Adcs smartcard setup v2#255
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request re-enables AD Certificate Authority functionality and updates the certificate template name in sssd_test_framework/roles/ad.py. It also modifies sssd_test_framework/topology_controllers.py to back up Kerberos configuration files, skip removing krb5.conf for AD providers, and write a custom ad_pkinit configuration. Feedback was provided regarding the indentation of the closing triple quotes in the textwrap.dedent block, which prevents proper dedenting of the generated configuration, along with a suggestion to simplify the isinstance check.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
Changing the default Certificate Template name for the Enrollment Agent template from EnrollmentAgent4 to EnrollmentAgent_IDMTEST.
862f217 to
36ad3a5
Compare
Updates for better AD support including with smart card tests that require a pkinit_anchor for the krb5 config. Also backing up krb5.conf and krb5.keytab to make setup/teardown a little cleaner. Skipping krb5.conf removal for AD tests so there is a functional version for use.
Re-enabling AD CA role support for smart card testing to align with sssd-ci-containers change to enable this funtionality. Depends-on: SSSD/sssd-ci-containers#174
In some environments, the stdin password pipe for an openssl command in the ad.ca.request() method fails with invalid password. Removing the pipe and setting it directly from the command line. The AD CA is not always configured with the name forced to ad-RootCA. Changing to use _get_ca_config() to determine the CA name to use.
36ad3a5 to
abecbd1
Compare
3 participants
Changing the default Certificate Template name for the Enrollment Agent template from EnrollmentAgent4 to EnrollmentAgent_IDMTEST.
Updates for better AD support including with smart card tests that require a pkinit_anchor for the krb5 config.
Also backing up krb5.conf and krb5.keytab to make setup/teardown a little cleaner.
Skipping krb5.conf removal for AD tests so there is a functional version for use.
Re-enabling AD CA role support for smart card testing to align with sssd-ci-containers change to enable this funtionality.
Depends-on: SSSD/sssd-ci-containers#174