1 files changed, 94 insertions, 0 deletions
diff --git a/testprogs/blackbox/test_rpcclient_schannel.sh b/testprogs/blackbox/test_rpcclient_schannel.sh
new file mode 100755
index 0000000..9981d4d
--- /dev/null
+++ b/testprogs/blackbox/test_rpcclient_schannel.sh
@@ -0,0 +1,94 @@
+#!/bin/bash
+# Blackbox tests rpcclient with schannel
+# Copyright (c) 2021      Andreas Schneider <asn@samba.org>
+
+if [ $# -lt 8 ]; then
+    cat << EOF
+Usage: test_rpcclient_schannel.sh DOMAIN REALM USERNAME PASSWORD SERVER PREFIX CONFIGURATION TESTENV
+EOF
+    exit 1
+fi
+
+DOMAIN=$1
+REALM=$2
+USERNAME=$3
+PASSWORD=$4
+SERVER=$5
+PREFIX=$6
+CONFIGURATION=$7
+TESTENV=$8
+shift 8
+
+failed=0
+
+samba_subunit_dir=$(dirname "$0")
+. "${samba_subunit_dir}/subunit.sh"
+. "${samba_subunit_dir}/common_test_fns.inc"
+
+samba_bindir="${BINDIR}"
+samba_rpcclient="${samba_bindir}/rpcclient"
+
+test_rpc_getusername()
+{
+    cmd="$samba_rpcclient ncacn_np:${SERVER}[schannel] --machine-pass --configfile=${CONFIGURATION} -c getusername 2>&1"
+    out=$(eval "$cmd")
+    ret=$?
+    if [ $ret -ne 0 ]; then
+        echo "Failed to connect! Error: $ret"
+        echo "$out"
+        return 1
+    fi
+
+    echo "$out" | grep -q "Account Name: ANONYMOUS LOGON, Authority Name: NT AUTHORITY"
+    ret=$?
+    if [ $ret -ne 0 ]; then
+        echo "Incorrect account/authority name! Error: $ret"
+        echo "$out"
+        return 1
+    fi
+
+    return 0
+}
+
+test_rpc_lookupsids()
+{
+    cmd="$samba_rpcclient ncacn_ip_tcp:${SERVER}[schannel] --machine-pass --configfile=${CONFIGURATION} -c 'lookupsids3 S-1-1-0' 2>&1"
+    out=$(eval "$cmd")
+    ret=$?
+    if [ $ret -ne 0 ]; then
+        echo "Failed to connect! Error: $ret"
+        echo "$out"
+        return 1
+    fi
+
+    echo "$out" | grep -q "S-1-1-0 Everyone"
+    ret=$?
+    if [ $ret -ne 0 ]; then
+        echo "Incorrect account/authority name! Error: $ret"
+        echo "$out"
+        return 1
+    fi
+
+    return 0
+}
+
+testit "ncacn_np.getusername" \
+    test_rpc_getusername || \
+    failed=$((failed + 1))
+
+if [[ "$TESTENV" == "ad_member_fips"* ]]; then
+    unset GNUTLS_FORCE_FIPS_MODE
+
+    testit "ncacn_np.getusername.fips" \
+        test_rpc_getusername || \
+        failed=$((failed + 1))
+
+    GNUTLS_FORCE_FIPS_MODE=1
+    export GNUTLS_FORCE_FIPS_MODE
+fi
+
+testit "ncacn_ip_tcp.lookupsids" \
+    test_rpc_lookupsids || \
+    failed=$((failed + 1))
+
+exit ${failed}