Adcs smartcard setup v2

[spoore1]

• AD role: change Enrollment Agent name

Changing the default Certificate Template name for the Enrollment Agent template from EnrollmentAgent4 to EnrollmentAgent_IDMTEST.

• topology_controller: update join_domain for ad

Updates for better AD support including with smart card tests that require a pkinit_anchor for the krb5 config.

Also backing up krb5.conf and krb5.keytab to make setup/teardown a little cleaner.

Skipping krb5.conf removal for AD tests so there is a functional version for use.

• Re-Enable AD CA along with containers update

Re-enabling AD CA role support for smart card testing to align with sssd-ci-containers change to enable this funtionality.

Depends-on: SSSD/sssd-ci-containers#174

[gemini-code-assist]

Code Review

This pull request re-enables AD Certificate Authority functionality and updates the certificate template name in sssd_test_framework/roles/ad.py. It also modifies sssd_test_framework/topology_controllers.py to back up Kerberos configuration files, skip removing krb5.conf for AD providers, and write a custom ad_pkinit configuration. Feedback was provided regarding the indentation of the closing triple quotes in the textwrap.dedent block, which prevents proper dedenting of the generated configuration, along with a suggestion to simplify the isinstance check.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

The closing triple quotes """ on line 118 are indented with 12 spaces, while the content lines are indented with 16 spaces. Because of this mismatch, textwrap.dedent will only strip 12 spaces of indentation, leaving 4 spaces of leading whitespace on every line of the generated krb5.conf snippet.

Aligning the closing triple quotes with the content's base indentation (16 spaces) ensures that textwrap.dedent strips all 16 spaces, producing a correctly formatted file with no leading whitespace on the main section headers. Additionally, we can simplify isinstance(provider, (ADHost)) to isinstance(provider, ADHost).

Suggested change

	if isinstance(provider, (ADHost)):
	ad_krb5_content = textwrap.dedent(
	f"""\
	[realms]
	{provider.realm} = {{
	default_domain = {provider.domain}
	pkinit_anchors = FILE:/etc/sssd/pki/sssd_auth_ca_db.pem
	pkinit_eku_checking = kpServerAuth
	pkinit_kdc_hostname = {provider.hostname}
	}}
	"""
	)
	if isinstance(provider, ADHost):
	ad_krb5_content = textwrap.dedent(
	f"""\
	[realms]
	{provider.realm} = {{
	default_domain = {provider.domain}
	pkinit_anchors = FILE:/etc/sssd/pki/sssd_auth_ca_db.pem
	pkinit_eku_checking = kpServerAuth
	pkinit_kdc_hostname = {provider.hostname}
	}}
	"""
	)

[jakub-vavra-cz]

Valid issue or intended extra indent?