rkerberos 0.3.0 → 0.3.1

data/ext/rkerberos/keytab.c

@@ -20,6 +20,8 @@ void rkrb5_keytab_typed_free(void *ptr) {
     krb5_free_cred_contents(kt->ctx, &kt->creds);
   if (kt->ctx && kt->rb_context == Qnil)
     krb5_free_context(kt->ctx);
+  else if (kt->rb_context != Qnil)
+    rkrb5_context_release(kt->rb_context);
   free(kt);
 }
 
@@ -54,7 +56,7 @@ typedef struct {
 static VALUE rkrb5_keytab_each_body(VALUE arg){
   keytab_each_arg* ea = (keytab_each_arg*)arg;
   krb5_keytab_entry entry;
-  krb5_error_code kerror;
+  krb5_error_code kerror, iteration_error;
   char* principal;
   VALUE v_kt_entry;
 
@@ -79,9 +81,13 @@ static VALUE rkrb5_keytab_each_body(VALUE arg){
     rb_yield(v_kt_entry);
   }
 
-  ea->cursor_active = 0;
+  iteration_error = kerror;
 
   kerror = krb5_kt_end_seq_get(ea->ctx, ea->keytab, &ea->cursor);
+  ea->cursor_active = 0;
+
+  if(iteration_error != KRB5_KT_END)
+    rb_raise(cKrb5Exception, "krb5_kt_next_entry: %s", error_message(iteration_error));
 
   if(kerror)
     rb_raise(cKrb5Exception, "krb5_kt_end_seq_get: %s", error_message(kerror));
@@ -114,6 +120,9 @@ static VALUE rkrb5_keytab_each(VALUE self){
 
   TypedData_Get_Struct(self, RUBY_KRB5_KEYTAB, &rkrb5_keytab_data_type, ptr);
 
+  if(!ptr->ctx || !ptr->keytab)
+    rb_raise(cKrb5Exception, "keytab is closed");
+
   ea.ctx = ptr->ctx;
   ea.keytab = ptr->keytab;
 
@@ -144,6 +153,9 @@ static VALUE rkrb5_keytab_default_name(VALUE self){
 
   TypedData_Get_Struct(self, RUBY_KRB5_KEYTAB, &rkrb5_keytab_data_type, ptr);
 
+  if(!ptr->ctx)
+    rb_raise(cKrb5Exception, "no context has been established");
+
   kerror = krb5_kt_default_name(ptr->ctx, default_name, MAX_KEYTAB_NAME_LEN);
 
   if(kerror)
@@ -177,6 +189,8 @@ static VALUE rkrb5_keytab_close(VALUE self){
 
   if(ptr->ctx && ptr->rb_context == Qnil)
     krb5_free_context(ptr->ctx);
+  else if(ptr->rb_context != Qnil)
+    rkrb5_context_release(ptr->rb_context);
 
   ptr->ctx = NULL;
   ptr->rb_context = Qnil;
@@ -233,13 +247,14 @@ static VALUE rkrb5_keytab_add_entry(int argc, VALUE* argv, VALUE self){
 
   memset(&entry, 0, sizeof(entry));
 
+  entry.vno = NIL_P(v_vno) ? 1 : NUM2INT(v_vno);
+  entry.key.enctype = NIL_P(v_enctype) ? ENCTYPE_AES256_CTS_HMAC_SHA1_96 : NUM2INT(v_enctype);
+
   kerror = krb5_parse_name(ptr->ctx, StringValueCStr(v_principal), &entry.principal);
 
   if(kerror)
     rb_raise(cKrb5Exception, "krb5_parse_name: %s", error_message(kerror));
 
-  entry.vno = NIL_P(v_vno) ? 1 : NUM2INT(v_vno);
-  entry.key.enctype = NIL_P(v_enctype) ? ENCTYPE_AES256_CTS_HMAC_SHA1_96 : NUM2INT(v_enctype);
   entry.timestamp = time(NULL);
 
   // Derive the salt from the principal
@@ -323,14 +338,14 @@ static VALUE rkrb5_keytab_remove_entry(int argc, VALUE* argv, VALUE self){
 
   Check_Type(v_principal, T_STRING);
 
+  match_vno = NIL_P(v_vno) ? 0 : NUM2INT(v_vno);
+  match_enctype = NIL_P(v_enctype) ? 0 : NUM2INT(v_enctype);
+
   kerror = krb5_parse_name(ptr->ctx, StringValueCStr(v_principal), &match_princ);
 
   if(kerror)
     rb_raise(cKrb5Exception, "krb5_parse_name: %s", error_message(kerror));
 
-  match_vno = NIL_P(v_vno) ? 0 : NUM2INT(v_vno);
-  match_enctype = NIL_P(v_enctype) ? 0 : NUM2INT(v_enctype);
-
   // Retrieve the full entry via krb5_kt_get_entry and then pass the
   // complete struct to krb5_kt_remove_entry so all fields match exactly.
   // Loop to remove every matching entry when vno/enctype are wildcards.
@@ -383,26 +398,22 @@ static VALUE rkrb5_keytab_get_entry(int argc, VALUE* argv, VALUE self){
 
   TypedData_Get_Struct(self, RUBY_KRB5_KEYTAB, &rkrb5_keytab_data_type, ptr);
 
+  if(!ptr->ctx || !ptr->keytab)
+    rb_raise(cKrb5Exception, "keytab is closed");
+
   rb_scan_args(argc, argv, "12", &v_principal, &v_vno, &v_enctype);
 
   Check_Type(v_principal, T_STRING);
   name = StringValueCStr(v_principal);
 
+  vno = NIL_P(v_vno) ? 0 : NUM2INT(v_vno);
+  enctype = NIL_P(v_enctype) ? 0 : NUM2INT(v_enctype);
+
   kerror = krb5_parse_name(ptr->ctx, name, &principal);
 
   if(kerror)
     rb_raise(cKrb5Exception, "krb5_parse_name: %s", error_message(kerror));
 
-  if(NIL_P(v_vno))
-    vno = 0;
-  else
-    vno = NUM2INT(v_vno);
-
-  if(NIL_P(v_enctype))
-    enctype = 0;
-  else
-    enctype = NUM2INT(v_enctype);
-
   kerror = krb5_kt_get_entry(
     ptr->ctx,
     ptr->keytab,
@@ -566,17 +577,7 @@ static VALUE rkrb5_keytab_initialize(int argc, VALUE* argv, VALUE self){
 
   // Initialize or borrow the context
   if(!NIL_P(v_context)){
-    RUBY_KRB5_CONTEXT* ctx_ptr;
-
-    if(!rb_obj_is_kind_of(v_context, cKrb5Context))
-      rb_raise(rb_eTypeError, "context must be a Kerberos::Krb5::Context object");
-
-    TypedData_Get_Struct(v_context, RUBY_KRB5_CONTEXT, &rkrb5_context_data_type, ctx_ptr);
-
-    if(!ctx_ptr->ctx)
-      rb_raise(cKrb5Exception, "context is closed");
-
-    ptr->ctx = ctx_ptr->ctx;
+    ptr->ctx = rkrb5_context_borrow(v_context);
     ptr->rb_context = v_context;
   }
   else{
@@ -629,7 +630,7 @@ typedef struct {
 static VALUE rkrb5_s_keytab_foreach_body(VALUE arg){
   keytab_foreach_arg* fa = (keytab_foreach_arg*)arg;
   krb5_keytab_entry entry;
-  krb5_error_code kerror;
+  krb5_error_code kerror, iteration_error;
   char* principal;
   VALUE v_kt_entry;
 
@@ -654,9 +655,13 @@ static VALUE rkrb5_s_keytab_foreach_body(VALUE arg){
     rb_yield(v_kt_entry);
   }
 
-  fa->cursor_active = 0;
+  iteration_error = kerror;
 
   kerror = krb5_kt_end_seq_get(fa->ctx, fa->keytab, &fa->cursor);
+  fa->cursor_active = 0;
+
+  if(iteration_error != KRB5_KT_END)
+    rb_raise(cKrb5Exception, "krb5_kt_next_entry: %s", error_message(iteration_error));
 
   if(kerror)
     rb_raise(cKrb5Exception, "krb5_kt_end_seq_get: %s", error_message(kerror));

data/ext/rkerberos/principal.c

@@ -18,6 +18,8 @@ static void rkrb5_princ_typed_free(void *ptr) {
     krb5_free_principal(p->ctx, p->principal);
   if (p->ctx && p->rb_context == Qnil)
     krb5_free_context(p->ctx);
+  else if (p->rb_context != Qnil)
+    rkrb5_context_release(p->rb_context);
   free(p);
 }
 
@@ -86,17 +88,7 @@ static VALUE rkrb5_princ_initialize(int argc, VALUE* argv, VALUE self){
 
   // Initialize or borrow the context
   if(!NIL_P(v_context)){
-    RUBY_KRB5_CONTEXT* ctx_ptr;
-
-    if(!rb_obj_is_kind_of(v_context, cKrb5Context))
-      rb_raise(rb_eTypeError, "context must be a Kerberos::Krb5::Context object");
-
-    TypedData_Get_Struct(v_context, RUBY_KRB5_CONTEXT, &rkrb5_context_data_type, ctx_ptr);
-
-    if(!ctx_ptr->ctx)
-      rb_raise(cKrb5Exception, "context is closed");
-
-    ptr->ctx = ctx_ptr->ctx;
+    ptr->ctx = rkrb5_context_borrow(v_context);
     ptr->rb_context = v_context;
   }
   else{
@@ -145,6 +137,36 @@ static VALUE rkrb5_princ_initialize(int argc, VALUE* argv, VALUE self){
   return self;
 }
 
+/*
+ * call-seq:
+ *   principal.close
+ *
+ * Releases the principal and its Kerberos context lease. Once closed, the
+ * principal cannot be reused.
+ */
+static VALUE rkrb5_princ_close(VALUE self){
+  RUBY_KRB5_PRINC* ptr;
+
+  TypedData_Get_Struct(self, RUBY_KRB5_PRINC, &rkrb5_princ_data_type, ptr);
+
+  if(!ptr->ctx)
+    return self;
+
+  if(ptr->principal)
+    krb5_free_principal(ptr->ctx, ptr->principal);
+
+  if(ptr->rb_context == Qnil)
+    krb5_free_context(ptr->ctx);
+  else
+    rkrb5_context_release(ptr->rb_context);
+
+  ptr->ctx = NULL;
+  ptr->principal = NULL;
+  ptr->rb_context = Qnil;
+
+  return self;
+}
+
 /*
  * call-seq:
  *   principal.realm
@@ -153,13 +175,16 @@ static VALUE rkrb5_princ_initialize(int argc, VALUE* argv, VALUE self){
  */
 static VALUE rkrb5_princ_get_realm(VALUE self){
   RUBY_KRB5_PRINC* ptr;
+  krb5_data* realm;
 
   TypedData_Get_Struct(self, RUBY_KRB5_PRINC, &rkrb5_princ_data_type, ptr);
 
   if(!ptr->principal)
     rb_raise(cKrb5Exception, "no principal has been established");
 
-  return rb_str_new2(krb5_princ_realm(ptr->ctx, ptr->principal)->data);
+  realm = krb5_princ_realm(ptr->ctx, ptr->principal);
+
+  return rb_str_new(realm->data, realm->length);
 }
 
 /*
@@ -195,6 +220,10 @@ static VALUE rkrb5_princ_equal(VALUE self, VALUE v_other){
   VALUE v_bool = Qfalse;
 
   TypedData_Get_Struct(self, RUBY_KRB5_PRINC, &rkrb5_princ_data_type, ptr1);
+
+  if(!rb_obj_is_kind_of(v_other, cKrb5Principal))
+    return Qfalse;
+
   TypedData_Get_Struct(v_other, RUBY_KRB5_PRINC, &rkrb5_princ_data_type, ptr2);
 
   if(!ptr1->principal || !ptr2->principal)
@@ -349,6 +378,7 @@ void Init_principal(void){
   rb_define_method(cKrb5Principal, "==", rkrb5_princ_equal, 1);
   rb_define_method(cKrb5Principal, "principal_type", rkrb5_princ_get_type, 0);
   rb_define_method(cKrb5Principal, "components", rkrb5_princ_components, 0);
+  rb_define_method(cKrb5Principal, "close", rkrb5_princ_close, 0);
 
   // Attributes
 

data/ext/rkerberos/rkerberos.c

@@ -43,6 +43,8 @@ static void rkrb5_typed_free(void *ptr) {
     krb5_free_principal(r->ctx, r->princ);
   if (r->ctx && r->rb_context == Qnil)
     krb5_free_context(r->ctx);
+  else if (r->rb_context != Qnil)
+    rkrb5_context_release(r->rb_context);
   free(r);
 }
 
@@ -74,8 +76,8 @@ static VALUE rkrb5_allocate(VALUE klass){
  * If a +context+ keyword argument is provided, it must be a
  * Kerberos::Krb5::Context object. The context will be borrowed rather than
  * creating a new one internally via krb5_init_context. The caller is
- * responsible for keeping the Context object alive for the lifetime of
- * this Krb5 instance.
+ * retained for the lifetime of this Krb5 instance. The Context cannot be
+ * closed normally until this object has been closed.
  *
  * A block form is also supported. If a block is given, the object is
  * yielded to the block and automatically closed when the block returns.
@@ -98,17 +100,7 @@ static VALUE rkrb5_initialize(int argc, VALUE* argv, VALUE self){
   v_context = kw_vals[0] == Qundef ? Qnil : kw_vals[0];
 
   if(!NIL_P(v_context)){
-    RUBY_KRB5_CONTEXT* ctx_ptr;
-
-    if(!rb_obj_is_kind_of(v_context, cKrb5Context))
-      rb_raise(rb_eTypeError, "context must be a Kerberos::Krb5::Context object");
-
-    TypedData_Get_Struct(v_context, RUBY_KRB5_CONTEXT, &rkrb5_context_data_type, ctx_ptr);
-
-    if(!ctx_ptr->ctx)
-      rb_raise(cKrb5Exception, "context is closed");
-
-    ptr->ctx = ctx_ptr->ctx;
+    ptr->ctx = rkrb5_context_borrow(v_context);
     ptr->rb_context = v_context;
   }
   else{
@@ -139,6 +131,9 @@ static VALUE rkrb5_get_default_realm(VALUE self){
 
   TypedData_Get_Struct(self, RUBY_KRB5, &rkrb5_data_type, ptr);
 
+  if(!ptr->ctx)
+    rb_raise(cKrb5Exception, "no context has been established");
+
   kerror = krb5_get_default_realm(ptr->ctx, &realm);
 
   if(kerror)
@@ -165,6 +160,9 @@ static VALUE rkrb5_set_default_realm(int argc, VALUE* argv, VALUE self){
 
   TypedData_Get_Struct(self, RUBY_KRB5, &rkrb5_data_type, ptr);
 
+  if(!ptr->ctx)
+    rb_raise(cKrb5Exception, "no context has been established");
+
   rb_scan_args(argc, argv, "01", &v_realm);
 
   if(NIL_P(v_realm)){
@@ -317,6 +315,11 @@ static VALUE rkrb5_get_init_creds_keytab(int argc, VALUE* argv, VALUE self){
     RUBY_KRB5_CCACHE* ccptr;
     TypedData_Get_Struct(v_ccache, RUBY_KRB5_CCACHE, &rkrb5_ccache_data_type, ccptr);
 
