*  Licensed to the Apache Software Foundation (ASF) under one

*  or more contributor license agreements.  See the NOTICE file

*  distributed with this work for additional information

*  regarding copyright ownership.  The ASF licenses this file

*  to you under the Apache License, Version 2.0 (the

*  "License"); you may not use this file except in compliance

*  with the License.  You may obtain a copy of the License at

* 

*    http://www.apache.org/licenses/LICENSE-2.0

* 

*  Unless required by applicable law or agreed to in writing,

*  software distributed under the License is distributed on an

*  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY

*  KIND, either express or implied.  See the License for the

*  specific language governing permissions and limitations

*  under the License.

* 

*/

* Tests the Ticket-Granting Service (TGS) via the {@link KerberosProtocolHandler}.

*

* @author <a href="mailto:dev@directory.apache.org">Apache Directory Project</a>

* @version $Rev$, $Date$

*/

    private KdcServer config;

    private PrincipalStore store;

    private KerberosProtocolHandler handler;

    private KrbDummySession session;

    /**

     * Creates a new instance of {@link TicketGrantingServiceTest}.

     */

    @Before

    public void setUp()

    {

        config = new KdcServer();

        /*

         * Body checksum verification must be disabled because we are bypassing

         * the codecs, where the body bytes are set on the KdcRequest message.

         */

        config.setBodyChecksumVerified( false );

        store = new MapPrincipalStoreImpl();

        handler = new KerberosProtocolHandler( config, store );

        session = new KrbDummySession();

        lockBox = new CipherTextHandler();

    }

    /**

     * Shutdown the Kerberos server

     */

    @After

    public void shutDown()

    {

        config.stop();

    }

   

   

    /**

     * Tests the default minimum request, which consists of as little as the

     * client name, service name, realm, till time, nonce, and encryption types.

     *

     * This is the request archetype.

     *

     * "The TGS exchange between a client and the Kerberos TGS is initiated by a

     * client ... when it seeks to obtain authentication credentials for a given

     * server (which might be registered in a remote realm)."

     *

     * "In the first case, the client must already have acquired a ticket for the

     * Ticket-Granting Service using the AS exchange (the TGT is usually obtained

     * when a client initially authenticates to the system, such as when a user

     * logs in)."

     *

     * @throws Exception

     */

    @Test

    public void testRequestArchetype() throws Exception

    {

        KerberosPrincipal clientPrincipal = new KerberosPrincipal( "hnelson@EXAMPLE.COM" );

        KerberosPrincipal serverPrincipal = new KerberosPrincipal( "krbtgt/EXAMPLE.COM@EXAMPLE.COM" );

        String serverPassword = "randomKey";

        Ticket tgt = getTgt( clientPrincipal, serverPrincipal, serverPassword );

        RequestBodyModifier modifier = new RequestBodyModifier();

        modifier.setServerName( getPrincipalName( "hnelson" ) );

        modifier.setRealm( "EXAMPLE.COM" );

        modifier.setEType( config.getEncryptionTypes() );

        modifier.setNonce( random.nextInt() );

        KdcOptions kdcOptions = new KdcOptions();

        modifier.setKdcOptions( kdcOptions );

        long currentTime = System.currentTimeMillis();

        KerberosTime requestedEndTime = new KerberosTime( currentTime + KerberosTime.DAY );

        modifier.setTill( requestedEndTime );

        RequestBody requestBody = modifier.getRequestBody();

        KdcRequest message = getKdcRequest( tgt, requestBody );

        handler.messageReceived( session, message );

    }

    /**

     * Tests the protocol version number, which must be '5'.

     */

    @Test

    public void testProtocolVersionNumber()

    {

        RequestBodyModifier modifier = new RequestBodyModifier();

        modifier.setServerName( getPrincipalName( "hnelson" ) );

        modifier.setRealm( "EXAMPLE.COM" );

        modifier.setEType( config.getEncryptionTypes() );

        KdcRequest message = new KdcRequest( 4, KerberosMessageType.TGS_REQ, null, modifier.getRequestBody() );

        handler.messageReceived( session, message );

        ErrorMessage error = ( ErrorMessage ) session.getMessage();

        assertEquals( "Requested protocol version number not supported", 3, error.getErrorCode() );

    }

    /**

     * Tests that a non-existent server principal returns the correct error message.

     *

     * @throws Exception

     */

    @Test

    public void testServerNotFound() throws Exception

    {

        KerberosPrincipal clientPrincipal = new KerberosPrincipal( "hnelson@EXAMPLE.COM" );

        KerberosPrincipal serverPrincipal = new KerberosPrincipal( "krbtgt/EXAMPLE.COM@EXAMPLE.COM" );

        String serverPassword = "randomKey";

        Ticket tgt = getTgt( clientPrincipal, serverPrincipal, serverPassword );

        RequestBodyModifier modifier = new RequestBodyModifier();

        modifier.setServerName( getPrincipalName( "badservice" ) );

        modifier.setRealm( "EXAMPLE.COM" );

        modifier.setEType( config.getEncryptionTypes() );

        modifier.setNonce( random.nextInt() );

        KdcOptions kdcOptions = new KdcOptions();

        modifier.setKdcOptions( kdcOptions );

        long currentTime = System.currentTimeMillis();

        KerberosTime requestedEndTime = new KerberosTime( currentTime + KerberosTime.DAY );

        modifier.setTill( requestedEndTime );

        RequestBody requestBody = modifier.getRequestBody();

        KdcRequest message = getKdcRequest( tgt, requestBody );

        handler.messageReceived( session, message );

        ErrorMessage error = ( ErrorMessage ) session.getMessage();

        assertEquals( "Server not found in Kerberos database", 7, error.getErrorCode() );

    }

    /**

     * Tests when no ticket is found in the auth header that the request is rejected

     * with the correct error message.

     *

     * "If no ticket can be found in the padata field, the KDC_ERR_PADATA_TYPE_NOSUPP

     * error is returned."

     *

     * @throws Exception

     */

    @Test

    public void testNoTicketFound() throws Exception

    {

        KerberosPrincipal clientPrincipal = new KerberosPrincipal( "hnelson@EXAMPLE.COM" );

        KerberosPrincipal serverPrincipal = new KerberosPrincipal( "krbtgt/EXAMPLE.COM@EXAMPLE.COM" );

        String serverPassword = "randomKey";

        Ticket tgt = getTgt( clientPrincipal, serverPrincipal, serverPassword );

        RequestBodyModifier modifier = new RequestBodyModifier();

        modifier.setServerName( getPrincipalName( "hnelson" ) );

        modifier.setRealm( "EXAMPLE.COM" );

        modifier.setEType( config.getEncryptionTypes() );

        modifier.setNonce( random.nextInt() );

        KdcOptions kdcOptions = new KdcOptions();

        modifier.setKdcOptions( kdcOptions );

        long currentTime = System.currentTimeMillis();

        KerberosTime requestedEndTime = new KerberosTime( currentTime + KerberosTime.DAY );

        modifier.setTill( requestedEndTime );

        RequestBody requestBody = modifier.getRequestBody();

        // Get the session key from the service ticket.

        sessionKey = tgt.getEncTicketPart().getSessionKey();

        // Generate a new sequence number.

        sequenceNumber = random.nextInt();

        now = new KerberosTime();

        KdcRequest message = new KdcRequest( 5, KerberosMessageType.TGS_REQ, null, requestBody );

        handler.messageReceived( session, message );

        ErrorMessage error = ( ErrorMessage ) session.getMessage();

        assertEquals( "KDC has no support for padata type", 16, error.getErrorCode() );

    }

    /**

     * Tests that an inappropriate checksum returns the correct error message.

     *

     * @throws Exception

     */

    @Test

    public void testInappropriateChecksum() throws Exception

    {

        config.setBodyChecksumVerified( true );

        KerberosPrincipal clientPrincipal = new KerberosPrincipal( "tquist@EXAMPLE.COM" );

        KerberosPrincipal serverPrincipal = new KerberosPrincipal( "krbtgt/EXAMPLE.COM@EXAMPLE.COM" );

        String serverPassword = "randomKey";

        Ticket tgt = getTgt( clientPrincipal, serverPrincipal, serverPassword );

        RequestBodyModifier modifier = new RequestBodyModifier();

        modifier.setServerName( getPrincipalName( "hnelson" ) );

        modifier.setRealm( "EXAMPLE.COM" );

        modifier.setEType( config.getEncryptionTypes() );

        modifier.setNonce( random.nextInt() );

        KdcOptions kdcOptions = new KdcOptions();

        modifier.setKdcOptions( kdcOptions );

        long currentTime = System.currentTimeMillis();

        KerberosTime requestedEndTime = new KerberosTime( currentTime + KerberosTime.DAY );

        modifier.setTill( requestedEndTime );

        RequestBody requestBody = modifier.getRequestBody();

        KdcRequest message = getKdcRequest( tgt, requestBody );

        handler.messageReceived( session, message );

        ErrorMessage error = ( ErrorMessage ) session.getMessage();

        assertEquals( "Inappropriate type of checksum in message", 50, error.getErrorCode() );

    }

    /**

     * Tests that an inappropriate checksum returns the correct error message.

     *

     * @throws Exception

     */

    @Test

    public void testChecksumTypeNoSupport() throws Exception

    {

        config.setBodyChecksumVerified( true );

        KerberosPrincipal clientPrincipal = new KerberosPrincipal( "tquist@EXAMPLE.COM" );

        KerberosPrincipal serverPrincipal = new KerberosPrincipal( "krbtgt/EXAMPLE.COM@EXAMPLE.COM" );

        String serverPassword = "randomKey";

        Ticket tgt = getTgt( clientPrincipal, serverPrincipal, serverPassword );

        RequestBodyModifier modifier = new RequestBodyModifier();

        modifier.setServerName( getPrincipalName( "hnelson" ) );

        modifier.setRealm( "EXAMPLE.COM" );

        modifier.setEType( config.getEncryptionTypes() );

        modifier.setNonce( random.nextInt() );

        KdcOptions kdcOptions = new KdcOptions();

        modifier.setKdcOptions( kdcOptions );

        long currentTime = System.currentTimeMillis();

        KerberosTime requestedEndTime = new KerberosTime( currentTime + KerberosTime.DAY );

        modifier.setTill( requestedEndTime );

        RequestBody requestBody = modifier.getRequestBody();

        try

        {

            getKdcRequest( tgt, requestBody, ChecksumType.DES_MAC_K );

        }

        catch ( KerberosException ke )

        {

            assertEquals( "KDC has no support for checksum type", 15, ke.getErrorCode() );

        }

    }

    /**

     * "If any of the decryptions indicate failed integrity checks, the

     * KRB_AP_ERR_BAD_INTEGRITY error is returned."

     *

     * @throws Exception

     */

    @Test

    public void testIntegrityCheckedFailed() throws Exception

    {

        KerberosPrincipal clientPrincipal = new KerberosPrincipal( "hnelson@EXAMPLE.COM" );

        KerberosPrincipal serverPrincipal = new KerberosPrincipal( "krbtgt/EXAMPLE.COM@EXAMPLE.COM" );

        String serverPassword = "badpassword";

        Ticket tgt = getTgt( clientPrincipal, serverPrincipal, serverPassword );

        RequestBodyModifier modifier = new RequestBodyModifier();

        modifier.setServerName( getPrincipalName( "hnelson" ) );

        modifier.setRealm( "EXAMPLE.COM" );

        modifier.setEType( config.getEncryptionTypes() );

        modifier.setNonce( random.nextInt() );

        KdcOptions kdcOptions = new KdcOptions();

        modifier.setKdcOptions( kdcOptions );

        long currentTime = System.currentTimeMillis();

        KerberosTime requestedEndTime = new KerberosTime( currentTime + KerberosTime.DAY );

        modifier.setTill( requestedEndTime );

        RequestBody requestBody = modifier.getRequestBody();

        KdcRequest message = getKdcRequest( tgt, requestBody );

        handler.messageReceived( session, message );

        ErrorMessage error = ( ErrorMessage ) session.getMessage();

        assertEquals( "Integrity check on decrypted field failed", 31, error.getErrorCode() );

    }

    /**

     * Tests when the ticket isn't for us that the correct error message is returned.

     *

     * @throws Exception

     */

    @Test

    public void testNotUs() throws Exception

    {

        KerberosPrincipal clientPrincipal = new KerberosPrincipal( "hnelson@EXAMPLE.COM" );

        KerberosPrincipal serverPrincipal = new KerberosPrincipal( "krbtgt/EXAMPLE.COM@APACHE.ORG" );

        String serverPassword = "randomKey";

        Ticket tgt = getTgt( clientPrincipal, serverPrincipal, serverPassword );

        RequestBodyModifier modifier = new RequestBodyModifier();

        modifier.setServerName( getPrincipalName( "hnelson" ) );

        modifier.setRealm( "EXAMPLE.COM" );

        modifier.setEType( config.getEncryptionTypes() );

        modifier.setNonce( random.nextInt() );

        KdcOptions kdcOptions = new KdcOptions();

        modifier.setKdcOptions( kdcOptions );

        long currentTime = System.currentTimeMillis();

        KerberosTime requestedEndTime = new KerberosTime( currentTime + KerberosTime.DAY );

        modifier.setTill( requestedEndTime );

        RequestBody requestBody = modifier.getRequestBody();

        KdcRequest message = getKdcRequest( tgt, requestBody );

        handler.messageReceived( session, message );

        ErrorMessage error = ( ErrorMessage ) session.getMessage();

        assertEquals( "The ticket isn't for us", 35, error.getErrorCode() );

    }

    /**

     * "The TGS exchange between a client and the Kerberos TGS is initiated by a

     * client when ... it seeks to renew an existing ticket."

     *

     * @throws Exception

     */

    @Test

    public void testRenewTicket() throws Exception

    {

        KerberosPrincipal clientPrincipal = new KerberosPrincipal( "hnelson@EXAMPLE.COM" );

        KerberosPrincipal serverPrincipal = new KerberosPrincipal( "krbtgt/EXAMPLE.COM@EXAMPLE.COM" );

        String serverPassword = "randomKey";

        Ticket tgt = getTgt( clientPrincipal, serverPrincipal, serverPassword );

        RequestBodyModifier modifier = new RequestBodyModifier();

        modifier.setServerName( getPrincipalName( "hnelson" ) );

        modifier.setRealm( "EXAMPLE.COM" );

        modifier.setEType( config.getEncryptionTypes() );

        modifier.setNonce( random.nextInt() );

        KdcOptions kdcOptions = new KdcOptions();

        kdcOptions.set( KdcOptions.RENEW );

        modifier.setKdcOptions( kdcOptions );

        long currentTime = System.currentTimeMillis();

        KerberosTime requestedEndTime = new KerberosTime( currentTime + KerberosTime.DAY );

        modifier.setTill( requestedEndTime );

        RequestBody requestBody = modifier.getRequestBody();

        KdcRequest message = getKdcRequest( tgt, requestBody );

        handler.messageReceived( session, message );

        TicketGrantReply reply = ( TicketGrantReply ) session.getMessage();

        KerberosTime expectedRenewTillTime = tgt.getEncTicketPart().getRenewTill();

        boolean isClose = Math.abs( reply.getRenewTill().getTime() - expectedRenewTillTime.getTime() ) < 5000;

        assertTrue( "Expected renew till time", isClose );

    }

    /**

     * "The TGS exchange between a client and the Kerberos TGS is initiated by a

     * client when ... it seeks to validate an existing ticket."

     *

     * @throws Exception

     */

    @Test

    public void testValidateTicket() throws Exception

    {

        // Get the mutable ticket part.

        KerberosPrincipal clientPrincipal = new KerberosPrincipal( "hnelson@EXAMPLE.COM" );

        EncTicketPartModifier encTicketPartModifier = getTicketArchetype( clientPrincipal );

        // Make changes to test.

        encTicketPartModifier.setFlag( TicketFlag.INVALID );

        // Seal the ticket for the server.

