tests: add LDAP+KRB5 DNS discovery and SASL tests

[madhuriupadhye]

Add three pytest system tests to test_ldap_krb5.py:

• DNS SRV discovery for LDAP (Trac 754): dns_discovery_domain without ldap_uri
• BZ 700805: ldap_backup_uri when discovery domain has no _ldap._tcp SRV
• BZ 732935: ldap_sasl_canonicalize vs reverse DNS with GSSAPI over ldaps://IP

Uses client.tools.dig and client.tools.getent.ahostsv4 (sssd-test-framework).

[gemini-code-assist]

Code Review

This pull request introduces new system tests for SSSD's LDAP and Kerberos integration, specifically covering DNS SRV discovery, backup URI failover, and SASL canonicalization behavior with GSSAPI. The review feedback highlights a need to handle IPv6 addresses correctly in LDAP URIs by using square brackets and suggests reordering test logic to ensure the test skips appropriately when the environment cannot reproduce the specific canonicalization issue.

[gemini-code-assist]

The LDAP URI construction does not account for IPv6 addresses. If ldap_ip is an IPv6 address, it must be enclosed in square brackets (e.g., ldaps://[2001:db8::1]) to be a valid URI. Using a raw IPv6 address will cause SSSD or libldap to fail parsing the URI due to the ambiguous colons.

Suggested change

	client.sssd.domain["ldap_uri"] = f"ldaps://{ldap_ip}"
	ldap_uri = f"ldaps://[{ldap_ip}]" if ":" in ldap_ip else f"ldaps://{ldap_ip}"
	client.sssd.domain["ldap_uri"] = ldap_uri

[gemini-code-assist]

The test logic for skipping when the environment cannot reproduce the issue is flawed. The check if not broken is performed after a second SSSD restart and an assertion. If the environment has a working reverse DNS (i.e., broken is False), the test should skip immediately after the first id call. Otherwise, if the second id call fails for unrelated reasons, the test will incorrectly report a failure instead of skipping.

    broken = client.tools.id("puser1") is None
    if not broken:
        pytest.skip(
            "Reverse DNS for LDAP IP matches expected hostname; cannot reproduce BZ 732935 "
            "canonicalize failure in this environment"
        )

    client.sssd.domain["ldap_sasl_canonicalize"] = "false"
    client.sssd.restart(clean=True)
    assert client.tools.id("puser1") is not None, "id should succeed with ldap_sasl_canonicalize=false"