Merge ~ahasenack/ubuntu/+source/autofs:autofs-noble-merge-519 into ubuntu/+source/autofs:debian/sid

[Andreas Hasenack]

Last autofs merge for noble.

A lot of delta dropped due to upstream inclusion. Most of the remaining delta was sent to debian via PRs in salsa: https://salsa.debian.org/debian/autofs/-/merge_requests

Maybe I should file bugs instead to get some attention.

We have good DEP8 coverage with ldap and sasl authentication mechanisms, where we test:
shared_secret_mechs="DIGEST-MD5 SCRAM-SHA-1 SCRAM-SHA-224 SCRAM-SHA-256 SCRAM-SHA-384 SCRAM-SHA-512 NTLM CRAM-MD5"
gssapi_mechs="GSSAPI GSS-SPNEGO"

PPA: https://launchpad.net/~ahasenack/+archive/ubuntu/autofs-merge

DEP8: green

[Mitchell Dzurick (mitchdz)]

I took a look at this but don't have upload permissions yet so someone else will need to upload it.

The only thing I'd change is a small changelog nit below. Otherwise LGTM!

[Sergio Durigan Junior (sergiodj)]

Thanks, Andreas.

Package builds fine. dep8 tests are passing. git range-diff is OK as well; I manually verified that the dropped delta is indeed present in the new upstream release (which was a bit of a pain because upstream doesn't use a publicly available VCS). I agree with filing bugs; sometimes the Debian maintainer doesn't pay close attention to Salsa.

LGTM modulo whatever Mitchell flagged. +1

review: Approve

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: ahasenack, sergiodj
Uploaders: ahasenack, sergiodj
MP auto-approved

review: Approve

d3fb2c6... by Andreas Hasenack on 2024-02-29

merge-changelogs

8544330... by Andreas Hasenack on 2024-02-29

reconstruct-changelog

71624bc... by Andreas Hasenack on 2024-02-29

update-maintainer

[Andreas Hasenack (ahasenack)]

Updated the indentation in the changelog's last dropped entry

[Andreas Hasenack (ahasenack)]

Thanks all, uploaded:

Uploading autofs_5.1.9-1ubuntu1.dsc
Uploading autofs_5.1.9.orig.tar.xz
Uploading autofs_5.1.9-1ubuntu1.debian.tar.xz
Uploading autofs_5.1.9-1ubuntu1_source.buildinfo
Uploading autofs_5.1.9-1ubuntu1_source.changes

diff --git a/debian/changelog b/debian/changelog
index bcbf99c..c62615d 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,31 @@
+autofs (5.1.9-1ubuntu1) noble; urgency=medium
+
+  * Merge with Debian unstable (LP: #2040368). Remaining changes:
+    - Fix authenticated cifs mount failure caught by DEP8  (LP #1955851):
+      + d/t/smb-mount: fix setting the password of the smb test user
+    - d/t/control, d/t/ldap-map-sasl-auth: DEP8 tests for SASL
+      authentication mechanisms in LDAP maps, including shared secret
+      mechanisms and GSSAPI ones
+    - d/p/ntlm-crammd5-require-credentials.patch: fix NTLM and CRAM-MD5
+      authentication (LP #2023595)
+  * Dropped:
+    - d/p/fix-loop-under-run-in-cache_get_offset_parent.patch: fix crash
+      on s390x
+      [Included by upstream in 5.1.9]
+    - d/p/autofs-5.1.8-support-SCRAM-for-SASL-binding.patch: Support
+      SASL SCRAM authentication (LP #1987992)
+      [Included by upstream in 5.1.9]
+    - Switch to OpenLDAP for SASL binds (LP #1984073):
+      + d/p/autofs-5.1.8-prepare-for-OpenLDAP-SASL-binding.patch: autoconf
+        changes
+      + d/p/autofs-5.1.8-let-OpenLDAP-handle-SASL-binding.patch: use
+        OpenLDAP for SASL binds
+      + d/p/autofs-5.1.8-ldap_sasl_interactive_bind-needs-credentials-for-auto-detection.patch:
+        fix auto-detection case
+      [Included by upstream in 5.1.9]
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 29 Feb 2024 11:05:09 -0300
+
 autofs (5.1.9-1) unstable; urgency=medium
 
   * New upstream release.
@@ -19,6 +47,36 @@ autofs (5.1.9-1) unstable; urgency=medium
 
  -- Mike Gabriel <[e-mail]>  Sun, 11 Feb 2024 18:45:01 +0100
 
+autofs (5.1.8-3.1ubuntu1) mantic; urgency=medium
+
+  * Merge with Debian unstable (LP: #2031241). Remaining changes:
+    - Fix authenticated cifs mount failure caught by DEP8  (LP #1955851):
+      + d/t/smb-mount: fix setting the password of the smb test user
+      + d/p/fix-loop-under-run-in-cache_get_offset_parent.patch: fix crash
+        on s390x
+    - d/p/autofs-5.1.8-support-SCRAM-for-SASL-binding.patch: Support
+      SASL SCRAM authentication (LP #1987992):
+    - Switch to OpenLDAP for SASL binds (LP #1984073):
+      + d/p/autofs-5.1.8-prepare-for-OpenLDAP-SASL-binding.patch: autoconf
+        changes
+      + d/p/autofs-5.1.8-let-OpenLDAP-handle-SASL-binding.patch: use
+        OpenLDAP for SASL binds
+      + d/p/autofs-5.1.8-ldap_sasl_interactive_bind-needs-credentials-for-auto-detection.patch:
+        fix auto-detection case
+      + d/p/support-external-cc-for-gssapi-bind.patch: fix external
+        credentials cache case when using openldap for sasl binds
+    - d/t/control, d/t/ldap-map-sasl-auth: DEP8 tests for SASL
+      authentication mechanisms in LDAP maps, including shared secret
+      mechanisms and GSSAPI ones
+    - d/p/ntlm-crammd5-require-credentials.patch: fix NTLM and CRAM-MD5
+      authentication (LP #2023595)
+  * Dropped:
+    - d/p/autofs-5.1.8-ldap-kerberos-leads-to-automount-hang-p.patch: fix lock
+      imbalance (LP #1982219)
+      [In 5.1.8-3]
+
+ -- Andreas Hasenack <[e-mail]>  Sun, 13 Aug 2023 11:04:40 -0300
+
 autofs (5.1.8-3.1) unstable; urgency=medium
 
   * Non-maintainer upload (with approval by maintainer).
@@ -35,6 +93,49 @@ autofs (5.1.8-3) unstable; urgency=medium
 
  -- Mike Gabriel <[e-mail]>  Wed, 05 Jul 2023 11:50:21 +0200
 
+autofs (5.1.8-2ubuntu2) mantic; urgency=medium
+
+  * Fix NTLM and CRAM-MD5 SASL authentication (LP: #2023595):
+    - d/p/ntlm-crammd5-require-credentials.patch: fix NTLM and CRAM-MD5
+    - d/t/ldap-map-sasl-auth: add NTLM and CRAM-MD5 to the test
+  * d/p/autofs-5.1.8-support-SCRAM-for-SASL-binding.patch: fix typo in
+    the "Origin" DEP3 header
+  * d/t/ldap-map-sasl-auth, d/t/control: add a missing 2>&1 to the test,
+    which allows us to drop the allow-stderr flag from the control file
+
+ -- Andreas Hasenack <[e-mail]>  Tue, 25 Jul 2023 11:29:10 -0300
+
+autofs (5.1.8-2ubuntu1) mantic; urgency=medium
+
+  * Merge with Debian unstable (LP: #2018059). Remaining changes:
+    - Fix authenticated cifs mount failure caught by DEP8  (LP #1955851):
+      + d/t/smb-mount: fix setting the password of the smb test user
+      + d/p/fix-loop-under-run-in-cache_get_offset_parent.patch: fix crash
+        on s390x
+    - d/p/autofs-5.1.8-ldap-kerberos-leads-to-automount-hang-p.patch: fix lock
+      imbalance (LP #1982219)
+    - Support SASL SCRAM authentication (LP #1987992):
+      + d/p/autofs-5.1.8-support-SCRAM-for-SASL-binding.patch: allow
+        SCRAM-SHA-*
+    - Switch to OpenLDAP for SASL binds (LP #1984073):
+      + d/p/autofs-5.1.8-prepare-for-OpenLDAP-SASL-binding.patch: autoconf
+        changes
+      + d/p/autofs-5.1.8-let-OpenLDAP-handle-SASL-binding.patch: use
+        OpenLDAP for SASL binds
+      + d/p/autofs-5.1.8-ldap_sasl_interactive_bind-needs-credentials-for-auto-detection.patch:
+        fix auto-detection case
+      + d/p/support-external-cc-for-gssapi-bind.patch: fix external
+        credentials cache case when using openldap for sasl binds
+    - d/t/control, d/t/ldap-map-sasl-auth: DEP8 tests for SASL
+      authentication mechanisms in LDAP maps, including shared secret
+      mechanisms and GSSAPI ones
+  * Dropped:
+    - d/p/fix-nfsv4-only-mounts-should-not-use-rpcbind.patch:
+      Make NFSv4-only mounts not depend on rpcbind.  (LP #1970264)
+      [In 5.1.8-2]
+
+ -- Andreas Hasenack <[e-mail]>  Mon, 12 Jun 2023 17:06:05 -0300
+
 autofs (5.1.8-2) unstable; urgency=medium
 