+    if(!ccptr->ctx || !ccptr->ccache){
+      krb5_get_init_creds_opt_free(ptr->ctx, opt);
+      rb_raise(cKrb5Exception, "credentials cache is closed or destroyed");
+    }
+
     kerror = krb5_get_init_creds_opt_set_out_ccache(ptr->ctx, opt, ccptr->ccache);
     if(kerror) {
       krb5_get_init_creds_opt_free(ptr->ctx, opt);
@@ -384,6 +387,9 @@ static VALUE rkrb5_change_password(VALUE self, VALUE v_old, VALUE v_new){
   if(!ptr->princ)
     rb_raise(cKrb5Exception, "no principal has been established");
 
+  memset(&result_string, 0, sizeof(result_string));
+  memset(&pw_result_string, 0, sizeof(pw_result_string));
+
   krb5_free_cred_contents(ptr->ctx, &ptr->creds);
   memset(&ptr->creds, 0, sizeof(ptr->creds));
 
@@ -505,6 +511,9 @@ static VALUE rkrb5_get_init_creds_passwd(int argc, VALUE* argv, VALUE self){
     RUBY_KRB5_CCACHE* ccptr;
     TypedData_Get_Struct(v_ccache, RUBY_KRB5_CCACHE, &rkrb5_ccache_data_type, ccptr);
 
+    if(!ccptr->ctx || !ccptr->ccache)
+      rb_raise(cKrb5Exception, "credentials cache is closed or destroyed");
+
     kerror = krb5_get_init_creds_opt_alloc(ptr->ctx, &opt);
     if(kerror)
       rb_raise(cKrb5Exception, "krb5_get_init_creds_opt_alloc: %s", error_message(kerror));
@@ -618,14 +627,7 @@ static VALUE rkrb5_authenticate_bang(int argc, VALUE* argv, VALUE self){
   if(kerror)
     rb_raise(cKrb5Exception, "krb5_get_init_creds_password: %s", error_message(kerror));
 
-  /*
-   * Try strict verification first (AP-REQ nofail). If strict verification
-   * cannot be performed (e.g. missing keytab or other environment issue),
-   * fall back to the standard verification so authenticate! remains useful
-   * in minimal test environments.
-   */
   krb5_verify_init_creds_opt vicopt;
-  krb5_error_code kerror_strict = 0;
 
   krb5_verify_init_creds_opt_init(&vicopt);
   krb5_verify_init_creds_opt_set_ap_req_nofail(&vicopt, TRUE);
@@ -638,19 +640,12 @@ static VALUE rkrb5_authenticate_bang(int argc, VALUE* argv, VALUE self){
       rb_raise(cKrb5Exception, "krb5_parse_name(service): %s", error_message(kerror));
   }
 
-  // First, attempt strict verification
   kerror = krb5_verify_init_creds(ptr->ctx, &ptr->creds, server_princ, NULL, NULL, &vicopt);
 
   if(kerror){
-    /* strict verification failed — try a best-effort standard verify */
-    kerror_strict = kerror;
-    kerror = krb5_verify_init_creds(ptr->ctx, &ptr->creds, server_princ, NULL, NULL, NULL);
-    if(kerror){
-      if(server_princ)
-        krb5_free_principal(ptr->ctx, server_princ);
-      /* raise the original strict-verification error to inform caller */
-      rb_raise(cKrb5Exception, "krb5_verify_init_creds: %s", error_message(kerror_strict));
-    }
+    if(server_princ)
+      krb5_free_principal(ptr->ctx, server_princ);
+    rb_raise(cKrb5Exception, "krb5_verify_init_creds: %s", error_message(kerror));
   }
 
