tests: keep the integration suite runnable on modern Samba and NSS users

The adsysd integration tests run the daemon against a guest-only smbd
with no real KDC, relying on libsmbclient falling back from kerberos to
anonymous authentication. Samba >= 4.23 dropped that implicit fallback,
so the SMB fetch fails with EINVAL on current systems. Gating a test-only
ADSYS_TESTS_WITHOUT_KERBEROS variable in ad.New() lets the daemon skip
kerberos under the harness; it must never be set in production.

The mock D-Bus/polkit/systemd containers also resolve the connecting user
through the bind-mounted /etc/passwd and /etc/group. When the suite runs
as a user only known through NSS (e.g. an LDAP/SSSD user absent from the
local files), the container cannot resolve the UID and resets the
connection, so the harness now generates augmented passwd/group databases
that include the current user before mounting them.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: denisonbarbosa

cmd/adsysd/integration_tests/adsys_test.go

@@ -13,6 +13,8 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"strconv"
+	"strings"
 	"sync"
 	"testing"
 	"time"
@@ -33,6 +35,15 @@ var (
 )
 
 func TestMain(m *testing.M) {
+	// The integration tests run the daemon against a guest-only smbd with no
+	// real KDC, relying on libsmbclient falling back from kerberos to
+	// anonymous. Newer Samba (>= 4.23) dropped that implicit fallback, so we
+	// tell the daemon to skip kerberos entirely. This env var is only honored
+	// by the daemon for tests and is propagated to re-exec'd helper processes.
+	if err := os.Setenv("ADSYS_TESTS_WITHOUT_KERBEROS", "1"); err != nil {
+		log.Fatalf("Setup: can't disable kerberos for tests: %v", err)
+	}
+
 	if os.Getenv("ADSYS_SKIP_INTEGRATION_TESTS") != "" {
 		fmt.Println("Integration tests skipped as requested")
 		return
@@ -402,6 +413,15 @@ func runDaemons() (teardown func()) {
 		answers[mode] = filepath.Join(dir, mode)
 	}
 
+	// The mock containers resolve the connecting user through the bind-mounted
+	// /etc/passwd and /etc/group. When the tests run as a user that is only
+	// known through NSS (e.g. an LDAP/SSSD user not present in the local files),
+	// the container's D-Bus daemon can't resolve the UID and resets the
+	// connection. Generate augmented databases that also contain the current
+	// user and group so the mocks work regardless of the NSS backend.
+	passwdFile := writeUserDatabase(dir, "passwd", "/etc/passwd")
+	groupFile := writeUserDatabase(dir, "group", "/etc/group")
+
 	var errsDocker error
 	var wg sync.WaitGroup
 	for answer, socketDir := range answers {
@@ -422,8 +442,8 @@ func runDaemons() (teardown func()) {
 				"run", "--rm", "--pid", "host",
 				"--name", containerName+answer,
 				"--volume", fmt.Sprintf("%s:%s:ro", adsysActionsDir, "/usr/share/polkit-1/actions.orig"),
-				"--volume", `/etc/group:/etc/group:ro`,
-				"--volume", `/etc/passwd:/etc/passwd:ro`,
+				"--volume", fmt.Sprintf("%s:/etc/group:ro", groupFile),
+				"--volume", fmt.Sprintf("%s:/etc/passwd:ro", passwdFile),
 				"--volume", fmt.Sprintf("%s:/dbus/", socketDir),
 				dockerSystemDaemonsImage,
 				answer,
@@ -474,6 +494,49 @@ func runDaemons() (teardown func()) {
 	}
 }
 
+// writeUserDatabase copies the host NSS database file (/etc/passwd or /etc/group)
+// into dir and ensures the current user and group are present so that the mock
+// containers can resolve the connecting UID even when it is only provided through
+// NSS (e.g. an LDAP/SSSD user not listed in the local files). It returns the path
+// to the generated file.
+func writeUserDatabase(dir, name, src string) string {
+	content, err := os.ReadFile(src)
+	if err != nil {
+		log.Fatalf("Setup: can't read %s: %v", src, err)
+	}
+
+	// Resolve the current user (passwd) or group (group) entry through NSS and
+	// append it if it isn't already provided by the local file.
+	var id, entry string
+	switch name {
+	case "passwd":
+		id = strconv.Itoa(os.Getuid())
+	case "group":
+		id = strconv.Itoa(os.Getgid())
+	}
+
+	// #nosec G204: name and id are controlled by the test.
+	out, err := exec.Command("getent", name, id).Output()
+	if err == nil {
+		entry = strings.TrimSpace(string(out))
+	}
+	if entry != "" {
+		field := entry[:strings.Index(entry, ":")+1]
+		if !bytes.Contains(content, []byte("\n"+field)) && !bytes.HasPrefix(content, []byte(field)) {
+			if len(content) > 0 && content[len(content)-1] != '\n' {
+				content = append(content, '\n')
+			}
+			content = append(content, []byte(entry+"\n")...)
+		}
+	}
+
+	dest := filepath.Join(dir, name)
+	if err := os.WriteFile(dest, content, 0644); err != nil {
+		log.Fatalf("Setup: can't write %s database: %v", name, err)
+	}
+	return dest
+}
+
 // dbusAnswer will flip to which polkit and systemd mock to communicate to:
 // - yes for polkit always authorizing our actions, with a harcoded startup time and next refresh unit time.
 // - no for polkit always denying our actions, with a harcoded startup time and next refresh unit time.

internal/ad/ad.go

@@ -149,6 +149,13 @@ func New(ctx context.Context, configBackend backends.Backend, hostname string, o
 		}
 	}
 
+	// Allow integration tests running the real daemon binary to disable
+	// kerberos authentication, as they have no real KDC to authenticate
+	// against. This must never be set in production.
+	if os.Getenv("ADSYS_TESTS_WITHOUT_KERBEROS") != "" {
+		args.withoutKerberos = true
+	}
+
 	krb5CacheDir := filepath.Join(args.runDir, "krb5cc")
 	if err := os.MkdirAll(filepath.Join(krb5CacheDir, "tracking"), 0700); err != nil {
 		return nil, err