   [ Mike Gabriel ]
@@ -48,6 +149,61 @@ autofs (5.1.8-2) unstable; urgency=medium
 
  -- Mike Gabriel <[e-mail]>  Fri, 19 May 2023 10:25:31 +0200
 
+autofs (5.1.8-1ubuntu6) mantic; urgency=medium
+
+  * d/t/ldap-map-sasl-auth: wait for slapd to be ready (LP: #2023232)
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 08 Jun 2023 14:02:00 -0300
+
+autofs (5.1.8-1ubuntu5) mantic; urgency=medium
+
+  * Support SASL SCRAM authentication (LP: #1987992):
+    - d/p/autofs-5.1.8-support-SCRAM-for-SASL-binding.patch: allow
+      SCRAM-SHA-*
+  * Switch to OpenLDAP for SASL binds (LP: #1984073):
+    - d/p/autofs-5.1.8-prepare-for-OpenLDAP-SASL-binding.patch: autoconf
+      changes
+    - d/p/autofs-5.1.8-let-OpenLDAP-handle-SASL-binding.patch: use
+      OpenLDAP for SASL binds
+    - d/p/autofs-5.1.8-ldap_sasl_interactive_bind-needs-credentials-for-auto-detection.patch:
+      fix auto-detection case
+    - d/p/support-external-cc-for-gssapi-bind.patch: fix external
+      credentials cache case when using openldap for sasl binds
+  * d/t/control, d/t/ldap-map-sasl-auth: DEP8 tests for SASL
+    authentication mechanisms in LDAP maps, including shared secret
+    mechanisms and GSSAPI ones
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 31 May 2023 14:32:36 -0300
+
+autofs (5.1.8-1ubuntu4) lunar; urgency=medium
+
+  * No-change rebuild against libldap-2
+
+ -- Steve Langasek <[e-mail]>  Thu, 15 Dec 2022 19:43:08 +0000
+
+autofs (5.1.8-1ubuntu3) kinetic; urgency=medium
+
+  * d/p/autofs-5.1.8-ldap-kerberos-leads-to-automount-hang-p.patch: fix
+    lock imbalance (LP: #1982219)
+
+ -- Christian Ehrhardt <[e-mail]>  Thu, 28 Jul 2022 07:27:10 +0200
+
+autofs (5.1.8-1ubuntu2) kinetic; urgency=medium
+
+  * d/p/fix-nfsv4-only-mounts-should-not-use-rpcbind.patch:
+    Make NFSv4-only mounts not depend on rpcbind.  (LP: #1970264)
+
+ -- Sergio Durigan Junior <[e-mail]>  Thu, 28 Apr 2022 23:05:15 -0400
+
+autofs (5.1.8-1ubuntu1) jammy; urgency=medium
+
+  * Fix authenticated cifs mount failure caught by DEP8  (LP: #1955851):
+    - d/t/smb-mount: fix setting the password of the smb test user
+    - d/p/fix-loop-under-run-in-cache_get_offset_parent.patch: fix crash
+      on s390x
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 20 Jan 2022 15:16:09 -0300
+
 autofs (5.1.8-1) unstable; urgency=medium
 
   * New upstream release.
diff --git a/debian/control b/debian/control
index 0e368ff..fef09cc 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: autofs
 Section: utils
 Priority: optional
-Maintainer: Mike Gabriel <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Mike Gabriel <[e-mail]>
 Uploaders:
  Debian Edu Packaging Team <[e-mail]>,
 Build-Depends:
diff --git a/debian/patches/ntlm-crammd5-require-credentials.patch b/debian/patches/ntlm-crammd5-require-credentials.patch
 new file mode 100644
index 0000000..8a92899
--- /dev/null
+++ b/debian/patches/ntlm-crammd5-require-credentials.patch
@@ -0,0 +1,16 @@
+Description: NTLM and CRAM-MD5 also require creds
+ Noticed while writing the DEP8 test for SASL authentication.
+Author: Andreas Hasenack <[e-mail]>
+Forwarded: https://www.spinics.net/lists/autofs/msg02585.html
+Last-Update: 2023-05-24
+--- a/modules/lookup_ldap.c
++++ b/modules/lookup_ldap.c
+@@ -1208,6 +1208,8 @@
+ 	if (!strncmp(authtype, "PLAIN", strlen("PLAIN")) ||
+ 	    !strncmp(authtype, "DIGEST-MD5", strlen("DIGEST-MD5")) ||
+ 	    !strncmp(authtype, "SCRAM-SHA-", strlen("SCRAM-SHA-")) ||
++	    !strncmp(authtype, "NTLM", strlen("NTLM")) ||
++	    !strncmp(authtype, "CRAM-MD5", strlen("CRAM-MD5")) ||
+ 	    !strncmp(authtype, "LOGIN", strlen("LOGIN")))
+ 		return 1;
+ #endif
diff --git a/debian/patches/series b/debian/patches/series
index c8fc5ee..6cd3624 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -11,3 +11,4 @@ hardening-flags.patch
 spelling-error-fixes.patch
 fix-lookup-ldap-crash.patch
 fix-nfs4-mounts-in-auto-net.patch
+ntlm-crammd5-require-credentials.patch
diff --git a/debian/tests/control b/debian/tests/control
index 0058590..13c13cd 100644
--- a/debian/tests/control
+++ b/debian/tests/control
@@ -5,3 +5,7 @@ Restrictions: isolation-machine, needs-root, allow-stderr
 Tests: nfs-mount
 Depends: @, nfs-common, nfs-server
 Restrictions: isolation-machine, needs-root, allow-stderr
+
+Tests: ldap-map-sasl-auth
+Depends: @, autofs-ldap, nfs-common, nfs-server, slapd, ldap-utils, schema2ldif, sasl2-bin, libsasl2-modules, libsasl2-modules-db, libsasl2-modules-gssapi-mit, krb5-kdc, krb5-admin-server
+Restrictions: isolation-machine, needs-root
diff --git a/debian/tests/ldap-map-sasl-auth b/debian/tests/ldap-map-sasl-auth
 new file mode 100755
index 0000000..786cb07
--- /dev/null
+++ b/debian/tests/ldap-map-sasl-auth
@@ -0,0 +1,385 @@
+#!/bin/bash
+
+set -e
+
+sasluser="user$$"
+saslpass="pass$$"
+ldap_admin_pw="ldapadminpw$$"
+mydomain="example.fake"
+realm="${mydomain^^}" # uppercase
+myhostname="server.${mydomain}"
+ldap_suffix="dc=example,dc=fake"
+ldap_admin_dn="cn=admin,${ldap_suffix}"
+ldap_service_principal="ldap/${myhostname}"
+shared_secret_mechs="DIGEST-MD5 SCRAM-SHA-1 SCRAM-SHA-224 SCRAM-SHA-256 SCRAM-SHA-384 SCRAM-SHA-512 NTLM CRAM-MD5"
+gssapi_mechs="GSSAPI GSS-SPNEGO"
+test_file="test_file_$$"
+
+cleanup() {
+    if [ $? -ne 0 ]; then
+        echo "## Something failed, gathering logs"
+        echo
+        echo "## syslog:"
+        tail -n 300 /var/log/syslog
+        echo
+        echo "## mounts:"
+        mount
+    fi
+    rm -f /etc/sasldb2
+    # This is not meant to fully restore the state, but just don't leave a file
+    # with clear text and easy to guess credentials lying around.
+    # From sasl2-bin's postinst
+    echo '!' | saslpasswd2 -c 'no:such:user'
+    saslpasswd2 -d 'no:such:user'
+    chmod 0640 /etc/sasldb2
+    chown root:sasl /etc/sasldb2
+    rm -rf /storage
+    rm -rf /run/systemd/system/autofs.service.d
+    systemctl daemon-reload
+}
+
+trap cleanup EXIT
+
+check_slapd_ready() {
+    ldapwhoami -Q -Y EXTERNAL -H ldapi:/// > /dev/null 2>&1
+}
+
+wait_service_ready() {
+    local service="${1}"
+    local check_function="${2}"
+	local -i tries=5
+    echo -n "Waiting for ${service} to be ready "
+    while [ ${tries} -ne 0 ]; do
+        echo -n "."
+        if "${check_function}"; then
+            echo
+            break
+        fi
+        tries=$((tries-1))
+        sleep 1s
+    done
+    if [ ${tries} -eq 0 ]; then
+        echo "ERROR: ${service} is not ready"
+        return 1
+    fi
+}
+
+setup_slapd() {
+    local domain="$1"
+    local password="$2"
+    # MUST use REAL TABS as delimiters below!
+    debconf-set-selections << EOF
+slapd	slapd/domain	string	${domain}
+slapd	shared/organization	string	${domain}
+slapd	slapd/password1	password	${password}
+slapd	slapd/password2	password	${password}
+EOF
+    rm -rf /var/backups/*slapd* /var/backups/unknown*ldapdb
+    # so that slapd can read /etc/sasldb2
+    gpasswd -a openldap sasl > /dev/null 2>&1 || :
+    dpkg-reconfigure -fnoninteractive -pcritical slapd 2>&1
+    systemctl restart slapd # http://bugs.debian.org/1010678
+    wait_service_ready slapd check_slapd_ready
+    echo
+    echo "## Configuring slapd"
+    # olcSaslAuxprops: sasldb
+    # Configures openldap to check SASL secrets using the sasldb plugin and
+    # only allows authenticated users to read the ou=auto.indirect subtree.
+    # This removes the chance of any anonymous bind fallback by autofs from
+    # working, so we can be sure we are using an authenticated connection.
+    ldapmodify -Y EXTERNAL -H ldapi:/// 2>&1 <<EOF
+dn: cn=config
+changetype: modify
+replace: olcSaslAuxprops
+olcSaslAuxprops: sasldb
+-
+replace: olcLogLevel
+olcLogLevel: stats
+
+dn: olcDatabase={1}mdb,cn=config
+changetype: modify
+add: olcAccess
+olcAccess: {2}to dn.subtree="ou=auto.indirect,${ldap_suffix}"
+  by users read
+  by * none
+
+EOF
+    echo
+    echo "## Adding autofs schema to ldap"
+    ldap-schema-manager -i autofs.schema 2>&1
+
+    echo
+    echo "## Adding automount maps to ldap"
+    ldapadd -x -D "${ldap_admin_dn}" -w "${ldap_admin_pw}" <<EOF
+dn: ou=auto.indirect,${ldap_suffix}
+objectClass: top
+objectClass: automountMap
+ou: auto.indirect
+
+dn: cn=/,ou=auto.indirect,${ldap_suffix}
+objectClass: automount
+cn: /
+automountInformation: -fstype=nfs4 ${myhostname}:/&
+
+EOF
+
+}
+
+adjust_sasl_sec_props() {
+    # olcSaslSecProps: minssf=256
+    # Configures openldap to require a minimum strength factor of 256, which is
+    # kind of 256 bit encryption.
+    # This tests that #1984073 is fixed without having to deploy a Samba AD/DC server
+    # After this is done, further ldapmodify commands with -Y EXTERNAL will be blocked
+    # because the EXTERNAL mechanism has an ssf of zero.
+    ldapmodify -Y EXTERNAL -H ldapi:/// 2>&1 <<EOF
+dn: cn=config
+changetype: modify
+replace: olcSaslSecProps
+olcSaslSecProps: minssf=256
+
+EOF
+}
+
+adjust_hostname() {
+    local myhostname="$1"
+
+    echo "${myhostname}" > /etc/hostname
+    hostname "${myhostname}"
