redefine test 7 for init.

[krb5.git] / doc / kadm5 / api-unit-test.tex

\documentstyle[times,fullpage,rcsid]{article}

\rcs$Header$

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%% Make _ actually generate an _, and allow line-breaking after it.
\let\underscore=\_
\catcode`_=13
\def_{\underscore\penalty75\relax}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\newcommand{\test}[1]{\begin{description}
\setlength{\itemsep}{0pt}
#1
\end{description}

}

\newcommand{\numtest}[2]{\begin{description}
\setlength{\itemsep}{0pt}
\Number{#1}
#2
\end{description}

}

\newcommand{\Number}[1]{\item[Number:] #1}
\newcommand{\Reason}[1]{\item[Reason:] #1}
%\newcommand{\Call}[1]{\item[Call:] #1}
\newcommand{\Expected}[1]{\item[Expected:] #1}
\newcommand{\Conditions}[1]{\item[Conditions:] #1}
\newcommand{\Priority}[1]{\item[Priority:] #1}
\newcommand{\Status}[1]{\item[Status:] #1}
%\newcommand{\Number}[1]{}
%\newcommand{\Reason}[1]{}
\newcommand{\Call}[1]{}
%\newcommand{\Expected}[1]{}
%\newcommand{\Conditions}[1]{}
%\newcommand{\Priority}[1]{}

\title{OpenV*Secure 1.0 Admin API\\
Unit Test Description\footnote{\rcsHeader}}
\author{Jonathan I. Kamens}

\begin{document}

\maketitle

%\tableofcontents

\section{Introduction}

The following is a description of a black-box unit test of the
OpenV*Secure Admin API.  Each API function is listed, followed by the
tests that shoud be performed on it.

The tests described here are based on the ``OV*Secure Admin Functional
Specifications'' revision 1.27, dated November 17, 1993.

Since inter-realm functionality is not a requirement for OpenV*Secure
1.0, it is not tested.

All tests which test for success should verify, using some means other
than the return value of the function being tested, that the requested
operation was successfully performed.  For example: for init, test
that other operations can be performed after init; for destroy, test
that other operations can't be performed after destroy; for modify
functions, verify that all modifications to the database which should
have taken place did, and that the new, modified data is in effect;
for get operations, verify that the data retrieved is the data that
should actually be in the database.

As of now the tests are being re-worked to use database comparision routines
simular to the GUI tests.  This routines are not completly in place yet. The
purpose for using these routines is for better detection of incorrect
database modification.

Similarly, all tests which test for failure should verify that the
no component of the requested operation took place.  For example: if
init fails, other operations should not work.  If a modify fails, all
data in the database should be the same as it was before the attempt
to modify, and the old data should still be what is enforced.
Furthermore, tests which test for failure should verify that the
failure code returned is correct for the specific failure condition
tested.

Most of the tests listed below should be run twice -- once locally on
the server after linking against the server API library, and once
talking to the server via authenticated Sun RPC after linking against
the client API library.  Tests which should only be run locally or via
RPC are labelled with a ``local'' or ``RPC''.

Furthermore, in addition to the tests labelled below, a test should be
implemented to verify that a client can't perform operations on the
server through the client API library when it's linked against
standard Sun RPC instead of OpenV*Secure's authenticated Sun RPC.
This will require a client with a modified version of ovsec_kadm_init
which doesn't call auth_gssapi_create.  This client should call this
modified ovsec_kadm_init and then call some other admin API function,
specifying arguments to both functions that would work if the
authenciated Sun RPC had been used, but shouldn't if authentication
wasn't used.  The test should verify that the API function call after
the init doesn't succeed.

\section{ovsec_kadm_init}

\numtest{1}{
\Reason{An empty string realm is rejected.}
\Status{Implemented}
}

\numtest{2}{
\Reason{A realm containing invalid characters is rejected.}
\Status{Implemented}
}

\numtest{2.5}{
\Reason{A non-existent realm is rejected.}
\Status{Implemented}
}

\numtest{3}{
\Reason{A bad service name representing an existing principal
        (different from the client principal) is rejected.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{4}{
\Reason{A bad service name representing a non-existent
                principal is rejected.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{5}{
\Reason{A bad service name identical to the (existing) client
                name is rejected.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{6}{
\Reason{A null password causes password prompting.}
\Status{Implemented}
}

\numtest{7}{
\Reason{An empty-string causes password prompting}
\Status{Implemented}
}

\numtest{8}{
\Reason{An incorrect password which is the password of another
                user is rejected.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{9}{
\Reason{An incorrect password which isn't the password of any
                user is rejected.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{10}{
\Reason{A null client_name is rejected.}
\Status{Implemented}
}

% Empty string client name is legal.
%\numtest{11}{
%\Reason{An empty-string client_name is rejected.}
%}

\numtest{12}{
\Reason{A client_name referring to a non-existent principal in
                the default realm is rejected.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{13}{
\Reason{A client_name referring to a non-existent principal
                with the local realm specified explicitly is rejected.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{14}{
\Reason{A client_name referring to a non-existent principal in
        a nonexistent realm is rejected.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{15}{
\Reason{A client_name referring to an existing principal in a
        nonexistent realm is rejected.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{16}{
\Reason{Valid invocation.}
\Status{Implemented}
}

\numtest{17}{
\Reason{Valid invocation (explicit client realm).}
\Status{Implemented}
}

\numtest{18}{
\Reason{Valid invocation (CHANGEPW_SERVICE).}
\Status{Implemented}
}

\numtest{19}{
\Reason{Valid invocation (explicit service realm).}
\Status{Implemented}
}

\numtest{20}{
\Reason{Valid invocation (database access allowed after init).}
\Status{Implemented}
}

\numtest{21}{
\Reason{Init fails when called twice in a row.}
\Status{Implemented}
}

\numtest{22}{
\Reason{A null password causes master-key prompting.}
\Conditions{local}
\Status{Implemented}
}

\numtest{23}{
\Reason{A non-null password causes reading from the kstash.}
\Conditions{local}
\Status{Implemented}

}

\numtest{24}{
\Reason{Null service name is ignored in local invocation.}
\Conditions{local}
\Status{Implemented}
}

\numtest{25}{
\Reason{Non-null service name is ignored in local invocation.}
\Conditions{local}
\Status{Implemented}
}

\numtest{26}{
\Reason{Can't do ``get'' operation before calling init.}
\Status{Implemented}
}

\numtest{27}{
\Reason{Can't do ``add'' operation before calling init.}
\Status{Implemented}
}

\numtest{28}{
\Reason{Can't do ``modify'' operation before calling init.}
\Status{Implemented}
}

\numtest{29}{
\Reason{Can't do ``delete'' operation before calling init.}
\Status{Implemented}
}

\numtest{30}{
\Reason{Can init after failed init attempt.}
\Conditions{local}
\Status{Implemented}
}

\section{ovsec_kadm_destroy}

\numtest{1}{
\Reason{Valid invocation.}
\Status{Implemented}
}

\numtest{2}{
\Reason{Valid invocation (``get'' not allowed after destroy).}
\Status{Implemented}
}

\numtest{3}{
\Reason{Valid invocation (``add'' not allowed after destroy).}
\Status{Implemented}
}

\numtest{4}{
\Reason{Valid invocation (``modify'' not allowed after destroy).}
\Status{Implemented}
}

\numtest{5}{
\Reason{Valid invocation (``delete'' not allowed after destroy).}
\Status{Implemented}
}

\numtest{6}{
\Reason{Fails if database not initialized.}
\Status{Implemented}
}

\numtest{7}{
\Reason{Fails if invoked twice in a row.}
\Status{Implemented}
}

\numtest{8}{
\Reason{Database can be reinitialized after destroy.}
\Status{Implemented}
}

\section{ovsec_kadm_create_principal}

%In the tests below, ``getu'' refers to a user who has only ``get'' access,
%''addu'' refers to a user who has only ``add'' access, ``modifyu'' refers to
%a user who has only ``modify'' access, and ``deleteu'' refers to a user
%who has only ``delete'' access. ``amu'' refers to a user with ``add'' and
%''modify'' access.  ``new_princ'' refers to a principal entry structure
%filled in as follows:
%
%       krb5_parse_name("newuser", \&new_princ.principal);
%       krb5_timeofday(\&new_princ.princ_expire_time);
%               new_princ.princ_expire_time += 130;
%       krb5_timeofday(\&new_princ.last_pwd_change);
%               new_princ.last_pwd_change += 140;
%       krb5_timeofday(\&new_princ.pw_expiration);
%               new_princ.pw_expiration += 150;
%       new_princ.max_life = 160;
%       krb5_parse_name("usera", \&new_princ.mod_name);
%       krb5_timeofday(\&new_princ.mod_date);
%               new_princ.mod_date += 170;
%       new_princ.attributes = 0xabcdabcd;
%       new_princ.kvno = 180;
%       new_princ.mkvno = 190;
%       new_princ.policy = null;
%       new_princ.aux_attributes = 0xdeadbeef;
%
%The offsets of 130 through 190 above are used to ensure that the
%fields are all known to be different from each other, so that
%accidentally switched fields can be detected.  Some of the fields in
%this structure may be changed by the tests, but they should clean up
%after themselves.

\numtest{1}{
\Reason{Fails if database not initialized.}
\Status{Implemented}
}

\numtest{2}{
\Reason{Fails on null princ argument.}
\Status{Implemented}
}

\numtest{3}{
\Reason{Fails on null password argument.}
\Status{Implemented}
}

\numtest{4}{
\Reason{Fails on empty-string password argument.}
\Status{Implemented}
}

\numtest{5}{
\Reason{Fails when mask contains undefined bit.}
\Status{Implemented}
}

\numtest{6}{
\Reason{Fails when mask contains LAST_PWD_CHANGE bit.}
\Status{Implemented}
}

\numtest{7}{
\Reason{Fails when mask contains MOD_TIME bit.}
\Status{Implemented}
}

\numtest{8}{
\Reason{Fails when mask contains MOD_NAME bit.}
\Status{Implemented}
}

\numtest{9}{
\Reason{Fails when mask contains MKVNO bit.}
\Status{Implemented}
}

\numtest{10}{
\Reason{Fails when mask contains AUX_ATTRIBUTES bit.}
\Status{Implemented}
}

\numtest{11}{
\Reason{Fails when mask contains POLICY_CLR bit.}
\Status{Implemented}
}

\numtest{12}{
\Reason{Fails for caller with no access bits.}
\Status{Implemented}
}

\numtest{13}{
\Reason{Fails when caller has ``get'' access and not ``add''.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{14}{
\Reason{Fails when caller has ``modify'' access and not ``add''.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{15}{
\Reason{Fails when caller has ``delete'' access and not ``add''.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{16}{
\Reason{Fails when caller connected with CHANGEPW_SERVICE.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{17}{
\Reason{Fails on attempt to create existing principal.}
\Status{Implemented}
}

\numtest{18}{
\Reason{Fails when password is too short.}
\Status{Implemented}
}

\numtest{19}{
\Reason{Fails when password has too few classes.}
\Status{Implemented}
}

\numtest{20}{
\Reason{Fails when password is in dictionary.}
\Status{Implemented}
}

\numtest{21}{
\Reason{Nonexistent policy is rejected.}
\Status{Implemented}
}

\numtest{22}{
\Reason{Fails on invalid principal name.}
\Status{Implemented}
}

\numtest{23}{
\Reason{Valid invocation.}
\Status{Implemented}
}

\numtest{24}{
\Reason{Succeeds when caller has ``add'' access and another one.}
\Status{Implemented}
}

%\numtest{25}{
%\Reason{Fails when password is too short, when override_qual is true.}
%}

%\numtest{26}{
%\Reason{Fails when password has too few classes, when
%               override_qual is true.}
%}

%\numtest{27}{
%\Reason{Fails when password is in dictionary, when override_qual is
%               true.}
%}

\numtest{28}{
\Reason{Succeeds when assigning policy.}
\Status{Implemented}
}

\numtest{29}{
\Priority{High}
\Reason{Allows 0 (never) for princ_expire_time.}
\Status{Implemented}
}

\numtest{30}{
\Reason{Allows 0 (never) for pw_expiration when there's no policy.}
\Status{Implemented}
}

\numtest{31}{
\Reason{Allows 0 (never) for pw_expiration when there's a policy with
        0 for pw_max_life.}
\Status{Implemented}
}

\numtest{32}{
\Reason{Accepts 0 (never) for pw_expiration when there's a policy with
        non-zero pw_max_life, but actually sets pw_expiration to now +
        pw_max_life.}
\Status{Implemented}    
}

\numtest{33}{
\Reason{Accepts and sets non-zero pw_expiration when no policy.}
\Status{Implemented}
}

\numtest{34}{
\Reason{Accepts and sets non-zero pw_expiration when there's a policy
        with zero pw_max_life.}
\Status{Implemented}    
}

\numtest{35}{
\Reason{Accepts and sets non-zero pw_expiration when there's a policy
        with pw_max_life later than the specified pw_expiration.}
\Status{Implemented}    
}

\numtest{36}{
\Reason{Accepts non-zero pw_expiration and limits it to now +
        pw_max_life when it's later than now + non-zero pw_max_life in
        policy.}
\Status{Implemented}    
}

\numtest{37}{
\Priority{High}
\Reason{Sets pw_expiration to 0 (never) if there's no policy and no
        specified pw_expiration.}
\Status{Implemented}    
}

\numtest{38}{
\Priority{High}
\Reason{Sets pw_expiration to 0 (never) if it isn't specified and the
        policy has a 0 (never) pw_max_life.}
\Status{Implemented}    
}

\numtest{39}{
\Priority{High}
\Reason{Sets pw_expiration to now + pw_max_life if it isn't specified
        and the policy has a non-zero pw_max_life.}
\Status{Implemented}    
}

\numtest{40}{
\Priority{High}
\Reason{Allows 0 (forever) for max_life.}
\Status{Implemented}
}

\numtest{41}{
\Priority{High}
\Reason{Doesn't modify or free mod_name on success.}
}

\numtest{42}{
\Priority{High}
\Reason{Doesn't modify or free mod_name on failure.}
}

\section{ovsec_kadm_delete_principal}

\numtest{1}{
\Reason{Fails if database not initialized.}
\Status{Implemented}
}

\numtest{2}{
\Reason{Fails on null principal.}
\Status{Implemented}
}

% Empty string principal is legal.
%\numtest{3}{
%\Reason{Fails on empty-string principal.}
%}

% There is not invalid principal names
%\numtest{4}{
%\Reason{Fails on invalid principal name.}
%}

\numtest{5}{
\Priority{High}
\Reason{Fails on nonexistent principal.}
\Status{Implemented}
}

\numtest{6}{
\Priority{High}
\Reason{Fails when caller connected with CHANGEPW_SERVICE.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{7}{
\Priority{High}
\Reason{Fails if caller has ``add'' access and not ``delete''.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{8}{
\Priority{High}
\Reason{Fails if caller has ``modify'' access and not ``delete''.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{9}{
\Priority{High}
\Reason{Fails if caller has ``get'' access and not ``delete''.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{10}{
\Priority{High}
\Reason{Fails if caller has no access bits.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{11}{
\Priority{High}
\Reason{Valid invocation.}
\Status{Implemented}
}

\numtest{12}{
\Priority{High}
\Reason{Valid invocation (on principal with policy).}
\Status{Implemented}
}



\section{ovsec_kadm_modify_principal}

\numtest{1}{
\Reason{Fails if database not initialized.}
\Status{Implemented}
}

\numtest{2}{
\Priority{High}
\Reason{Fails if user connected with CHANGEPW_SERVICE.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{3}{
\Reason{Fails on mask with undefined bit set.}
\Status{Implemented}
}

\numtest{4}{
\Reason{Fails on mask with PRINCIPAL set.}
\Status{Implemented}
}

\numtest{5}{
\Priority{High}
\Reason{Fails on mask with LAST_PWD_CHANGE set.}
\Status{Implemented}
}

\numtest{6}{
\Reason{Fails on mask with MOD_TIME set.}
\Status{Implemented}
}

\numtest{7}{
\Reason{Fails on mask with MOD_NAME set.}
\Status{Implemented}
}

\numtest{8}{
\Reason{Fails on mask with MKVNO set.}
\Status{Implemented}
}

\numtest{9}{
\Priority{High}
\Reason{Fails on mask with AUX_ATTRIBUTES set.}
\Status{Implemented}
}

\numtest{10}{
\Reason{Fails on nonexistent principal.}
\Status{Implemented}
}

\numtest{11}{
\Priority{High}
\Reason{Fails for user with no access bits.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{12}{
\Priority{High}
\Reason{Fails for user with ``get'' access.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{13}{
\Priority{High}
\Reason{Fails for user with ``add'' access.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{14}{
\Priority{High}
\Reason{Fails for user with ``delete'' access.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{15}{
\Priority{High}
\Reason{Succeeds for user with ``modify'' access.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{16}{
\Reason{Succeeds for user with ``modify'' and another access.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{17}{
\Priority{High}
\Reason{Fails when nonexistent policy is specified.}
\Status{Implemented}
}

\numtest{18}{
\Priority{High}
\Reason{Succeeds when existent policy is specified.}
\Status{Implemented}
}

\numtest{19}{
\Reason{Updates policy count when setting policy from none.}
\Status{Implemented}
}

\numtest{20}{
\Reason{Updates policy count when clearing policy from set.}
\Status{Implemented}
}

\numtest{21}{
\Reason{Updates policy count when setting policy from other policy.}
\Status{Implemented}
}

\numtest{21.5}
\Reason{Policy reference count remains unchanged when policy is
        changed to itself.}
\status{Implemented.}
}

\numtest{22}{
\Reason{Allows 0 (never) for pw_expiration when there's no policy.}
\Status{Implemented}
}

\numtest{23}{
\Reason{Allows 0 (never) for pw_expiration when there's a policy with
        0 for pw_max_life.}
\Status{Implemented}
}

\numtest{24}{
\Reason{Accepts 0 (never) for pw_expiration when there's a policy with
        non-zero pw_max_life, but actually sets pw_expiration to
        last_pwd_change + pw_max_life.}
\Status{Implemented}
}

\numtest{25}{
\Reason{Accepts and sets non-zero pw_expiration when no policy.}
\Status{Implemented}
}

\numtest{26}{
\Reason{Accepts and sets non-zero pw_expiration when there's a policy
        with zero pw_max_life.}
\Status{Implemented}    
}

\numtest{27}{
\Reason{Accepts and sets non-zero pw_expiration when there's a policy
        with pw_max_life later than the specified pw_expiration.}
\Status{Implemented}    
}

\numtest{28}{
\Reason{Accepts non-zero pw_expiration and limits it to last_pwd_change +
        pw_max_life when it's later than last_pwd_change + non-zero
        pw_max_life in policy.}
\Status{Implemented}    
}

\numtest{29}{
\Priority{High}
\Reason{Sets pw_expiration to 0 (never) if there's no policy and no
        specified pw_expiration.}
\Status{Implemented}    
}

\numtest{30}{
\Priority{High}
\Reason{Sets pw_expiration to 0 (never) if it isn't specified and the
        policy has a 0 (never) pw_max_life.}
\Status{Implemented}    
}

\numtest{31}{
\Priority{High}
\Reason{Sets pw_expiration to now + pw_max_life if it isn't specified
        and the policy has a non-zero pw_max_life.}
\Status{Implemented}    
}

\numtest{32}{
\Priority{High}
\Reason{Accepts princ_expire_time change.}
\Status{Implemented}
}



\numtest{33}{
\Priority{High}
\Reason{Accepts attributes change.}
\Status{Implemented}
}

\numtest{33.25}{
\Priority{High}
\Reason{Accepts attributes change (KRB5_KDB_REQUIRES_PW_CHANGE).}
\Status{Implemented}
}

\numtest{33.5}{
\Priority{High}
\Reason{Accepts attributes change (KRB5_DISALLOW_TGT_BASE).}
\Status{Implemented}
}

\numtest{33.75}{
\Priority{High}
\Reason{Accepts attributes change (KRB5_PW_CHANGE_SERVICE).}
\Status{Implemented}
}

\numtest{34}{
\Priority{High}
\Reason{Accepts max_life change.}
\Status{Implemented}
}

\numtest{35}{
\Priority{High}
\Reason{Accepts kvno change.}
\Status{Implemented}
}

\numtest{36}{
\Reason{Behaves correctly when policy is set to the same as it was
        before.}
\Status{Implemented}    
}

\numtest{37}{
\Reason{Behaves properly when POLICY_CLR is specified and there was no
        policy before.}
\Status{Implemented}    
}

\numtest{38}{
\Priority{High}
\Reason{Accepts 0 (never) for princ_expire_time.}
\Status{Implemented}
}

\numtest{39}{
\Priority{High}
\Reason{Accepts 0 for max_life.}
\Status{Implemented}
}

\numtest{40}{
\Reason{Rejects null principal argument.}
\Status{Implemented}
}

\numtest{41}{
\Priority{High}
\Reason{Doesn't modify or free mod_name on success.}
}

\numtest{42}{
\Priority{High}
\Reason{Doesn't modify or free mod_name on failure.}
}


\section{ovsec_kadm_rename_principal}

\numtest{1}{
\Reason{Fails if database not initialized.}
\Status{Implemented}
}

\numtest{2}{
\Priority{High}
\Reason{Fails if user connected with CHANGEPW_SERVICE.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{3}{
\Priority{High}
\Reason{Fails for user with no access bits.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{4}{
\Reason{Fails for user with ``modify'' access and not ``add'' or
``delete''.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{5}{
\Reason{Fails for user with ``get'' access and not ``add'' or
``delete''.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{6}{
\Reason{Fails for user with ``modify'' and ``add'' but not ``delete''.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{7}{
\Reason{Fails for user with ``modify'' and ``delete'' but not ``add''.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{8}{
\Reason{Fails for user with ``get'' and ``add'' but not ``delete''.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{9}{
\Reason{Fails for user with ``get'' and ``delete'' but not ``add.''}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{10}{
\Reason{Fails for user with ``modify'', ``get'' and ``add'', but not
        ``delete''.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{11}{
\Reason{Fails for user with ``modify'', ``get'' and ``delete'', but
        not ``add''.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{12}{
\Priority{High}
\Reason{Fails for user with ``add'' but not ``delete''.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{13}{
\Priority{High}
\Reason{Fails for user with ``delete'' but not ``add''.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{14}{
\Priority{High}
\Reason{Succeeds for user with ``add'' and ``delete''.}
\Status{Implemented}
}

\numtest{15}{
\Priority{High}
\Reason{Fails if target principal name exists.}
\Status{Implemented}
}



\section{ovsec_kadm_chpass_principal}
\label{ovseckadmchpassprincipal}

\subsection{Quality/history enforcement tests}

This section lists a series of tests which will be run a number of
times, with various parameter settings (e.g., which access bits user
has, whether user connected with ADMIN_SERVICE or CHANGEPW_SERVICE,
etc.).  The table following the
list of tests gives the various parameter settings under which the
tests should be run, as well which should succeed and which should
fail for each choice of parameter settings.

\subsubsection{List of tests}

The test number of each of these tests is an offset from the base
given in the table below.

\numtest{1}{
\Priority{High}
\Reason{With history setting of 1, change password to itself.}
}

\numtest{2}{
\Reason{With history setting of 2 but no password changes since
        principal creation, change password to itself.}
}

\numtest{3}{
\Reason{With history setting of 2 and one password change since
        principal creation, change password to itself
        and directly previous password.}
}

\numtest{4}{
\Priority{High}
\Reason{With a history setting of 3 and no password changes,
        change password to itself.}
}

\numtest{5}{
\Priority{High}
\Reason{With a history setting of 3 and 1 password change,
        change password to itself or previous password.}
}

\numtest{6}{
\Priority{High}
\Reason{With a history setting of 3 and 2 password changes,
        change password to itself and the two previous passwords.}
}

\numtest{7}{
\Priority{High}
\Reason{Change to previously unused password when now -
        last_pwd_change $<$ pw_min_life.}
}

\numtest{8}{
\Priority{High}
\Reason{Change to previously unused password that doesn't contain enough
        character classes.}
}

\numtest{9}{
\Priority{High}
\Reason{Change to previously unused password that's too short.}
}

\numtest{10}{
\Priority{High}
\Reason{Change to previously unused password that's in the dictionary.}
}

\subsubsection{List of parameter settings}

In the table below, ``7 passes'' means that test 7 above passes and
the rest of the tests fail.

\begin{tabular}{llllll}
Base & Modify access? & Own password? & Service & Pass/Fail \\ \hline
0 & No & Yes & ADMIN & all fail \\
20 & No & Yes & CHANGEPW & all fail \\
40 & No & No & ADMIN & all fail \\
60 & No & No & CHANGEPW & all fail \\
80 & Yes & Yes & ADMIN & all fail \\
100 & Yes & Yes & CHANGEPW & all fail \\
120 & Yes & No & ADMIN & all fail \\
140 & Yes & No & CHANGEPW & all fail \\
\end{tabular}

\subsection{Other quality/history tests}

\numtest{161}{
\Priority{High}
\Reason{With history of 1, can change password to anything other than
        itself that doesn't conflict with other quality
        rules.}
}

\numtest{162}{
\Reason{With history of 2 and 2 password changes, can change password
        to original password.}
}

\numtest{163}{
\Priority{High}
\Reason{With history of 3 and 3 password changes, can change password
        to original password.}
}

\numtest{164}{
\Priority{High}
\Reason{Can change password when now - last_pwd_change $>$ pw_min_life.}
}

\numtest{165}{
\Priority{High}
\Reason{Can change password when it contains exactly the number of
        classes required by the policy.}
}

\numtest{166}{
\Priority{High}
\Reason{Can change password when it is exactly the length required by
        the policy.}
}

\numtest{167}{
\Priority{High}
\Reason{Can change password to a word that isn't in the dictionary.}
}


\subsection{Other tests}

\numtest{168}{
\Reason{Fails if database not initialized.}
}

\numtest{169}{
\Reason{Fails for non-existent principal.}
}

\numtest{170}{
\Reason{Fails for null password.}
}

\numtest{171}{
\Priority{High}
\Reason{Fails for empty-string password.}
}

\numtest{172}{
\Priority{High}
\Reason{Pw_expiration is set to now + max_pw_life if policy exists and
        has non-zero max_pw_life.}
}

\numtest{173}{
\Priority{High}
\Reason{Pw_expiration is set to 0 if policy exists and has zero
        max_pw_life.}
}

\numtest{174}{
\Priority{High}
\Reason{Pw_expiration is set to 0 if no policy.}
}

\numtest{175}{
\Priority{High}
\Reason{KRB5_KDC_REQUIRES_PWCHANGE bit is cleared when password is
        successfully changed.}
}

\numtest{176}{
\Priority{High}
\Reason{Fails for user with no access bits, on other's password.}
}

\numtest{177}{
\Priority{High}
\Reason{Fails for user with ``get'' but not ``modify'' access, on
        other's password.}
}

\numtest{178}{
\Reason{Fails for user with ``delete'' but not ``modify'' access, on
        other's password.}
}

\numtest{179}{
\Reason{Fails for user with ``add'' but not ``modify'' access, on
        other's password.}
}

\numtest{180}{
\Reason{Succeeds for user with ``get'' and ``modify'' access, on
        other's password.}
}

\numtest{180.5}{
\Priority{High}
\Reason{Succeeds for user with ``modify'' but not ``get'' access, on
        other's password.}
}

%\numtest{181}{
%\Reason{Password that would succeed if override_qual were false fails
%       if override_qual is true.}
%\Expected{Returns CANNOT_OVERRIDE.}
%}


\section{ovsec_kadm_chpass_principal_util}

Rerun all the tests listed for ovsec_kadm_chpass_principal above in
Section \ref{ovseckadmchpassprincipal}.  Verify that they succeed
and fail in the same circumstances.  Also verify that in each failure
case, the error message returned in msg_ret is as specified in the
functional specification.

Also, run the following additional tests.

