Title: #3163: Getkeytab fixes
This is a set of initial patches needed to support a Samba server running on IPA domain
These patches by themselves do not enable Samba server yet. They fix assorted bugs I found
when adding the support for SMB service and tests for them. Some patches were omitted due
to the complexity to untangle.
Most of `test_xmlrpc` tests that rely on a comparison of the user/group results cannot
tolerate running in an environment where trust to Active Directory support is enabled.
Originally, I started adding fixes for these problems but it quickly escalated to several
hundred failed tests. The main issue is a dictionary comparison feature that doesn't
allow to specify an attribute to be optional. When trust to AD is enabled, all POSIX users
and groups in IPA will get `ipaNTSecurityIdentifier` attribute and
`ipantuserattrs`/`ipantgroupattrs` object class added at a creation time.
Dictionary comparison in tests will fail:
- a tracker-maintained dictionary would not have `ipantuserattrs`/`ipantgroupattrs`
- a result returned from `user-add` / `group-add` commands might contain the objectclasses
and `ipaNTSecurityIdentifier` or might not, depending on how powerful is the test machine
so that `sidgen` plugin is able to add the attributes before `user-add` / `group-add`
command would retrieve the entry
- if we would add `ipaNTSecurityIdentifier` into the tracker-maintained dictionary, the
result comparison code will have no logic to understand that if `ipaNTSecurityIdentifier`
is missing in the result, it is not a failure: `fuzzy_sid` class allows for `None`
- for group-finding tests, it is impossible to get just a subset of required groups. This
prevents from any additional configuration on the test machines. An attempt to search by a
wildcard with `ipa group-find --description="Test desc*"` fails because we
escape "*" and that filter doesn't match. We need to refactor search code to
allow a wildcard search to reduce the number of expected groups in such tests.
I started fixing these issues but they will evidently require a major refactoring of the
test code. Meanwhile, these problems are tracked with
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3163/head:pr3163
git checkout pr3163