test

              "join: the password in unicodePwd (quoted, UTF-16LE) and in the secret file");

        CHECK(a["sAMAccountName"] == std::vector<std::string>{ "FENRIR1$" } && a["userAccountControl"][0] == "4096" &&

              a["msDS-SupportedEncryptionTypes"][0] == "24" && a["dNSHostName"][0] == "fenrir1.example.com" &&

              a["servicePrincipalName"].size() == 2, "join: the account's attributes");

              a["servicePrincipalName"] == std::vector<std::string>{ "HOST/FENRIR1", "HOST/fenrir1.example.com",

                                                                    "cifs/FENRIR1", "cifs/fenrir1.example.com" },

              "join: the account's attributes, cifs/ SPNs for SMB");

        struct stat st;

        CHECK(stat(secret.c_str(), &st) == 0 && (st.st_mode & 077) == 0, "join: the secret file root only");

        std::map<std::string, std::vector<std::string>> a2(o2.attrs.begin(), o2.attrs.end());

        CHECK(!again.created && pw2 != pw && a2["unicodePwd"][0] == utf16(pw2), "join again: the existing account, a new password");

        /* an older join with HOST/ only: adconnectd adds cifs/ */

        {

            LdapSource src(admin);

            src.modify("CN=FENRIR1,CN=Computers,DC=example,DC=com",

                       { { ldap::Connection::ModReplace, { "servicePrincipalName", { "HOST/FENRIR1", "host/fenrir1.example.com" } } } });

            std::vector<std::string> added = addMissingSpns(src, admin, "FENRIR1$");

            CHECK(added == (std::vector<std::string>{ "cifs/FENRIR1", "cifs/fenrir1.example.com" }), "SPNs: the missing cifs/ ones added");

            fake::Object o3;

            srv.object("CN=FENRIR1,CN=Computers,DC=example,DC=com", o3);

            std::map<std::string, std::vector<std::string>> a3(o3.attrs.begin(), o3.attrs.end());

            CHECK(a3["servicePrincipalName"].size() == 4, "SPNs: four on the account");

            CHECK(addMissingSpns(src, admin, "FENRIR1$").empty(), "SPNs: nothing to add the second time");

            CHECK(throws([&] { addMissingSpns(src, admin, "NOPE$"); }), "SPNs: no such account");

        }

        CHECK(leaveWith(admin, "FENRIR1$"), "leave: the computer account deleted");

        fake::Object gone;

        CHECK(!srv.object("CN=FENRIR1,CN=Computers,DC=example,DC=com", gone), "leave: no CN=FENRIR1 any more");