fix(harness): swap retired bitnami/openldap for GLAuth in the Host real-LDAP mode
The Host.IntegrationTests opt-in real-LDAP mode (OTOPCUA_HARNESS_USE_LDAP=1) used bitnami/openldap:2.6, gone since Bitnami deprecated their free image catalog in 2025. Replaced it with GLAuth — the same LDAP server the rest of the project already uses (docker-dev + the live OPC UA data-plane auth, both against the shared GLAuth on :3893) — removing the lone OpenLDAP outlier and the gone-image breakage. - Added tests/.../Host.IntegrationTests/glauth/config.toml: baseDN dc=zb,dc=local, a search-capable serviceaccount, dev users alice (full access) / bob (read-only), and role groups with the same gidnumbers as scadaproj/infra/glauth so GroupToRole maps identically. - Compose ldap service -> glauth/glauth:latest, mounting the config, host :3894 -> :3893. - Repointed the harness real-LDAP override from the OpenLDAP cn=admin/ldapadmin to GLAuth's cn=serviceaccount/serviceaccount123. Live-verified against a deployed container on :3894: the serviceaccount bind searches and returns alice + her 5 memberOf groups; alice/bob bind with the correct password; a wrong password yields Invalid credentials (49) — exactly the OtOpcUaLdapAuthService flow (proven identical to the data-plane's shared-GLAuth path). NB: real-LDAP mode is opt-in; the default Host run uses StubLdapAuthService, so this never blocked the default suite. Integration-sweep follow-up #6 (LDAP leg); the amd64-emulated-SQL deadline leg remains open.
This commit is contained in:
Joseph Doherty
@@ -21,7 +21,7 @@ need sudo to create new ones — I deployed FOCAS to `~/otopcua-focas` on the ho
|
||||
| **OpcUaClient.Browser** | ✅ 1/1 | — |
|
||||
| **S7** | ✅ 3/3 (2 skip) | skips = outage tests needing `S7_TIMEOUT_OUTAGE_*` env |
|
||||
| **Modbus** (profile=standard) | ✅ 6/6 | — |
|
||||
| **Host** | ⚠️ **105/117** (7F, 5 skip) | 7 heavy 2-node deploy/failover E2E time out (20–45 s) under amd64-emulated SQL; 5 LDAP-backed skip |
|
||||
| **Host** | ⚠️ **105/117** (7F, 5 skip) | 7 heavy E2E time out under amd64-emulated SQL (OPEN); LDAP image swapped OpenLDAP→GLAuth 2026-07-15 (PR #451). The 5 skips are driver-fixture-gated E2E, not LDAP |
|
||||
| **TwinCAT** | ⏭️ 13 skip | no TC3 XAR fixture exists (expected clean-skip) |
|
||||
| **Modbus** (dl205 / mitsubishi / s7_1500 / exception_injection) | ✅ 16/13/10/17 (was 8F/5F/3F/8F) | **NOT drift** — fixture-cycling artifact, re-verified GREEN 2026-07-15 — see below |
|
||||
| **AbCip** | ✅ 10P/3skip (was 6F/1P/3skip) | static-init-order bug FIXED 2026-07-15 (`326b22a7`) — see below |
|
||||
@@ -38,9 +38,11 @@ and all driver **unit** suites + the live `/run` gates pass. These integration s
|
||||
and never run, so they'd bit-rotted in several distinct ways.
|
||||
|
||||
**Follow-up progress (2026-07-15):** #1 AbCip (PR #446), #5 OpcUaServer (PR #447), #2 Modbus (PR #448 — false
|
||||
alarm), #4 AbLegacy (PR #449 — fixture gap), #3 FOCAS (PR #450 — topology + mock-timer-endianness), and #7
|
||||
(fixture deploys) all closed. **6 of 7 done; every driver + server suite now verified GREEN.** Remaining:
|
||||
**#6 Host only** — swap the gone `bitnami/openldap:2.6` image + relax deadlines for amd64-emulated SQL.
|
||||
alarm), #4 AbLegacy (PR #449 — fixture gap), #3 FOCAS (PR #450 — topology + mock-timer), #7 (fixture deploys),
|
||||
and the #6 **LDAP-image** leg (PR #451 — swapped OpenLDAP→GLAuth) all closed. **The only thing left is the #6
|
||||
amd64-emulated-SQL timing leg** (7 heavy E2E tests time out under emulated `mssql:2022` on arm64 — run against
|
||||
real SQL or raise deadlines; a local-emulation artifact, not a product defect). Every driver + server suite is
|
||||
verified GREEN.
|
||||
|
||||
---
|
||||
|
||||
@@ -105,14 +107,24 @@ alarm), #4 AbLegacy (PR #449 — fixture gap), #3 FOCAS (PR #450 — topology +
|
||||
`ServiceResultException(BadNodeIdUnknown)` for a removed node rather than returning a bad `DataValue`;
|
||||
the two subscription-survival assertions now use `Should.ThrowAsync`. Suite **4F → 4/4 green**.
|
||||
|
||||
- **Host** — largely healthy (105/117). 7 failures are the heavy 2-node deploy/failover/reconnect E2E tests
|
||||
(`DeployHappyPathTests`, `FailoverDuringDeployTests`, `DriverReconnectE2eTests`,
|
||||
`FleetDiagnosticsRoundTripTests`, `EquipmentNamespaceMaterializationTests`,
|
||||
`RoslynVirtualTagEvaluatorTests`) taking 20–45 s — likely **timing under the amd64-emulated SQL** on the
|
||||
arm64 Mac (mssql:2022 has no arm64 image). 5 LDAP-backed tests skip because **`bitnami/openldap:2.6` is gone
|
||||
from Bitnami's catalog** (manifest unknown — Bitnami deprecated their free image catalog in 2025).
|
||||
**Fix:** replace the openldap image with a maintained one; run Host E2E against real (non-emulated) SQL or
|
||||
raise deadlines.
|
||||
- **Host** — largely healthy (105/117). Two independent issues:
|
||||
- **LDAP image — ✅ FIXED 2026-07-15 (PR #451).** The opt-in real-LDAP mode (`OTOPCUA_HARNESS_USE_LDAP=1`)
|
||||
used `bitnami/openldap:2.6`, gone since Bitnami deprecated their free catalog in 2025. **Replaced it with
|
||||
GLAuth** — the same LDAP server the rest of the project uses (docker-dev + the live OPC UA data-plane auth,
|
||||
both against the shared GLAuth on `:3893`), removing the lone OpenLDAP outlier. Added a harness
|
||||
`glauth/config.toml` (base DN `dc=zb,dc=local`, search-capable `serviceaccount`, dev users alice=full /
|
||||
bob=read-only, role groups with the same gidnumbers as `scadaproj/infra/glauth`) + repointed the harness's
|
||||
service-account override to `cn=serviceaccount`. Live-verified all three bind legs against a deployed
|
||||
container on `:3894` (serviceaccount search returns alice + 5 memberOf groups; alice/bob bind OK; wrong
|
||||
password → `Invalid credentials (49)`). NB: the real-LDAP mode is **opt-in** — the default Host run uses
|
||||
`StubLdapAuthService`, so this never blocked the default suite (the sweep's "5 LDAP skips" were actually the
|
||||
driver-fixture-gated E2E tests, not LDAP).
|
||||
- **amd64-emulated-SQL timing (still open).** 7 heavy 2-node deploy/failover/reconnect E2E tests
|
||||
(`DeployHappyPathTests`, `FailoverDuringDeployTests`, `DriverReconnectE2eTests`,
|
||||
`FleetDiagnosticsRoundTripTests`, `EquipmentNamespaceMaterializationTests`, `RoslynVirtualTagEvaluatorTests`)
|
||||
take 20–45 s and time out under the amd64-emulated `mssql:2022` (no arm64 image) on the arm64 Mac. **Fix:**
|
||||
run Host E2E against real (non-emulated) SQL — e.g. the shared SQL on the Linux Docker host — or raise the
|
||||
per-test deadlines. Not a product defect; a local-emulation timing artifact.
|
||||
|
||||
- **TwinCAT** — 13 skip cleanly (no TC3 XAR fixture exists; unit-only per the driver's design). Expected.
|
||||
|
||||
@@ -144,7 +156,11 @@ alarm), #4 AbLegacy (PR #449 — fixture gap), #3 FOCAS (PR #450 — topology +
|
||||
`SubscriptionSurvivalTests`. That unmasked a **second** drift: the 1.5.378 node-cache read path
|
||||
*throws* `ServiceResultException(BadNodeIdUnknown)` for a removed node instead of returning a bad
|
||||
`DataValue` — updated the two subscription-survival assertions to `Should.ThrowAsync`. Suite **4F → 4/4**.
|
||||
6. **Host** — replace `bitnami/openldap:2.6` (image gone); run E2E on real SQL or raise deadlines.
|
||||
6. **Host** — ⬐ split into two:
|
||||
- ~~replace `bitnami/openldap:2.6` (image gone)~~ ✅ **DONE 2026-07-15 (PR #451)** — swapped the harness LDAP
|
||||
to **GLAuth** (unifies on the LDAP the rest of the project uses); live-verified the binds on `:3894`.
|
||||
- **[OPEN] amd64-emulated-SQL timing** — the 7 heavy E2E tests time out under emulated `mssql:2022` on arm64.
|
||||
Run them against real (non-emulated) SQL or raise deadlines. Local-emulation artifact, not a product defect.
|
||||
7. ~~**Fixture deployment gap** — FOCAS + AbLegacy fixtures aren't on the host.~~
|
||||
✅ **RESOLVED 2026-07-15.** Both now deployed under the home dir: `~/otopcua-ablegacy` (PR #449) +
|
||||
`~/otopcua-focas` (PR #450). (`/opt` still needs sudo; the home-dir deploys work fine.)
|
||||
@@ -174,7 +190,7 @@ Run per suite (env → project):
|
||||
| AbCip | `AB_SERVER_ENDPOINT=10.100.0.35:44818` `AB_SERVER_PROFILE=controllogix` | `tests/Drivers/…AbCip.IntegrationTests` |
|
||||
| AbLegacy | `AB_LEGACY_ENDPOINT=10.100.0.35:44818` `AB_LEGACY_COMPOSE_PROFILE=<slc500\|micrologix\|plc5>` (**must** match the running PCCC container — else the `[Theory]` runs all 3 families and 2 fail) | `tests/Drivers/…AbLegacy.IntegrationTests` |
|
||||
| FOCAS | `OTOPCUA_FOCAS_SIM_ENDPOINT=10.100.0.35:8193` (tests now honour this — no longer hardcoded to 127.0.0.1) | `tests/Drivers/…FOCAS.IntegrationTests` |
|
||||
| Host | `OTOPCUA_HARNESS_USE_SQL=1` (+ SQL `:14331` via `tests/Server/…Host.IntegrationTests/docker-compose.yml up sql`) `OTOPCUA_HARNESS_USE_LDAP=0` | `tests/Server/…Host.IntegrationTests` |
|
||||
| Host | `OTOPCUA_HARNESS_USE_SQL=1` (+ SQL `:14331` via the harness `docker-compose.yml up sql`) — set `OTOPCUA_HARNESS_USE_LDAP=1` to exercise real binds against the **GLAuth** service (`up ldap`, host `:3894`; users alice/bob, svc `cn=serviceaccount`/`serviceaccount123`) | `tests/Server/…Host.IntegrationTests` |
|
||||
|
||||
**Modbus profile cycling:** the sim services share `:5020`, so to run a profile:
|
||||
`ssh … 'cd /opt/otopcua-modbus && docker compose down && docker compose --profile <p> up -d'`, then run with
|
||||
|
||||
Reference in New Issue
Block a user