tests: port LDAP+Kerberos tests to pytest

[madhuriupadhye]

• Port three downstream krb_misc_bugzilla bash tests to upstream pytest
• BZ 773660: Clock skew errors logged to syslog
• BZ 869150: ldap_child handles missing keytab without segfault
• BZ 805281: Correct principal selected from multi-realm keytab

[gemini-code-assist]

Code Review

This pull request ports three bash tests for LDAP+Kerberos to pytest. The new tests are well-structured and cover important scenarios like clock skew handling, missing keytabs, and multi-realm principal selection. My review focuses on improving the robustness of the clock skew test by removing a hardcoded external dependency, which will make the test more reliable.

[madhuriupadhye]

/gemini review

[gemini-code-assist]

Code Review

This pull request ports three LDAP+Kerberos tests from bash to pytest, which is a great improvement for maintainability. The new tests are well-structured and cover important bug-fix scenarios.

My review has identified a few issues that should be addressed:

• A critical issue in requirements.txt where a dependency points to a personal fork. This must be changed to an official repository before merging.
• The tests have some reliability concerns. One test depends on a hardcoded external NTP server, which can cause flakiness.
• Two tests lack robust resource cleanup (for keytab files). If a test fails, it could leave the system in a modified state and affect subsequent test runs. I've suggested using try...finally blocks to ensure cleanup always happens.

Addressing these points will improve the reliability and maintainability of the new tests.

[thalman]

LGTM, thanks

We just have to wait for requirements.txt not to point to personal repo

[madhuriupadhye]

Tested with IDM-CI,

collected 3 items                                                                                                    

tests/test_ldap_krb5.py::test_ldap_krb5__clock_skew_errors_logged_to_syslog (ldap) PASSED
tests/test_ldap_krb5.py::test_ldap_krb5__ldap_child_handles_missing_keytab_without_segfault (ldap) PASSED
tests/test_ldap_krb5.py::test_ldap_krb5__keytab_selects_correct_principal_with_multiple_realms (ldap) PASSED

============================== 3 passed in 237.77s (0:03:57) =======================================

[danlavu]

This is great. We have quite a few more ldap/krb5 (multihost) tests. Before we move anymore should create a new topologycontroller that creates the host keytab and downloads it to the client to configures the client. I'm approving this now, and we can do that later, unless you want to do it now?

[madhuriupadhye]

This is great. We have quite a few more ldap/krb5 (multihost) tests. Before we move anymore should create a new topologycontroller that creates the host keytab and downloads it to the client to configures the client. I'm approving this now, and we can do that later, unless you want to do it now?

Created the 3rd commit in same PR for topologycontroller, thanks for suggesting,
SSSD/sssd-test-framework@346ba85

[madhuriupadhye]

Again tested with IDM-CI,

collected 3 items                                                                                                    

tests/test_ldap_krb5.py::test_ldap_krb5__clock_skew_errors_logged_to_syslog (ldap_krb5) PASSED
tests/test_ldap_krb5.py::test_ldap_krb5__ldap_child_handles_missing_keytab_without_segfault (ldap_krb5) PASSED
tests/test_ldap_krb5.py::test_ldap_krb5__keytab_selects_correct_principal_with_multiple_realms (ldap_krb5) PASSED

==================================== 3 passed in 204.14s (0:03:24) =================================

[danlavu]

This is great, thank you @madhuriupadhye

[thalman]

Tests looks good, thanks for the update.

Ping me when requirements.txt change is reverted an I will approve.

[thalman]

Thanks, ACK

[sssd-bot]

The pull request was accepted by @madhuriupadhye with the following PR CI status:

---

🟢 CodeQL (success)
🟢 osh-diff-scan:fedora-rawhide-x86_64:upstream (success)
🟢 rpm-build:centos-stream-10-x86_64:upstream (success)
🟢 rpm-build:fedora-42-x86_64:upstream (success)
🟢 rpm-build:fedora-43-x86_64:upstream (success)
🟢 rpm-build:fedora-44-x86_64:upstream (success)
🟢 rpm-build:fedora-rawhide-x86_64:upstream (success)
🟢 Analyze (target) / cppcheck (success)
🟢 ci / intgcheck (centos-10) (success)
🟢 ci / intgcheck (fedora-42) (success)
🟢 ci / intgcheck (fedora-43) (success)
🟢 ci / intgcheck (fedora-44) (success)
🟢 ci / intgcheck (fedora-45) (success)
🟢 ci / prepare (success)
🟢 ci / system (centos-10) (success)
🟢 ci / system (fedora-42) (success)
🟢 ci / system (fedora-43) (success)
🟢 ci / system (fedora-44) (success)
🟢 ci / system (fedora-45) (success)
➖ Coverity scan / coverity (skipped)
🟢 Static code analysis / codeql (success)
🟢 Static code analysis / pre-commit (success)
🟢 Static code analysis / python-system-tests (success)

---

There are unsuccessful or unfinished checks. Make sure that the failures are not related to this pull request before merging.