Change the way has_keytab is determined, also check for password.

We need an indicator to see if a keytab has been set on host and
service entries. We also need a way to know if a one-time password is
set on a host.

This adds an ACI that grants search on userPassword and
krbPrincipalKey so we can do an existence search on them. This way
we can tell if the attribute is set and create a fake attribute
accordingly.

When a userPassword is set on a host a keytab is generated against
that password so we always set has_keytab to False if a password
exists. This is fine because when keytab gets generated for the
host the password is removed (hence one-time).

This adds has_keytab/has_password to the user, host and service plugins.

ticket https://fedorahosted.org/freeipa/ticket/1538

10 files changed, 112 insertions, 3 deletions

diff --git a/tests/test_xmlrpc/test_attr.py b/tests/test_xmlrpc/test_attr.py
index 3f78a678d..11aaa01e3 100644
--- a/tests/test_xmlrpc/test_attr.py
+++ b/tests/test_xmlrpc/test_attr.py
@@ -69,6 +69,8 @@ class test_attr(Declarative):
                     dn=lambda x: DN(x) == \
                         DN(('uid','tuser1'),('cn','users'),('cn','accounts'),
                            api.env.basedn),
+                    has_keytab=False,
+                    has_password=False,
                 ),
             ),
         ),
@@ -91,6 +93,8 @@ class test_attr(Declarative):
                     mail=[u'test@example.com'],
                     memberof_group=[u'ipausers'],
                     nsaccountlock=False,
+                    has_keytab=False,
+                    has_password=False,
                 ),
                 summary=u'Modified user "tuser1"',
                 value=user1,
@@ -115,6 +119,8 @@ class test_attr(Declarative):
                     mail=[u'test@example.com', u'test2@example.com'],
                     memberof_group=[u'ipausers'],
                     nsaccountlock=False,
+                    has_keytab=False,
+                    has_password=False,
                 ),
                 summary=u'Modified user "tuser1"',
                 value=user1,
@@ -140,6 +146,8 @@ class test_attr(Declarative):
                     memberof_group=[u'ipausers'],
                     telephonenumber=[u'410-555-1212', u'301-555-1212'],
                     nsaccountlock=False,
+                    has_keytab=False,
+                    has_password=False,
                 ),
                 summary=u'Modified user "tuser1"',
                 value=user1,
@@ -165,6 +173,8 @@ class test_attr(Declarative):
                     memberof_group=[u'ipausers'],
                     telephonenumber=[u'301-555-1212'],
                     nsaccountlock=False,
+                    has_keytab=False,
+                    has_password=False,
                 ),
                 summary=u'Modified user "tuser1"',
                 value=user1,
@@ -190,6 +200,8 @@ class test_attr(Declarative):
                     memberof_group=[u'ipausers'],
                     telephonenumber=[u'301-555-1212', u'202-888-9833', u'703-555-1212'],
                     nsaccountlock=False,
+                    has_keytab=False,
+                    has_password=False,
                 ),
                 summary=u'Modified user "tuser1"',
                 value=user1,
@@ -233,6 +245,8 @@ class test_attr(Declarative):
                     memberof_group=[u'ipausers'],
                     telephonenumber=[u'301-555-1212', u'202-888-9833', u'703-555-1212'],
                     nsaccountlock=False,
+                    has_keytab=False,
+                    has_password=False,
                 ),
                 summary=u'Modified user "tuser1"',
                 value=user1,
@@ -258,6 +272,8 @@ class test_attr(Declarative):
                     memberof_group=[u'ipausers'],
                     telephonenumber=[u'301-555-1212', u'202-888-9833', u'703-555-1212'],
                     nsaccountlock=False,
+                    has_keytab=False,
+                    has_password=False,
                 ),
                 summary=u'Modified user "tuser1"',
                 value=user1,
diff --git a/tests/test_xmlrpc/test_group_plugin.py b/tests/test_xmlrpc/test_group_plugin.py
index 096bab2de..6403251e6 100644
--- a/tests/test_xmlrpc/test_group_plugin.py
+++ b/tests/test_xmlrpc/test_group_plugin.py
@@ -637,6 +637,8 @@ class test_group(Declarative):
                     dn=lambda x: DN(x) == \
                         DN(('uid',user1),('cn','users'),('cn','accounts'),
                            api.env.basedn),
+                    has_keytab=False,
+                    has_password=False,
                 ),
             ),
         ),
@@ -753,6 +755,8 @@ class test_group(Declarative):
                     dn=lambda x: DN(x) == \
                         DN(('uid','tuser1'),('cn','users'),('cn','accounts'),
                            api.env.basedn),
+                    has_keytab=False,
+                    has_password=False,
                 ),
             ),
         ),
diff --git a/tests/test_xmlrpc/test_host_plugin.py b/tests/test_xmlrpc/test_host_plugin.py
index 87eb93768..f7746407b 100644
--- a/tests/test_xmlrpc/test_host_plugin.py
+++ b/tests/test_xmlrpc/test_host_plugin.py
@@ -109,6 +109,8 @@ class test_host(Declarative):
                     objectclass=objectclasses.host,
                     ipauniqueid=[fuzzy_uuid],
                     managedby_host=[fqdn1],
+                    has_keytab=False,
+                    has_password=False,
                 ),
             ),
         ),
@@ -140,6 +142,7 @@ class test_host(Declarative):
                     l=[u'Undisclosed location 1'],
                     krbprincipalname=[u'host/%s@%s' % (fqdn1, api.env.realm)],
                     has_keytab=False,
+                    has_password=False,
                     managedby_host=[fqdn1],
                 ),
             ),
@@ -168,7 +171,8 @@ class test_host(Declarative):
                     managedby_host=[fqdn1],
                     managing_host=[fqdn1],
                     ipauniqueid=[fuzzy_uuid],
-                    has_keytab=False
+                    has_keytab=False,
+                    has_password=False,
                 ),
             ),
         ),
@@ -189,6 +193,8 @@ class test_host(Declarative):
                         l=[u'Undisclosed location 1'],
                         krbprincipalname=[u'host/%s@%s' % (fqdn1, api.env.realm)],
                         managedby_host=[u'%s' % fqdn1],
+                        has_keytab=False,
+                        has_password=False,
                     ),
                 ],
             ),
@@ -219,6 +225,8 @@ class test_host(Declarative):
                         ipauniqueid=[fuzzy_uuid],
                         managedby_host=[u'%s' % fqdn1],
                         managing_host=[u'%s' % fqdn1],
+                        has_keytab=False,
+                        has_password=False,
                     ),
                 ],
             ),
@@ -265,6 +273,7 @@ class test_host(Declarative):
                     l=[u'Undisclosed location 1'],
                     krbprincipalname=[u'host/%s@%s' % (fqdn1, api.env.realm)],
                     has_keytab=False,
+                    has_password=False,
                     managedby_host=[u'%s' % fqdn1],
                     usercertificate=[base64.b64decode(servercert)],
                     valid_not_before=fuzzy_date,
@@ -300,6 +309,8 @@ class test_host(Declarative):
                     objectclass=objectclasses.host,
                     ipauniqueid=[fuzzy_uuid],
                     managedby_host=[u'%s' % fqdn3],
+                    has_keytab=False,
+                    has_password=False,
                 ),
             ),
         ),
@@ -326,6 +337,8 @@ class test_host(Declarative):
                     objectclass=objectclasses.host,
                     ipauniqueid=[fuzzy_uuid],
                     managedby_host=[u'%s' % fqdn4],
+                    has_keytab=False,
+                    has_password=False,
                 ),
             ),
         ),
@@ -369,6 +382,7 @@ class test_host(Declarative):
                     l=[u'Undisclosed location 2'],
                     krbprincipalname=[u'host/%s@%s' % (fqdn3, api.env.realm)],
                     has_keytab=False,
+                    has_password=False,
                     managedby_host=[u'%s' % fqdn3, u'%s' % fqdn1],
                 ),
             ),
@@ -468,6 +482,8 @@ class test_host(Declarative):
                     objectclass=objectclasses.host,
                     ipauniqueid=[fuzzy_uuid],
                     managedby_host=[u'%s' % fqdn1],
+                    has_keytab=False,
+                    has_password=False,
                 ),
             ),
         ),
@@ -479,7 +495,7 @@ class test_host(Declarative):
                 value=service1,
                 summary=u'Added service "%s"' % service1,
                 result=dict(
-                    dn=service1dn,
+                    dn=lambda x: DN(x) == service1dn,
                     krbprincipalname=[service1],
                     objectclass=objectclasses.service,
                     managedby_host=[fqdn1],
@@ -539,6 +555,8 @@ class test_host(Declarative):
                     objectclass=objectclasses.host,
                     ipauniqueid=[fuzzy_uuid],
                     managedby_host=[u'%s' % fqdn2],
+                    has_keytab=False,
+                    has_password=False,
                 ),
             ),
         ),
diff --git a/tests/test_xmlrpc/test_hostgroup_plugin.py b/tests/test_xmlrpc/test_hostgroup_plugin.py
index 1bfbae43e..e0d115854 100644
--- a/tests/test_xmlrpc/test_hostgroup_plugin.py
+++ b/tests/test_xmlrpc/test_hostgroup_plugin.py
@@ -121,6 +121,8 @@ class test_hostgroup(Declarative):
                     objectclass=objectclasses.host,
                     ipauniqueid=[fuzzy_uuid],
                     managedby_host=[fqdn1],
+                    has_keytab=False,
+                    has_password=False,
                 ),
             ),
         ),
diff --git a/tests/test_xmlrpc/test_krbtpolicy.py b/tests/test_xmlrpc/test_krbtpolicy.py
index 3db743d51..3ef603b3a 100644
--- a/tests/test_xmlrpc/test_krbtpolicy.py
+++ b/tests/test_xmlrpc/test_krbtpolicy.py
@@ -116,6 +116,8 @@ class test_krbtpolicy(Declarative):
                         [DN(('cn',user1),('cn','groups'),('cn','accounts'),
                             api.env.basedn)],
                     memberof_group=[u'ipausers'],
+                    has_keytab=False,
+                    has_password=False,
                     dn=lambda x: DN(x) == \
                         DN(('uid',user1),('cn','users'),('cn','accounts'),
                            api.env.basedn)
diff --git a/tests/test_xmlrpc/test_nesting.py b/tests/test_xmlrpc/test_nesting.py
index f28d47935..cb2d1d0b2 100644
--- a/tests/test_xmlrpc/test_nesting.py
+++ b/tests/test_xmlrpc/test_nesting.py
@@ -186,6 +186,8 @@ class test_nesting(Declarative):
                         [DN(('cn',user1),('cn','groups'),('cn','accounts'),
                             api.env.basedn)],
                     memberof_group=[u'ipausers'],
+                    has_keytab=False,
+                    has_password=False,
                     dn=lambda x: DN(x) == \
                         DN(('uid',user1),('cn','users'),('cn','accounts'),
                            api.env.basedn)
@@ -224,6 +226,8 @@ class test_nesting(Declarative):
                         [DN(('cn',user2),('cn','groups'),('cn','accounts'),
                             api.env.basedn)],
                     memberof_group=[u'ipausers'],
+                    has_keytab=False,
+                    has_password=False,
                     dn=lambda x: DN(x) == \
                         DN(('uid',user2),('cn','users'),('cn','accounts'),
                            api.env.basedn)
@@ -262,6 +266,8 @@ class test_nesting(Declarative):
                         [DN(('cn',user3),('cn','groups'),('cn','accounts'),
                             api.env.basedn)],
                     memberof_group=[u'ipausers'],
+                    has_keytab=False,
+                    has_password=False,
                     dn=lambda x: DN(x) == \
                         DN(('uid',user3),('cn','users'),('cn','accounts'),
                            api.env.basedn)
@@ -300,6 +306,8 @@ class test_nesting(Declarative):
                         [DN(('cn',user4),('cn','groups'),('cn','accounts'),
                             api.env.basedn)],
                     memberof_group=[u'ipausers'],
+                    has_keytab=False,
+                    has_password=False,
                     dn=lambda x: DN(x) == \
                         DN(('uid',user4),('cn','users'),('cn','accounts'),
                            api.env.basedn)
@@ -676,6 +684,8 @@ class test_nesting(Declarative):
                     objectclass=objectclasses.host,
                     ipauniqueid=[fuzzy_uuid],
                     managedby_host=[fqdn1],
+                    has_keytab=False,
+                    has_password=False,
                 ),
             ),
         ),
@@ -801,6 +811,7 @@ class test_nesting(Declarative):
                     l=[u'Undisclosed location 1'],
                     krbprincipalname=[u'host/%s@%s' % (fqdn1, api.env.realm)],
                     has_keytab=False,
+                    has_password=False,
                     managedby_host=[fqdn1],
                     memberof_hostgroup = [u'testhostgroup2'],
                     memberofindirect_hostgroup = [u'testhostgroup1'],
diff --git a/tests/test_xmlrpc/test_netgroup_plugin.py b/tests/test_xmlrpc/test_netgroup_plugin.py
index fc3bb5456..9194b5492 100644
--- a/tests/test_xmlrpc/test_netgroup_plugin.py
+++ b/tests/test_xmlrpc/test_netgroup_plugin.py
@@ -168,6 +168,8 @@ class test_netgroup(Declarative):
                     objectclass=objectclasses.host,
                     ipauniqueid=[fuzzy_uuid],
                     managedby_host=[host1],
+                    has_keytab=False,
+                    has_password=False,
                 ),
             ),
         ),
@@ -225,6 +227,8 @@ class test_netgroup(Declarative):
                         [DN(('cn',user1),('cn','groups'),('cn','accounts'),
                             api.env.basedn)],
                     memberof_group=[u'ipausers'],
+                    has_keytab=False,
+                    has_password=False,
                     dn=lambda x: DN(x) == \
                         DN(('uid',user1),('cn','users'),('cn','accounts'),
                            api.env.basedn),
@@ -262,6 +266,8 @@ class test_netgroup(Declarative):
                         [DN(('cn',user2),('cn','groups'),('cn','accounts'),
                             api.env.basedn)],
                     memberof_group=[u'ipausers'],
+                    has_keytab=False,
+                    has_password=False,
                     dn=lambda x: DN(x) == \
                         DN(('uid',user2),('cn','users'),('cn','accounts'),
                            api.env.basedn),
diff --git a/tests/test_xmlrpc/test_replace.py b/tests/test_xmlrpc/test_replace.py
index a1fd5d280..f5203607c 100644
--- a/tests/test_xmlrpc/test_replace.py
+++ b/tests/test_xmlrpc/test_replace.py
@@ -73,6 +73,8 @@ class test_replace(Declarative):
                         [DN(('cn',user1),('cn','groups'),('cn','accounts'),
                             api.env.basedn)],
                     memberof_group=[u'ipausers'],
+                    has_keytab=False,
+                    has_password=False,
                     dn=lambda x: DN(x) == \
                         DN(('uid','tuser1'),('cn','users'),('cn','accounts'),
                            api.env.basedn),
@@ -98,6 +100,8 @@ class test_replace(Declarative):
                     mail=[u'test1@example.com', u'test3@example.com'],
                     memberof_group=[u'ipausers'],
                     nsaccountlock=False,
+                    has_keytab=False,
+                    has_password=False,
                 ),
                 summary=u'Modified user "tuser1"',
                 value=user1,
@@ -122,6 +126,8 @@ class test_replace(Declarative):
                     mail=[u'test4@example.com'],
                     memberof_group=[u'ipausers'],
                     nsaccountlock=False,
+                    has_keytab=False,
+                    has_password=False,
                 ),
                 summary=u'Modified user "tuser1"',
                 value=user1,
@@ -146,6 +152,8 @@ class test_replace(Declarative):
                     mail=[u'test6@example.com', u'test7@example.com', u'test5@example.com'],
                     memberof_group=[u'ipausers'],
                     nsaccountlock=False,
+                    has_keytab=False,
+                    has_password=False,
                 ),
                 summary=u'Modified user "tuser1"',
                 value=user1,
@@ -169,6 +177,8 @@ class test_replace(Declarative):
                     gidnumber=[fuzzy_digits],
                     memberof_group=[u'ipausers'],
                     nsaccountlock=False,
+                    has_keytab=False,
+                    has_password=False,
                 ),
                 summary=u'Modified user "tuser1"',
                 value=user1,
@@ -193,6 +203,8 @@ class test_replace(Declarative):
                     initials=[u'ABC'],
                     memberof_group=[u'ipausers'],
                     nsaccountlock=False,
+                    has_keytab=False,
+                    has_password=False,
                 ),
                 summary=u'Modified user "tuser1"',
                 value=user1,
@@ -216,6 +228,8 @@ class test_replace(Declarative):
                     gidnumber=[fuzzy_digits],
                     memberof_group=[u'ipausers'],
                     nsaccountlock=False,
+                    has_keytab=False,
+                    has_password=False,
                 ),
                 summary=u'Modified user "tuser1"',
                 value=user1,
diff --git a/tests/test_xmlrpc/test_service_plugin.py b/tests/test_xmlrpc/test_service_plugin.py
index d424eeedd..d36dac984 100644
--- a/tests/test_xmlrpc/test_service_plugin.py
+++ b/tests/test_xmlrpc/test_service_plugin.py
@@ -47,7 +47,7 @@ fd.close()
 badservercert = 'MIICbzCCAdigAwIBAgICA/4wDQYJKoZIhvcNAQEFBQAwKTEnMCUGA1UEAxMeSVBBIFRlc3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTEwMDgwOTE1MDIyN1oXDTIwMDgwOTE1MDIyN1owKTEMMAoGA1UEChMDSVBBMRkwFwYDVQQDExBwdW1hLmdyZXlvYWsuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwYbfEOQPgGenPn9vt1JFKvWm/Je3y2tawGWA3LXDuqfFJyYtZ8ib3TcBUOnLk9WK5g2qCwHaNlei7bj8ggIfr5hegAVe10cun+wYErjnYo7hsHYd+57VZezeipWrXu+7NoNd4+c4A5lk4A/xJay9j3bYx2oOM8BEox4xWYoWge1ljPrc5JK46f0X7AGW4F2VhnKPnf8rwSuzI1U8VGjutyM9TWNy3m9KMWeScjyG/ggIpOjUDMV7HkJL0Di61lznR9jXubpiEC7gWGbTp84eGl/Nn9bgK1AwHfJ2lHwfoY4uiL7ge1gyP6EvuUlHoBzdb7pekiX28iePjW3iEG9IawIDAQABoyIwIDARBglghkgBhvhCAQEEBAMCBkAwCwYDVR0PBAQDAgUgMA0GCSqGSIb3DQEBBQUAA4GBACRESLemRV9BPxfEgbALuxH5oE8jQm8WZ3pm2pALbpDlAd9wQc3yVf6RtkfVthyDnM18bg7IhxKpd77/p3H8eCnS8w5MLVRda6ktUC6tGhFTS4QKAf0WyDGTcIgkXbeDw0OPAoNHivoXbIXIIRxlw/XgaSaMzJQDBG8iROsN4kCv'
 
 
-class test_host(Declarative):
+class test_service(Declarative):
 
     cleanup_commands = [
         ('host_del', [fqdn1], {}),
@@ -99,6 +99,8 @@ class test_host(Declarative):
                     objectclass=objectclasses.host,
                     ipauniqueid=[fuzzy_uuid],
                     managedby_host=[u'%s' % fqdn1],
+                    has_keytab=False,
+                    has_password=False,
                 ),
             ),
         ),
@@ -125,6 +127,8 @@ class test_host(Declarative):
                     objectclass=objectclasses.host,
                     ipauniqueid=[fuzzy_uuid],
                     managedby_host=[u'%s' % fqdn2],
+                    has_keytab=False,
+                    has_password=False,
                 ),
             ),
         ),
@@ -151,6 +155,8 @@ class test_host(Declarative):
                     objectclass=objectclasses.host,
                     ipauniqueid=[fuzzy_uuid],
                     managedby_host=[u'%s' % fqdn3.lower()],
+                    has_keytab=False,
+                    has_password=False,
                 ),
             ),
         ),
diff --git a/tests/test_xmlrpc/test_user_plugin.py b/tests/test_xmlrpc/test_user_plugin.py
index 12aec153c..9392742e9 100644
--- a/tests/test_xmlrpc/test_user_plugin.py
+++ b/tests/test_xmlrpc/test_user_plugin.py
@@ -104,6 +104,8 @@ class test_user(Declarative):
                         [DN(('cn',user1),('cn','groups'),('cn','accounts'),
                             api.env.basedn)],
                     memberof_group=[u'ipausers'],
+                    has_keytab=False,
+                    has_password=False,
                     dn=lambda x: DN(x) == \
                         DN(('uid','tuser1'),('cn','users'),('cn','accounts'),
                            api.env.basedn),
@@ -140,6 +142,8 @@ class test_user(Declarative):
                     gidnumber=[fuzzy_digits],
                     memberof_group=[u'ipausers'],
                     nsaccountlock=False,
+                    has_keytab=False,
+                    has_password=False,
                 ),
                 value=user1,
                 summary=None,
@@ -178,6 +182,8 @@ class test_user(Declarative):
                             [DN(('cn','global_policy'),('cn',api.env.realm),
                                 ('cn','kerberos'),api.env.basedn)],
                         'nsaccountlock': False,
+                        'has_keytab': False,
+                        'has_password': False,
                         'displayname': [u'Test User1'],
                         'cn': [u'Test User1'],
                         'initials': [u'TU'],
@@ -206,6 +212,8 @@ class test_user(Declarative):
                         sn=[u'User1'],
                         uid=[user1],
                         nsaccountlock=False,
+                        has_keytab=False,
+                        has_password=False,
                         uidnumber=[fuzzy_digits],
                         gidnumber=[fuzzy_digits],
                     ),
@@ -233,6 +241,8 @@ class test_user(Declarative):
                         sn=[u'Administrator'],
                         uid=[u'admin'],
                         nsaccountlock=False,
+                        has_keytab=True,
+                        has_password=True,
                         uidnumber=[fuzzy_digits],
                         gidnumber=[fuzzy_digits],
                     ),
@@ -246,6 +256,8 @@ class test_user(Declarative):
                         sn=[u'User1'],
                         uid=[user1],
                         nsaccountlock=False,
+                        has_keytab=False,
+                        has_password=False,
                         uidnumber=[fuzzy_digits],
                         gidnumber=[fuzzy_digits],
                     ),
@@ -273,6 +285,8 @@ class test_user(Declarative):
                         sn=[u'Administrator'],
                         uid=[u'admin'],
                         nsaccountlock=False,
+                        has_keytab=True,
+                        has_password=True,
                         uidnumber=[fuzzy_digits],
                         gidnumber=[fuzzy_digits],
                     ),
@@ -326,6 +340,8 @@ class test_user(Declarative):
                     gidnumber=[fuzzy_digits],
                     memberof_group=[u'ipausers'],
                     nsaccountlock=False,
+                    has_keytab=False,
+                    has_password=False,
                 ),
                 summary=u'Modified user "tuser1"',
                 value=user1,
@@ -359,6 +375,8 @@ class test_user(Declarative):
                     gidnumber=[fuzzy_digits],
                     memberof_group=[u'ipausers'],
                     nsaccountlock=False,
+                    has_keytab=False,
+                    has_password=False,
                 ),
                 summary=None,
                 value=user1,
@@ -381,6 +399,8 @@ class test_user(Declarative):
                     gidnumber=[fuzzy_digits],
                     memberof_group=[u'ipausers'],
                     nsaccountlock=False,
+                    has_keytab=False,
+                    has_password=False,
                 ),
                 summary=u'Modified user "%s"' % user1,
                 value=user1,
@@ -409,6 +429,8 @@ class test_user(Declarative):
                     gidnumber=[fuzzy_digits],
                     memberof_group=[u'ipausers'],
                     nsaccountlock=False,
+                    has_keytab=False,
+                    has_password=False,
                 ),
                 summary=u'Modified user "%s"' % renameduser1,
                 value=renameduser1,
@@ -475,6 +497,8 @@ class test_user(Declarative):
                         [DN(('cn',user1),('cn','groups'),('cn','accounts'),
                             api.env.basedn)],
                     memberof_group=[u'ipausers'],
+                    has_keytab=False,
+                    has_password=False,
                     dn=lambda x: DN(x) == \
                         DN(('uid','tuser1'),('cn','users'),('cn','accounts'),
                            api.env.basedn),
@@ -513,6 +537,8 @@ class test_user(Declarative):
                         [DN(('cn',user2),('cn','groups'),('cn','accounts'),
                             api.env.basedn)],
                     memberof_group=[u'ipausers'],
+                    has_keytab=False,
+                    has_password=False,
                     dn=lambda x: DN(x) == \
                         DN(('uid','tuser2'),('cn','users'),('cn','accounts'),
                            api.env.basedn),
@@ -542,6 +568,8 @@ class test_user(Declarative):
                     gidnumber=[fuzzy_digits],
                     memberof_group=[u'ipausers'],
                     nsaccountlock=False,
+                    has_keytab=False,
+                    has_password=False,
                     manager=[user1],
                 ),
                 summary=u'Modified user "%s"' % user2,
@@ -655,6 +683,8 @@ class test_user(Declarative):
                         [DN(('cn',user1),('cn','groups'),('cn','accounts'),
                             api.env.basedn)],
                     memberof_group=[u'ipausers'],
+                    has_keytab=False,
+                    has_password=False,
                     dn=lambda x: DN(x) == \
                         DN(('uid','tuser1'),('cn','users'),('cn','accounts'),
                            api.env.basedn),