@pytest.parametrize("hbac", ["user", "host", "service"])
@pytest.mark.importance("medium")
@pytest.mark.topology(KnownTopology.IPA)
def test_ipa__hbac_service_category_all(client: Client, ipa: IPA, hbac: str):
    users = ["user1", "user2"]
    for user in users:
        ipa.user(user).add()
    ipa.hbac("allow_all").disable()
    ipa_rule = (ipa.hbac(f"user1_all_{hbac}_access"))

    if hbac == "user":
        ipa_rule.create(description="Allow user1 access to all services", usercat="all", users="user1", hosts="client.test")
    elif hbac == "host":
        ipa_rule.create(description = "Allow user1 access to all services", hostcat = "all", users = "user1",
                        hosts = "client.test")
    elif hbac == "service":
        ipa_rule.create(description="Allow user1 access to all services", servicecat="all", users="user1", hosts="client.test")

    client.sssd.restart()
    assert client.auth.ssh.password("user1", "Secret123"), "user1 SSH should succeed!"
    assert not client.auth.ssh.password("user2", "Secret123"), "user2 SSH should be denied!"

    if hbac == "user":
        ipa_rule.modify(servicecat="")
    elif hbac == "host":
        ipa_rule.modify(hostcat = "")
    elif hbac == "service":
        ipa_rule.modify(servicecat = "")

    client.sssd.restart()
    assert not client.auth.ssh.password("user1", "Secret123"), "user1 SSH should be denied!"
    assert not client.auth.ssh.password("user2", "Secret123"), "user2 SSH should be denied!"