ldaps: add LDAPS support by shridhargadekar · Pull Request #264 · SSSD/sssd-test-framework

shridhargadekar · 2026-07-31T12:59:33Z

Add export_root_ca_certificate() to ADHost, SambaHost, and IPAHost
Add CertUtils (client.cert) utility for system-level CA cert install into /etc/openldap/ldap.conf — works with adcli, realmd, ldapsearch
Add SSSDCommonConfiguration helpers: ad_use_ldaps(), samba_use_ldaps(), ipa_set_tls_cacert() for SSSD-specific LDAPS configuration

danlavu · 2026-08-07T16:32:54Z


        return self.__naming_context

+    def export_root_ca_certificate(self) -> str:


These functions doesn't belong in hosts, it should be in roles and actually already have this method for this.

You should also add it to the generic provider because realm join works for AD, Samba, and IPA, allowing you to write a single test for multiple topologies using TopologyGroup.AnyDC or AnyAD

danlavu · 2026-08-07T16:36:42Z

            truncate --size 0 /var/log/krb5kdc.log
            """)

+    def export_root_ca_certificate(self) -> str:


Like the previous comment, this doesn't belong in hosts, it should be in roles, there is an IPACertifcateAuthority.get() which may work for the CA as well. This CertificateAuthority class should be extended.

danlavu · 2026-08-07T16:36:54Z

        self.adminpw: str = self.config.get("adminpw", self.bindpw)
        """Password of the admin user, defaults to value of ``bindpw``."""

+        self.ca_cert_path: str = self.config.get("ca_cert_path", "/var/data/certs/ca.crt")


Same as the previous comment, but this has no CertificateAuthority class. Please make each role a separate commit.

Still needs to move to the ad role.

danlavu · 2026-08-07T16:41:46Z

+    .. code-block:: python
+        :caption: Example usage with adcli
+
+        @pytest.mark.topology(KnownTopology.Samba)


I don't think this test scenario is really valid, since the KnownTopology.Samba is already joined when the test starts. Have you tried running this test?

danlavu · 2026-08-07T16:49:21Z

+
+
+class _HasCACert(Protocol):
+    """Any host that can export its root CA certificate."""


Moving to roles, this shouldn't be necessary.

danlavu · 2026-08-07T16:51:01Z

+    def install_ca(
+        self,
+        host: _HasCACert,
+        name: str = "test-ldap-ca.crt",


Nitpick, the ca.crt doesn't have to be used for ldap, I'd omit ldap from the name.

danlavu · 2026-08-07T17:00:42Z

+            self.sssd.fs.mkdir_p(parent)
+        self.sssd.fs.write(cacert_path, ca_cert)
+
+    def ad_use_ldaps(self, ad: AD, cacert_path: str = "/etc/sssd/pki/ad-ca.crt") -> None:


We already have a method to configure ldap, SSSDCommonConfiugration.ldap_provider, instead of adding three new methods, please extend this method to support ldaps.

def ldap_provider( self, server: str, naming_context: str, bind_user_dn: str, bind_password: str, subids: bool = False, cacert: str = "/etc/ipa/ca.crt", tls_reqcert: str = "demand", ssl: bool = False, config: dict[str, str] | None = None, ) -> None:

spoore1

Just a couple of quick notes until I can test this out.

spoore1 · 2026-08-12T00:48:13Z

        """
        return self._password_policy

+    def export_root_ca_certificate(self) -> str:


This won't be needed when we re-enable the AD CA class right?

I already have an approved PR to re-enable it but, I need to first get the sssd-ci-containers dependency merged. I'm planning to do that early next week unless it's urgent to get this in place sooner?

Once dependent PR is merged, this can modify

Both of those PRs are now merged. You can rebase and pick up the updates to use here.

I may have misread this initially. Is this needed because not all providers have a CA object with an export method?

shridhargadekar · 2026-08-14T10:26:12Z

Depends upon #255

sumit-bose · 2026-08-20T15:04:05Z

+
+    def _configure_tls_cacert(self) -> None:
+        """Point ``/etc/openldap/ldap.conf`` at the system CA bundle."""
+        system_bundle = "/etc/pki/tls/certs/ca-bundle.crt"


Hi,

with Fedora 44 this changed, see https://fedoraproject.org/wiki/Changes/droppingOfCertPemFile for details.

Since you add the CA certificates to the system store, which sould be used by OpenLDAP by default, maybe the better strategy would be to make sure that all occurrences of TLS_CACERT and TLS_CACERTDIR are commented out in /etc/openldap/ldap.conf to force libldap to use the defaults?

bye,
Sumit

sumit-bose · 2026-08-20T15:16:51Z

+        :param provider: Provider role to fetch the root CA certificate from.
+        :type provider: GenericProvider
+        :param cacert_path: Path on the client where the CA cert is written,
+            defaults to ``/etc/sssd/pki/ca.crt``


Hi,

would it be better to let use SSSD the system's CA certificate store by default and only use a dedicated file if one is provided?

bye,
Sumit

sumit-bose · 2026-08-20T15:29:40Z

+
+        Connects to ``hostname:port`` with ``openssl s_client``, captures the
+        certificate the server presents, writes it to the system trust anchor
+        directory, runs ``update-ca-trust``, and points ``TLS_CACERT`` in


See comments below about the system certificates and Fedora 44.

sumit-bose · 2026-08-20T16:34:47Z


+    def export_root_ca_certificate(self) -> str:
+        """
+        Export the AD root CA certificate in PEM format.


Hi,

you can get the CA certificate directly with certutil.exe -ca.cert filename.

bye,
Sumit

This doesn't seem to work for me (at least not in the VM we have in sssd-ci-containers):

PS C:\Users\Administrator\AppData\Local\Temp> certutil.exe -ca.cert C:\temp\ca.crt Expected no more than 1 args, received 2 CertUtil: Too many arguments

The old PowerShell code though did appear to work better but, I'm not sure it actually exported the correct certificate. It seems to have exported the AD Certificate for CN=dc.ad.test not the CN=ad-RootCA, DC=ad, DC=test one. I'm guessing the latter is needed?

danlavu · 2026-08-22T21:30:25Z


 from __future__ import annotations

+import posixpath


Everywhere else, we just use os.path I suggest keeping it consistent.

danlavu · 2026-08-22T21:37:03Z

+            self.sssd.fs.mkdir_p(parent)
+        self.sssd.fs.write(cacert_path, ca_cert)
+
+    def use_ldaps(self, provider: GenericProvider, cacert_path: str = "/etc/sssd/pki/ca.crt") -> None:


Please extend the existing method.

Are you referring to client.install_ca() from client.py? Or any other file.

…vider Add abstract method that each AD/IPA/Samba role must implement. Returns the root CA certificate in PEM format for use with LDAPS connections. Signed-off-by: shridhargadekar <shridhar.always@gmail.com>

Add ca_cert_path to SambaHost (defaults to /var/data/certs/ca.crt) and implement export_root_ca_certificate() on the Samba role to read the CA certificate from that path for LDAPS connections. Signed-off-by: shridhargadekar <shridhar.always@gmail.com>

Implement export_root_ca_certificate() on the IPA role by fetching the CA certificate via IPA's HTTP endpoint for LDAPS connections. Signed-off-by: shridhargadekar <shridhar.always@gmail.com>

Implement export_root_ca_certificate() on the AD role by walking the cert chain from the LDAPS server certificate in LocalMachine\My to its issuer in LocalMachine\Root, falling back to the server cert for self-signed DC certs (no AD CS required). Signed-off-by: shridhargadekar <shridhar.always@gmail.com>

Add use_ldaps() to SSSDCommonConfiguration that fetches the root CA certificate from the provider, writes it to the client, and sets ldap_tls_cacert in the SSSD domain section. Sets ad_use_ldaps=True for AD/Samba providers. Signed-off-by: shridhargadekar <shridhar.always@gmail.com>

spoore1

I'm not sure the AD export method is working as expected. My testing showed the certutil fail and the old commit worked better but, I'm not sure it's pulling the expected certificate.

spoore1 · 2026-08-25T14:08:02Z


+    def export_root_ca_certificate(self) -> str:
+        """
+        Export the AD root CA certificate in PEM format.


This doesn't seem to work for me (at least not in the VM we have in sssd-ci-containers):

PS C:\Users\Administrator\AppData\Local\Temp> certutil.exe -ca.cert C:\temp\ca.crt Expected no more than 1 args, received 2 CertUtil: Too many arguments

The old PowerShell code though did appear to work better but, I'm not sure it actually exported the correct certificate. It seems to have exported the AD Certificate for CN=dc.ad.test not the CN=ad-RootCA, DC=ad, DC=test one. I'm guessing the latter is needed?

spoore1 · 2026-08-25T14:09:35Z

        """
        return self._password_policy

+    def export_root_ca_certificate(self) -> str:


I may have misread this initially. Is this needed because not all providers have a CA object with an export method?

spoore1 · 2026-08-25T14:11:37Z

+        result = self.host.conn.run(
+            """
+            $tmp = [System.IO.Path]::GetTempFileName() + ".crt"
+            certutil -ca.cert $tmp | Out-Null


As I mentioned above, this didn't work for me when I was testing the changes. The old code in a previous commit came closer but, it exported a certificate for "cn=dc.ad.test" not the "CN=ad-RootCA, DC=ad, DC=test" Root CA certificate. The get_ca_cert() method code grabs the ad-RootCA one so maybe just use that for the AD method?

spoore1 · 2026-08-25T14:12:16Z


        return self.local.sudorule(name)
+
+    def install_ca(


Maybe name this one install_ca_cert or install_ca_certificate? My first thought with install_ca was that this was for setting up an openssl local CA.

Hi,

about certutil, you might have to use quotes in PowerShell like e.g. certutil.exe -"ca.cert" C:\temp\ca.crt to avoid some shell magic.

HTH

bye,
Sumit

Add install_ca() to install a provider's root CA certificate into the system trust store and configure /etc/openldap/ldap.conf with TLS_CACERT and SASL_CBINDING tls-server-end-point for adcli/realmd/ ldapsearch LDAPS use. Add install_ca_from_server() as an alternative that fetches the CA directly from a TLS port via openssl s_client. Signed-off-by: shridhargadekar <shridhar.always@gmail.com>

Replace the PowerShell cert-chain-walk with certutil.exe -ca.cert which reads the CA certificate directly from AD Certificate Services, converts from DER to PEM in Python. Signed-off-by: shridhargadekar <shridhar.always@gmail.com>

shridhargadekar force-pushed the cert_ldaps branch 2 times, most recently from 74dde9f to 3721fa4 Compare July 31, 2026 20:17

shridhargadekar mentioned this pull request Aug 5, 2026

Add export_root_ca_certificate() methods for LDAPS #248

Closed

pbrezina requested review from danlavu and spoore1 August 6, 2026 12:37

pbrezina assigned danlavu and spoore1 Aug 6, 2026

danlavu requested changes Aug 7, 2026

View reviewed changes

shridhargadekar force-pushed the cert_ldaps branch 4 times, most recently from a94e0cc to 41ed743 Compare August 10, 2026 19:05

spoore1 reviewed Aug 12, 2026

View reviewed changes

shridhargadekar force-pushed the cert_ldaps branch from 41ed743 to 0cc8a13 Compare August 14, 2026 10:23

shridhargadekar requested review from danlavu, spoore1 and sumit-bose August 18, 2026 15:43

shridhargadekar assigned sumit-bose Aug 18, 2026

sumit-bose reviewed Aug 20, 2026

View reviewed changes

danlavu requested changes Aug 22, 2026

View reviewed changes

danlavu mentioned this pull request Aug 22, 2026

tests: port ad_provider idmap.sh coverage to system tests SSSD/sssd#8871

Draft

shridhargadekar added 4 commits August 24, 2026 18:48

roles: add export_root_ca_certificate() abstract method to GenericPro…

573693f

…vider Add abstract method that each AD/IPA/Samba role must implement. Returns the root CA certificate in PEM format for use with LDAPS connections. Signed-off-by: shridhargadekar <shridhar.always@gmail.com>

roles/ipa: add export_root_ca_certificate()

8eaec83

Implement export_root_ca_certificate() on the IPA role by fetching the CA certificate via IPA's HTTP endpoint for LDAPS connections. Signed-off-by: shridhargadekar <shridhar.always@gmail.com>

shridhargadekar force-pushed the cert_ldaps branch from 0cc8a13 to e2b0d8a Compare August 24, 2026 18:53

shridhargadekar force-pushed the cert_ldaps branch from e2b0d8a to 7b80a98 Compare August 24, 2026 20:44

spoore1 requested changes Aug 25, 2026

View reviewed changes

shridhargadekar force-pushed the cert_ldaps branch from 7b80a98 to e7f0513 Compare August 25, 2026 19:15

shridhargadekar added 2 commits August 26, 2026 00:48

shridhargadekar force-pushed the cert_ldaps branch from e7f0513 to effb2c3 Compare August 25, 2026 19:45


		return self.__naming_context

		def export_root_ca_certificate(self) -> str:



		class _HasCACert(Protocol):
		"""Any host that can export its root CA certificate."""

Uh oh!

Conversation

shridhargadekar commented Jul 31, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

spoore1 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

shridhargadekar commented Aug 14, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

spoore1 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants