krb5 commit [krb5-1.11]: Test SPNEGO error message in t_s4u.py

[Tom Yu]

https://github.com/krb5/krb5/commit/544965cad68a5f0acdcb44634f82e52b470b3755
commit 544965cad68a5f0acdcb44634f82e52b470b3755
Author: Tom Yu <tlyu at mit.edu>
Date:   Thu Jan 16 14:31:55 2014 -0500

    Test SPNEGO error message in t_s4u.py
    
    Now that #7045 is fixed, we can check for the correct error message
    from t_s4u2proxy_krb5 with --spnego.
    
    (back ported from commit 4faca53e3a8ee213d43da8998f6889e7bfd36248)
    
    ticket: 7823
    version_fixed: 1.11.5
    status: resolved

 src/tests/gssapi/t_s4u.py |   11 +++++------
 1 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/src/tests/gssapi/t_s4u.py b/src/tests/gssapi/t_s4u.py
index cd67591..d278b1c 100644
--- a/src/tests/gssapi/t_s4u.py
+++ b/src/tests/gssapi/t_s4u.py
@@ -30,12 +30,12 @@ if ('auth1: ' + realm.user_princ not in output or
     'NOT_ALLOWED_TO_DELEGATE' not in output):
     fail('krb5 -> s4u2proxy')
 
-# Again with SPNEGO.  Bug #7045 prevents us from checking the error
-# message, but we can at least exercise the code.
+# Again with SPNEGO.
 output = realm.run_as_server(['./t_s4u2proxy_krb5', '--spnego', usercache,
                               storagecache, '-', pservice1, pservice2],
                              expected_code=1)
-if ('auth1: ' + realm.user_princ not in output):
+if ('auth1: ' + realm.user_princ not in output or
+    'NOT_ALLOWED_TO_DELEGATE' not in output):
     fail('krb5 -> s4u2proxy (SPNEGO)')
 
 # Try krb5 -> S4U2Proxy without forwardable user creds.  This should
@@ -66,10 +66,9 @@ if 'NOT_ALLOWED_TO_DELEGATE' not in output:
     fail('s4u2self')
 
 # Again with SPNEGO.  This uses SPNEGO for the initial authentication,
-# but still uses krb5 for S4U2Proxy (the delegated cred is returned as
+# but still uses krb5 for S4U2Proxy--the delegated cred is returned as
 # a krb5 cred, not a SPNEGO cred, and t_s4u uses the delegated cred
-# directly rather than saving and reacquiring it) so bug #7045 does
-# not apply and we can verify the error message.
+# directly rather than saving and reacquiring it.
 output = realm.run_as_server(['./t_s4u', '--spnego', puser, pservice2],
                              expected_code=1)
 if 'NOT_ALLOWED_TO_DELEGATE' not in output: