From 59e68f79e48e5eaa18c60f3dc418d0bf516684ab Mon Sep 17 00:00:00 2001
From: Florence Blanc-Renaud <flo@redhat.com>
Date: Aug 17 2023 12:28:26 +0000
Subject: ipa-epn: include timezone info


ipa-epn is using timezone-aware timestamps for "now"
but converts krbpasswordexpiration attribute into
a naive datetime object that is missing the tzinfo.

It is not possible to substract timezone aware and
naive values. Convert krbpasswordexpiration attribute
into an UTC value before doing the substration.

Related: https://pagure.io/freeipa/issue/9425

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>

---

diff --git a/ipaclient/install/ipa_epn.py b/ipaclient/install/ipa_epn.py
index 8798558..959ef75 100644
--- a/ipaclient/install/ipa_epn.py
+++ b/ipaclient/install/ipa_epn.py
@@ -571,7 +571,7 @@ class EPN(admintool.AdminTool):
                 now = datetime.now(tz=UTC)
                 expdate = datetime.strptime(
                     entry["krbpasswordexpiration"],
-                    '%Y-%m-%d %H:%M:%S')
+                    '%Y-%m-%d %H:%M:%S').replace(tzinfo=UTC)
                 logger.debug(
                     "Notified %s (%s). Password expiring in %d days at %s.",
                     entry["mail"], entry["uid"], (expdate - now).days,