Tests: add ldap_sudo_search_base warning test by spoore1 · Pull Request #8902 · SSSD/sssd

spoore1 · 2026-07-07T17:39:25Z

When ldap_sudo_search_base is not set, SSSD defaults to searching the entire directory tree for sudoRole objects. In this case, we expect a warning message to be logged.

Assisted-By: Claude Code (Sonnet 4.6 (1M context))

gemini-code-assist · 2026-07-07T17:52:29Z

Warning

Gemini is experiencing higher than usual traffic and was unable to create the review. Please try again in a few hours by commenting /gemini review.

jakub-vavra-cz

The test looks pretty straightforward. I would be wary if the log is produced before the reading is done especially if the infra is under load.

I would probably check if ""ldap_sudo_search_base is not set"" is in the log and if not retry a few times before hard failing.

sssd-bot · 2026-07-08T12:45:13Z

The pull request was accepted by @jakub-vavra-cz with the following PR CI status:

🟢 CodeQL (success)
🟢 rpm-build:centos-stream-10-x86_64:upstream (success)
🟢 rpm-build:fedora-43-x86_64:upstream (success)
🟢 rpm-build:fedora-44-x86_64:upstream (success)
🔴 rpm-build:fedora-rawhide-x86_64:upstream (failure)
🟢 testing-farm:centos-stream-10-x86_64:upstream (success)
🔴 testing-farm:fedora-43-x86_64:upstream (failure)
🟢 testing-farm:fedora-44-x86_64:upstream (success)
🔴 testing-farm:fedora-rawhide-x86_64:upstream (failure)
➖ ci / intgcheck (skipped)
🔴 ci / prepare (failure)
➖ ci / system (skipped)
➖ Coverity scan / coverity (skipped)
🟢 Static code analysis / codeql (success)
🟢 Static code analysis / pre-commit (success)
🟢 Static code analysis / python-system-tests (success)

There are unsuccessful or unfinished checks. Make sure that the failures are not related to this pull request before merging.

madhuriupadhye · 2026-07-09T12:25:12Z

I testes with IDM-CI, with unpatched version assert is failing, and with patch version is passed.

unpatched version,

Failed tests/test_sudo.py::test_sudo__ldap_sudo_search_base_not_set_emits_warning (ldap)

        log = client.fs.read(client.sssd.logs.domain())
>       assert (
            "`ldap_sudo_search_base` is not set" in log
        ), "Domain log must contain security warning when ldap_sudo_search_base is not set!"
E       AssertionError: Domain log must contain security warning when ldap_sudo_search_base is not set!
E       assert '`ldap_sudo_search_base` is not set' in '(2026-07-08 17:08:11): [be[test]] [server_setup] (0x3f7c0): Starting with debug level = 0xfff0\n(2026-07-08 17:08:11): [be[test]] [server_setup] (0x0400): CONFDB: /var/lib/sss/db/config.ldb\n(2026-07-08 17:08:11): [be[test]] [log_string_option] (0x0100): Option lookup_family_order has value ipv4_first\n(2026-07-08 17:08:11): [be[test]] [dp_get_options] (0x0100): Option dns_resolver_timeout has value 6\n(2026-07-08 17:08:11): [be[test]] [dp_get_options] (0x0100): Option dns_resolver_op_timeout has value 3\n(2026-07-08 17:08:11): [be[test]] [dp_get_options] (0x0100): Option dns_resolver_server_timeout has value 1000\n(2026-07-08 17:08:11): [be[test]] [dp_get_options] (0x0100): Option dns_resolver_use_search_list is TRUE\n(2026-07-08 17:08:11): [be[test]] [log_string_option] (0x0100): Option dns_discovery_domain has value ldap.test\n(2026-07-08 17:08:11): [be[test]] [dp_get_options] (0x0100): Option failover_primary_timeout has value 31\n(2026-07-08 17:08:11): [be[test]] [be_res_get_opts] (0x0100): Lookup order: ipv4_first\n(2026-07-08 17:08:11): [be[test]] [recreate_ares_channel] (0x0100): Initializing new c-ares channel\n(2026-07-08 17:08:11): [be[test]] [fo_context_init] (0x0400... (0x2000): Inserting identity of sender [sssd.nss]: 995\n(2026-07-08 17:08:11): [be[test]] [dp_attach_req] (0x0400): [RID#3] DP Request [Subdomains #3]: REQ_TRACE: New request. Flags [0000].\n(2026-07-08 17:08:11): [be[test]] [dp_attach_req] (0x0400): [RID#3] Number of active DP request: 1\n(2026-07-08 17:08:11): [be[test]] [dp_find_method] (0x0100): [RID#3] Target [subdomains] is not initialized\n(2026-07-08 17:08:11): [be[test]] [_dp_req_recv] (0x0400): DP Request [Subdomains #3]: Receiving request data.\n(2026-07-08 17:08:11): [be[test]] [dp_req_destructor] (0x0400): DP Request [Subdomains #3]: Request removed.\n(2026-07-08 17:08:11): [be[test]] [dp_req_destructor] (0x0400): Number of active DP request: 0\n(2026-07-08 17:08:11): [be[test]] [sbus_issue_request_done] (0x0200): sssd.dataprovider.getDomains: Error [1432158215]: DP target is not configured\n(2026-07-08 17:08:11): [be[test]] [be_ptask_online_cb] (0x0400): Back end is online\n(2026-07-08 17:08:11): [be[test]] [be_ptask_enable] (0x0080): Task [SUDO Full Refresh]: already enabled\n(2026-07-08 17:08:11): [be[test]] [sdap_sudo_online_cb] (0x0400): We are back online. SUDO host information will be renewed on next refresh.'

client     = <sssd_test_framework.roles.client.Client object at 0x7fc46edeead0>
ldap       = <sssd_test_framework.roles.ldap.LDAP object at 0x7fc46eded090>
log        = '(2026-07-08 17:08:11): [be[test]] [server_setup] (0x3f7c0): Starting with debug level = 0xfff0\n(2026-07-08 17:08:11)... [be[test]] [sdap_sudo_online_cb] (0x0400): We are back online. SUDO host information will be renewed on next refresh.'

../sssd/src/tests/system/tests/test_sudo.py:647: AssertionError

with patched version,
Passed tests/test_sudo.py::test_sudo__ldap_sudo_search_base_not_set_emits_warning (ldap)

spoore1 · 2026-07-09T22:31:08Z

I testes with IDM-CI, with unpatched version assert is failing, and with patch version is passed.

unpatched version,

Failed tests/test_sudo.py::test_sudo__ldap_sudo_search_base_not_set_emits_warning (ldap)
...

with patched version, Passed tests/test_sudo.py::test_sudo__ldap_sudo_search_base_not_set_emits_warning (ldap)

@madhuriupadhye thanks for testing this out. I have a couple of follow up questions:

We expect/want it to fail on older versions because this is a check for a fix related to a CVE right? This wouldn't be running in general on older versions outside of the latest supported by the branch right? Or would we?

On the topic of branches, should I add additional backports for this to cover other releases that the main fix was covered in?

sssd-2-9-4
sssd-2-9
sssd-2-10
sssd-2-12
sssd-2-13

madhuriupadhye · 2026-07-14T08:48:05Z

I testes with IDM-CI, with unpatched version assert is failing, and with patch version is passed.
unpatched version,
Failed tests/test_sudo.py::test_sudo__ldap_sudo_search_base_not_set_emits_warning (ldap)
...
with patched version, Passed tests/test_sudo.py::test_sudo__ldap_sudo_search_base_not_set_emits_warning (ldap)

@madhuriupadhye thanks for testing this out. I have a couple of follow up questions:

We expect/want it to fail on older versions because this is a check for a fix related to a CVE right? This wouldn't be running in general on older versions outside of the latest supported by the branch right? Or would we?

On the topic of branches, should I add additional backports for this to cover other releases that the main fix was covered in?
* sssd-2-9-4

* sssd-2-9

* sssd-2-10

* sssd-2-12

* sssd-2-13

CVE is added in older RHEL versions also, so good to have in all branches.

When ldap_sudo_search_base is not set, SSSD defaults to searching the entire directory tree for sudoRole objects. In this case, we expect a warning message to be logged. Assisted-By: Claude Code (Sonnet 4.6 (1M context)) Reviewed-by: Jakub Vávra <jvavra@redhat.com>

sssd-bot · 2026-07-17T05:08:05Z

The pull request was accepted by @jakub-vavra-cz with the following PR CI status:

There are unsuccessful or unfinished checks. Make sure that the failures are not related to this pull request before merging.

spoore1 added Tests backport-to-sssd-2-9 backport-to-sssd-2-13 Waiting for review labels Jul 7, 2026

spoore1 force-pushed the ldap_sudo_search_base_warning branch from 6e61fc5 to 2c2af94 Compare July 7, 2026 18:07

jakub-vavra-cz self-assigned this Jul 8, 2026

jakub-vavra-cz self-requested a review July 8, 2026 12:35

jakub-vavra-cz approved these changes Jul 8, 2026

View reviewed changes

jakub-vavra-cz added Accepted and removed Waiting for review labels Jul 8, 2026

sssd-bot force-pushed the ldap_sudo_search_base_warning branch from 2c2af94 to a52661a Compare July 8, 2026 12:45

spoore1 added backport-to-sssd-2-10 backport-to-sssd-2-9-4 Corresponds to C8S backport-to-sssd-2-12 and removed Accepted labels Jul 14, 2026

spoore1 force-pushed the ldap_sudo_search_base_warning branch from a52661a to 96f2261 Compare July 16, 2026 13:21

spoore1 requested a review from jakub-vavra-cz July 16, 2026 22:49

jakub-vavra-cz approved these changes Jul 17, 2026

View reviewed changes

jakub-vavra-cz added the Accepted label Jul 17, 2026

sssd-bot force-pushed the ldap_sudo_search_base_warning branch from 96f2261 to 674c2b4 Compare July 17, 2026 05:08

jakub-vavra-cz merged commit 4b915fc into SSSD:master Jul 17, 2026
16 of 17 checks passed

This was referenced Jul 17, 2026

[autobackport: sssd-2-9] Tests: add ldap_sudo_search_base warning test #8963

Merged

[autobackport: sssd-2-10] Tests: add ldap_sudo_search_base warning test #8964

Merged

This was referenced Jul 17, 2026

[autobackport: sssd-2-9-4] Tests: add ldap_sudo_search_base warning test #8965

Open

[autobackport: sssd-2-12] Tests: add ldap_sudo_search_base warning test #8966

Merged

[autobackport: sssd-2-13] Tests: add ldap_sudo_search_base warning test #8967

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Tests: add ldap_sudo_search_base warning test#8902

Tests: add ldap_sudo_search_base warning test#8902
jakub-vavra-cz merged 1 commit into
SSSD:masterfrom
spoore1:ldap_sudo_search_base_warning

spoore1 commented Jul 7, 2026

Uh oh!

gemini-code-assist Bot commented Jul 7, 2026

Uh oh!

jakub-vavra-cz left a comment

Uh oh!

sssd-bot commented Jul 8, 2026

Uh oh!

madhuriupadhye commented Jul 9, 2026

Uh oh!

spoore1 commented Jul 9, 2026

Uh oh!

madhuriupadhye commented Jul 14, 2026

Uh oh!

sssd-bot commented Jul 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

spoore1 commented Jul 7, 2026

Uh oh!

gemini-code-assist Bot commented Jul 7, 2026

Uh oh!

jakub-vavra-cz left a comment

Choose a reason for hiding this comment

Uh oh!

sssd-bot commented Jul 8, 2026

Uh oh!

madhuriupadhye commented Jul 9, 2026

Uh oh!

spoore1 commented Jul 9, 2026

Uh oh!

madhuriupadhye commented Jul 14, 2026

Uh oh!

sssd-bot commented Jul 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants