Add AD certificate authentication test

[krishnavema]

Adds a system test verifying that an AD user can authenticate using a certificate on a virtual smart card.

[gemini-code-assist]

Code Review

This pull request adds a new system test for AD certificate authentication using a virtual smartcard. The changes include updating a test dependency and adding the new test case with a helper function for certificate enrollment. The overall approach is sound, but I've identified one area for improvement to increase test reliability by replacing a fixed sleep with a more robust polling mechanism.

[gemini-code-assist]

Using a fixed time.sleep(5) can lead to flaky tests. If the virt_cacard.service takes longer to start under load, the test might fail. Conversely, if the service starts quickly, the test is unnecessarily delayed. A more robust approach is to poll for the service's status until it becomes active.

Suggested change

	time.sleep(5)
	for _ in range(10):
	result = client.host.conn.run("systemctl is-active --quiet virt_cacard.service", raise_on_error=False)
	if result.rc == 0:
	break
	time.sleep(1)
	else:
	pytest.fail("virt_cacard.service did not become active in time.")

[krishnavema]

SSSD/sssd-test-framework#283

[sumit-bose]

Hi,

please rebase to get Pavel's "test: fix missing cmocka prerequisite includes in test_nfsidmap.c" included to make the CI builds pass.

bye,
Sumit

[sumit-bose]

Hi,

the current system test failures are related to the temporary "git+https://github.com/krishnavema/sssd-test-framework@ad-ca-request-consistent-key" in requirements.txt. If you rebase your PR then the shown error should go away but I would still expect failure since this test depends on two fo your PR for the test framework.

bye,
Sumit

[spoore1]

LGTM.

[spoore1]

Failed system test is unrelated:

FAILED tests/test_sudo.py::test_sudo__ldap_sudo_search_base_not_set_emits_warning (ldap) 

[sumit-bose]

Hi,

thank you for the test and your patience, ACK.

bye,
Sumit

[sumit-bose]

Hi,

do we need backports of this test and if yes to which branches?

bye,
Sumit