adding sssd ldap_provider() to optionally ad or ipa to use ldap #228

danlavu · 2026-01-23T05:48:41Z

No description provided.

gemini-code-assist · 2026-01-23T05:49:02Z

Summary of Changes

Hello @danlavu, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the SSSD test framework by adding a dedicated method to configure SSSD for LDAP provider usage, expanding its testing capabilities beyond existing IPA and Active Directory setups. Concurrently, it refines the codebase with several minor but impactful style improvements, such as modernizing Python's tuple unpacking and streamlining multiline string definitions, contributing to overall code clarity and maintainability.

Highlights

New SSSD LDAP Provider Configuration: A new ldap_provider method has been introduced in the SSSD utility, allowing for flexible configuration of SSSD to use an LDAP backend for identity and authentication management, including support for sub-ID ranges.
Python Syntax Modernization: Tuple unpacking syntax has been updated across multiple files, changing (a, b) = c to a, b = c for improved readability and adherence to modern Python style.
Multiline String Formatting Refinement: Multiline string command executions and configurations have been refactored to remove redundant parentheses, making the code cleaner and more concise.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces a new ldap_provider method for SSSD configuration and includes numerous stylistic cleanups across the codebase, such as removing unnecessary parentheses and standardizing multiline string formats. My review focuses on the new functionality and a related area with an existing issue. I've identified an opportunity to improve the efficiency of the new ldap_provider method by reducing redundant operations. Additionally, I've found a potential bug in the policy method in ad.py where configuration could be unintentionally overwritten. The suggested changes aim to fix this bug and enhance the code's robustness and performance.

sssd_test_framework/roles/ad.py

sssd_test_framework/utils/sssd.py

danlavu · 2026-01-23T16:45:12Z

Tox is throwing some syntax errors, too many files are touched so I split up the PRs into two.

The tox fixes are in #229. After this is merged, tox will be green.

danlavu · 2026-01-26T23:09:36Z

Checking the configuration file fails the test with the following: I'm not quite sure why yet.

E           [rule/allowed_domain_options]: Attribute 'ldap_subuid_object_class' is not allowed in section 'domain/test'. Check for typos.
E           [rule/allowed_domain_options]: Attribute 'ldap_subuid_count' is not allowed in section 'domain/test'. Check for typos.
E           [rule/allowed_domain_options]: Attribute 'ldap_subgid_count' is not allowed in section 'domain/test'. Check for typos.
E           [rule/allowed_domain_options]: Attribute 'ldap_subuid_number' is not allowed in section 'domain/test'. Check for typos.
E           [rule/allowed_domain_options]: Attribute 'ldap_subgid_number' is not allowed in section 'domain/test'. Check for typos.
E           [rule/allowed_domain_options]: Attribute 'ldap_subid_range_owner' is not allowed in section 'domain/test'. Check for typos.
E

alexey-tikhonov · 2026-01-27T09:38:32Z

Checking the configuration file fails the test with the following: I'm not quite sure why yet.

It's a bug: SSSD/sssd#8403

alexey-tikhonov · 2026-01-27T09:43:08Z

sssd_test_framework/utils/sssd.py

+        tls_reqcert: str = "demand",
+    ) -> None:
+        """
+        Configure SSSD to use the ldap_provider to connect to IPA or AD.


First of all, the name used - ldap_provider() - doesn't give a slightest hint it will be AD/IPA backed.

But more important, I'm not sure at all if this fits here architecturally (maybe it does).

CC @pbrezina

Yes, because it doesn't really care what it's backed by, as long as it is an LDAP server. Does it also make more sense when using the full path? fqn? (I'm not sure of the term exactly)

client.sssd.common.ldap_provider(args)

Just that it configures the client to use ldap exclusively.

It does fit here IMO, exclusively using the ldap_provider to connect to AD was a common customer scenario because it doesn't require the client to join the domain. So, for all customers who want AD authentication but don't have administrative rights to AD. Often, we found that they simply didn't want computer objects in their directory; they'd configure SSSD accordingly.

alexey-tikhonov · 2026-01-27T09:43:43Z

sssd_test_framework/utils/sssd.py

+                ldap_subid_range_owner="ipaOwner",
+            )
+
+        self.sssd.config_apply(check_config=False)


Once SSSD/sssd#8403 is merged, it should be possible to use 'check_config=True'

Ack, the default value is True, so it will just be removed.

jakub-vavra-cz · 2026-01-27T09:59:18Z

sssd_test_framework/utils/sssd.py

+        self.sssd.domain.update(
+            id_provider="ldap",
+            auth_provider="ldap",
+            ldap_uri=f"ldap://{server}",


This might need ldaps:// in some cases.

Ack, I'll update it to pass in the URI.

Okay, updated: not passing in the URI, but adding an SSL bool.

danlavu added the Waiting for review label Jan 23, 2026

gemini-code-assist bot reviewed Jan 23, 2026

View reviewed changes

sssd_test_framework/roles/ad.py Show resolved Hide resolved

sssd_test_framework/utils/sssd.py Outdated Show resolved Hide resolved

danlavu changed the title ~~Ipa ldap config~~ ldap config for ipa/ad providers and tox fixes. Jan 23, 2026

danlavu force-pushed the ipa-ldap-config branch from bac079d to f4f9b81 Compare January 23, 2026 16:41

danlavu changed the title ~~ldap config for ipa/ad providers and tox fixes.~~ adding sssd ldap_provider() to optionally ad or ipa to use ldap Jan 23, 2026

danlavu requested review from alexey-tikhonov and jakub-vavra-cz January 26, 2026 15:00

danlavu force-pushed the ipa-ldap-config branch 2 times, most recently from 149b7b7 to 20c6cdf Compare January 26, 2026 23:07

danlavu force-pushed the ipa-ldap-config branch from 20c6cdf to 36726df Compare January 26, 2026 23:20

alexey-tikhonov reviewed Jan 27, 2026

View reviewed changes

alexey-tikhonov requested a review from pbrezina January 27, 2026 09:44

jakub-vavra-cz reviewed Jan 27, 2026

View reviewed changes

adding sssd ldap_provider() to optionally ad or ipa to use ldap

ae83c15

danlavu force-pushed the ipa-ldap-config branch from 36726df to ae83c15 Compare January 27, 2026 14:44

adding sssd ldap_provider() to optionally ad or ipa to use ldap #228

Are you sure you want to change the base?

adding sssd ldap_provider() to optionally ad or ipa to use ldap #228

Uh oh!

Conversation

danlavu commented Jan 23, 2026

Uh oh!

gemini-code-assist bot commented Jan 23, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

danlavu commented Jan 23, 2026

Uh oh!

danlavu commented Jan 26, 2026

Uh oh!

alexey-tikhonov commented Jan 27, 2026

Uh oh!

alexey-tikhonov Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

danlavu Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

alexey-tikhonov Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

danlavu Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

jakub-vavra-cz Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

danlavu Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

danlavu Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants