Test: changes for krb_misc by madhuriupadhye · Pull Request #240 · SSSD/sssd-test-framework

madhuriupadhye · 2026-03-23T12:48:03Z

No description provided.

gemini-code-assist · 2026-03-23T12:48:19Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces several enhancements to the SSSD test framework, primarily focusing on Kerberos-related testing utilities. It integrates new Kerberos keytab and authentication utilities into the client role, expands the capabilities for creating KDC principals with more specific options, and adds a robust method for changing user passwords via SSH, which is crucial for testing Kerberos password change flows. These changes collectively improve the framework's ability to simulate and test complex Kerberos authentication scenarios.

Highlights

Kerberos Utilities Integration: Integrated Krb5AuthUtils and Krb5KeytabUtils into the Client role, providing direct access to Kerberos keytab and authentication functionalities for client-side testing.
Enhanced KDC Principal Management: Extended the KDCPrincipal.add method to allow specifying requires_preauth and additional extra_options when creating Kerberos principals, enabling more granular control for testing scenarios like clock skew.
SSH-based Password Change Utility: Introduced a new password_via_ssh method in authentication.py to facilitate changing user passwords over SSH using expect scripts, specifically designed for testing Kerberos initial authentication for password changes.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces changes for Kerberos-related testing utilities. The modifications to kdc.py to allow for more flexible principal creation and the additions to client.py are well-implemented. I've identified a small area for improvement in a new expect script within authentication.py to enhance its reliability.

gemini-code-assist · 2026-03-23T12:49:39Z

sssd_test_framework/utils/authentication.py

+            set timeout {DEFAULT_AUTHENTICATION_TIMEOUT}
+            spawn ssh -o StrictHostKeyChecking=no -l {user} {host}
+            expect -nocase "*password:"
+            send "{password}\r"
+            sleep 5
+            send "passwd\r"
+            expect -nocase "*Current Password:"
+            send "{password}\r"
+            expect -nocase "New password:"
+            send "{new_password}\r"
+            expect -nocase "Retype new password:"
+            send "{retyped}\r"
+            expect -re "passwd: .+ updated successfully"
+            send "exit\r"
+            expect eof


Using a fixed sleep is unreliable and can lead to flaky tests. It's better to wait for the shell prompt after logging in before sending the passwd command. This ensures the session is ready for the next command and makes the test more robust. Please define and expect the shell prompt instead of using sleep 5.

set timeout {DEFAULT_AUTHENTICATION_TIMEOUT} set prompt "\n.*\[#\$>\] $" spawn ssh -o StrictHostKeyChecking=no -l {user} {host} expect -nocase "*password:" send "{password}\r" expect -re $prompt send "passwd\r" expect -nocase "*Current Password:" send "{password}\r" expect -nocase "New password:" send "{new_password}\r" expect -nocase "Retype new password:" send "{retyped}\r" expect -re "passwd: .+ updated successfully" send "exit\r" expect eof

Signed-off-by: Madhuri Upadhye <mupadhye@redhat.com>

danlavu

So, I looked at the tests, and I don't think it's important to do this on LDAP/KRB5. I suggest we convert the tests and use the IPA provider. Thoughts?

danlavu · 2026-03-27T05:05:08Z

sssd_test_framework/roles/kdc.py

+        *,
+        password: str | None = "Secret123",
+        requires_preauth: bool = False,
+        extra_options: str | None = None,


nitpick, we use args everywhere else. I would just use the same variable name.

danlavu · 2026-03-27T05:13:36Z

sssd_test_framework/roles/kdc.py

+            opts.append("+requires_preauth")
+        if extra_options:
+            opts.append(extra_options)
+        opts_str = " " + " ".join(opts) if opts else ""


Nitpick, I find this strange, for the leading space? I think it's more readable, add a space in the command on line 195, -randkey {opt_str} "{self.name}"

danlavu · 2026-03-27T05:28:37Z

sssd_test_framework/utils/authentication.py

            raise ExpectScriptError(result.rc)

        return result.rc == 0
+


Why is it important that this is done via SSH?

madhuriupadhye · 2026-03-27T13:14:45Z

So, I looked at the tests, and I don't think it's important to do this on LDAP/KRB5. I suggest we convert the tests and use the IPA provider. Thoughts?

Only BZ 773660 (clock skew) can use IPA — krb5_child runs the same way under IPA auth.

BZ 869150 and BZ 805281 cannot — they require manual keytab manipulation (remove, replace), which breaks IPA enrollment. IPA owns its keytab and uses ipa_child instead of ldap_child, so the bug paths aren't exercised.

danlavu · 2026-03-27T14:01:27Z

Only BZ 773660 (clock skew) can use IPA — krb5_child runs the same way under IPA auth.

BZ 869150 and BZ 805281 cannot — they require manual keytab manipulation (remove, replace), which breaks IPA enrollment. IPA owns its keytab and uses ipa_child instead of ldap_child, so the bug paths aren't exercised.

Ack, understood. I'd like to better understand the case for passwd over SSH. If it's simply logging in via ssh, then issuing 'passwd', we should make it like the others.

Because we have

client.auth.passwd.password('tuser', 'Secret123', 'New_password123')

make it

client.auth.ssh.passwd.password('user', 'password', 'new_pass') and create the two method, passwd, passwd_with_output.

gemini-code-assist bot reviewed Mar 23, 2026

View reviewed changes

madhuriupadhye force-pushed the krb_misc branch 2 times, most recently from 4248db6 to b1d3713 Compare March 24, 2026 14:28

Test: changes for krb_misc

fb27c3a

Signed-off-by: Madhuri Upadhye <mupadhye@redhat.com>

madhuriupadhye force-pushed the krb_misc branch from b1d3713 to fb27c3a Compare March 24, 2026 14:34

madhuriupadhye assigned danlavu Mar 26, 2026

madhuriupadhye requested a review from danlavu March 26, 2026 13:36

alexey-tikhonov requested a review from thalman March 26, 2026 13:45

alexey-tikhonov assigned thalman Mar 26, 2026

danlavu reviewed Mar 27, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Test: changes for krb_misc#240

Test: changes for krb_misc#240
madhuriupadhye wants to merge 1 commit intoSSSD:masterfrom
madhuriupadhye:krb_misc

madhuriupadhye commented Mar 23, 2026

Uh oh!

gemini-code-assist bot commented Mar 23, 2026

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

gemini-code-assist bot Mar 23, 2026

Uh oh!

danlavu left a comment

Uh oh!

danlavu Mar 27, 2026

Uh oh!

danlavu Mar 27, 2026

Uh oh!

thalman Mar 27, 2026

Uh oh!

danlavu Mar 27, 2026

Uh oh!

madhuriupadhye commented Mar 27, 2026

Uh oh!

danlavu commented Mar 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

madhuriupadhye commented Mar 23, 2026

Uh oh!

gemini-code-assist bot commented Mar 23, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

danlavu left a comment

Choose a reason for hiding this comment

Uh oh!

danlavu Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

danlavu Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

thalman Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

danlavu Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

madhuriupadhye commented Mar 27, 2026

Uh oh!

danlavu commented Mar 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants