self = <ipatests.test_integration.test_trust_functional.TestTrustFunctionalHbac object at 0x7f58c482bac0>
    def test_ipa_trust_func_hbac_0011(self):
        """
        Test HBAC rule allows sudo access for AD users in external group.
        This test creates an HBAC rule for sudo service that allows members of
        the hbacgroup (which includes AD users via external group membership),
        and a sudo rule that allows hbacgroup members to run all commands.
        It verifies that AD users who are members of the external group can
        successfully use sudo and gain root privileges.
        """
        hrule = "ipa_trust_func_hbac_0011"
        srule = "ipa_trust_func_hbac_0011"
        tasks.clear_sssd_cache(self.master)
        tasks.kinit_admin(self.master)
        try:
            self._add_hbacrule_with_service(hrule, 'sudo')
            self.master.run_command(
                ["ipa", "hbacrule-add-user", hrule, "--groups=hbacgroup"]
            )
            self.master.run_command(["ipa", "hbacrule-disable", "allow_all"])
            self.master.run_command(
                ["ipa", "sudorule-add", srule, "--hostcat=all", "--cmdcat=all"]
            )
            self.master.run_command(
                ["ipa", "sudorule-add-user", srule, "--groups=hbacgroup"]
            )
            tasks.clear_sssd_cache(self.master)
            tasks.clear_sssd_cache(self.clients[0])
            tasks.wait_for_sssd_domain_status_online(self.master)
            test_sudo = "su {user} -c 'sudo -S id'"
            for user in [self.aduser, self.subaduser]:
                with self.clients[0].spawn_expect(
                        test_sudo.format(user=user)) as e:
                    e.sendline('Secret123')
>                   e.expect_exit(ignore_remaining_output=True, timeout=60)
e          = <ipatests.pytest_ipa.integration.expect.IpaTestExpect object at 0x7f58c49f7e00>
hrule      = 'ipa_trust_func_hbac_0011'
self       = <ipatests.test_integration.test_trust_functional.TestTrustFunctionalHbac object at 0x7f58c482bac0>
srule      = 'ipa_trust_func_hbac_0011'
test_sudo  = "su {user} -c 'sudo -S id'"
user       = 'nonposixuser@ad-et1b.test'

DEBUG    ipatests.pytest_ipa.integration.host.Host.client.IPAOpenSSHTransport:transport.py:53 Starting pexpect ssh session
DEBUG    ipatests.pytest_ipa.integration.host.Host.client.IPAOpenSSHTransport:transport.py:48 SSH invocation: ['ssh', '-l', 'root', '-o', 'ControlPath=/tmp/multihost_tests.ahl9hshv/control', '-o', 'StrictHostKeyChecking=no', '-o', 'UserKnownHostsFile=/tmp/multihost_tests.ahl9hshv/known_hosts', '-i', '/root/.ssh/id_rsa', 'ip-10-0-201-88.rhos-01.prod.psi.rdu2.redhat.com']
DEBUG    ipatests.pytest_ipa.integration.expect:expect.py:71 Expect will spawn command "ssh" with args ['-l', 'root', '-o', 'ControlPath=/tmp/multihost_tests.ahl9hshv/control', '-o', 'StrictHostKeyChecking=no', '-o', 'UserKnownHostsFile=/tmp/multihost_tests.ahl9hshv/known_hosts', '-i', '/root/.ssh/id_rsa', 'ip-10-0-201-88.rhos-01.prod.psi.rdu2.redhat.com', '-q', "su nonposixuser@ad-et1b.test -c 'sudo -S id'"]
DEBUG    ipatests.pytest_ipa.integration.expect:expect.py:109 Sending 'Secret123\n'
DEBUG    ipatests.pytest_ipa.integration.expect:expect.py:136 Output received: '[sudo] password for nonposixuser@ad-et1b.test: sudo: PAM account management error: Permission denied\r\nsudo: a password is required\r\n', expected: "[<class 'pexpect.exceptions.EOF'>]",