Tests: add ldap_sudo_search_base warning test

[spoore1]

When ldap_sudo_search_base is not set, SSSD defaults to searching the entire directory tree for sudoRole objects. In this case, we expect a warning message to be logged.

Assisted-By: Claude Code (Sonnet 4.6 (1M context))

[gemini-code-assist]

Warning

Gemini is experiencing higher than usual traffic and was unable to create the review. Please try again in a few hours by commenting /gemini review.

[jakub-vavra-cz]

The test looks pretty straightforward. I would be wary if the log is produced before the reading is done especially if the infra is under load.

I would probably check if ""ldap_sudo_search_base is not set"" is in the log and if not retry a few times before hard failing.

[sssd-bot]

The pull request was accepted by @jakub-vavra-cz with the following PR CI status:

---

🟢 CodeQL (success)
🟢 rpm-build:centos-stream-10-x86_64:upstream (success)
🟢 rpm-build:fedora-43-x86_64:upstream (success)
🟢 rpm-build:fedora-44-x86_64:upstream (success)
🔴 rpm-build:fedora-rawhide-x86_64:upstream (failure)
🟢 testing-farm:centos-stream-10-x86_64:upstream (success)
🔴 testing-farm:fedora-43-x86_64:upstream (failure)
🟢 testing-farm:fedora-44-x86_64:upstream (success)
🔴 testing-farm:fedora-rawhide-x86_64:upstream (failure)
➖ ci / intgcheck (skipped)
🔴 ci / prepare (failure)
➖ ci / system (skipped)
➖ Coverity scan / coverity (skipped)
🟢 Static code analysis / codeql (success)
🟢 Static code analysis / pre-commit (success)
🟢 Static code analysis / python-system-tests (success)

---

There are unsuccessful or unfinished checks. Make sure that the failures are not related to this pull request before merging.

[madhuriupadhye]

I testes with IDM-CI, with unpatched version assert is failing, and with patch version is passed.

unpatched version,

Failed tests/test_sudo.py::test_sudo__ldap_sudo_search_base_not_set_emits_warning (ldap)

        log = client.fs.read(client.sssd.logs.domain())
>       assert (
            "`ldap_sudo_search_base` is not set" in log
        ), "Domain log must contain security warning when ldap_sudo_search_base is not set!"
E       AssertionError: Domain log must contain security warning when ldap_sudo_search_base is not set!
E       assert '`ldap_sudo_search_base` is not set' in '(2026-07-08 17:08:11): [be[test]] [server_setup] (0x3f7c0): Starting with debug level = 0xfff0\n(2026-07-08 17:08:11): [be[test]] [server_setup] (0x0400): CONFDB: /var/lib/sss/db/config.ldb\n(2026-07-08 17:08:11): [be[test]] [log_string_option] (0x0100): Option lookup_family_order has value ipv4_first\n(2026-07-08 17:08:11): [be[test]] [dp_get_options] (0x0100): Option dns_resolver_timeout has value 6\n(2026-07-08 17:08:11): [be[test]] [dp_get_options] (0x0100): Option dns_resolver_op_timeout has value 3\n(2026-07-08 17:08:11): [be[test]] [dp_get_options] (0x0100): Option dns_resolver_server_timeout has value 1000\n(2026-07-08 17:08:11): [be[test]] [dp_get_options] (0x0100): Option dns_resolver_use_search_list is TRUE\n(2026-07-08 17:08:11): [be[test]] [log_string_option] (0x0100): Option dns_discovery_domain has value ldap.test\n(2026-07-08 17:08:11): [be[test]] [dp_get_options] (0x0100): Option failover_primary_timeout has value 31\n(2026-07-08 17:08:11): [be[test]] [be_res_get_opts] (0x0100): Lookup order: ipv4_first\n(2026-07-08 17:08:11): [be[test]] [recreate_ares_channel] (0x0100): Initializing new c-ares channel\n(2026-07-08 17:08:11): [be[test]] [fo_context_init] (0x0400... (0x2000): Inserting identity of sender [sssd.nss]: 995\n(2026-07-08 17:08:11): [be[test]] [dp_attach_req] (0x0400): [RID#3] DP Request [Subdomains #3]: REQ_TRACE: New request. Flags [0000].\n(2026-07-08 17:08:11): [be[test]] [dp_attach_req] (0x0400): [RID#3] Number of active DP request: 1\n(2026-07-08 17:08:11): [be[test]] [dp_find_method] (0x0100): [RID#3] Target [subdomains] is not initialized\n(2026-07-08 17:08:11): [be[test]] [_dp_req_recv] (0x0400): DP Request [Subdomains #3]: Receiving request data.\n(2026-07-08 17:08:11): [be[test]] [dp_req_destructor] (0x0400): DP Request [Subdomains #3]: Request removed.\n(2026-07-08 17:08:11): [be[test]] [dp_req_destructor] (0x0400): Number of active DP request: 0\n(2026-07-08 17:08:11): [be[test]] [sbus_issue_request_done] (0x0200): sssd.dataprovider.getDomains: Error [1432158215]: DP target is not configured\n(2026-07-08 17:08:11): [be[test]] [be_ptask_online_cb] (0x0400): Back end is online\n(2026-07-08 17:08:11): [be[test]] [be_ptask_enable] (0x0080): Task [SUDO Full Refresh]: already enabled\n(2026-07-08 17:08:11): [be[test]] [sdap_sudo_online_cb] (0x0400): We are back online. SUDO host information will be renewed on next refresh.'

client     = <sssd_test_framework.roles.client.Client object at 0x7fc46edeead0>
ldap       = <sssd_test_framework.roles.ldap.LDAP object at 0x7fc46eded090>
log        = '(2026-07-08 17:08:11): [be[test]] [server_setup] (0x3f7c0): Starting with debug level = 0xfff0\n(2026-07-08 17:08:11)... [be[test]] [sdap_sudo_online_cb] (0x0400): We are back online. SUDO host information will be renewed on next refresh.'

../sssd/src/tests/system/tests/test_sudo.py:647: AssertionError

with patched version,
Passed tests/test_sudo.py::test_sudo__ldap_sudo_search_base_not_set_emits_warning (ldap)

[spoore1]

I testes with IDM-CI, with unpatched version assert is failing, and with patch version is passed.

unpatched version,

Failed tests/test_sudo.py::test_sudo__ldap_sudo_search_base_not_set_emits_warning (ldap)
...

with patched version, Passed tests/test_sudo.py::test_sudo__ldap_sudo_search_base_not_set_emits_warning (ldap)

@madhuriupadhye thanks for testing this out. I have a couple of follow up questions:

We expect/want it to fail on older versions because this is a check for a fix related to a CVE right? This wouldn't be running in general on older versions outside of the latest supported by the branch right? Or would we?

On the topic of branches, should I add additional backports for this to cover other releases that the main fix was covered in?

• sssd-2-9-4
• sssd-2-9
• sssd-2-10
• sssd-2-12
• sssd-2-13

[madhuriupadhye]

I testes with IDM-CI, with unpatched version assert is failing, and with patch version is passed.
unpatched version,
Failed tests/test_sudo.py::test_sudo__ldap_sudo_search_base_not_set_emits_warning (ldap)
...
with patched version, Passed tests/test_sudo.py::test_sudo__ldap_sudo_search_base_not_set_emits_warning (ldap)

@madhuriupadhye thanks for testing this out. I have a couple of follow up questions:

We expect/want it to fail on older versions because this is a check for a fix related to a CVE right? This wouldn't be running in general on older versions outside of the latest supported by the branch right? Or would we?

On the topic of branches, should I add additional backports for this to cover other releases that the main fix was covered in?

* sssd-2-9-4

* sssd-2-9

* sssd-2-10

* sssd-2-12

* sssd-2-13

CVE is added in older RHEL versions also, so good to have in all branches.

[sssd-bot]

The pull request was accepted by @jakub-vavra-cz with the following PR CI status:

---

🟢 CodeQL (success)
🟢 osh-diff-scan:fedora-rawhide-x86_64:upstream (success)
🟢 rpm-build:centos-stream-10-x86_64:upstream (success)
🟢 rpm-build:fedora-43-x86_64:upstream (success)
🟢 rpm-build:fedora-44-x86_64:upstream (success)
🟢 rpm-build:fedora-rawhide-x86_64:upstream (success)
🟢 testing-farm:centos-stream-10-x86_64:upstream (success)
🟢 testing-farm:fedora-43-x86_64:upstream (success)
🟢 testing-farm:fedora-44-x86_64:upstream (success)
🔴 testing-farm:fedora-rawhide-x86_64:upstream (failure)
🟢 ci / intgcheck (centos-10) (success)
🟢 ci / intgcheck (fedora-43) (success)
🟢 ci / intgcheck (fedora-44) (success)
🔴 ci / intgcheck (fedora-45) (failure)
🟢 ci / prepare (success)
🟢 ci / system (centos-10) (success)
🟢 ci / system (fedora-43) (success)
🟢 ci / system (fedora-44) (success)
🔴 ci / system (fedora-45) (failure)
➖ Coverity scan / coverity (skipped)
🟢 Static code analysis / codeql (success)
🟢 Static code analysis / pre-commit (success)
🟢 Static code analysis / python-system-tests (success)

---

There are unsuccessful or unfinished checks. Make sure that the failures are not related to this pull request before merging.