Tests:Added IPA Certificate Authority Tests

[krishnavema]

The system should prompt the user for a PIN when attempting to authenticate via smart card. This ensures that the smart card is being used as the primary authentication method.

[gemini-code-assist]

Code Review

This pull request adds a new test case to verify smart card authentication with nested 'su' commands for IPA users. The test sets up an IPA user, requests a smart card certificate, configures SSSD for smart card authentication, and then executes nested 'su' commands to validate the authentication flow. The review focuses on ensuring the test case is reliable and correctly validates the intended functionality.

[danlavu]

A few minor details, but overall, it looks very good. Thankyou.

[danlavu]

This looks great, thank you. One comment, nothing related to the test code.

[danlavu]

This looks great, thank you. I'm going to approve this since I'm on PTO this week, but you need to add pytest.mark.importance. Critical or High will run with each PRCI run, I think this test case is important enough to execute with each PR.

[thalman]

LGTM, thanks Vema

[sumit-bose]

Hi,

thank you for the changes, test is still working fine and I have no further comments, ACK.

bye,
Sumit

[sssd-bot]

The pull request was accepted by @sumit-bose with the following PR CI status:

---

🟢 CodeFactor (success)
🟢 CodeQL (success)
NEUTRAL osh-diff-scan:fedora-rawhide-x86_64:upstream (neutral)
🟢 rpm-build:centos-stream-10-x86_64:upstream (success)
🟢 rpm-build:fedora-41-x86_64:upstream (success)
🟢 rpm-build:fedora-42-x86_64:upstream (success)
🟢 rpm-build:fedora-43-x86_64:upstream (success)
🟢 rpm-build:fedora-rawhide-x86_64:upstream (success)
🟢 Analyze (target) / All tests are successful (success)
🟢 Analyze (target) / cppcheck (success)
🟢 Build / freebsd (success)
🟢 Build / make-distcheck (success)
🟢 ci / All tests are successful (success)
🟢 ci / intgcheck (centos-10) (success)
🟢 ci / intgcheck (fedora-41) (success)
🟢 ci / intgcheck (fedora-42) (success)
🟢 ci / intgcheck (fedora-43) (success)
🟢 ci / intgcheck (fedora-44) (success)
🟢 ci / prepare (success)
🟢 ci / system (centos-10) (success)
🟢 ci / system (fedora-41) (success)
🟢 ci / system (fedora-42) (success)
🟢 ci / system (fedora-43) (success)
🟢 ci / system (fedora-44) (success)
➖ Coverity scan / coverity (skipped)
🟢 Static code analysis / All tests are successful (success)
🟢 Static code analysis / codeql (success)
🟢 Static code analysis / pre-commit (success)
🟢 Static code analysis / python-system-tests (success)

---

There are unsuccessful or unfinished checks. Make sure that the failures are not related to this pull request before merging.

[sumit-bose]

Hi,

I came a across a race-condition. It looks like after re-starting virt_cacard.service the certificates might not be available in the virtual Smartcard immediately which makes the test fail. Adding a time.sleep(1) after the restart makes it pass again.

Not sure if a sleep is the best fix here, maybe checking with pkcs11-tool from the OpenSC package or some other utilities before running the test would be better?

Since the test always passed in the PR CI it might be possible to delay fixing this and merge the patch as is. But this might be risky and I would suggest to at least add the sleep. What do you think?

bye,
Sumit

[danlavu]

Not sure if a sleep is the best fix here, maybe checking with pkcs11-tool from the OpenSC package or some other utilities before running the test would be better?

This can probably use wait_for_condition() ?

            @pytest.mark.topology(KnownTopology.LDAP)
            def test_just_condition(client: Client):
                client.sssd.domain["ldap_uri"] = "ldap://typo"
                client.sssd.start(debug_level=None, raise_on_error=False)

                assert client.sssd.default_domain
                r = client.tools.wait_for_condition(condition=f"sssctl domain-status {client.sssd.default_domain}")
                assert r.rc == 0
                assert "LDAP: not connected" in r.stdout

[spoore1]

One minor update to add a builtwith() marker. This can be added at a later time if this PR is merged before updated.

[spoore1]

LGTM