#!/bin/sh

set -e

TEST_REALM="EXAMPLE.INTERNAL"

mkdir -p /etc/krb5.conf.d
if ! grep -q includedir /etc/krb5.conf; then
    echo "## Adding includedir directive to /etc/krb5.conf"
    sed -r -i '1 i\includedir /etc/krb5.conf.d\n' /etc/krb5.conf
fi

echo
echo "## Creating /etc/krb5.conf.d/autopkgtest.conf"
cat > /etc/krb5.conf.d/autopkgtest.conf <<EOF
[libdefaults]
    default_realm = ${TEST_REALM}

[realms]
    ${TEST_REALM} = {
        kdc = localhost
        admin_server = localhost
    }
EOF

echo
echo "## Stopping heimdal-kdc.service and heimdal-kpasswdd.service and cleaning up DB directory"
systemctl stop heimdal-kdc.service heimdal-kpasswdd.service

# leave symlink to /etc/heimdal-kdc/kdc.conf
rm -f /var/lib/heimdal-kdc/{heimdal.db,log,m-key} || :

echo
echo "## Stashing key"
kstash --random-key

echo
echo "## Initializing realm ${TEST_REALM}"
kadmin -l init \
    --realm-max-ticket-life=unlimited \
    --realm-max-renewable-life=unlimited \
    "${TEST_REALM}"

echo
echo "## Starting heimdal-kdc.service and heimdal-kpasswdd.service"
systemctl start heimdal-kdc.service heimdal-kpasswdd.service

# create a random-enough principal
principal="testuser$$"
password="password$$"
newpassword="New-password-$$"
echo
echo "## Creating test principal named ${principal}"
kadmin -l add \
    --password="${password}" \
    --max-ticket-life=8h \
    --max-renewable-life=8h \
    --expiration-time=never \
    --pw-expiration-time=never \
    --attributes="" \
    --policy=default \
    "${principal}"

# get a ticket
echo
echo "## Getting TGT for principal ${principal}"
echo "${password}" | kinit --password-file=STDIN "${principal}"

# did we really get a ticket?
echo
echo "## Verifying we got a TGT"
klist | grep krbtgt/${TEST_REALM}@${TEST_REALM}
echo
echo "## Changing password for principal ${principal} using kpasswd"
expect <<EXPECT_EOF
spawn kpasswd ${principal}
expect {
    "*Password:*" { send -- "${password}\r" }
    timeout { puts "Timed out waiting for old password prompt"; exit 1 }
    eof { puts "kpasswd exited before old password prompt"; exit 1 }
}
expect {
    "New password*" { send -- "${newpassword}\r" }
    timeout { puts "Timed out waiting for new password prompt"; exit 1 }
    eof { puts "kpasswd exited before new password prompt"; exit 1 }
}
expect {
    "Verify password*" { send -- "${newpassword}\r" }
    timeout { puts "Timed out waiting for verify password prompt"; exit 1 }
    eof { puts "kpasswd exited before verify password prompt"; exit 1 }
}
expect eof
catch wait result
exit [lindex \$result 3]
EXPECT_EOF

# destroy it
echo
echo "## Destroying ticket"
kdestroy

echo
echo "## Verifying old password no longer works"
if echo "${password}" | kinit --password-file=STDIN "${principal}"; then
    echo "Old password still works after password change" >&2
    exit 1
fi

echo
echo "## Getting TGT for principal ${principal} with new password"
echo "${newpassword}" | kinit --password-file=STDIN "${principal}"

echo
echo "## Verifying we got a TGT with the new password"
klist | grep krbtgt/${TEST_REALM}@${TEST_REALM}

echo
echo "## Destroying ticket"
kdestroy

# remove the principal
echo
echo "## Removing principal ${principal} from the db"
kadmin -l delete "${principal}"
