ldaps: add LDAPS support by shridhargadekar · Pull Request #264 · SSSD/sssd-test-framework

shridhargadekar · 2026-07-31T12:59:33Z

Add export_root_ca_certificate() to ADHost, SambaHost, and IPAHost
Add CertUtils (client.cert) utility for system-level CA cert install into /etc/openldap/ldap.conf — works with adcli, realmd, ldapsearch
Add SSSDCommonConfiguration helpers: ad_use_ldaps(), samba_use_ldaps(), ipa_set_tls_cacert() for SSSD-specific LDAPS configuration

spoore1

Just a couple of quick notes until I can test this out.

shridhargadekar · 2026-08-14T10:26:12Z

Depends upon #255

spoore1

I'm not sure the AD export method is working as expected. My testing showed the certutil fail and the old commit worked better but, I'm not sure it's pulling the expected certificate.

spoore1 · 2026-10-05T20:50:33Z

FYI, latest updates are passing:

======================================== short test summary info ========================================
PASSED tests/test_adcli.py::test_adcli__join_and_update_with_ldaps (ad)
PASSED tests/test_adcli.py::test_adcli__delete_computer_with_ldaps (ad)
PASSED tests/test_adcli.py::test_adcli__join_and_update_with_ldaps (samba)
PASSED tests/test_adcli.py::test_adcli__delete_computer_with_ldaps (samba)
=================================== 4 passed, 84 deselected in 59.91s ===================================

spoore1

Small change suggestion unless I'm misreading something.

sumit-bose · 2026-10-06T17:07:06Z

Hi,

I'm still fine with this PR, but I think ti would be good to squash some of the related patches into one.

bye,
Sumit

spoore1

Just two minor questions about using the cat command.

Code appears to be working and I ran it with a slight modification to the tests in SSSD/sssd#9137

spoore1

Changes LGTM. Testing with SSSD/sssd#9137 is passing with this:

======================================== short test summary info ========================================
PASSED tests/test_authentication.py::test_authentication__user_lookup_over_ldaps (ad)
PASSED tests/test_authentication.py::test_authentication__user_authentication_over_ldaps (ad)
PASSED tests/test_authentication.py::test_authentication__user_lookup_over_ldaps (ipa)
PASSED tests/test_authentication.py::test_authentication__user_authentication_over_ldaps (ipa)
PASSED tests/test_ldaps.py::test_ldaps__ipa_ssl_tls_sets_sssd_options (ipa)
PASSED tests/test_ldaps.py::test_ldaps__ipa_user_lookup_over_starttls (ipa)
PASSED tests/test_authentication.py::test_authentication__user_lookup_over_ldaps (samba)
PASSED tests/test_authentication.py::test_authentication__user_authentication_over_ldaps (samba)
PASSED tests/test_ldaps.py::test_ldaps__samba_user_lookup_over_ldaps (samba)
PASSED tests/test_ldaps.py::test_ldaps__samba_ca_cert_present_on_client (samba)
PASSED tests/test_ldaps.py::test_ldaps__samba_ssl_tls_sets_sssd_options (samba)
============================ 11 passed, 969 deselected in 193.78s (0:03:13) =============================

sumit-bose

Hi,

as said I agree with the PR and is working well in my tests, ACK.

But I still would prefer if some of releated the patches can be squashed together.

bye,
Sumit

danlavu

Thank you for all the changes, the PR looks good. One nitpick, please make those changes but I'm approving.

danlavu · 2026-10-14T18:00:11Z


        client.fs.backup("/etc/resolv.conf")

+        # Install IPA CA certificate so LDAPS/STARTTLS tests can use it without per-test setup.


Please match the comments' style and provide a one-line summary. The extra information isn't particularly useful.

Install the provider CA certificate on the client

is sufficient.

danlavu · 2026-10-14T18:05:43Z

                provider.fs.backup("/etc/resolv.conf")
                provider.fs.write("/etc/resolv.conf", f"search {provider.domain}\nnameserver 127.0.0.1\n\n")

+        # Install the provider's CA certificate on the client so LDAPS tests can use it


Please match the comments' style and provide a one-line summary. The extra information isn't particularly useful.

Install the provider CA certificate on the client

is sufficient.

Add export_root_ca_certificate() abstract method to GenericProvider and implement it in the AD, IPA, and Samba roles. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Add OpenSSLUtils to utils/tools.py with install_ca_cert(), install_ca_cert_from_server(), and _configure_openldap() helpers. Add install_ca_cert() and ssl attribute to the Client role. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ADTopologyController (Samba) and IPATopologyController now install the provider's CA certificate on the client via OpenSSLUtils before the provisioned check, so LDAPS/STARTTLS tests have the cert available without any per-test setup. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Replace use_ldaps() with ssl_tls() in SSSDCommonConfiguration. The CA certificate is now pre-installed by the topology controller, so ssl_tls() only sets the SSSD domain options (ad_use_ldaps or ldap_id_use_start_tls) and ldap_tls_cacert path. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Remove install_ca_cert(), install_ca_cert_from_server(), use_ldaps(), and _configure_tls_cacert() from the Client role. Add self.ssl (OpenSSLUtils) for tests that still need to install a cert manually (e.g. AD with no AD CS). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Move cert export logic from ADCertificateAuthority to ADHost so topology controllers can access it directly without going through role fixtures. ADCertificateAuthority._get_ca_config() and get_ca_cert() now delegate to self.host, keeping the role-level API unchanged. ADTopologyController gains an ADHost cert install branch with two-level fallback: ADCS/PowerShell first, then openssl s_client, so cert install works regardless of whether Windows Certificate Services is present. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- utils/tools: make install_ca_cert idempotent; add fs.backup() for ldap.conf; replace conn.run cat with fs.exists/fs.read - topology_controllers: check client before fetching cert to skip redundant SSH round-trips; name certs by topology (ipa-ca.crt, samba-ca.crt, ad-ca.crt); replace conn.run cat with fs.exists/fs.read Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

spoore1

Still LGTM after the comment updates.

sumit-bose

Hi,

still ACK, although I still think that related parts of the patches can be squashed together.

bye,
Sumit

shridhargadekar force-pushed the cert_ldaps branch 2 times, most recently from 74dde9f to 3721fa4 Compare July 31, 2026 20:17

shridhargadekar mentioned this pull request Aug 5, 2026

Add export_root_ca_certificate() methods for LDAPS #248

Closed

pbrezina requested review from danlavu and spoore1 August 6, 2026 12:37

pbrezina assigned danlavu and spoore1 Aug 6, 2026

danlavu requested changes Aug 7, 2026

View reviewed changes

shridhargadekar force-pushed the cert_ldaps branch 4 times, most recently from a94e0cc to 41ed743 Compare August 10, 2026 19:05

spoore1 reviewed Aug 12, 2026

View reviewed changes

Comment thread sssd_test_framework/roles/ad.py

Comment thread sssd_test_framework/roles/ad.py

shridhargadekar force-pushed the cert_ldaps branch from 41ed743 to 0cc8a13 Compare August 14, 2026 10:23

shridhargadekar requested review from danlavu, spoore1 and sumit-bose August 18, 2026 15:43

shridhargadekar assigned sumit-bose Aug 18, 2026

sumit-bose reviewed Aug 20, 2026

View reviewed changes

Comment thread sssd_test_framework/roles/client.py Outdated

Comment thread sssd_test_framework/utils/sssd.py Outdated

Comment thread sssd_test_framework/roles/client.py Outdated

Comment thread sssd_test_framework/roles/ad.py

danlavu requested changes Aug 22, 2026

View reviewed changes

Comment thread sssd_test_framework/roles/client.py Outdated

Comment thread sssd_test_framework/utils/sssd.py Outdated

danlavu mentioned this pull request Aug 22, 2026

tests: port ad_provider idmap.sh coverage to system tests SSSD/sssd#8871

Draft

shridhargadekar force-pushed the cert_ldaps branch 2 times, most recently from e2b0d8a to 7b80a98 Compare August 24, 2026 20:44

