TESTS: Add an integration test for renaming incomplete groups during initgroups As we implemented the group renaming heuristics to rename only if we can use another "hint" like the original DN or the SID to know the group is the same, this patch adds two tests (positive and negative) to make sure a group with a totally different RDN and hence different originalDN cannot be renamed but a group whose name changed but the RDN stays the same can be renamed. Related: https://pagure.io/SSSD/sssd/issue/3282 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>

SYSDB: When marking an entry as expired, also set the originalModifyTimestamp to 1 Resolves: https://pagure.io/SSSD/sssd/issue/3684 If the cleanup task removes a user who was a fully resolved member (not a ghost), but then the group the user was a member of is requested, unless the group had changed, the user doesn't appear as a member of the group again. This is because the modify timestamp would prevent the group from updating and therefore the ghost attribute is not readded. To mitigate this, let's also set the originalModifyTimestamp attribute to 1, so that we never take the optimized path while updating the group. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>

TESTS: Fix E303 pep8 issues on test_ldap.py E303: too many blank lines (3) Resolves: https://pagure.io/SSSD/sssd/issue/3605 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>

TESTS: Fix E501 pep8 issues on test_ldap.py E501: line too long (longer than 79 characters) Resolves: https://pagure.io/SSSD/sssd/issue/3605 Reviewed-by: Michal Židek <mzidek@redhat.com> Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com>

TESTS: Fix E266 pep8 issues on test_ldap.py E266: too many leading '#' for block comment Resolves: https://pagure.io/SSSD/sssd/issue/3605 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>

TESTS: Add integration tests for the auto_private_groups option Related: https://pagure.io/SSSD/sssd/issue/1872 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>

TESTS: Add regression tests to try if resolving root and ID 0 fails as expected Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>

TESTS: Update zero nesting level test Add code to the existing zero nesting level test, check group list and ensure nested groups are intentionally skipped and filtered out. Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>

INTG_TESTS: Add one more test for filtered out users/groups The added test is quite simple and basically ensures that when some shortcut is taken in the cache_req_send() SSSD still filters out the already cached users/groups. The real situation the test tries to test is: - getent passwd 1002 - sleep(2) - getent passwd 1002 - getent group 2002 - sleep(2) - getent group 2002 (Considering entry_negative_timeout = 1 in [nss] section of sssd.conf). Related: https://pagure.io/SSSD/sssd/issue/3362 Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

test_ldap.py: Add test for filter_{users,groups} Related: https://pagure.io/SSSD/sssd/issue/3362 Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com> Reviewed-by: Pavel Březina <pbrezina@redhat.com>

intg: Use bytes for value of attributes in ldif Python3 version of ldap module require string for name of attribute but bytes for value of attribute. It was not a problem in python2 due to unicode changes in python3 Reviewed-by: Martin Basti <mbasti@redhat.com>

tests: Add a test for group resolution with ldap_group_nesting_level=0 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

TESTS: Adding intg. tests on nested groups Resolves: https://fedorahosted.org/sssd/ticket/2940 Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com> Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

intg: Test extra attributes duplicate Regresion test for ticket #3120 Resolves: https://fedorahosted.org/sssd/ticket/3120 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

test_ldap: test resolving of names with special characters Integration test for #3121 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

test_ldap: test nested membership with rfc2307bis Integration test for #3093 Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

intg: create ldap test without enumeration Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>