#!/bin/sh -eux

# clean up from previous run, so that test becomes idempotent
userdel -r alice 2>/dev/null || true
systemctl stop sssd
rm -f /var/log/sssd/*

CERT=/tmp/alice.pem
cat <<EOF > $CERT
-----BEGIN CERTIFICATE-----
MIIDATCCAemgAwIBAgIBATANBgkqhkiG9w0BAQsFADAuMRAwDgYDVQQKDAdDb2Nr
cGl0MQ0wCwYDVQQLDAR0ZXN0MQswCQYDVQQDDAJDQTAeFw0yMDA3MTYxMDAwMDRa
Fw0zMDA3MTQxMDAwMDRaMD4xDjAMBgNVBAMMBWFsaWNlMRcwFQYKCZImiZPyLGQB
GRYHQ09DS1BJVDETMBEGCgmSJomT8ixkARkWA0xBTjCCASIwDQYJKoZIhvcNAQEB
BQADggEPADCCAQoCggEBAKCyJitfhk/xbb+Y9vOX5qbNu6ZKggvmDvT7NLv8PZoV
zi8GYtDhCCBEj80tfAbFlf34Vk/TtLFEbuETFpeMKjgX15dTtvUHOYfUQ1pSOIAa
rDPrf57rcbtxkTUHEgVg21RxzglTl17VQjl7JzS3F/pr/JifleGKxgTWDNAfpQJF
tppLkanzSOfNDGTy2cxv82I20SSI5AhAXKz7h3NWnXCBdinFbhtlkAl/j9zlZJou
dCht6qA92ZvbOjl6ta+DlykCg0fMuRiy4X96DRwCdCW8Bht/g1x0AlUXUI5MKH68
xmnb2xeYwFrT5Tf0p20kVIQaBjOD9mmywYNnlfWu/nsCAwEAAaMaMBgwCQYDVR0T
BAIwADALBgNVHQ8EBAMCA6gwDQYJKoZIhvcNAQELBQADggEBAILcT4LCN1PxN/kB
OLOQWeJyO2B63q0IRB7b6KwtI9nWP9FMB9Obhlw0EHFIvznbR4VmiXcZUmxfelJM
nLU2yLClQOTUI+JVDE2ZrVJgJzxaf2JLgTAqNvH8ZRpaRtAI81lJkLROVRJuXldS
aANbIpToVgPZTAA8wjNoUbVZsAHP4z+hE8ZOaJ4LvCU/+QTGyBdLcJTmZH3CWUcJ
zUEGmTj+tgNZw1X0L6l9JfStwvHNn2Mirytw6L2r50Rqx5OyU8rcERGJOeQq1kj1
P5xsqZEkzaV4Qz9CaJc9/OnOGBgJ+eJftzTY8ODWjIkI3yQfHLx1EWaea4DYeprK
y4f1exM=
-----END CERTIFICATE-----
EOF

useradd alice
echo alice:foobar123 | chpasswd

echo 'echo foobar123' > /tmp/askpass.sh
chmod 755 /tmp/askpass.sh

cat <<EOF > /etc/sssd/sssd.conf
[sssd]
domains = local

[domain/local]
id_provider = files

[certmap/local/alice]
# WARNING: Requires sssd >= 2.6.1 and installing sssd_auth_ca_db.pem; with earlier sssd this is completely unsafe
matchrule = <SUBJECT>^DC=LAN,DC=COCKPIT,CN=alice$
EOF
chmod 600 /etc/sssd/sssd.conf
systemctl restart sssd

# no CA set up, so supposed to fail on "invalid cert"
! busctl call org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe/Users \
              org.freedesktop.sssd.infopipe.Users FindByValidCertificate s -- "$(cat $CERT)"

[ $(stat -c %u /var/log/sssd/p11_child.log) = 0 ]

# non-interactive standard PAM login
SSH_ASKPASS_REQUIRE=force SSH_ASKPASS=/tmp/askpass.sh setsid ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o CheckHostIP=no alice@localhost whoami

# this messes up permissions
[ $(stat -c %u /var/log/sssd/p11_child.log) = 0 ] || {
    echo "FAIL:"
    ls -l /var/log/sssd/p11_child.log
    exit 1
}