\numtest{1}{
\Reason{Null msg_ret is rejected.}
}

\numtest{2}{
\Priority{High}
\Reason{New password is put into pw_ret, when it's prompted for.}
}

\numtest{3}{
\Priority{High}
Reason{New password is put into pw_ret, when it's supplied by the
        caller.}
}

\numtest{4}{
\Priority{High}
\Reason{Successful invocation when pw_ret is null.}
}



\section{ovsec_kadm_randkey_principal}

\subsection{TOOSOON enforcement tests}

This test should be run a number of times, as indicated in the table
following it.  The table also indicates the expected result of each
run of the test.

\test{
\Reason{Change key when now - last_pwd_change $<$ pw_min_life.}
}

\subsubsection{List of parameter settings}

\begin{tabular}{llllll}
Number & Modify Access? & Own Key? & Service & Pass/Fail \\ \hline
1 & No & Yes & ADMIN & fail \\
3 & No & Yes & CHANGEPW & fail \\
5 & No & No & ADMIN & fail \\
7 & No & No & CHANGEPW & fail \\
9 & Yes & Yes & ADMIN & fail \\
11 & Yes & Yes & CHANGEPW & fail \\
13 & Yes & No & ADMIN & fail \\
15 & Yes & No & CHANGEPW & fail \\
\end{tabular}

\subsection{Other tests}

\numtest{17}{
\Reason{Fails if database not initialized.}
}

\numtest{18}{
\Reason{Fails for non-existent principal.}
}

\numtest{19}{
\Reason{Fails for null keyblock pointer.}
}

\numtest{20}{
\Priority{High}
\Reason{Pw_expiration is set to now + max_pw_life if policy exists and
        has non-zero max_pw_life.}
}

\numtest{21}{
\Priority{High}
\Reason{Pw_expiration is set to 0 if policy exists and has zero
        max_pw_life.}
}

\numtest{22}{
\Priority{High}
\Reason{Pw_expiration is set to 0 if no policy.}
}

\numtest{23}{
\Priority{High}
\Reason{KRB5_KDC_REQUIRES_PWCHANGE bit is cleared when key is
        successfully changed.}
}

\numtest{24}{
\Priority{High}
\Reason{Fails for user with no access bits, on other's password.}
}

\numtest{25}{
\Priority{High}
\Reason{Fails for user with ``get'' but not ``modify'' access, on
        other's password.}
}

\numtest{26}{
\Reason{Fails for user with ``delete'' but not ``modify'' access, on
        other's password.}
}

\numtest{27}{
\Reason{Fails for user with ``add'' but not ``modify'' access, on
        other's password.}
}

\numtest{28}{
\Reason{Succeeds for user with ``get'' and ``modify'' access, on
        other's password.}
}

\numtest{28.5}{
\Priority{High}
\Reason{Succeeds for user with ``modify'' but not ``get'' access, on
        other's password.}
}

\numtest{29}{
\Reason{The new key that's assigned is truly random. XXX not sure how
        to test this.}
}



\section{ovsec_kadm_get_principal}

\numtest{1}{
\Reason{Fails for null ent.}
\Status{Implemented}
}

\numtest{2}{
\Reason{Fails for non-existent principal.}
\Status{Implemented}
}

\numtest{3}{
\Priority{High}
\Reason{Fails for user with no access bits, retrieving other principal.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{4}{
\Priority{High}
\Reason{Fails for user with ``add'' but not ``get'', getting principal
        other than his own, using ADMIN_SERVICE.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{5}{
\Reason{Fails for user with ``modify'' but not ``get'', getting
        principal other than his own, using ADMIN_SERVICE.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{6}{
\Reason{Fails for user with ``delete'' but not ``get'', getting
        principal other than his own, using ADMIN_SERVICE.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{7}{
\Reason{Fails for user with ``delete'' but not ``get'', getting
        principal other than his own, using CHANGEPW_SERVICE.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{8}{
\Priority{High}
\Reason{Fails for user with ``get'', getting principal other than his
        own, using CHANGEPW_SERVICE.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{9}{
\Priority{High}
\Reason{Succeeds for user without ``get'', retrieving self, using
        ADMIN_SERVICE.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{10}{
\Reason{Succeeds for user without ``get'', retrieving self, using
        CHANGEPW_SERVICE.}
\Status{Implemented}    
}

\numtest{11}{
\Reason{Succeeds for user with ``get'', retrieving self, using
        ADMIN_SERVICE.}
\Status{Implemented}            
}

\numtest{12}{
\Reason{Succeeds for user with ``get'', retrieving self, using
        CHANGEPW_SERVICE.}
\Status{Implemented}            
}

\numtest{13}{
\Priority{High}
\Reason{Succeeds for user with ``get'', retrieving other user, using
        ADMIN_SERVICE.}
\Status{Implemented}            
}

\numtest{14}{
\Reason{Succeeds for user with ``get'' and ``modify'', retrieving
        other principal, using ADMIN_SERVICE.}
\Status{Implemented}            
}



\section{ovsec_kadm_create_policy}

\numtest{1}{
\Reason{Fails for mask with undefined bit set.}
\Status{Implemented - untested}
}

\numtest{2}{
\Priority{High}
\Reason{Fails if caller connected with CHANGEPW_SERVICE.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{3}{
\Reason{Fails for mask without POLICY bit set.}
\Status{Implemented - untested}
}

\numtest{4}{
\Reason{Fails for mask with REF_COUNT bit set.}
\Status{Implemented}
}

\numtest{5}{
\Reason{Fails for invalid policy name.}
\Status{Implemented - untested}
}

\numtest{6}{
\Priority{High}
\Reason{Fails for existing policy name.}
\Status{Implemented}
}

\numtest{7}{
\Reason{Fails for null policy name.}
\Status{Implemented - untested}
}

\numtest{8}{
\Priority{High}
\Reason{Fails for empty-string policy name.}
\Status{Implemented}
}

\numtest{9}{
\Priority{High}
\Reason{Accepts 0 for pw_min_life.}
\Status{Implemented}
}

\numtest{10}{
\Priority{High}
\Reason{Accepts non-zero for pw_min_life.}
\Status{Implemented}
}

\numtest{11}{
\Priority{High}
\Reason{Accepts 0 for pw_max_life.}
\Status{Implemented}
}

\numtest{12}{
\Priority{High}
\Reason{Accepts non-zero for pw_max_life.}
\Status{Implemented}
}

\numtest{13}{
\Priority{High}
\Reason{Rejects 0 for pw_min_length.}
\Status{Implemented}
}

\numtest{14}{
\Priority{High}
\Reason{Accepts non-zero for pw_min_length.}
\Status{Implemented}
}

\numtest{15}{
\Priority{High}
\Reason{Rejects 0 for pw_min_classes.}
\Status{Implemented}
}

\numtest{16}{
\Priority{High}
\Reason{Accepts 1 for pw_min_classes.}
\Status{Implemented}
}

\numtest{17}{
\Priority{High}
\Reason{Accepts 4 for pw_min_classes.}
\Status{Implemented}
}

\numtest{18}{
\Priority{High}
\Reason{Rejects 5 for pw_min_classes.}
\Status{Implemented}
}

\numtest{19}{
\Priority{High}
\Reason{Rejects 0 for pw_history_num.}
\Status{Implemented}
}

\numtest{20}{
\Priority{High}
\Reason{Accepts 1 for pw_history_num.}
\Status{Implemented}
}

\numtest{21}{
\Priority{High}
\Reason{Accepts 10 for pw_history_num.}
\Status{Implemented}
}

\numtest{21.5}{
\Reason{Rejects 11 for pw_history_num.}
\Status{Implemented - untested}
}

\numtest{22}{
\Priority{High}
\Reason{Fails for user with no access bits.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{23}{
\Priority{High}
\Reason{Fails for user with ``get'' but not ``add''.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{24}{
\Reason{Fails for user with ``modify'' but not ``add.''}
\Conditions{RPC}
\Status{Implemented - untested}
}

\numtest{25}{
\Reason{Fails for user with ``delete'' but not ``add.''}
\Conditions{RPC}
\Status{Implemented - untested}
}

\numtest{26}{
\Priority{High}
\Reason{Succeeds for user with ``add.''}
\Status{Implemented}
}

\numtest{27}{
\Reason{Succeeds for user with ``get'' and ``add.''}
\Status{Implemented - untested}
}

\numtest{28}{
\Reason{Rejects null policy argument.}
\Status{Implemented - untested}
}

\numtest{29}{
\Reason{Rejects pw_min_life greater than pw_max_life.}
}


\section{ovsec_kadm_delete_policy}

\numtest{1}{
\Reason{Fails for null policy name.}
}

\numtest{2}{
\Priority{High}
\Reason{Fails for empty-string policy name.}
\Status{Implemented}
}

\numtest{3}{
\Reason{Fails for non-existent policy name.}
}

\numtest{4}{
\Reason{Fails for bad policy name.}
}

\numtest{5}{
\Priority{High}
\Reason{Fails if caller connected with CHANGEPW_SERVICE.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{6}{
\Priority{High}
\Reason{Fails for user with no access bits.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{7}{
\Priority{High}
\Reason{Fails for user with ``add'' but not ``delete''.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{8}{
\Reason{Fails for user with ``modify'' but not ``delete''.}
\Conditions{RPC}
}

\numtest{9}{
\Reason{Fails for user with ``get'' but not ``delete.''}
\Conditions{RPC}
}

\numtest{10}{
\Priority{High}
\Reason{Succeeds for user with only ``delete''.}
\Status{Implemented}
}

\numtest{11}{
\Reason{Succeeds for user with ``delete'' and ``add''.}
}

\numtest{12}{
\Priority{High}
\Reason{Fails for policy with non-zero reference count.}
\Status{Implemented}
}



\section{ovsec_kadm_modify_policy}

\numtest{1}{
\Reason{Fails for mask with undefined bit set.}
\Conditions{RPC}
}

\numtest{2}{
\Priority{High}
\Reason{Fails if caller connected with CHANGEPW_SERVICE.}
\Status{Implemented}
}

\numtest{3}{
\Reason{Fails for mask with POLICY bit set.}
}

\numtest{4}{
\Reason{Fails for mask with REF_COUNT bit set.}
\status{Implemented}
}

\numtest{5}{
\Reason{Fails for invalid policy name.}
}

\numtest{6}{
\Reason{Fails for non-existent policy name.}
}

\numtest{7}{
\Reason{Fails for null policy name.}
}

\numtest{8}{
\Priority{High}
\Reason{Fails for empty-string policy name.}
\Status{Implemented}
}

\numtest{9}{
\Priority{High}
\Reason{Accepts 0 for pw_min_life.}
\Status{Implemented}
}

\numtest{10}{
\Priority{High}
\Reason{Accepts non-zero for pw_min_life.}
\Status{Implemented}
}

\numtest{11}{
\Priority{High}
\Reason{Accepts 0 for pw_max_life.}
\Status{Implemented}
}

\numtest{12}{
\Priority{High}
\Reason{Accepts non-zero for pw_max_life.}
\Status{Implemented}
}

\numtest{13}{
\Priority{High}
\Reason{Accepts 0 for pw_min_length.}
\Status{Implemented}
}

\numtest{14}{
\Priority{High}
\Reason{Accepts non-zero for pw_min_length.}
\Status{Implemented}
}

\numtest{15}{
\Priority{High}
\Reason{Rejects 0 for pw_min_classes.}
\Status{Implemented}
}

\numtest{16}{
\Priority{High}
\Reason{Accepts 1 for pw_min_classes.}
\Status{Implemented}
}

\numtest{17}{
\Priority{High}
\Reason{Accepts 4 for pw_min_classes.}
\Status{Implemented}
}

\numtest{18}{
\Priority{High}
\Reason{Rejects 5 for pw_min_classes.}
\Status{Implemented}
}

\numtest{19}{
\Priority{High}
\Reason{Rejects 0 for pw_history_num.}
\Status{Implemented}
}

\numtest{20}{
\Priority{High}
\Reason{Accepts 1 for pw_history_num.}
\Status{Implemented}
}

\numtest{21}{
\Priority{High}
\Reason{Accepts 10 for pw_history_num.}
\Status{Implemented}
}

\numtest{22}{
\Priority{High}
\Reason{Fails for user with no access bits.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{23}{
\Priority{High}
\Reason{Fails for user with ``get'' but not ``modify''.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{24}{
\Reason{Fails for user with ``add'' but not ``modify.''}
\Conditions{RPC}
}

\numtest{25}{
\Reason{Fails for user with ``delete'' but not ``modify.''}
\Conditions{RPC}
}

\numtest{26}{
\Priority{High}
\Reason{Succeeds for user with ``modify.''}
\Status{Implemented}
}

\numtest{27}{
\Reason{Succeeds for user with ``get'' and ``modify.''}
}

\numtest{28}{
\Reason{Rejects null policy argument.}
}

\numtest{29}{
\Reason{Rejects change which makes pw_min_life greater than
        pw_max_life.}
}

\section{ovsec_kadm_get_policy}

\numtest{1}{
\Reason{Fails for null policy.}
}

\numtest{2}{
\Reason{Fails for invalid policy name.}
}

\numtest{3}{
\Priority{High}
\Reason{Fails for empty-string policy name.}
\Status{Implemented}
}

\numtest{4}{
\Reason{Fails for non-existent policy name.}
}

\numtest{5}{
\Reason{Fails for null ent.}
}

\numtest{6}{
\Priority{High}
\Reason{Fails for user with no access bits trying to get other's
        policy, using ADMIN_SERVICE.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{7}{
\Priority{High}
\Reason{Fails for user with ``add'' but not ``get'' trying to get
        other's policy, using ADMIN_SERVICE.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{8}{
\Reason{Fails for user with ``modify'' but not ``get'' trying to get
        other's policy, using ADMIN_SERVICE.}
\Conditions{RPC}        
}

\numtest{9}{
\Reason{Fails for user with ``delete'' but not ``get'' trying to get
        other's policy, using ADMIN_SERVICE.}
\Conditions{RPC}        
}

\numtest{10}{
\Reason{Fails for user with ``delete'' but not ``get'' trying to get
        other's policy, using CHANGEPW_SERVICE.}
\Conditions{RPC}        
}

\numtest{11}{
\Priority{High}
\Reason{Succeeds for user with only ``get'', trying to get own policy,
        using ADMIN_SERVICE.}
\Status{Implemented}
}

\numtest{12}{
\Priority{High}
\Reason{Succeeds for user with only ``get'', trying to get own policy,
        using CHANGEPW_SERVICE.}
\Status{Implemented}    
}

\numtest{13}{
\Reason{Succeeds for user with ``add'' and ``get'', trying to get own
        policy, using ADMIN_SERVICE.}
}

\numtest{14}{
\Reason{Succeeds for user with ``add'' and ``get'', trying to get own
        policy, using CHANGEPW_SERVICE.}
}

\numtest{15}{
\Reason{Succeeds for user without ``get'', trying to get own policy,
        using ADMIN_SERVICE.}
}

\numtest{16}{
\Priority{High}
\Reason{Succeeds for user without ``get'', trying to get own policy,
        using CHANGEPW_SERVICE.}
\Status{Implemented}    
}

\numtest{17}{
\Priority{High}
\Reason{Succeeds for user with ``get'', trying to get other's policy,
        using ADMIN_SERVICE.}
\Status{Implemented}    
}

\numtest{18}{
\Priority{High}
\Reason{Fails for user with ``get'', trying to get other's policy,
        using CHANGEPW_SERVICE.}
\Conditions{RPC}
\Status{Implemented}
}

\numtest{19}{
\Reason{Succeeds for user with ``modify'' and ``get'', trying to get
        other's policy, using ADMIN_SERVICE.}
}

\numtest{20}{
\Reason{Fails for user with ``modify'' and ``get'', trying to get
        other's policy, using CHANGEPW_SERVICE.}
}



\section{ovsec_kadm_free_principal_ent}

In addition to the tests listed here, a memory-leak detector such as
TestCenter, Purify or dbmalloc should be used to verify that the
memory freed by this function is really freed.

\numtest{1}{
\Reason{Null princ succeeds.}
}

\numtest{2}{
\Reason{Non-null princ succeeds.}
}


\section{ovsec_kadm_free_policy_ent}

In addition to the tests listed here, a memory-leak detector such as
TestCenter, Purify or dbmalloc should be used to verify that the
memory freed by this function is really freed.

\numtest{1}{
\Reason{Null policy succeeds.}
}

\numtest{2}{
\Reason{Non-null policy succeeds.}
}



\section{ovsec_kadm_get_privs}

\numtest{1}{
\Reason{Fails for null pointer argument.}
}

This test should be run with the 16 possible combinations of access
bits (since there are 4 access bits, there are $2^4 = 16$ possible
combinations of them):

\numtest{2}{
\Priority{High}
\Reason{Returns correct bit mask for access bits of user.}
\Conditions{RPC}
}

This test should be run locally:

\numtest{3}{
\Priority{High}
\Reason{Returns 0x0f.}
\Conditions{local}
}

\end{document}