test: Test OTP 2FA login with FreeIPA

[martinpitt]

This demonstrates how to set up FreeIPA to enable two-factor
authentication. On RHEL, this is the only supported method, as there is
no google-authenticator package.

Use HOTP instead of the default TOTP as that's more predictable for an
automated test.

This has worked for a long time already, but let's make sure it stays
that way.

[martinpitt]

I ran this several times locally on fedora-31. Let's see how it fares on all the other OSes.

[martinpitt]

Failed on debian-stable and ubuntu-1804, and the two others as well. This may need an extra waiting loop that sssd sees the new user from IdM. Investigating locally..

[martinpitt]

On Debian stable and the Ubuntus the login attempt already fails at the password stage. I'm trying this with ssh, easier than with cockpit:

Dec 19 13:05:25 x0.cockpit.lan [sssd[krb5_child[21014]: Preauthentication failed
Dec 19 13:05:25 x0.cockpit.lan [sssd[krb5_child[21014]: Preauthentication failed
Dec 19 13:05:25 x0.cockpit.lan sshd[20940]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.27.0.2 user=alice
Dec 19 13:05:25 x0.cockpit.lan sshd[20940]: pam_sss(sshd:auth): received for user alice: 17 (Failure setting user credentials)

Unfortunately sssctl debug-level 5 does not really improve this.

On debian-testing it works, so maybe this is a reasonably recent feature. So let's wait until ubuntu-stable moves over to 20.04, focal already has the latest sssd version. My gut feeling is that this is related to

  * default-to-socket-activated-services.diff: Don't enable any
     services when run without a conffile.

[croissanne]

nice :)