        KerberosPrincipal serverPrincipal = new KerberosPrincipal( "krbtgt/EXAMPLE.COM@EXAMPLE.COM" );

        String passPhrase = "randomKey";

        EncryptionKey serverKey = getEncryptionKey( serverPrincipal, passPhrase );

        Ticket tgt = getTicket( encTicketPartModifier, serverPrincipal, serverKey );

        RequestBodyModifier modifier = new RequestBodyModifier();

        modifier.setServerName( getPrincipalName( "hnelson" ) );

        modifier.setRealm( "EXAMPLE.COM" );

        modifier.setEType( config.getEncryptionTypes() );

        modifier.setNonce( random.nextInt() );

        KdcOptions kdcOptions = new KdcOptions();

        kdcOptions.set( KdcOptions.VALIDATE );

        modifier.setKdcOptions( kdcOptions );

        long currentTime = System.currentTimeMillis();

        KerberosTime requestedEndTime = new KerberosTime( currentTime + KerberosTime.DAY );

        modifier.setTill( requestedEndTime );

        RequestBody requestBody = modifier.getRequestBody();

        KdcRequest message = getKdcRequest( tgt, requestBody );

        handler.messageReceived( session, message );

        TicketGrantReply reply = ( TicketGrantReply ) session.getMessage();

        KerberosTime expectedRenewTillTime = tgt.getEncTicketPart().getRenewTill();

        boolean isClose = Math.abs( reply.getRenewTill().getTime() - expectedRenewTillTime.getTime() ) < 5000;

        assertTrue( "Expected renew till time", isClose );

    }

    /**

     * "The TGS exchange between a client and the Kerberos TGS is initiated by a

     * client when ... it seeks to obtain a proxy ticket."

     *

     * @throws Exception

     */

    @Test

    public void testProxyTicket() throws Exception

    {

        // Get the mutable ticket part.

        KerberosPrincipal clientPrincipal = new KerberosPrincipal( "hnelson@EXAMPLE.COM" );

        EncTicketPartModifier encTicketPartModifier = getTicketArchetype( clientPrincipal );

        // Make changes to test.

        encTicketPartModifier.setFlag( TicketFlag.PROXIABLE );

        // Seal the ticket for the server.

        KerberosPrincipal serverPrincipal = new KerberosPrincipal( "krbtgt/EXAMPLE.COM@EXAMPLE.COM" );

        String passPhrase = "randomKey";

        EncryptionKey serverKey = getEncryptionKey( serverPrincipal, passPhrase );

        Ticket tgt = getTicket( encTicketPartModifier, serverPrincipal, serverKey );

        RequestBodyModifier modifier = new RequestBodyModifier();

        modifier.setServerName( getPrincipalName( "ldap/ldap.example.com@EXAMPLE.COM" ) );

        modifier.setRealm( "EXAMPLE.COM" );

        modifier.setEType( config.getEncryptionTypes() );

        modifier.setNonce( random.nextInt() );

        KdcOptions kdcOptions = new KdcOptions();

        kdcOptions.set( KdcOptions.PROXY );

        modifier.setKdcOptions( kdcOptions );

        long now = System.currentTimeMillis();

        KerberosTime requestedEndTime = new KerberosTime( now + 1 * KerberosTime.DAY );

        modifier.setTill( requestedEndTime );

        HostAddress[] address =

            { new HostAddress( InetAddress.getByName( null ) ) };

        HostAddresses addresses = new HostAddresses( address );

        modifier.setAddresses( addresses );

        RequestBody requestBody = modifier.getRequestBody();

        KdcRequest message = getKdcRequest( tgt, requestBody );

        handler.messageReceived( session, message );

        TicketGrantReply reply = ( TicketGrantReply ) session.getMessage();

        assertTrue( "PROXY flag", reply.getFlags().isProxy() );

        assertFalse( "INVALID flag", reply.getFlags().isInvalid() );

        assertTrue( "PROXY flag", reply.getTicket().getEncTicketPart().getFlags().isProxy() );

        assertFalse( "INVALID flag", reply.getTicket().getEncTicketPart().getFlags().isInvalid() );

        assertNotNull( reply.getTicket().getEncTicketPart().getClientAddresses() );

    }

    /**

     * "The TGS exchange between a client and the Kerberos TGS is initiated by a

     * client when ... it seeks to obtain a forwarded ticket."

     *

     * @throws Exception

     */

    @Test

    public void testForwardedTicket() throws Exception

    {

        // Get the mutable ticket part.

        KerberosPrincipal clientPrincipal = new KerberosPrincipal( "hnelson@EXAMPLE.COM" );

        EncTicketPartModifier encTicketPartModifier = getTicketArchetype( clientPrincipal );

        // Make changes to test.

        encTicketPartModifier.setFlag( TicketFlag.FORWARDABLE );

        // Seal the ticket for the server.

        KerberosPrincipal serverPrincipal = new KerberosPrincipal( "krbtgt/EXAMPLE.COM@EXAMPLE.COM" );

        String passPhrase = "randomKey";

        EncryptionKey serverKey = getEncryptionKey( serverPrincipal, passPhrase );

        Ticket tgt = getTicket( encTicketPartModifier, serverPrincipal, serverKey );

        RequestBodyModifier modifier = new RequestBodyModifier();

        modifier.setServerName( getPrincipalName( "ldap/ldap.example.com@EXAMPLE.COM" ) );

        modifier.setRealm( "EXAMPLE.COM" );

        modifier.setEType( config.getEncryptionTypes() );

        modifier.setNonce( random.nextInt() );

        KdcOptions kdcOptions = new KdcOptions();

        kdcOptions.set( KdcOptions.FORWARDED );

        modifier.setKdcOptions( kdcOptions );

        long now = System.currentTimeMillis();

        KerberosTime requestedEndTime = new KerberosTime( now + 1 * KerberosTime.DAY );

        modifier.setTill( requestedEndTime );

        HostAddress[] address =

            { new HostAddress( InetAddress.getByName( null ) ) };

        HostAddresses addresses = new HostAddresses( address );

        modifier.setAddresses( addresses );

        RequestBody requestBody = modifier.getRequestBody();

        KdcRequest message = getKdcRequest( tgt, requestBody );

        handler.messageReceived( session, message );

        TicketGrantReply reply = ( TicketGrantReply ) session.getMessage();

        assertTrue( "FORWARDED flag", reply.getFlags().isForwarded() );

        assertFalse( "INVALID flag", reply.getFlags().isInvalid() );

        assertTrue( "FORWARDED flag", reply.getTicket().getEncTicketPart().getFlags().isForwarded() );

        assertFalse( "INVALID flag", reply.getTicket().getEncTicketPart().getFlags().isInvalid() );

        assertNotNull( reply.getTicket().getEncTicketPart().getClientAddresses() );

    }

    /**

     * As is the case for all application servers, expired tickets are not

     * accepted by the TGS, so once a renewable or TGT expires, the client

     * must use a separate exchange to obtain valid tickets.

     *

     * @throws Exception

     */

    @Test

    public void testExpiredTgt() throws Exception

    {

        // Get the mutable ticket part.

        KerberosPrincipal clientPrincipal = new KerberosPrincipal( "hnelson@EXAMPLE.COM" );

        EncTicketPartModifier encTicketPartModifier = getTicketArchetype( clientPrincipal );

        // Make changes to test.

        encTicketPartModifier.setEndTime( new KerberosTime( 0 ) );

        // Seal the ticket for the server.

        KerberosPrincipal serverPrincipal = new KerberosPrincipal( "krbtgt/EXAMPLE.COM@EXAMPLE.COM" );

        String passPhrase = "randomKey";

        EncryptionKey serverKey = getEncryptionKey( serverPrincipal, passPhrase );

        Ticket tgt = getTicket( encTicketPartModifier, serverPrincipal, serverKey );

        RequestBodyModifier modifier = new RequestBodyModifier();

        modifier.setServerName( getPrincipalName( "hnelson" ) );

        modifier.setRealm( "EXAMPLE.COM" );

        modifier.setEType( config.getEncryptionTypes() );

        modifier.setNonce( random.nextInt() );

        KdcOptions kdcOptions = new KdcOptions();

        modifier.setKdcOptions( kdcOptions );

        long now = System.currentTimeMillis();

        KerberosTime requestedEndTime = new KerberosTime( now + KerberosTime.DAY );

        modifier.setTill( requestedEndTime );

        RequestBody requestBody = modifier.getRequestBody();

        KdcRequest message = getKdcRequest( tgt, requestBody );

        handler.messageReceived( session, message );

        ErrorMessage error = ( ErrorMessage ) session.getMessage();

        assertEquals( "Ticket expired", 32, error.getErrorCode() );

    }

    /**

     * As is the case for all application servers, expired tickets are not accepted

     * by the TGS, so once a renewable or TGT expires, the client must use a separate

     * exchange to obtain valid tickets.

     *

     * @throws Exception

     */

    @Test

    public void testExpiredRenewableTicket() throws Exception

    {

        // Get the mutable ticket part.

        KerberosPrincipal clientPrincipal = new KerberosPrincipal( "hnelson@EXAMPLE.COM" );

        EncTicketPartModifier encTicketPartModifier = getTicketArchetype( clientPrincipal );

        // Make changes to test.

        encTicketPartModifier.setFlag( TicketFlag.RENEWABLE );

        encTicketPartModifier.setRenewTill( new KerberosTime( 0 ) );

        // Seal the ticket for the server.

        KerberosPrincipal serverPrincipal = new KerberosPrincipal( "ldap/ldap.example.com@EXAMPLE.COM" );

        String passPhrase = "randomKey";

        EncryptionKey serverKey = getEncryptionKey( serverPrincipal, passPhrase );

        Ticket tgt = getTicket( encTicketPartModifier, serverPrincipal, serverKey );

        RequestBodyModifier modifier = new RequestBodyModifier();

        modifier.setServerName( getPrincipalName( "ldap/ldap.example.com@EXAMPLE.COM" ) );

        modifier.setRealm( "EXAMPLE.COM" );

        modifier.setEType( config.getEncryptionTypes() );

        modifier.setNonce( random.nextInt() );

        KdcOptions kdcOptions = new KdcOptions();

        kdcOptions.set( KdcOptions.RENEW );

        modifier.setKdcOptions( kdcOptions );

        long now = System.currentTimeMillis();

        KerberosTime requestedEndTime = new KerberosTime( now + KerberosTime.DAY );

        modifier.setTill( requestedEndTime );

        RequestBody requestBody = modifier.getRequestBody();

        KdcRequest message = getKdcRequest( tgt, requestBody );

        handler.messageReceived( session, message );

        ErrorMessage error = ( ErrorMessage ) session.getMessage();

        assertEquals( "Ticket expired", 32, error.getErrorCode() );

    }

    /**

     * Tests when a renewable ticket is presented for renewal, that if the RENEW

     * flag is NOT set, the ticket is renewed for the endtime of the presented

     * ticket, as though it were a TGT.

     *

     * @throws Exception

     */

    @Test

    public void testRenewableTicketNoRenew() throws Exception

    {

        long now = System.currentTimeMillis();

        // Get the mutable ticket part.

        KerberosPrincipal clientPrincipal = new KerberosPrincipal( "hnelson@EXAMPLE.COM" );

        EncTicketPartModifier encTicketPartModifier = getTicketArchetype( clientPrincipal );

        // Make changes to test.

        encTicketPartModifier.setFlag( TicketFlag.RENEWABLE );

        encTicketPartModifier.setStartTime( new KerberosTime( now - KerberosTime.DAY / 2 ) );

        encTicketPartModifier.setEndTime( new KerberosTime( now + KerberosTime.DAY / 2 ) );

        // Seal the ticket for the server.

        KerberosPrincipal serverPrincipal = new KerberosPrincipal( "ldap/ldap.example.com@EXAMPLE.COM" );

        String passPhrase = "randomKey";

        EncryptionKey serverKey = getEncryptionKey( serverPrincipal, passPhrase );

        Ticket tgt = getTicket( encTicketPartModifier, serverPrincipal, serverKey );

        RequestBodyModifier modifier = new RequestBodyModifier();

        modifier.setServerName( getPrincipalName( "ldap/ldap.example.com@EXAMPLE.COM" ) );

        modifier.setRealm( "EXAMPLE.COM" );

        modifier.setEType( config.getEncryptionTypes() );

        modifier.setNonce( random.nextInt() );

        KdcOptions kdcOptions = new KdcOptions();

        modifier.setKdcOptions( kdcOptions );

        KerberosTime requestedEndTime = new KerberosTime( now + KerberosTime.DAY / 2 );

        modifier.setTill( requestedEndTime );

        RequestBody requestBody = modifier.getRequestBody();

        KdcRequest message = getKdcRequest( tgt, requestBody );

        handler.messageReceived( session, message );

        TicketGrantReply reply = ( TicketGrantReply ) session.getMessage();

        KerberosTime expectedEndTime = tgt.getEncTicketPart().getEndTime();

        boolean isClose = Math.abs( reply.getEndTime().getTime() - expectedEndTime.getTime() ) < 5000;

        assertTrue( "Expected renew till time", isClose );

    }

    /**

     * Tests when a renewable ticket is presented for renewal, that if the RENEW

     * flag is set, the ticket is renewed for the lifetime of the presented ticket.

     *

     * @throws Exception

     */

    @Test

    public void testRenewableTicketRenewal() throws Exception

    {

        long now = System.currentTimeMillis();

        // Get the mutable ticket part.

        KerberosPrincipal clientPrincipal = new KerberosPrincipal( "hnelson@EXAMPLE.COM" );

        EncTicketPartModifier encTicketPartModifier = getTicketArchetype( clientPrincipal );

        // Make changes to test.

        encTicketPartModifier.setFlag( TicketFlag.RENEWABLE );

        encTicketPartModifier.setStartTime( new KerberosTime( now - KerberosTime.DAY / 2 ) );

        encTicketPartModifier.setEndTime( new KerberosTime( now + KerberosTime.DAY / 2 ) );

        // Seal the ticket for the server.

        KerberosPrincipal serverPrincipal = new KerberosPrincipal( "ldap/ldap.example.com@EXAMPLE.COM" );

        String passPhrase = "randomKey";

        EncryptionKey serverKey = getEncryptionKey( serverPrincipal, passPhrase );

        Ticket tgt = getTicket( encTicketPartModifier, serverPrincipal, serverKey );

        RequestBodyModifier modifier = new RequestBodyModifier();

        modifier.setServerName( getPrincipalName( "ldap/ldap.example.com@EXAMPLE.COM" ) );

        modifier.setRealm( "EXAMPLE.COM" );

        modifier.setEType( config.getEncryptionTypes() );

        modifier.setNonce( random.nextInt() );

        KdcOptions kdcOptions = new KdcOptions();

        kdcOptions.set( KdcOptions.RENEW );

        modifier.setKdcOptions( kdcOptions );

        KerberosTime requestedEndTime = new KerberosTime( now + KerberosTime.DAY / 2 );

        modifier.setTill( requestedEndTime );

        RequestBody requestBody = modifier.getRequestBody();

        KdcRequest message = getKdcRequest( tgt, requestBody );

        handler.messageReceived( session, message );

        TicketGrantReply reply = ( TicketGrantReply ) session.getMessage();

        KerberosTime expectedEndTime = new KerberosTime( now + KerberosTime.DAY );

        boolean isClose = Math.abs( reply.getEndTime().getTime() - expectedEndTime.getTime() ) < 5000;

        assertTrue( "Expected renew till time", isClose );

    }

    /**

     * Test when an unsupported encryption type is requested, that the request is

     * rejected with the correct error message.

     *

     * "If the server cannot accommodate any encryption type requested by the

     * client, an error message with code KDC_ERR_ETYPE_NOSUPP is returned."

     *

     * @throws Exception

     */

    @Test

    public void testEncryptionTypeNoSupport() throws Exception

    {

        RequestBodyModifier modifier = new RequestBodyModifier();

        modifier.setServerName( getPrincipalName( "krbtgt/EXAMPLE.COM@EXAMPLE.COM" ) );

        modifier.setRealm( "EXAMPLE.COM" );

        Set<EncryptionType> encryptionTypes = new HashSet<EncryptionType>();

        encryptionTypes.add( EncryptionType.DES3_CBC_MD5 );

        modifier.setEType( encryptionTypes );

        modifier.setKdcOptions( new KdcOptions() );

        long now = System.currentTimeMillis();

        KerberosTime requestedEndTime = new KerberosTime( now + KerberosTime.DAY );

        modifier.setTill( requestedEndTime );

        KdcRequest message = new KdcRequest( 5, KerberosMessageType.TGS_REQ, null, modifier.getRequestBody() );

        handler.messageReceived( session, message );

        ErrorMessage error = ( ErrorMessage ) session.getMessage();

        assertEquals( "KDC has no support for encryption type", 14, error.getErrorCode() );

    }

    /**

     * Tests that when a server principal is not configured with Kerberos keys that

     * the correct error message is returned.

     *

     * @throws Exception

     */

    @Test

    public void testServerNullKey() throws Exception

    {

        KerberosPrincipal clientPrincipal = new KerberosPrincipal( "hnelson@EXAMPLE.COM" );

        KerberosPrincipal serverPrincipal = new KerberosPrincipal( "krbtgt/EXAMPLE.COM@EXAMPLE.COM" );

        String serverPassword = "randomKey";

        Ticket tgt = getTgt( clientPrincipal, serverPrincipal, serverPassword );

        RequestBodyModifier modifier = new RequestBodyModifier();

        modifier.setServerName( getPrincipalName( "tquist" ) );

        modifier.setRealm( "EXAMPLE.COM" );

        modifier.setEType( config.getEncryptionTypes() );

        modifier.setNonce( random.nextInt() );

        KdcOptions kdcOptions = new KdcOptions();

        modifier.setKdcOptions( kdcOptions );

        long currentTime = System.currentTimeMillis();

        KerberosTime requestedEndTime = new KerberosTime( currentTime + KerberosTime.DAY );

        modifier.setTill( requestedEndTime );

        RequestBody requestBody = modifier.getRequestBody();

        KdcRequest message = getKdcRequest( tgt, requestBody );

        handler.messageReceived( session, message );

        ErrorMessage error = ( ErrorMessage ) session.getMessage();

        assertEquals( "The client or server has a null key", 9, error.getErrorCode() );

    }

    /**

     * Tests when the starttime is absent and the POSTDATED option has not been

     * specified, that the starttime of the ticket is set to the authentication

     * server's current time.

     *

     * "If the requested starttime is absent, indicates a time in the past,

     * or is within the window of acceptable clock skew for the KDC and the

     * POSTDATE option has not been specified, then the starttime of the

     * ticket is set to the authentication server's current time."

     *

     * @throws Exception

     */

    @Test

    public void testStartTimeAbsentNoPostdate() throws Exception

    {

        // Get the mutable ticket part.

        KerberosPrincipal clientPrincipal = new KerberosPrincipal( "hnelson@EXAMPLE.COM" );

        EncTicketPartModifier encTicketPartModifier = getTicketArchetype( clientPrincipal );

        // Make changes to test.

        // Seal the ticket for the server.

        KerberosPrincipal serverPrincipal = new KerberosPrincipal( "krbtgt/EXAMPLE.COM@EXAMPLE.COM" );

        String passPhrase = "randomKey";

        EncryptionKey serverKey = getEncryptionKey( serverPrincipal, passPhrase );

        Ticket tgt = getTicket( encTicketPartModifier, serverPrincipal, serverKey );

        RequestBodyModifier modifier = new RequestBodyModifier();

        modifier.setServerName( getPrincipalName( "ldap/ldap.example.com@EXAMPLE.COM" ) );

        modifier.setRealm( "EXAMPLE.COM" );

        modifier.setEType( config.getEncryptionTypes() );

        modifier.setNonce( random.nextInt() );

        modifier.setKdcOptions( new KdcOptions() );

        long now = System.currentTimeMillis();

        KerberosTime requestedEndTime = new KerberosTime( now + KerberosTime.DAY );

        modifier.setTill( requestedEndTime );

        RequestBody requestBody = modifier.getRequestBody();

        KdcRequest message = getKdcRequest( tgt, requestBody );

        handler.messageReceived( session, message );

        TicketGrantReply reply = ( TicketGrantReply ) session.getMessage();

        KerberosTime expectedStartTime = new KerberosTime( now );

        boolean isClose = reply.getStartTime() == null

            || Math.abs( reply.getStartTime().getTime() - expectedStartTime.getTime() ) < 5000;

        assertTrue( "Expected start time", isClose );

    }

    /**

     * Tests when the starttime indicates a time in the past and the POSTDATED option

     * has not been specified, that the starttime of the ticket is set to the

     * authentication server's current time.

     *

     * "If the requested starttime is absent, indicates a time in the past,

     * or is within the window of acceptable clock skew for the KDC and the

     * POSTDATE option has not been specified, then the starttime of the

     * ticket is set to the authentication server's current time."

     *

     * @throws Exception

     */

    @Test

    public void testStartTimeInThePastNoPostdate() throws Exception

    {

        // Get the mutable ticket part.

        KerberosPrincipal clientPrincipal = new KerberosPrincipal( "hnelson@EXAMPLE.COM" );

        EncTicketPartModifier encTicketPartModifier = getTicketArchetype( clientPrincipal );

        // Make changes to test.

