Joseph Doherty
3a48eb0c70
The Host.IntegrationTests opt-in real-LDAP mode (OTOPCUA_HARNESS_USE_LDAP=1) used bitnami/openldap:2.6, gone since Bitnami deprecated their free image catalog in 2025. Replaced it with GLAuth — the same LDAP server the rest of the project already uses (docker-dev + the live OPC UA data-plane auth, both against the shared GLAuth on :3893) — removing the lone OpenLDAP outlier and the gone-image breakage. - Added tests/.../Host.IntegrationTests/glauth/config.toml: baseDN dc=zb,dc=local, a search-capable serviceaccount, dev users alice (full access) / bob (read-only), and role groups with the same gidnumbers as scadaproj/infra/glauth so GroupToRole maps identically. - Compose ldap service -> glauth/glauth:latest, mounting the config, host :3894 -> :3893. - Repointed the harness real-LDAP override from the OpenLDAP cn=admin/ldapadmin to GLAuth's cn=serviceaccount/serviceaccount123. Live-verified against a deployed container on :3894: the serviceaccount bind searches and returns alice + her 5 memberOf groups; alice/bob bind with the correct password; a wrong password yields Invalid credentials (49) — exactly the OtOpcUaLdapAuthService flow (proven identical to the data-plane's shared-GLAuth path). NB: real-LDAP mode is opt-in; the default Host run uses StubLdapAuthService, so this never blocked the default suite. Integration-sweep follow-up #6 (LDAP leg); the amd64-emulated-SQL deadline leg remains open.
56 lines
2.4 KiB
YAML
56 lines
2.4 KiB
YAML
# Real-mode dependencies for ZB.MOM.WW.OtOpcUa.Host.IntegrationTests.
|
|
#
|
|
# The default harness (TwoNodeClusterHarness) uses EF InMemoryDatabase + StubLdapAuthService
|
|
# so the suite runs anywhere with zero infrastructure. This compose stack exists for two
|
|
# situations the in-memory mode can't cover:
|
|
#
|
|
# 1. EF behaviors that diverge between provider implementations — index uniqueness,
|
|
# RowVersion concurrency, JSON column round-trips, EF migration application.
|
|
# 2. Real LDAP binds against a GLAuth server (./glauth/config.toml) with dev users
|
|
# alice (full access) / bob (read-only) and the cn=serviceaccount bind account.
|
|
#
|
|
# Activate by setting these env vars before running the suite:
|
|
#
|
|
# export OTOPCUA_HARNESS_USE_SQL=1
|
|
# export OTOPCUA_HARNESS_USE_LDAP=1
|
|
# docker compose -f tests/Server/ZB.MOM.WW.OtOpcUa.Host.IntegrationTests/docker-compose.yml up -d
|
|
# dotnet test tests/Server/ZB.MOM.WW.OtOpcUa.Host.IntegrationTests --filter "Category!=E2E"
|
|
# docker compose -f tests/Server/ZB.MOM.WW.OtOpcUa.Host.IntegrationTests/docker-compose.yml down -v
|
|
#
|
|
# Ports differ from docker-dev/ on purpose so both stacks can run side-by-side:
|
|
# - SQL: 14331 (docker-dev uses 14330)
|
|
# - LDAP: 3894 (docker-dev uses 3893)
|
|
#
|
|
# DESKTOP-6JL3KKO note: Docker Desktop is not installed here. Run this stack on the shared
|
|
# Linux Docker host (10.100.0.35) per docs/v2/dev-environment.md, or in CI on Linux.
|
|
|
|
name: otopcua-harness
|
|
|
|
services:
|
|
|
|
sql:
|
|
image: mcr.microsoft.com/mssql/server:2022-latest
|
|
environment:
|
|
ACCEPT_EULA: "Y"
|
|
SA_PASSWORD: "OtOpcUa!Harness123"
|
|
MSSQL_PID: Developer
|
|
ports:
|
|
- "14331:1433"
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "/opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P 'OtOpcUa!Harness123' -No -Q 'SELECT 1' || exit 1"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 20
|
|
|
|
ldap:
|
|
# GLAuth — the same LDAP server the rest of the project uses (docker-dev + the live
|
|
# OPC UA data-plane auth, both against the shared GLAuth on :3893). Replaced the retired
|
|
# bitnami/openldap:2.6 (Bitnami deprecated their free catalog in 2025). Seeded by
|
|
# ./glauth/config.toml with a search-capable serviceaccount + dev users alice/bob.
|
|
# Listens on :3893 in-container; mapped to host :3894 to run beside docker-dev's :3893.
|
|
image: glauth/glauth:latest
|
|
volumes:
|
|
- ./glauth/config.toml:/app/config/config.cfg:ro
|
|
ports:
|
|
- "3894:3893"
|