[autobackport: sssd-2-12] Tests: LDAP+KRB5 krb_misc tests

[sssd-bot]

This is an automatic backport of PR#8612 Tests: LDAP+KRB5 krb_misc tests to branch sssd-2-12, created by @madhuriupadhye.

Please make sure this backport is correct.

Note

The commits were cherry-picked without conflicts.

You can push changes to this pull request

git remote add sssd-bot git@github.com:sssd-bot/sssd.git
git fetch sssd-bot refs/heads/SSSD-sssd-backport-pr8612-to-sssd-2-12
git checkout SSSD-sssd-backport-pr8612-to-sssd-2-12
git push sssd-bot SSSD-sssd-backport-pr8612-to-sssd-2-12 --force

---

Original commits
20eeac6 - Tests: LDAP+KRB5 krb_misc tests

Backported commits

• 42021f4 - Tests: LDAP+KRB5 krb_misc tests

---

Original Pull Request Body

Ported following test case:

• kpasswd: BZ 847039: login works when krb5_kpasswd is unresolvable (kpasswd not needed for auth).
• high UID: BZ 798655: auth and logs stay clean with a setuid(-1) helper process running.
• password change: GH 677: SSH passwd with chpass_provider=krb5 logs initial auth in krb5_child.log.

[gemini-code-assist]

Code Review

This pull request introduces new system tests for SSSD Kerberos functionality, covering scenarios such as unresolvable kpasswd servers, handling of processes with invalid UIDs, and password changes via SSH. The review feedback identifies a technical flaw in the C helper code where setuid(-1) acts as a no-op on Linux, potentially invalidating the test for BZ 798655. Additionally, it is recommended to explicitly set the SSSD debug level to ensure that the log messages being asserted in the tests are actually generated.

[aplopez]

LGTM

I think these new changes need to be ported to the other versions, in particular the -2.

[madhuriupadhye]

LGTM

I think these new changes need to be ported to the other versions, in particular the -2.

This is manually raised PR, #8655
Once @danlavu approves it, will do same changes to this branch, and will raise the PR for master branch with latest changes.

[spoore1]

Updated tests pass:

PASSED tests/test_ldap_krb5.py::test_ldap_krb5__user_can_login_when_kpasswd_cannot_be_resolved (ldap_krb5)
PASSED tests/test_ldap_krb5.py::test_ldap_krb5__auth_and_logs_clean_with_setuid_minus_two_helper (ldap_krb5)
PASSED tests/test_ldap_krb5.py::test_ldap_krb5__password_change_via_ssh (ldap_krb5)

LGTM

[sssd-bot]

The pull request was accepted by @spoore1 with the following PR CI status:

---

🟢 rpm-build:centos-stream-10-x86_64:upstream (success)
🟢 rpm-build:fedora-42-x86_64:upstream (success)
🟢 rpm-build:fedora-43-x86_64:upstream (success)
🟢 rpm-build:fedora-44-x86_64:upstream (success)
🟢 rpm-build:fedora-rawhide-x86_64:upstream (success)

---

There are unsuccessful or unfinished checks. Make sure that the failures are not related to this pull request before merging.