   if(server_princ)
@@ -684,6 +679,8 @@ static VALUE rkrb5_close(VALUE self){
 
   if(ptr->ctx && ptr->rb_context == Qnil)
     krb5_free_context(ptr->ctx);
+  else if(ptr->rb_context != Qnil)
+    rkrb5_context_release(ptr->rb_context);
 
   ptr->ctx = NULL;
   ptr->princ = NULL;
@@ -848,12 +845,20 @@ static VALUE rkrb5_verify_init_creds(int argc, VALUE* argv, VALUE self){
   if(!NIL_P(v_keytab)){
     // Will raise TypeError if object isn't the expected Keytab typed data
     TypedData_Get_Struct(v_keytab, RUBY_KRB5_KEYTAB, &rkrb5_keytab_data_type, ktptr);
+
+    if(!ktptr->ctx || !ktptr->keytab)
+      rb_raise(cKrb5Exception, "keytab is closed");
+
     keytab = ktptr->keytab;
   }
 
   if(!NIL_P(v_ccache)){
     // Will raise TypeError if object isn't the expected CCache typed data
     TypedData_Get_Struct(v_ccache, RUBY_KRB5_CCACHE, &rkrb5_ccache_data_type, ccptr);
+
+    if(!ccptr->ctx || !ccptr->ccache)
+      rb_raise(cKrb5Exception, "credentials cache is closed or destroyed");
+
     ccache_ptr = &ccptr->ccache;
   }
 
@@ -861,6 +866,22 @@ static VALUE rkrb5_verify_init_creds(int argc, VALUE* argv, VALUE self){
   if(ptr->creds.client == NULL)
     rb_raise(cKrb5Exception, "no credentials have been acquired");
 
+  /* A resolved FILE cache may not exist on disk yet. Create it before
+     krb5_verify_init_creds attempts to store any credentials it fetches. */
+  if(ccache_ptr && *ccache_ptr){
+    krb5_principal cache_princ = NULL;
+
+    kerror = krb5_cc_get_principal(ptr->ctx, *ccache_ptr, &cache_princ);
+
+    if(kerror == KRB5_CC_NOTFOUND || kerror == KRB5_FCC_NOFILE)
+      kerror = krb5_cc_initialize(ptr->ctx, *ccache_ptr, ptr->creds.client);
+    else if(!kerror)
+      krb5_free_principal(ptr->ctx, cache_princ);
+
+    if(kerror)
+      rb_raise(cKrb5Exception, "credentials cache setup: %s", error_message(kerror));
+  }
+
   // Optional server principal (parse after context & arg validation)
   if(!NIL_P(v_server)){
     kerror = krb5_parse_name(ptr->ctx, StringValueCStr(v_server), &server_princ);
@@ -876,16 +897,11 @@ static VALUE rkrb5_verify_init_creds(int argc, VALUE* argv, VALUE self){
   if(kerror)
     rb_raise(cKrb5Exception, "krb5_verify_init_creds: %s", error_message(kerror));
 
-  /* If the caller supplied a CredentialsCache object, store the verified
-     credentials there so Ruby-level callers can inspect the cache. */
+  /* Include the initial credential in addition to any credentials fetched
+     and stored by krb5_verify_init_creds. */
   if(ccache_ptr && *ccache_ptr){
     krb5_error_code k2;
 
-    k2 = krb5_cc_initialize(ptr->ctx, *ccache_ptr, ptr->creds.client);
-
-    if(k2)
-      rb_raise(cKrb5Exception, "krb5_cc_initialize: %s", error_message(k2));
-
     k2 = krb5_cc_store_cred(ptr->ctx, *ccache_ptr, &ptr->creds);
 
     if(k2)
@@ -1009,8 +1025,8 @@ void Init_rkerberos(void){
   rb_define_alias(cKrb5, "init_creds_keytab", "get_init_creds_keytab");
   rb_define_alias(cKrb5, "permitted_enctypes", "get_permitted_enctypes");
 
-  /* 0.3.0: The version of the custom rkerberos library */
-  rb_define_const(cKrb5, "VERSION", rb_str_new2("0.3.0"));
+  /* 0.3.1: The version of the custom rkerberos library */
+  rb_define_const(cKrb5, "VERSION", rb_str_new2("0.3.1"));
 
   // Encoding type constants
 

data/ext/rkerberos/rkerberos.h

@@ -49,6 +49,10 @@ void Init_ccache();
 // Defined in rkerberos.c
 VALUE rb_hash_aref2(VALUE, VALUE);
 
+// Defined in context.c
+krb5_context rkrb5_context_borrow(VALUE);
+void rkrb5_context_release(VALUE);
+
 // Variable declarations
 extern VALUE mKerberos;
 extern VALUE cKrb5;
@@ -76,6 +80,8 @@ typedef struct {
 typedef struct {
   krb5_context ctx;
   krb5_enctype etypes;
+  size_t borrowers;
+  int closed;
 } RUBY_KRB5_CONTEXT;
 
 // Kerberos::Kadm5

data/rkerberos.gemspec

@@ -2,7 +2,7 @@ require 'rubygems'
 
 Gem::Specification.new do |spec|
   spec.name       = 'rkerberos'
-  spec.version    = '0.3.0'
+  spec.version    = '0.3.1'
   spec.authors    = ['Daniel Berger', 'Dominic Cleal', 'Simon Levermann']
   spec.license    = 'Artistic-2.0'
   spec.email      = ['djberg96@gmail.com', 'dominic@cleal.org', 'simon-rubygems@slevermann.de']

data/spec/config_spec.rb

@@ -28,6 +28,14 @@ RSpec.describe 'Kerberos::Kadm5::Config', :kadm5 do
       expect(c2.realm).to eq(c1.realm)
     end
 
+    it 'releases its context lease after copying the configuration' do
+      ctx = Kerberos::Krb5::Context.new
+      config = klass.new(context: ctx)
+
+      expect { ctx.close }.not_to raise_error
+      expect(config.realm).to be_a(String)
+    end
+
     it 'raises TypeError for non-Context context argument' do
       expect { klass.new(context: "bad") }.to raise_error(TypeError)
     end

data/spec/context_spec.rb

@@ -16,6 +16,51 @@ RSpec.describe Kerberos::Krb5::Context do
     it 'can be called multiple times without error' do
       expect { 3.times { context.close } }.not_to raise_error
     end
+
+    it 'raises while a dependent wrapper remains open' do
+      krb5 = Kerberos::Krb5.new(context: context)
+
+      expect { context.close }
+        .to raise_error(Kerberos::Krb5::Exception, /1 dependent wrapper/)
+      expect(context.default_realm).to be_a(String)
+
+      krb5.close
+      expect { context.close }.not_to raise_error
+    end
+
+    it 'tracks multiple dependent wrappers independently' do
+      first = Kerberos::Krb5.new(context: context)
+      second = Kerberos::Krb5::Principal.new(name: 'user', context: context)
+
+      expect { context.close }
+        .to raise_error(Kerberos::Krb5::Exception, /2 dependent wrappers/)
+
+      first.close
+      expect { context.close }
+        .to raise_error(Kerberos::Krb5::Exception, /1 dependent wrapper/)
+
+      second.close
+      expect { context.close }.not_to raise_error
+    end
+
+    it 'supports a forced logical close with deferred native cleanup' do
+      krb5 = Kerberos::Krb5.new(context: context)
+      realm = krb5.default_realm
+
+      expect(context.close(force: true)).to equal(context)
+      expect { context.default_realm }.to raise_error(Kerberos::Krb5::Exception)
+      expect { Kerberos::Krb5.new(context: context) }
+        .to raise_error(Kerberos::Krb5::Exception, /context is closed/)
+      expect(krb5.default_realm).to eq(realm)
+
+      expect { krb5.close }.not_to raise_error
+      expect { context.close }.not_to raise_error
+    end
+
+    it 'requires close options to be keywords and rejects unknown keywords' do
+      expect { context.close({force: true}) }.to raise_error(ArgumentError)
+      expect { context.close(unknown: true) }.to raise_error(ArgumentError, /unknown keyword/)
+    end
   end
 
   describe 'constructor options' do

data/spec/credentials_cache_spec.rb

@@ -73,6 +73,9 @@ RSpec.describe Kerberos::Krb5::CredentialsCache do
       ctx = Kerberos::Krb5::Context.new
       c = described_class.new(principal: princ, context: ctx)
       expect(c.primary_principal).to eq(princ)
+      expect { ctx.close }.to raise_error(Kerberos::Krb5::Exception, /dependent wrapper/)
+      c.close
+      expect { ctx.close }.not_to raise_error
     end
 
     it 'raises TypeError for non-Context context argument' do

data/spec/kadm5_spec.rb

@@ -66,13 +66,20 @@ RSpec.describe 'Kerberos::Kadm5', :kadm5 do
       expect { subject.new(principal: user, keytab: 1) }.to raise_error(TypeError)
     end
 
+    it 'requires a principal when using a keytab' do
+      expect { subject.new(keytab: true) }.to raise_error(ArgumentError, /principal must be specified/)
+    end
+
     it 'requires service to be a string' do
       expect { subject.new(principal: user, password: pass, service: 1) }.to raise_error(TypeError)
     end
 
     it 'accepts a context keyword argument' do
       ctx = Kerberos::Krb5::Context.new
-      expect { subject.new(principal: user, password: pass, context: ctx) }.not_to raise_error
+      kadm5 = subject.new(principal: user, password: pass, context: ctx)
+      expect { ctx.close }.to raise_error(Kerberos::Krb5::Exception, /dependent wrapper/)
+      kadm5.close
+      expect { ctx.close }.not_to raise_error
     end
 
     it 'raises TypeError for non-Context context argument' do
@@ -152,6 +159,27 @@ RSpec.describe 'Kerberos::Kadm5', :kadm5 do
     end
   end
 
+  describe '#close' do
+    it 'makes all administrative operations fail safely' do
+      kadm5 = subject.new(principal: user, password: pass)
+      kadm5.close
+      policy = Kerberos::Kadm5::Policy.new(name: 'closed_policy')
+
+      operations = [
+        -> { kadm5.get_privileges },
+        -> { kadm5.get_principals },
+        -> { kadm5.get_policies },
+        -> { kadm5.create_policy(policy) },
+        -> { kadm5.modify_policy(policy) },
+        -> { kadm5.delete_policy('closed_policy') }
+      ]
+
+      operations.each do |operation|
+        expect(&operation).to raise_error(Kerberos::Kadm5::Exception, /no administrative context/)
+      end
+    end
+  end
+
   describe '#get_privileges' do
     before(:each) do
       @kadm5 = subject.new(principal: user, password: pass)
@@ -223,6 +251,19 @@ RSpec.describe 'Kerberos::Kadm5', :kadm5 do
         @kadm5.create_policy(name: @policy_name, unknown: true)
       }.to raise_error(ArgumentError, /unknown keyword/)
     end
+
+    it 'modifies values assigned through Policy writers' do
+      @kadm5.create_policy(name: @policy_name, min_length: 8, history_num: 1)
+      policy = @kadm5.get_policy(@policy_name)
+      policy.min_length = 12
+      policy.history_num = 3
+
+      expect(@kadm5.modify_policy(policy)).to equal(@kadm5)
+
+      modified = @kadm5.get_policy(@policy_name)
+      expect(modified.min_length).to eq(12)
+      expect(modified.history_num).to eq(3)
+    end
   end
 
   describe '#create_principal' do