Tests: LDAP+KRB5 krb_misc tests by madhuriupadhye · Pull Request #8655 · SSSD/sssd

madhuriupadhye · 2026-04-28T11:00:34Z

Ported following test case:

kpasswd: BZ 847039: login works when krb5_kpasswd is unresolvable (kpasswd not needed for auth).
high UID: BZ 798655: auth and logs stay clean with a setuid(-1) helper process running.
password change: GH 677: SSH passwd with chpass_provider=krb5 logs initial auth in krb5_child.log.

Backporting of #8612

gemini-code-assist

Code Review

This pull request adds three new system tests to the SSSD test suite, covering authentication scenarios with unresolvable kpasswd, handling of setuid(-1) helper processes, and password changes via SSH. The review feedback highlights the need to explicitly set the SSSD debug level to ensure logs are captured correctly for assertions, suggests reordering log checks to ensure they run even if authentication fails, and recommends adding a sleep delay to avoid race conditions when reading log files.

spoore1

While I think some of the gemini review comments are worth at least taking note of, this backport to sssd-2-13 looks good to me.

sssd-bot · 2026-04-28T15:13:49Z

The pull request was accepted by @alexey-tikhonov with the following PR CI status:

🟢 rpm-build:centos-stream-10-x86_64:upstream (success)
🟢 rpm-build:fedora-42-x86_64:upstream (success)
🟢 rpm-build:fedora-43-x86_64:upstream (success)
🟢 rpm-build:fedora-44-x86_64:upstream (success)
🟢 rpm-build:fedora-rawhide-x86_64:upstream (success)

There are unsuccessful or unfinished checks. Make sure that the failures are not related to this pull request before merging.

danlavu · 2026-04-29T22:01:58Z

+
+
+@pytest.mark.importance("high")
+@pytest.mark.authentication


Don't use the marker; we should get rid of them.

danlavu · 2026-04-29T22:04:04Z

+@pytest.mark.authentication
+@pytest.mark.ticket(bz=847039)
+@pytest.mark.topology(KnownTopology.LDAP_KRB5)
+def test_ldap_krb5__auth_succeeds_when_kpasswd_unresolvable(client: Client, provider: GenericProvider, kdc: KDC):


Let us use similar language to the other authentication test cases.

test_ldap_krb5__user_can_login_when_kpasswd_cannot_be_resolved()

danlavu · 2026-04-29T22:07:26Z

+
+    BZ 847039: login works when krb5_kpasswd is unresolvable (kpasswd not needed for auth)
+
+    :setup:


We can assume that all the ldap_krb5 bits. Let's generalize the language.

Add user

Configure SSSD with an invalid value for 'krb5_passwd' and start SSSD

Is the change in the parameter value important? I'm not sure because it hasn't cached the user yet. I would find out if steps 3 and 4 are important.

danlavu · 2026-04-29T22:17:50Z

+        3. Set krb5_kpasswd to an unresolvable hostname
+        4. Restart SSSD and clear cache
+    :steps:
+        1. Run id for puser1 so NSS resolution goes through SSSD before SSH login


Are you sure this is correct? And not to populate the cache? I'd double-check, but also simply the language.

updated, please check.

danlavu · 2026-04-29T22:18:08Z

+        2. Authenticate puser1 with SSH password
+    :expectedresults:
+        1. id succeeds for puser1
+        2. SSH password authentication succeeds despite unresolvable kpasswd


Login successful

danlavu · 2026-04-29T22:18:31Z

+    """
+    :title: Auth succeeds when krb5_kpasswd is unresolvable
+
+    BZ 847039: login works when krb5_kpasswd is unresolvable (kpasswd not needed for auth)


We don't need the bz in the title, it's a marker already!

danlavu · 2026-04-29T22:20:20Z

+        2. SSH password authentication succeeds despite unresolvable kpasswd
+    :customerscenario: True
+    """
+    provider.user("puser1").add(uid=50001, gid=50001, password="12345678")


the uid and gid should automatically generate, and the password should default to 'Secret123'

danlavu · 2026-04-29T22:21:10Z

+    kdc.principal("puser1").add(password="12345678")
+
+    client.sssd.common.krb5_auth(kdc)
+    client.sssd.domain["krb5_realm"] = kdc.realm


The default krb5_provider code configures krb5_realm and krb5_server, so these parameters can be dropped.

def krb_provider(self, backend: KDC | GenericProvider) -> None: """ Set auth_provider to krb5 and populate krb5 options. This method sets ``auth_provider=krb5`` and configures ``krb5_realm``, ``krb5_server``, and ``krb5_kpasswd`` based on the provided backend (KDC, IPA, or AD). :param backend: Backend role object (KDC, IPA, or AD). :type backend: KDC | GenericProvider """ host = backend.host if not isinstance(host, BaseDomainHost): raise TypeError(f"Expected BaseDomainHost, got {type(host)}") host.client.setdefault("auth_provider", "krb5") host.client.setdefault("krb5_realm", host.realm) host.client.setdefault("krb5_server", host.hostname) host.client.setdefault("krb5_kpasswd", host.hostname)

danlavu · 2026-04-29T22:22:16Z

+
+    assert client.auth.ssh.password("puser1", "12345678"), "Auth failed when krb5_kpasswd is unresolvable!"
+
+


Go ahead and apply everything above to the following two test cases.

Ported following test case: - kpasswd: BZ 847039: login works when krb5_kpasswd is unresolvable (kpasswd not needed for auth). - high UID: BZ 798655: auth and logs stay clean with a setuid(-2) helper process running. - password change: GH 677: SSH passwd with chpass_provider=krb5 logs initial auth in krb5_child.log. Backporting of SSSD#8612 Signed-off-by: Madhuri Upadhye <mupadhye@redhat.com>

madhuriupadhye requested review from aplopez, danlavu and spoore1 and removed request for danlavu April 28, 2026 11:00

madhuriupadhye assigned aplopez and spoore1 Apr 28, 2026

gemini-code-assist Bot reviewed Apr 28, 2026

View reviewed changes

Comment thread src/tests/system/tests/test_ldap_krb5.py

Comment thread src/tests/system/tests/test_ldap_krb5.py Outdated

Comment thread src/tests/system/tests/test_ldap_krb5.py

Comment thread src/tests/system/tests/test_ldap_krb5.py

spoore1 approved these changes Apr 28, 2026

View reviewed changes

alexey-tikhonov added the no-backport This should go to target branch only. label Apr 28, 2026

alexey-tikhonov removed the request for review from aplopez April 28, 2026 14:50

alexey-tikhonov unassigned aplopez Apr 28, 2026

alexey-tikhonov added the Accepted label Apr 28, 2026

sssd-bot force-pushed the bp_ldap_krb branch from a385aec to ad6573f Compare April 28, 2026 15:13

alexey-tikhonov added Tests and removed Accepted labels Apr 28, 2026

danlavu requested changes Apr 29, 2026

View reviewed changes

madhuriupadhye mentioned this pull request Apr 30, 2026

[autobackport: sssd-2-12] Tests: LDAP+KRB5 krb_misc tests #8652

Open

madhuriupadhye force-pushed the bp_ldap_krb branch from ad6573f to a2bbc56 Compare April 30, 2026 15:36

madhuriupadhye force-pushed the bp_ldap_krb branch from a2bbc56 to 478c06d Compare April 30, 2026 16:03

madhuriupadhye requested a review from danlavu April 30, 2026 16:04


		BZ 847039: login works when krb5_kpasswd is unresolvable (kpasswd not needed for auth)

		:setup:


		assert client.auth.ssh.password("puser1", "12345678"), "Auth failed when krb5_kpasswd is unresolvable!"



		@pytest.mark.importance("high")
		@pytest.mark.authentication

Conversation

madhuriupadhye commented Apr 28, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

spoore1 left a comment

Choose a reason for hiding this comment

Uh oh!

sssd-bot commented Apr 28, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

danlavu Apr 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

danlavu Apr 29, 2026 •

edited

Loading