[autobackport: sssd-2-12] Tests: add ldap_sudo_search_base warning test#8966
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new system test to verify that SSSD emits security warnings in both the domain debug log and the system journal when ldap_sudo_search_base is not configured. The reviewer identified a potential race condition because SSSD starts asynchronously, which could cause flaky test failures if the log is read immediately. They provided a code suggestion to implement a polling loop with a timeout to wait for the warnings to be logged before asserting.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
When ldap_sudo_search_base is not set, SSSD defaults to searching the entire directory tree for sudoRole objects. In this case, we expect a warning message to be logged. Assisted-By: Claude Code (Sonnet 4.6 (1M context)) Reviewed-by: Jakub Vávra <jvavra@redhat.com> (cherry picked from commit 4b915fc)
|
The pull request was accepted by @jakub-vavra-cz with the following PR CI status: 🟢 rpm-build:centos-stream-10-x86_64:upstream (success) There are unsuccessful or unfinished checks. Make sure that the failures are not related to this pull request before merging. |
e03ff6d to
0c85124
Compare
3 participants
This is an automatic backport of PR#8902 Tests: add ldap_sudo_search_base warning test to branch sssd-2-12, created by @spoore1.
Please make sure this backport is correct.
Note
The commits were cherry-picked without conflicts.
You can push changes to this pull request
Original commits
4b915fc - Tests: add ldap_sudo_search_base warning test
Backported commits
Original Pull Request Body
When ldap_sudo_search_base is not set, SSSD defaults to searching the entire directory tree for sudoRole objects. In this case, we expect a warning message to be logged.
Assisted-By: Claude Code (Sonnet 4.6 (1M context))