: princ)
       c2 = c.dup
       c2.close
       expect { c.default_name }.not_to raise_error
     end
 
     it 'raises when duping closed cache' do
-      c = described_class.new(princ)
+      c = described_class.new(principal: princ)
       c.close
       expect { c.dup }.to raise_error(Kerberos::Krb5::Exception)
     end
   end
+
+  describe '#full_name' do
+    it 'returns a string including the type prefix' do
+      cc = described_class.new(principal: princ)
+      name = cc.full_name
+      expect(name).to be_a(String)
+      expect(name).to match(/\A\w+:/)
+      cc.close
+    end
+
+    it 'includes FILE: for a file-based cache' do
+      cc = described_class.new(principal: princ, cache_name: cfile)
+      expect(cc.full_name).to start_with('FILE:')
+      cc.close
+    end
+
+    it 'raises when the context is closed' do
+      cc = described_class.new(principal: princ)
+      cc.close
+      expect { cc.full_name }.to raise_error(Kerberos::Krb5::Exception)
+    end
+  end
 end

data/spec/kadm5_spec.rb

@@ -3,6 +3,7 @@
 
 require 'spec_helper'
 require 'socket'
+require 'fileutils'
 
 RSpec.describe 'Kerberos::Kadm5', :kadm5 do
   let(:server){ Kerberos::Kadm5::Config.new.admin_server }
@@ -27,37 +28,128 @@ RSpec.describe 'Kerberos::Kadm5', :kadm5 do
     it 'responds to .new' do
       expect(subject).to respond_to(:new)
     end
+
     it 'works with valid user and password' do
       expect { subject.new(principal: user, password: pass) }.not_to raise_error
     end
+
     it 'works with valid service' do
       expect {
         subject.new(principal: user, password: pass, service: 'kadmin/admin')
       }.not_to raise_error
     end
-    it 'only accepts a hash argument' do
-      expect { subject.new(user) }.to raise_error(TypeError)
-      expect { subject.new(1) }.to raise_error(TypeError)
+
+    it 'accepts only keyword arguments' do
+      expect { subject.new({principal: user, password: pass}) }.to raise_error(ArgumentError)
+      expect { subject.new(user) }.to raise_error(ArgumentError)
+      expect { subject.new(unknown: true) }.to raise_error(ArgumentError, /unknown keyword/)
     end
+
     it 'accepts a block and yields itself' do
       expect { subject.new(principal: user, password: pass) {} }.not_to raise_error
       subject.new(principal: user, password: pass) { |kadm5| expect(kadm5).to be_a(subject) }
     end
+
     it 'requires principal to be specified' do
-      expect { subject.new({}) }.to raise_error(ArgumentError)
+      expect { subject.new }.to raise_error(ArgumentError)
     end
+
     it 'requires principal to be a string' do
-      expect { subject.new(principal: 1) }.to raise_error(TypeError)
+      expect { subject.new(principal: 1, password: pass) }.to raise_error(TypeError)
     end
+
     it 'requires password to be a string' do
       expect { subject.new(principal: user, password: 1) }.to raise_error(TypeError)
     end
+
     it 'requires keytab to be a string or boolean' do
       expect { subject.new(principal: user, keytab: 1) }.to raise_error(TypeError)
     end
+
     it 'requires service to be a string' do
       expect { subject.new(principal: user, password: pass, service: 1) }.to raise_error(TypeError)
     end
+
+    it 'accepts a context keyword argument' do
+      ctx = Kerberos::Krb5::Context.new
+      expect { subject.new(principal: user, password: pass, context: ctx) }.not_to raise_error
+    end
+
+    it 'raises TypeError for non-Context context argument' do
+      expect { subject.new(principal: user, password: pass, context: "bad") }.to raise_error(TypeError)
+    end
+
+    it 'raises error for a closed context' do
+      ctx = Kerberos::Krb5::Context.new
+      ctx.close
+      expect { subject.new(principal: user, password: pass, context: ctx) }.to raise_error(Kerberos::Krb5::Exception)
+    end
+
+    context 'with a credentials cache', :cache do
+      let(:krb5) { Kerberos::Krb5.new }
+      let(:cache_path) { "/tmp/test_kadm5_ccache_#{Process.pid}" }
+      let(:cache_name) { "FILE:#{cache_path}" }
+      let(:cache) { Kerberos::Krb5::CredentialsCache.new(cache_name: cache_name) }
+
+      before(:each) do
+        krb5.get_init_creds_password(
+          principal: user,
+          password: pass,
+          service: 'kadmin/admin',
+          ccache: cache
+        )
+      end
+
+      after(:each) do
+        cache.close rescue nil
+        krb5.close rescue nil
+        FileUtils.rm_f([cache_path, "#{cache_path}.lock"])
+      end
+
+      it 'works with a populated credentials cache' do
+        expect { subject.new(principal: user, ccache: cache) }.not_to raise_error
+      end
+
+      it 'returns a Kadm5 object' do
+        kadm5 = subject.new(principal: user, ccache: cache)
+        expect(kadm5).to be_a(subject)
+        kadm5.close
+      end
+
+      it 'can perform operations after ccache authentication' do
+        kadm5 = subject.new(principal: user, ccache: cache)
+        privs = kadm5.get_privileges
+        expect(privs).to be_a(Integer)
+        expect(privs).not_to eq(0)
+        kadm5.close
+      end
+
+      it 'raises TypeError if ccache is not a CredentialsCache' do
+        expect {
+          subject.new(principal: user, ccache: "not_a_ccache")
+        }.to raise_error(TypeError)
+      end
+
+      it 'raises an error for a destroyed credentials cache' do
+        dead_ccache = Kerberos::Krb5::CredentialsCache.new
+        dead_ccache.destroy
+        expect {
+          subject.new(principal: user, ccache: dead_ccache)
+        }.to raise_error(Kerberos::Krb5::Exception)
+      end
+
+      it 'raises ArgumentError when both password and ccache are given' do
+        expect {
+          subject.new(principal: user, password: pass, ccache: cache)
+        }.to raise_error(ArgumentError)
+      end
+
+      it 'raises ArgumentError when both keytab and ccache are given' do
+        expect {
+          subject.new(principal: user, keytab: true, ccache: cache)
+        }.to raise_error(ArgumentError)
+      end
+    end
   end
 
   describe '#get_privileges' do
@@ -100,4 +192,185 @@ RSpec.describe 'Kerberos::Kadm5', :kadm5 do
       expect(result).to include('GET')
     end
   end
+
+  describe '#create_policy' do
+    before(:each) do
+      @kadm5 = subject.new(principal: user, password: pass)
+      @policy_name = "keyword_policy_#{Process.pid}"
+    end
+
+    after(:each) do
+      @kadm5.delete_policy(@policy_name) rescue nil
+      @kadm5.close
+    end
+
+    it 'accepts policy attributes as keywords' do
+      expect {
+        @kadm5.create_policy(name: @policy_name, min_length: 8)
+      }.not_to raise_error
+      expect(@kadm5.get_policy(@policy_name).min_length).to eq(8)
+    end
+
+    it 'accepts a Policy object positionally' do
+      policy = Kerberos::Kadm5::Policy.new(name: @policy_name, min_length: 9)
+      expect { @kadm5.create_policy(policy) }.not_to raise_error
+      expect(@kadm5.get_policy(@policy_name).min_length).to eq(9)
+    end
+
+    it 'rejects positional option hashes and unknown keywords' do
+      expect { @kadm5.create_policy({name: @policy_name}) }.to raise_error(TypeError)
+      expect {
+        @kadm5.create_policy(name: @policy_name, unknown: true)
+      }.to raise_error(ArgumentError, /unknown keyword/)
+    end
+  end
+
+  describe '#create_principal' do
+    before(:each) do
+      @kadm5 = subject.new(principal: user, password: pass)
+      @realm = Kerberos::Kadm5::Config.new.realm
+      @created = []
+    end
+
+    after(:each) do
+      @created.each do |name|
+        @kadm5.delete_principal(name) rescue nil
+      end
+      @kadm5.close
+    end
+
+    it 'creates a principal with name: and password:' do
+      pname = "create_test1@#{@realm}"
+      @kadm5.create_principal(name: pname, password: 'Test1234!')
+      @created << pname
+      p = @kadm5.find_principal(pname)
+      expect(p).to be_a(Kerberos::Krb5::Principal)
+      expect(p.principal).to eq(pname)
+    end
+
+    it 'returns self for chaining' do
+      pname = "create_test2@#{@realm}"
+      result = @kadm5.create_principal(name: pname, password: 'Test1234!')
+      @created << pname
+      expect(result).to equal(@kadm5)
+    end
+
+    it 'accepts a nil db_args option' do
+      pname = "create_test3@#{@realm}"
+      expect {
+        @kadm5.create_principal(name: pname, password: 'Test1234!', db_args: nil)
+      }.not_to raise_error
+      @created << pname
+    end
+
+    it 'raises ArgumentError when password: is missing' do
+      expect {
+        @kadm5.create_principal(name: "create_nopass@#{@realm}")
+      }.to raise_error(ArgumentError)
+    end
+
+    it 'raises ArgumentError when neither name: nor principal: is given' do
+      expect {
+        @kadm5.create_principal(password: 'Test1234!')
+      }.to raise_error(ArgumentError)
+    end
+
+    it 'raises ArgumentError with no arguments' do
+      expect {
+        @kadm5.create_principal
+      }.to raise_error(ArgumentError)
+    end
+
+    it 'rejects positional arguments and unknown keywords' do
+      expect {
+        @kadm5.create_principal("positional@#{@realm}", 'Test1234!')
+      }.to raise_error(ArgumentError)
+      expect {
+        @kadm5.create_principal(name: "unknown_kw@#{@realm}", password: 'Test1234!', unknown: true)
+      }.to raise_error(ArgumentError, /unknown keyword/)
+    end
+
+    it 'raises ArgumentError when both name: and principal: are given' do
+      p = Kerberos::Krb5::Principal.new(name: "create_both@#{@realm}")
+      expect {
+        @kadm5.create_principal(name: "create_both@#{@realm}", principal: p, password: 'Test1234!')
+      }.to raise_error(ArgumentError)
+    end
+
+    it 'raises an error for a duplicate principal' do
+      pname = "create_dup@#{@realm}"
+      @kadm5.create_principal(name: pname, password: 'Test1234!')
+      @created << pname
+      expect {
+        @kadm5.create_principal(name: pname, password: 'Test1234!')
+      }.to raise_error(Kerberos::Kadm5::Exception)
+    end
+
+    context 'with a Principal object' do
+      it 'creates a principal from a Principal object' do
+        pname = "create_obj1@#{@realm}"
+        p = Kerberos::Krb5::Principal.new(name: pname)
+        @kadm5.create_principal(principal: p, password: 'Test1234!')
+        @created << pname
+        found = @kadm5.find_principal(pname)
+        expect(found).to be_a(Kerberos::Krb5::Principal)
+        expect(found.principal).to eq(pname)
+      end
+
+      it 'raises TypeError if principal: is not a Principal object' do
+        expect {
+          @kadm5.create_principal(principal: "notaobj", password: 'Test1234!')
+        }.to raise_error(TypeError)
+      end
+
+      it 'raises ArgumentError if the principal has no name' do
+        p = Kerberos::Krb5::Principal.new
+        expect {
+          @kadm5.create_principal(principal: p, password: 'Test1234!')
+        }.to raise_error(ArgumentError)
+      end
+
+      it 'forwards the policy attribute' do
+        pname = "create_pol@#{@realm}"
+        p = Kerberos::Krb5::Principal.new(name: pname)
+        p.policy = 'strict_policy'
+        @kadm5.create_principal(principal: p, password: 'Changeme1!')
+        @created << pname
+        found = @kadm5.find_principal(pname)
+        expect(found.policy).to eq('strict_policy')
+      end
+
+      it 'forwards expire_time' do
+        pname = "create_exp@#{@realm}"
+        p = Kerberos::Krb5::Principal.new(name: pname)
+        future = Time.now + 86400 * 365
+        p.expire_time = future
+        @kadm5.create_principal(principal: p, password: 'Test1234!')
+        @created << pname
+        found = @kadm5.find_principal(pname)
+        # Allow a small delta for timestamp rounding
+        expect(found.expire_time.to_i).to be_within(1).of(future.to_i)
+      end
+
+      it 'forwards max_life' do
+        pname = "create_maxlife@#{@realm}"
+        p = Kerberos::Krb5::Principal.new(name: pname)
+        p.max_life = 7200
+        @kadm5.create_principal(principal: p, password: 'Test1234!')
+        @created << pname
+        found = @kadm5.find_principal(pname)
+        expect(found.max_life).to eq(7200)
+      end
+
+      it 'forwards max_renewable_life' do
+        pname = "create_maxrenew@#{@realm}"
+        p = Kerberos::Krb5::Principal.new(name: pname)
+        p.max_renewable_life = 14400
+        @kadm5.create_principal(principal: p, password: 'Test1234!')
+        @created << pname
+        found = @kadm5.find_principal(pname)
+        expect(found.max_renewable_life).to eq(14400)
+      end
+    end
+  end
 end