fix(harness): swap retired bitnami/openldap for GLAuth (Host real-LDAP mode) #451

2026-07-15T06:04:04-04:00

dohertj2 commented

2026-07-15 06:04:04 -04:00

Integration-sweep follow-up #6 (LDAP leg). The Host.IntegrationTests opt-in real-LDAP mode used bitnami/openldap:2.6 (gone — Bitnami killed their free catalog). Swapped to GLAuth, the LDAP server the rest of the project already uses (docker-dev + data-plane auth). Added a harness glauth/config.toml (serviceaccount + alice/bob + role groups matching scadaproj/infra/glauth), repointed the service-account override. Live-verified all three bind legs on :3894. Real-LDAP mode is opt-in (default run uses the stub), so this never blocked the default suite. The amd64-emulated-SQL deadline leg of #6 remains open.

dohertj2 added 1 commit 2026-07-15 06:04:05 -04:00

fix(harness): swap retired bitnami/openldap for GLAuth in the Host real-LDAP mode

v2-ci / build (pull_request) Successful in 4m13s

Details

v2-ci / unit-tests (pull_request) Failing after 10m18s

Details

3a48eb0c70

The Host.IntegrationTests opt-in real-LDAP mode (OTOPCUA_HARNESS_USE_LDAP=1)
used bitnami/openldap:2.6, gone since Bitnami deprecated their free image
catalog in 2025. Replaced it with GLAuth — the same LDAP server the rest of
the project already uses (docker-dev + the live OPC UA data-plane auth, both
against the shared GLAuth on :3893) — removing the lone OpenLDAP outlier and
the gone-image breakage.

- Added tests/.../Host.IntegrationTests/glauth/config.toml: baseDN dc=zb,dc=local,
  a search-capable serviceaccount, dev users alice (full access) / bob (read-only),
  and role groups with the same gidnumbers as scadaproj/infra/glauth so GroupToRole
  maps identically.
- Compose ldap service -> glauth/glauth:latest, mounting the config, host :3894 -> :3893.
- Repointed the harness real-LDAP override from the OpenLDAP cn=admin/ldapadmin to
  GLAuth's cn=serviceaccount/serviceaccount123.

Live-verified against a deployed container on :3894: the serviceaccount bind
searches and returns alice + her 5 memberOf groups; alice/bob bind with the
correct password; a wrong password yields Invalid credentials (49) — exactly the
OtOpcUaLdapAuthService flow (proven identical to the data-plane's shared-GLAuth path).

NB: real-LDAP mode is opt-in; the default Host run uses StubLdapAuthService, so
this never blocked the default suite. Integration-sweep follow-up #6 (LDAP leg);
the amd64-emulated-SQL deadline leg remains open.

dohertj2 merged commit 779afbb66f into master

2026-07-15 06:04:19 -04:00

dohertj2 referenced this issue from a commit

2026-07-15 07:45:11 -04:00

test(ldap): live GLAuth outage/recovery gate (R2-08 03/S2)

dohertj2 referenced this pull request

2026-07-15 07:45:19 -04:00

test(ldap): live GLAuth outage/recovery gate (R2-08 03/S2) #455

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dohertj2/lmxopcua#451