spoore1 requested changes Aug 25, 2026

View reviewed changes

Comment thread sssd_test_framework/roles/ad.py

Comment thread sssd_test_framework/roles/ad.py

Comment thread sssd_test_framework/roles/ad.py Outdated

Comment thread sssd_test_framework/roles/client.py Outdated

shridhargadekar force-pushed the cert_ldaps branch 3 times, most recently from effb2c3 to b9de358 Compare August 27, 2026 19:59

sumit-bose reviewed Sep 2, 2026

View reviewed changes

Comment thread sssd_test_framework/roles/client.py Outdated

sumit-bose reviewed Sep 2, 2026

View reviewed changes

Comment thread sssd_test_framework/roles/client.py Outdated

shridhargadekar force-pushed the cert_ldaps branch from c31b96c to e2a23db Compare October 5, 2026 16:57

spoore1 requested changes Oct 5, 2026

View reviewed changes

Comment thread sssd_test_framework/roles/ad.py

shridhargadekar force-pushed the cert_ldaps branch 2 times, most recently from 060ea99 to a279b3d Compare October 6, 2026 13:41

shridhargadekar force-pushed the cert_ldaps branch from a279b3d to 990773a Compare October 6, 2026 20:19

shridhargadekar requested review from danlavu and spoore1 October 8, 2026 12:34

shridhargadekar force-pushed the cert_ldaps branch from 990773a to d61eee7 Compare October 8, 2026 16:45

spoore1 requested changes Oct 8, 2026

View reviewed changes

Comment thread sssd_test_framework/utils/tools.py Outdated

Comment thread sssd_test_framework/topology_controllers.py Outdated

shridhargadekar requested a review from spoore1 October 14, 2026 05:40

spoore1 reviewed Oct 14, 2026

View reviewed changes

spoore1 previously approved these changes Oct 14, 2026

View reviewed changes

sumit-bose previously approved these changes Oct 14, 2026

View reviewed changes

danlavu previously approved these changes Oct 14, 2026

View reviewed changes

shridhargadekar dismissed stale reviews from danlavu, sumit-bose, and spoore1 via 53d2f61 October 14, 2026 20:07

shridhargadekar force-pushed the cert_ldaps branch from beefd15 to 53d2f61 Compare October 14, 2026 20:07

shridhargadekar and others added 7 commits October 15, 2026 01:38

roles: add export_root_ca_certificate() to all providers

8ee99b5

Add export_root_ca_certificate() abstract method to GenericProvider and implement it in the AD, IPA, and Samba roles. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

shridhargadekar force-pushed the cert_ldaps branch from 53d2f61 to 3b805b2 Compare October 14, 2026 20:08

spoore1 approved these changes Oct 15, 2026

View reviewed changes

sumit-bose approved these changes Oct 16, 2026

View reviewed changes


		client.fs.backup("/etc/resolv.conf")

		# Install IPA CA certificate so LDAPS/STARTTLS tests can use it without per-test setup.

Conversation

shridhargadekar commented Jul 31, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

spoore1 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

shridhargadekar commented Aug 14, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

spoore1 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

spoore1 commented Oct 5, 2026

Uh oh!

spoore1 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sumit-bose commented Oct 6, 2026

Uh oh!

spoore1 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

spoore1 left a comment

Choose a reason for hiding this comment

Uh oh!

sumit-bose left a comment

Choose a reason for hiding this comment

Uh oh!

danlavu left a comment

Choose a reason for hiding this comment

Uh oh!

danlavu Oct 14, 2026

Choose a reason for hiding this comment

Uh oh!

danlavu Oct 14, 2026

Choose a reason for hiding this comment

Uh oh!

spoore1 left a comment

Choose a reason for hiding this comment

Uh oh!

sumit-bose left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants