fix(docker+tests): restore rig LDAP login via redundant local GLAuth pair + FallbackServers

The rig pointed at the shared 10.100.0.35 GLAuth whose serviceaccount password was rotated (SEC-36), so central login had been failing ('Authentication service is misconfigured') and a TEMP DisableLogin workaround was pending. Central nodes now point at the local redundant pair (scadaproj/infra/glauth-redundant, host.docker.internal:3893 + FallbackServers :3894), where the dev bind password is correct — live-gated on the redeployed rig: login OK, primary-kill failover, sticky preference (bind-count proven), walk-back on backup-kill. AuthFlowTests factory bound as cn=admin for search-then-bind, but the current directory grants the search capability only to serviceaccount (admin searches return 50 Insufficient access) — stale since the GLAuth config evolved; the test had been skipping on the closed port and failed once anything answered :3893. Now binds as serviceaccount; AuthFlowTests 5/5 against the pair.
chore(deps): bump ZB.MOM.WW.Auth to 0.2.1 — AD continuation-referral fix
2026-08-13 08:49:05 -04:00 · 2026-08-13 08:42:53 -04:00
5 changed files with 22 additions and 13 deletions
@@ -98,10 +98,10 @@
    <PackageVersion Include="ZB.MOM.WW.MxGateway.Client" Version="0.2.0" />
    <PackageVersion Include="ZB.MOM.WW.MxGateway.Contracts" Version="0.2.0" />
    <PackageVersion Include="ZB.MOM.WW.Configuration" Version="0.1.0" />
-    <PackageVersion Include="ZB.MOM.WW.Auth.Abstractions" Version="0.2.0" />
-    <PackageVersion Include="ZB.MOM.WW.Auth.Ldap" Version="0.2.0" />
-    <PackageVersion Include="ZB.MOM.WW.Auth.ApiKeys" Version="0.2.0" />
-    <PackageVersion Include="ZB.MOM.WW.Auth.AspNetCore" Version="0.2.0" />
+    <PackageVersion Include="ZB.MOM.WW.Auth.Abstractions" Version="0.2.1" />
+    <PackageVersion Include="ZB.MOM.WW.Auth.Ldap" Version="0.2.1" />
+    <PackageVersion Include="ZB.MOM.WW.Auth.ApiKeys" Version="0.2.1" />
+    <PackageVersion Include="ZB.MOM.WW.Auth.AspNetCore" Version="0.2.1" />
    <PackageVersion Include="ZB.MOM.WW.Audit" Version="0.1.0" />
    <PackageVersion Include="ZB.MOM.WW.Theme" Version="0.4.1" />
    <PackageVersion Include="ZB.MOM.WW.Secrets" Version="0.6.2" />
@@ -29,8 +29,10 @@
    },
    "Security": {
      "Ldap": {
-        "Server": "10.100.0.35",
+        "Server": "host.docker.internal",
        "Port": 3893,
+        "FallbackServers": [ "host.docker.internal:3894" ],
+        "_comment_FallbackServers": "Redundant local GLAuth pair (scadaproj/infra/glauth-redundant): zb-ldap-primary :3893 + zb-ldap-backup :3894 on the Docker host. Replaces the shared 10.100.0.35 GLAuth, whose serviceaccount password was rotated (SEC-36) away from the rig's dev bind creds. Also live-exercises Auth 0.2.x FallbackServers sticky failover.",
        "Transport": "None",
        "AllowInsecure": true,
        "SearchBase": "dc=zb,dc=local",
@@ -29,8 +29,10 @@
    },
    "Security": {
      "Ldap": {
-        "Server": "10.100.0.35",
+        "Server": "host.docker.internal",
        "Port": 3893,
+        "FallbackServers": [ "host.docker.internal:3894" ],
+        "_comment_FallbackServers": "Redundant local GLAuth pair (scadaproj/infra/glauth-redundant): zb-ldap-primary :3893 + zb-ldap-backup :3894 on the Docker host. Replaces the shared 10.100.0.35 GLAuth, whose serviceaccount password was rotated (SEC-36) away from the rig's dev bind creds. Also live-exercises Auth 0.2.x FallbackServers sticky failover.",
        "Transport": "None",
        "AllowInsecure": true,
        "SearchBase": "dc=zb,dc=local",
@@ -106,8 +106,10 @@ public class AuthFlowTests : IClassFixture<ScadaBridgeWebApplicationFactory>
    [Fact]
    public async Task LoginEndpoint_WithValidLdapCredentials_SetsCookieAndRedirects()
    {
-        // Requires GLAuth test LDAP server: docker compose -f infra/docker-compose.yml up -d glauth
-        // GLAuth runs on localhost:3893, baseDN dc=zb,dc=local, all passwords "password"
+        // Requires a local GLAuth on localhost:3893 — the redundant test pair:
+        //   cd ~/Desktop/scadaproj/infra/glauth-redundant && docker compose up -d
+        // (baseDN dc=zb,dc=local, user passwords "password"; the old infra/docker-compose.yml
+        // glauth service no longer exists — LDAP moved out of that stack.)
        if (!await IsLdapAvailableAsync())
        {
            // Skip gracefully if GLAuth not running — not a test failure
@@ -54,11 +54,14 @@ public class ScadaBridgeWebApplicationFactory : WebApplicationFactory<Program>
            ["ScadaBridge__Security__Ldap__Transport"] = "None",
            ["ScadaBridge__Security__Ldap__AllowInsecure"] = "true",
            ["ScadaBridge__Security__Ldap__SearchBase"] = "dc=zb,dc=local",
-            // GLAuth places users at cn=<name>,ou=<group>,ou=users,dc=... — a service
-            // account is configured to enable the shared service's search-then-bind:
-            // resolve the user's real DN by (UserNameAttribute=<name>) lookup, then bind it.
-            ["ScadaBridge__Security__Ldap__ServiceAccountDn"] = "cn=admin,ou=SCADA-Admins,ou=users,dc=zb,dc=local",
-            ["ScadaBridge__Security__Ldap__ServiceAccountPassword"] = "password",
+            // Search-then-bind needs an account holding GLAuth's `search` capability, which
+            // the current directory grants ONLY to `serviceaccount` (binding as `admin`
+            // succeeds but its searches return `50 Insufficient access`, i.e. auth reads as
+            // "service unavailable"). Matches the local redundant pair
+            // (scadaproj/infra/glauth-redundant), whose serviceaccount password is the
+            // well-known dev value — the shared 10.100.0.35 instance's is rotated (SEC-36).
+            ["ScadaBridge__Security__Ldap__ServiceAccountDn"] = "cn=serviceaccount,dc=zb,dc=local",
+            ["ScadaBridge__Security__Ldap__ServiceAccountPassword"] = "serviceaccount123",
        };

        foreach (var (key, value) in envVars)