Adcs smartcard setup v2

[spoore1]

• AD role: change Enrollment Agent name

Changing the default Certificate Template name for the Enrollment Agent template from EnrollmentAgent4 to EnrollmentAgent_IDMTEST.

• topology_controller: update join_domain for ad

Updates for better AD support including with smart card tests that require a pkinit_anchor for the krb5 config.

Also backing up krb5.conf and krb5.keytab to make setup/teardown a little cleaner.

Skipping krb5.conf removal for AD tests so there is a functional version for use.

• Re-Enable AD CA along with containers update

Re-enabling AD CA role support for smart card testing to align with sssd-ci-containers change to enable this funtionality.

Depends-on: SSSD/sssd-ci-containers#174

[gemini-code-assist]

Code Review

This pull request re-enables AD Certificate Authority functionality and updates the certificate template name in sssd_test_framework/roles/ad.py. It also modifies sssd_test_framework/topology_controllers.py to back up Kerberos configuration files, skip removing krb5.conf for AD providers, and write a custom ad_pkinit configuration. Feedback was provided regarding the indentation of the closing triple quotes in the textwrap.dedent block, which prevents proper dedenting of the generated configuration, along with a suggestion to simplify the isinstance check.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[spoore1]

Locally ran the system tests against fedora-latest containers with this result:

=========================== short test summary info ============================
FAILED tests/test_kcm.py::test_kcm__tgt_renewal_updates_ticket_as_configured (client)
FAILED tests/test_sudo.py::test_sudo__ldap_sudo_search_base_not_set_emits_warning (ldap)
FAILED tests/test_ldap_krb5.py::test_ldap_krb5__keytab_selects_correct_principal_with_multiple_realms (ldap_krb5)
FAILED tests/test_gpo.py::test_gpo__rejects_path_traversal_in_gpo_file_sys_path (samba)
= 4 failed, 618 passed, 26 skipped, 316 deselected, 1 xfailed in 9084.17s (2:31:24) =

Will merge this now.