test rewrite: legacy intg test_pam_responder.py - remaining batch - #9028
Open
danlavu wants to merge 5 commits into
Open
test rewrite: legacy intg test_pam_responder.py - remaining batch#9028danlavu wants to merge 5 commits into
danlavu wants to merge 5 commits into
Conversation
danlavu
force-pushed
the
rewrite-test_pam_responder.py2
branch
from
July 31, 2026 06:05
222f600 to
f6daee9
Compare
danlavu
requested review from
krishnavema and
thalman
and removed request for
thalman
July 31, 2026 06:06
Contributor
Author
|
This PR was branched from #9004 , it will contain extra commits until 9004 is merged. Look at the specific commit or wait until 9004 is merged. |
danlavu
force-pushed
the
rewrite-test_pam_responder.py2
branch
2 times, most recently
from
August 13, 2026 17:40
64b8a4e to
adc31aa
Compare
danlavu
force-pushed
the
rewrite-test_pam_responder.py2
branch
2 times, most recently
from
August 13, 2026 19:08
5259400 to
764d32f
Compare
sumit-bose
reviewed
Aug 14, 2026
| "user1", "KDCSecret123" | ||
| ), "Authentication should succeed via the matching 'domains=krb5' line!" | ||
|
|
||
| # IPA always forces an immediate password-expiration on an administrative password reset, |
Contributor
There was a problem hiding this comment.
Hi,
why do you try to changes the password and not use IPASecret123 directly?
bye,
Sumit
Contributor
Author
There was a problem hiding this comment.
I don't remember exactly, but removed after our discussion.
sumit-bose
reviewed
Aug 14, 2026
|
|
||
| assert client.auth.su.password( | ||
| "user1", "KDCSecret123" | ||
| ), "Authentication should succeed via the matching 'domains=krb5' line!" |
Contributor
There was a problem hiding this comment.
Hi,
it might be worth to call klist and check if the received TGT is coming from the expected Kerberos realm.
bye,
Sumit
Port sssd/src/tests/intg/test_pam_responder.py to test_smartcard.py, test_authentication.py - test_smartcard__login_fails_when_wrong_pin_is_entered - test_smartcard__login_fails_when_card_is_not_mapped - test_smartcard__cert_auth_limited_to_allowed_pam_services - test_smartcard__login_succeeds_when_cert_auth_required - test_smartcard__login_fails_when_cert_auth_required_without_card - test_authentication__custom_password_prompt_is_shown_at_login Peeling out the reviewed test cases into it's own PR, from SSSD#8873 AI: Claude Sonnet 4.6 Co-authored-by: Cursor <cursoragent@cursor.com>
danlavu
force-pushed
the
rewrite-test_pam_responder.py2
branch
3 times, most recently
from
August 18, 2026 22:06
ac070a5 to
4ce9743
Compare
Replace inline expect script in test_smartcard__unlock_console_with_vlock with client.auth.su.vlock_smartcard(), moving the logic into the test framework. Co-authored-by: Cursor <cursoragent@cursor.com>
Rewrite the remaining sssd/src/tests/intg/test_pam_responder.py cases to test_smartcard.py, test_authentication.py - test_try_sc_auth_root -> test_smartcard__try_cert_auth_never_used_for_root - test_sc_auth_missing_name, test_sc_auth_missing_name_whitespace -> test_smartcard__certificate_owner_resolved_when_username_is_missing - test_sc_auth_name_format -> test_smartcard__certificate_owner_resolved_with_full_name_format - test_sc_auth_two_missing_name -> test_smartcard__certificate_owner_resolved_with_two_tokens_and_missing_name - test_krb5_auth_domains -> test_authentication__pam_sss_domains_skips_non_matching_krb5_domains Authenticate once per realm with that realm's password and assert the TGT realm matches, covering the pam_sss domains try-and-error path. Peeling out the reviewed test cases into it's own PR, from SSSD#8873 AI: Cursor Grok 4.5 Co-authored-by: Cursor <cursoragent@cursor.com>
Port test_sc_proxy_password_fallback and test_sc_proxy_no_password_fallback from test_pam_responder.py into test_smartcard.py. - test_smartcard__proxy_auth_uses_password_or_smartcard_based_on_local_auth_policy AI: Cursor Grok 4.5 Co-authored-by: Cursor <cursoragent@cursor.com>
Temporary pin for CI against the ALLREALMS topology work. AI: Cursor Grok 4.5 Co-authored-by: Cursor <cursoragent@cursor.com>
danlavu
force-pushed
the
rewrite-test_pam_responder.py2
branch
from
August 19, 2026 13:43
4ce9743 to
6ccb38b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rewrite the remaining sssd/src/tests/intg/test_pam_responder.py cases to
test_smartcard.py, test_authentication.py
Peeling out the reviewed test cases into it's own PR, from
#8873
Requires the following framework change
SSSD/sssd-test-framework#262
Co-authored-by: Cursor cursoragent@cursor.com
Model used: Claude Sonnet 5