Tests: cache_credentials = true not working

[shridhargadekar]

Tests for cache_credentials = true not working in sssd, with specified PAM configuration in /etc/pam.d/system-auth and /etc/pam.d/password-auth

verifies #7968

[gemini-code-assist]

Code Review

The pull request adds a new test to verify that cache_credentials = true works correctly with a custom PAM configuration when the provider is offline. The test logic is sound and covers the intended scenario. My review focuses on improving the maintainability and clarity of the new test by suggesting a more descriptive name for the test function and updating its docstring to be accurate and complete.

[thalman]

Thanks for the effort.

[sumit-bose]

Hi,

thank you for the update, ACK.

Please note, this patch can only be committed if #7995 is committed, otherwise CI will always fail.

bye,
Sumit

[alexey-tikhonov]

Please note, this patch can only be committed if #7995 is committed, otherwise CI will always fail.

#7995 was merged. Re-running CI.

[alexey-tikhonov]

@shridhargadekar, please rebase.

[alexey-tikhonov]

tests/test_authentication.py::test_authentication__user_login_with_modified_PAM_stack_provider_is_offline[root-ssh] (ipa) PASSED [ 14%]
tests/test_authentication.py::test_authentication__user_login_with_modified_PAM_stack_provider_is_offline[root-su] (ipa) PASSED [ 14%]
tests/test_authentication.py::test_authentication__user_login_with_modified_PAM_stack_provider_is_offline[sssd-ssh] (ipa) PASSED [ 14%]
tests/test_authentication.py::test_authentication__user_login_with_modified_PAM_stack_provider_is_offline[sssd-su] (ipa) PASSED [ 14%]

Failing tests seems to be unrelated to this PR.

[alexey-tikhonov]

Conflict in sssd-2-9.
@shridhargadekar, please open explicit backport PR.

[shridhargadekar]

@sumit-bose latest changes are reverting PAM configuration to original state. Let me check with authselect way as well

[shridhargadekar]

Looks like previously failing tests are passing now.

[shridhargadekar]

Three test cases that are failing here, could not be related to this PR. Those test cases are running before current PR test cases.

[alexey-tikhonov]

Is this intentional:

pam_file = client.fs.read("/etc/pam.d/system-auth")
...
client.fs.write("/etc/pam.d/system-auth", pam_file)
client.fs.write("/etc/pam.d/password-auth", pam_file)

-- so that "password-auth" == "system-auth" after the test?

@sumit-bose , @thalman , are you fine with the recent updates?

[shridhargadekar]

As Sumit suggested earlier, implementing authselect utility to back-up and restore the PAM stack.

[alexey-tikhonov]

@shridhargadekar, is this ready?

[shridhargadekar]

@alexey-tikhonov Yes, it's ready.

[sumit-bose]

Hi,

I'm still fine withthe current version of the test, CI failures do not look related.

bye,
Sumit

[alexey-tikhonov]

Pushed PR: #8020

• master
  • 9856b6d - Tests: cache_credentials = true not working
• sssd-2-11
  • 61a5ab6 - Tests: cache_credentials = true not working