@pytest.mark.xfail(
osinfo.id == 'fedora' and osinfo.version_number <= (28,),
reason='sssd ticket 3819', strict=True)
def test_selinux_user_optimized(self):
"""
Check that SELinux login context is set on first login for the
user, even if the user is not mapped to a specific SELinux user.

Related ticket https://pagure.io/SSSD/sssd/issue/3819.
"""
# Scenario: add an IPA user with non-default home dir, login through
# ssh as this user and check that there is a SELinux user mapping
# for the user with `semanage login -l`.

# kinit admin
tasks.kinit_admin(self.master)

testuser = 'testuser_selinux'
password = 'Secret123'
testuser_password_confirmation = "%s\n%s\n" % (password,
password)
self.master.run_command(['ipa', 'user-add', testuser,
'--first', testuser,
'--last', testuser,
'--password',
'--homedir',
'/root/{}'.format(testuser)],
stdin_text=testuser_password_confirmation)

# login to the system
client = paramiko.SSHClient()
client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
client.connect(self.master.hostname,
username=testuser,
password=password)
client.close()

# check if user listed in output
cmd = self.master.run_command(['semanage', 'login', '-l'])
> assert testuser in cmd.stdout_text
E       AssertionError: assert 'testuser_selinux' in '\nLogin Name           SELinux User         MLS/MCS Range        Service\n\n__default__          unconfined_u         s0-s0:c0.c1023       *\nroot                 unconfined_u         s0-s0:c0.c1023       *\n'
E        +  where '\nLogin Name           SELinux User         MLS/MCS Range        Service\n\n__default__          unconfined_u         s0-s0:c0.c1023       *\nroot                 unconfined_u         s0-s0:c0.c1023       *\n' = <pytest_multihost.transport.SSHCommand object at 0x7f8ff2fa39e8>.stdout_text