[autobackport: sssd-2-10] test_kcm: use config_apply instead of start to avoid proxy domain auth issue

[sssd-bot]

This is an automatic backport of PR#9113 test_kcm: use config_apply instead of start to avoid proxy domain auth issue to branch sssd-2-10, created by @mmatsuya.

Please make sure this backport is correct.

Note

The commits were cherry-picked without conflicts.

You can push changes to this pull request

git remote add sssd-bot git@github.com:sssd-bot/sssd.git
git fetch sssd-bot refs/heads/SSSD-sssd-backport-pr9113-to-sssd-2-10
git checkout SSSD-sssd-backport-pr9113-to-sssd-2-10
git push sssd-bot SSSD-sssd-backport-pr9113-to-sssd-2-10 --force

---

Original commits
3efabe8 - test_kcm: use config_apply instead of start to avoid proxy domain auth issue

Backported commits

• eb8d332 - test_kcm: use config_apply instead of start to avoid proxy domain auth issue

---

Original Pull Request Body

Problem

test_kcm__ccache_holds_multiple_and_all_types_of_principals fails on RHEL 9.6
with SSHAuthenticationError when the client image ships with
passwd: sss files systemd in /etc/nsswitch.conf.

The root cause is that client.sssd.start() starts SSSD with a proxy+files
domain (id_provider=proxy, proxy_lib_name=files,
proxy_pam_target=system-auth). When sss appears before files in
nsswitch.conf, SSSD returns * in the password field for NSS lookups.
pam_unix sees * and treats the account as locked, causing SSH
authentication to fail.

Fix

Replace client.sssd.start() with client.sssd.config_apply() so that:

• sssd.conf is written with the correct ccache_storage setting (preserving
  the memory/secdb parametrization)
• sssd.service is not started → the proxy+files domain is never active
• sssd-kcm starts on demand via systemd socket activation when kinit first
  connects to the KCM socket

This approach is consistent with the observation that KCM functionality does
not require the full SSSD daemon to be running.

Testing

Verified on RHEL 9.6 (sssd-2.9.4) with passwd: sss files systemd in
/etc/nsswitch.conf:

• Before: test_kcm__ccache_holds_multiple_and_all_types_of_principals
  fails with SSHAuthenticationError for both memory and secdb
• After: 2 passed (memory + secdb)

Closes: SSSD/sssd-test-framework#265

Suggested-by: Sumit Bose sbose@redhat.com

[jakub-vavra-cz]

Clean backport. LGTM.

[sssd-bot]

The pull request was accepted by @jakub-vavra-cz with the following PR CI status:

---

🟢 rpm-build:centos-stream-10-x86_64:upstream (success)
🟡 testing-farm:centos-stream-10-x86_64:upstream (in_progress)

---

There are unsuccessful or unfinished checks. Make sure that the failures are not related to this pull request before merging.