+    if ! grep -qE "${myhostname}" /etc/hosts; then
+        # just so it's resolvable
+        echo "127.0.1.10 ${myhostname}" >> /etc/hosts
+    fi
+}
+
+create_realm() {
+    local realm_name="$1"
+    local kerberos_server="$2"
+
+    # start fresh
+    rm -rf /var/lib/krb5kdc/*
+    rm -rf /etc/krb5kdc/*
+    rm -f /etc/krb5.keytab
+
+    # setup some defaults
+    cat > /etc/krb5kdc/kdc.conf <<EOF
+[kdcdefaults]
+    kdc_ports = 750,88
+[realms]
+    ${realm_name} = {
+	    database_name = /var/lib/krb5kdc/principal
+	    admin_keytab = FILE:/etc/krb5kdc/kadm5.keytab
+	    acl_file = /etc/krb5kdc/kadm5.acl
+	    key_stash_file = /etc/krb5kdc/stash
+	    kdc_ports = 750,88
+	    max_life = 10h 0m 0s
+	    max_renewable_life = 7d 0h 0m 0s
+	    default_principal_flags = +preauth
+    }
+EOF
+
+    cat > /etc/krb5.conf <<EOF
+[libdefaults]
+    default_realm = ${realm_name}
+    kdc_timesync = 1
+    ccache_type = 4
+    forwardable = true
+    proxiable = true
+    fcc-mit-ticketflags = true
+[realms]
+	${realm_name} = {
+		kdc = ${kerberos_server}
+		admin_server = ${kerberos_server}
+	}
+EOF
+    echo "# */admin *" > /etc/krb5kdc/kadm5.acl
+
+    # create the realm
+    kdb5_util create -s -P secretpassword
+
+    # restart services
+    systemctl restart krb5-kdc.service krb5-admin-server.service
+}
+
+create_krb_principal() {
+    local principal="$1"
+    local password="$2"
+
+    if [ -n "${password}" ]; then
+        kadmin.local -q "addprinc -pw ${password} ${principal}" 2>&1
+    else
+        kadmin.local -q "addprinc -randkey ${principal}" 2>&1
+    fi
+}
+
+extract_keytab() {
+    local principal="$1"
+
+    kadmin.local -q "ktadd ${principal}"
+}
+
+create_exports() {
+    mkdir -m 0755 -p /storage
+    cat > /etc/exports <<EOF
+/storage *(rw,sync,no_subtree_check)
+EOF
+    date > /storage/${test_file}
+    exportfs -rav
+}
+
+# we restart autofs a lot during this test
+override_systemd_throttling_autofs() {
+    mkdir -p /run/systemd/system/autofs.service.d
+    cat > /run/systemd/system/autofs.service.d/override.conf <<EOF
+[Unit]
+StartLimitIntervalSec=0
+EOF
+    systemctl daemon-reload
+}
+
+configure_autofs_ldap_auth_type() {
+    local authtype="${1}"
+    local -r conf_file="/etc/autofs_ldap_auth.conf"
+
+    if echo "${shared_secret_mechs}" | grep -qw "${authtype}"; then
+        cat > "${conf_file}" <<EOF
+<?xml version="1.0" ?>
+<!--
+This files contains a single entry with multiple attributes tied to it.
+See autofs_ldap_auth.conf(5) for more information.
+-->
+
+<autofs_ldap_sasl_conf
+    usetls="no"
+    tlsrequired="no"
+    authrequired="yes"
+    user="${sasluser}@${mydomain}"
+    authtype="${authtype}"
+    secret="${saslpass}"
+/>
+EOF
+    elif echo "${gssapi_mechs}" | grep -qw "${authtype}"; then
+        cat > "${conf_file}" <<EOF
+<?xml version="1.0" ?>
+<!--
+This files contains a single entry with multiple attributes tied to it.
+See autofs_ldap_auth.conf(5) for more information.
+-->
+
+<autofs_ldap_sasl_conf
+    usetls="no"
+    tlsrequired="no"
+    authrequired="yes"
+    authtype="${authtype}"
+    clientprinc="${sasluser}@${realm}"
+    credentialcache="/tmp/krb5cc_$(id -u)"
+/>
+EOF
+    fi
+    chown root:root "${conf_file}"
+    chmod 0600 "${conf_file}"
+    systemctl restart autofs.service
+}
+
+test_autofs_with_sasl_mech() {
+    local mech="${1}"
+    local output=""
+
+    configure_autofs_ldap_auth_type "${mech}"
+    echo
+
+    echo "## Confirming target is not mounted"
+    # careful to not inadvertently trigger the mount by accessing it,
+    # i.e., don't attempt to list /mnt/storage
+    output=$(ls -la /mnt/)
+    echo "${output}"
+    if echo "${output}" | grep -q storage; then
+        echo "## FAIL, target directory should be clear"
+        exit 1
+    fi
+    echo
+
+    echo "## Triggering a mount, and checking that the mountpoint has the test file"
+    # XXX global var test_file
+    ls -la /mnt/storage/${test_file}
+    echo
+    echo "## Checking that the mountpoint is nfsv4"
+    findmnt -M /mnt/storage -t nfs4
+    echo
+}
+
+
+override_systemd_throttling_autofs
+
+adjust_hostname "${myhostname}"
+
+echo "## Setting up Kerberos"
+create_realm "${realm}" "${myhostname}"
+create_krb_principal "${sasluser}" "${saslpass}"
+create_krb_principal "${ldap_service_principal}"
+extract_keytab "${ldap_service_principal}"
+chgrp sasl /etc/krb5.keytab
+chmod g+r /etc/krb5.keytab
+echo
+
+echo "## Setting up slapd"
+setup_slapd "${mydomain}" "${ldap_admin_pw}"
+echo
+
+echo "## Populating NFS export"
+create_exports
+echo
+
+echo "## Creating test user ${sasluser} in sasldb"
+rm -f /etc/sasldb2
+echo -n "${saslpass}" | saslpasswd2 -c -p "${sasluser}" -u "${mydomain}"
+chown root:sasl /etc/sasldb2
+chmod 0640 /etc/sasldb2
+echo
+
+echo "## Testing shared secret mechanism auth one by one before letting autofs try it"
+echo
+for mech in ${shared_secret_mechs}; do
+    echo "Testing mechanism ${mech}"
+    ldapwhoami -Y "${mech}" -U "${sasluser}"@"${mydomain}" -w "${saslpass}" 2>&1
+    echo
+done
+
+echo "## Testing GSSAPI mechanisms before letting autofs try it"
+echo
+echo "${saslpass}" | timeout --verbose 30 kinit "${sasluser}"
+for mech in ${gssapi_mechs}; do
+    echo "Testing mechanism ${mech}"
+    ldapwhoami -Y "${mech}" 2>&1
+    echo
+done
+
+echo "## Adding automount to nsswitch.conf"
+if ! grep -qE "^automount:" /etc/nsswitch.conf; then
+    echo "automount: files ldap" >> /etc/nsswitch.conf
+else
+    sed -i -r "s,^automount:.*,automount: files ldap," /etc/nsswitch.conf
+fi
+echo
+
+echo "## Setting up autofs"
+# "nobind" tells autofs to not try to bind mount if it detects the mount is
+# from localhost, i.e., we REALLY want to use NFS
+echo "/mnt ldap://${myhostname}/ou=auto.indirect,${ldap_suffix} nobind" > /etc/auto.master
+echo
+
+echo "## Testing autofs with SASL shared secret mechanisms"
+echo
+for mech in ${shared_secret_mechs}; do
+    echo "## Configuring autofs to use mechanism ${mech}"
+    test_autofs_with_sasl_mech "${mech}"
+done
+
+echo "## Testing autofs with SASL GSSAPI mechanisms"
+echo "## Configuring openldap to reject SASL binds with SSF<256"
+adjust_sasl_sec_props
+echo
+for mech in ${gssapi_mechs}; do
+    echo "## Configuring autofs to use mechanism ${mech}"
+    test_autofs_with_sasl_mech "${mech}"
+done
diff --git a/debian/tests/smb-mount b/debian/tests/smb-mount
index b9b685b..ccdde4b 100644
--- a/debian/tests/smb-mount
+++ b/debian/tests/smb-mount
@@ -35,7 +35,7 @@ create_user() {
 
     useradd -m "$username"
     echo "Setting samba password for the ${username} user"
-    echo "${password}\n${password}" | smbpasswd -s -a ${username}
+    (echo "${password}"; echo "${password}") | smbpasswd -s -a ${username}
 }