release-engineering / waiverdb / 24718807055

85%

push

github

Migrate LDAP to new server with GSSAPI authentication (#384)

* Fix "make build" command

* Migrate LDAP to new server with GSSAPI authentication

Some groups are only available in LDAP, so we cannot rely solely on
OIDC token groups. Migrate to new IPA LDAP server with GSSAPI
authentication, following the same approach as product-listings-manager.

Keep existing OIDC groups check as the first path to avoid unnecessary
LDAP queries when groups are available in the token. Downgrade LDAP
fallback log messages from warnings to debug since falling back to LDAP
is now expected behavior.

Fix HTTP status codes for LDAP connection errors from 401 Unauthorized
to 502 Bad Gateway, since these are server-side failures.

JIRA: RHELWF-13972

Assisted-by: Claude Code (claude-opus-4-6)

* Drop authlib.jose and use uv sync in Dockerfile

Replace authlib.jose.jwt.decode + create_load_key() with simple base64
JWT payload extraction for reading OIDC access token claims. The token
was already verified during the OIDC login flow, so cryptographic
verification is unnecessary. This avoids the deprecated authlib.jose
module which breaks with newer authlib versions.

Use "uv sync --frozen --no-dev" instead of "uv pip install" in the
Dockerfile so the container installs exact versions from uv.lock.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Lukas Holecek <lholecek@redhat.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

264 of 368 branches covered (71.74%)

Branch coverage included in aggregate %.

36 of 41 new or added lines in 5 files covered. (87.8%)

2099 of 2455 relevant lines covered (85.5%)

0.85 hits per line