        // Seal the ticket for the server.

        KerberosPrincipal serverPrincipal = new KerberosPrincipal( "krbtgt/EXAMPLE.COM@EXAMPLE.COM" );

        String passPhrase = "randomKey";

        EncryptionKey serverKey = getEncryptionKey( serverPrincipal, passPhrase );

        Ticket tgt = getTicket( encTicketPartModifier, serverPrincipal, serverKey );

        RequestBodyModifier modifier = new RequestBodyModifier();

        modifier.setServerName( getPrincipalName( "ldap/ldap.example.com@EXAMPLE.COM" ) );

        modifier.setRealm( "EXAMPLE.COM" );

        modifier.setEType( config.getEncryptionTypes() );

        modifier.setNonce( random.nextInt() );

        modifier.setKdcOptions( new KdcOptions() );

        long now = System.currentTimeMillis();

        KerberosTime requestedStartTime = new KerberosTime( now + -1 * KerberosTime.DAY );

        modifier.setFrom( requestedStartTime );

        KerberosTime requestedEndTime = new KerberosTime( now + KerberosTime.DAY );

        modifier.setTill( requestedEndTime );

        RequestBody requestBody = modifier.getRequestBody();

        KdcRequest message = getKdcRequest( tgt, requestBody );

        handler.messageReceived( session, message );

        TicketGrantReply reply = ( TicketGrantReply ) session.getMessage();

        KerberosTime expectedStartTime = new KerberosTime( now );

        boolean isClose = reply.getStartTime() == null

            || Math.abs( reply.getStartTime().getTime() - expectedStartTime.getTime() ) < 5000;

        assertTrue( "Expected start time", isClose );

    }

    /**

     * Tests when the starttime is within the window of acceptable clock skew for

     * the KDC and the POSTDATED option has not been specified, that the starttime

     * of the ticket is set to the authentication server's current time.

     *

     * "If the requested starttime is absent, indicates a time in the past,

     * or is within the window of acceptable clock skew for the KDC and the

     * POSTDATE option has not been specified, then the starttime of the

     * ticket is set to the authentication server's current time."

     *

     * @throws Exception

     */

    @Test

    public void testStartTimeAcceptableClockSkewNoPostdate() throws Exception

    {

        // Get the mutable ticket part.

        KerberosPrincipal clientPrincipal = new KerberosPrincipal( "hnelson@EXAMPLE.COM" );

        EncTicketPartModifier encTicketPartModifier = getTicketArchetype( clientPrincipal );

        // Make changes to test.

        // Seal the ticket for the server.

        KerberosPrincipal serverPrincipal = new KerberosPrincipal( "krbtgt/EXAMPLE.COM@EXAMPLE.COM" );

        String passPhrase = "randomKey";

        EncryptionKey serverKey = getEncryptionKey( serverPrincipal, passPhrase );

        Ticket tgt = getTicket( encTicketPartModifier, serverPrincipal, serverKey );

        RequestBodyModifier modifier = new RequestBodyModifier();

        modifier.setServerName( getPrincipalName( "ldap/ldap.example.com@EXAMPLE.COM" ) );

        modifier.setRealm( "EXAMPLE.COM" );

        modifier.setEType( config.getEncryptionTypes() );

        modifier.setNonce( random.nextInt() );

        modifier.setKdcOptions( new KdcOptions() );

        long now = System.currentTimeMillis();

        KerberosTime requestedStartTime = new KerberosTime( now );

        modifier.setFrom( requestedStartTime );

        KerberosTime requestedEndTime = new KerberosTime( now + KerberosTime.DAY );

        modifier.setTill( requestedEndTime );

        RequestBody requestBody = modifier.getRequestBody();

        KdcRequest message = getKdcRequest( tgt, requestBody );

        handler.messageReceived( session, message );

        TicketGrantReply reply = ( TicketGrantReply ) session.getMessage();

        KerberosTime expectedStartTime = new KerberosTime( now );

        boolean isClose = reply.getStartTime() == null

            || Math.abs( reply.getStartTime().getTime() - expectedStartTime.getTime() ) < 5000;

        assertTrue( "Expected start time", isClose );

    }

    /**

     * Tests when a start time is after an end time that the request is rejected with the

     * correct error message.

     *

     * "If the requested expiration time minus the starttime (as determined above)

     * is less than a site-determined minimum lifetime, an error message with code

     * KDC_ERR_NEVER_VALID is returned."

     *

     * @throws Exception

     */

    @Test

    public void testStartTimeOrderNeverValid() throws Exception

    {

        // Get the mutable ticket part.

        KerberosPrincipal clientPrincipal = new KerberosPrincipal( "hnelson@EXAMPLE.COM" );

        EncTicketPartModifier encTicketPartModifier = getTicketArchetype( clientPrincipal );

        // Make changes to test.

        encTicketPartModifier.setFlag( TicketFlag.MAY_POSTDATE );

        // Seal the ticket for the server.

        KerberosPrincipal serverPrincipal = new KerberosPrincipal( "krbtgt/EXAMPLE.COM@EXAMPLE.COM" );

        String passPhrase = "randomKey";

        EncryptionKey serverKey = getEncryptionKey( serverPrincipal, passPhrase );

        Ticket tgt = getTicket( encTicketPartModifier, serverPrincipal, serverKey );

        RequestBodyModifier modifier = new RequestBodyModifier();

        modifier.setServerName( getPrincipalName( "ldap/ldap.example.com@EXAMPLE.COM" ) );