From e33ffab534c9ecce26fbd069956d15da182ce6ed Mon Sep 17 00:00:00 2001
From: Mohammad Rizwan <myusuf@redhat.com>
Date: Wed, 10 Jun 2020 19:49:06 +0530
Subject: [PATCH] ipatests: Test ipa user login with wrong password

When ipa user login to machine using wrong password, it
should log proper message in /var/log/secure

related: SSSD/sssd#5139

Signed-off-by: Mohammad Rizwan <myusuf@redhat.com>
Reviewed-By: Anuja More <amore@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
---
 ipatests/test_integration/test_commands.py | 41 ++++++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/ipatests/test_integration/test_commands.py b/ipatests/test_integration/test_commands.py
index e33aa28f1..1973ba843 100644
--- a/ipatests/test_integration/test_commands.py
+++ b/ipatests/test_integration/test_commands.py
@@ -1170,3 +1170,44 @@ class TestIPACommand(IntegrationTest):
             assert msg2 not in result.stderr_text
         finally:
             bashrc_backup.restore()
+
+    @pytest.fixture
+    def user_creation_deletion(self):
+        # create user
+        self.testuser = 'testuser'
+        tasks.create_active_user(self.master, self.testuser, 'Secret123')
+
+        yield
+
+        # cleanup
+        tasks.kinit_admin(self.master)
+        self.master.run_command(['ipa', 'user-del', self.testuser])
+
+    def test_login_wrong_password(self, user_creation_deletion):
+        """Test ipa user login with wrong password
+
+        When ipa user login to machine using wrong password, it
+        should log proper message
+
+        related: https://github.com/SSSD/sssd/issues/5139
+        """
+        # try to login with wrong password
+        sshconn = paramiko.SSHClient()
+        sshconn.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+        since = time.strftime('%H:%M:%S')
+        try:
+            sshconn.connect(self.master.hostname,
+                            username=self.testuser,
+                            password='WrongPassword')
+        except paramiko.AuthenticationException:
+            pass
+
+        sshconn.close()
+
+        # check if proper message logged
+        exp_msg = ("pam_sss(sshd:auth): received for user {}: 7"
+                   " (Authentication failure)".format(self.testuser))
+        result = self.master.run_command(['journalctl',
+                                          '-u', 'sshd',
+                                          '--since={}'.format(since)])
+        assert exp_msg in result.stdout_text