hluk / waiverdb / 24710457935 / 1

84%

master: %

push

github

Migrate LDAP to new server with GSSAPI authentication

Some groups are only available in LDAP, so we cannot rely solely on
OIDC token groups. Migrate to new IPA LDAP server with GSSAPI
authentication, following the same approach as product-listings-manager.

Keep existing OIDC groups check as the first path to avoid unnecessary
LDAP queries when groups are available in the token. Downgrade LDAP
fallback log messages from warnings to debug since falling back to LDAP
is now expected behavior.

Fix HTTP status codes for LDAP connection errors from 401 Unauthorized
to 502 Bad Gateway, since these are server-side failures.

JIRA: RHELWF-13972

Assisted-by: Claude Code (claude-opus-4-6)

264 of 368 branches covered (71.74%)

Branch coverage included in aggregate %.

2099 of 2455 relevant lines covered (85.5%)

0.85 hits per line