Test: changes for krb_misc

[madhuriupadhye]

No description provided.

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces several enhancements to the SSSD test framework, primarily focusing on Kerberos-related testing utilities. It integrates new Kerberos keytab and authentication utilities into the client role, expands the capabilities for creating KDC principals with more specific options, and adds a robust method for changing user passwords via SSH, which is crucial for testing Kerberos password change flows. These changes collectively improve the framework's ability to simulate and test complex Kerberos authentication scenarios.

Highlights

• Kerberos Utilities Integration: Integrated Krb5AuthUtils and Krb5KeytabUtils into the Client role, providing direct access to Kerberos keytab and authentication functionalities for client-side testing.
• Enhanced KDC Principal Management: Extended the KDCPrincipal.add method to allow specifying requires_preauth and additional extra_options when creating Kerberos principals, enabling more granular control for testing scenarios like clock skew.
• SSH-based Password Change Utility: Introduced a new password_via_ssh method in authentication.py to facilitate changing user passwords over SSH using expect scripts, specifically designed for testing Kerberos initial authentication for password changes.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request introduces changes for Kerberos-related testing utilities. The modifications to kdc.py to allow for more flexible principal creation and the additions to client.py are well-implemented. I've identified a small area for improvement in a new expect script within authentication.py to enhance its reliability.

[danlavu]

So, I looked at the tests, and I don't think it's important to do this on LDAP/KRB5. I suggest we convert the tests and use the IPA provider. Thoughts?

[madhuriupadhye]

So, I looked at the tests, and I don't think it's important to do this on LDAP/KRB5. I suggest we convert the tests and use the IPA provider. Thoughts?

Only BZ 773660 (clock skew) can use IPA — krb5_child runs the same way under IPA auth.

BZ 869150 and BZ 805281 cannot — they require manual keytab manipulation (remove, replace), which breaks IPA enrollment. IPA owns its keytab and uses ipa_child instead of ldap_child, so the bug paths aren't exercised.

[danlavu]

Only BZ 773660 (clock skew) can use IPA — krb5_child runs the same way under IPA auth.

BZ 869150 and BZ 805281 cannot — they require manual keytab manipulation (remove, replace), which breaks IPA enrollment. IPA owns its keytab and uses ipa_child instead of ldap_child, so the bug paths aren't exercised.

Ack, understood. I'd like to better understand the case for passwd over SSH. If it's simply logging in via ssh, then issuing 'passwd', we should make it like the others.

Because we have

client.auth.passwd.password('tuser', 'Secret123', 'New_password123')

make it

client.auth.ssh.passwd.password('user', 'password', 'new_pass') and create the two method, passwd, passwd_with_output.

[madhuriupadhye]

Only BZ 773660 (clock skew) can use IPA — krb5_child runs the same way under IPA auth.
BZ 869150 and BZ 805281 cannot — they require manual keytab manipulation (remove, replace), which breaks IPA enrollment. IPA owns its keytab and uses ipa_child instead of ldap_child, so the bug paths aren't exercised.

Ack, understood. I'd like to better understand the case for passwd over SSH. If it's simply logging in via ssh, then issuing 'passwd', we should make it like the others.

Because we have

client.auth.passwd.password('tuser', 'Secret123', 'New_password123')

make it

client.auth.ssh.passwd.password('user', 'password', 'new_pass') and create the two method, passwd, passwd_with_output.

Those changes require for next set of tests, so can I remove it from this PR and will create the new fresh PR for with next set of tests.

[danlavu]

Because we have

client.auth.passwd.password('tuser', 'Secret123', 'New_password123')

make it

client.auth.ssh.passwd.password('user', 'password', 'new_pass') and create the two method, passwd, passwd_with_output.

?

[danlavu]

This looks great! thank you!