fix(docker+tests): restore rig LDAP login via redundant local GLAuth pair + FallbackServers

The rig pointed at the shared 10.100.0.35 GLAuth whose serviceaccount password
was rotated (SEC-36), so central login had been failing ('Authentication service
is misconfigured') and a TEMP DisableLogin workaround was pending. Central nodes
now point at the local redundant pair (scadaproj/infra/glauth-redundant,
host.docker.internal:3893 + FallbackServers :3894), where the dev bind password
is correct — live-gated on the redeployed rig: login OK, primary-kill failover,
sticky preference (bind-count proven), walk-back on backup-kill.

AuthFlowTests factory bound as cn=admin for search-then-bind, but the current
directory grants the search capability only to serviceaccount (admin searches
return 50 Insufficient access) — stale since the GLAuth config evolved; the test
had been skipping on the closed port and failed once anything answered :3893.
Now binds as serviceaccount; AuthFlowTests 5/5 against the pair.
This commit is contained in:
Joseph Doherty
2026-08-13 08:49:05 -04:00
parent d28824d967
commit b71fbae36e
4 changed files with 18 additions and 9 deletions
@@ -106,8 +106,10 @@ public class AuthFlowTests : IClassFixture<ScadaBridgeWebApplicationFactory>
[Fact]
public async Task LoginEndpoint_WithValidLdapCredentials_SetsCookieAndRedirects()
{
// Requires GLAuth test LDAP server: docker compose -f infra/docker-compose.yml up -d glauth
// GLAuth runs on localhost:3893, baseDN dc=zb,dc=local, all passwords "password"
// Requires a local GLAuth on localhost:3893 — the redundant test pair:
// cd ~/Desktop/scadaproj/infra/glauth-redundant && docker compose up -d
// (baseDN dc=zb,dc=local, user passwords "password"; the old infra/docker-compose.yml
// glauth service no longer exists — LDAP moved out of that stack.)
if (!await IsLdapAvailableAsync())
{
// Skip gracefully if GLAuth not running — not a test failure