feat(sso): Test Login admin flow across Custom OIDC, SAML, LDAP

[siddhant1]

Summary

• Adds a Test Login admin flow that verifies an SSO configuration end-to-end before it's saved: popup-driven for OIDC and SAML, in-page modal for LDAP. Backend handlers (TestLoginHandler, TestSamlHandler, TestLdapHandler) talk to the IdP using the form's draft config so admins can validate credentials, certs, and discovery URIs without ever applying a broken config.
• Lockout-safe save: the Save button is gated behind a fresh Test Login whenever a lockout-risk field (clientId, clientSecret, idpX509Certificate, dnAdminPassword, etc.) is edited. Includes a mode=existing overlay so admins can re-verify a saved config without retyping secrets, and a claim selector that surfaces every claim the IdP returned and remembers the chosen emailClaim.
• SSO Configuration form rebuilt on Untitled UI primitives; trimmed SAML/LDAP main sections to IdP-only / bind-only fields; full E2E coverage in a new sso-test-login Playwright project plus unit-test parity for TestLdapHandlerTest / TestLoginHandlerTest / TestSamlHandlerTest.

Test plan

• docker compose -f docker/development/docker-compose.yml --profile sso-test up -d brings up mock-OIDC (:9090) and OpenLDAP (:1389)
• KEYCLOAK_SAML_PORT=8081 docker compose -f docker/local-sso/keycloak-saml/docker-compose.yml up -d for the SAML fixture
• SSO_USERNAME=azure.saml@openmetadata.local SSO_PASSWORD=OpenMetadata@123 KEYCLOAK_SAML_BASE_URL=http://localhost:8081 yarn playwright test --project=sso-test-login — 13 tests cover happy path / failure / mode=existing / lockout-risk gate per provider; 5× back-to-back locally showed zero flakes
• Backend integration: mvn test -pl openmetadata-service -Dtest=TestLdapHandlerTest,TestLoginHandlerTest,TestSamlHandlerTest
• Manual smoke: configure Google/Okta/SAML/LDAP from the SSO Configuration page; verify Test Login → claim selector → Save persists the canonical shape; verify Save is blocked with toast when a lockout-risk field is edited without re-testing

🤖 Generated with Claude Code

---

Summary by Gitar

• Refined test infrastructure:
  • Standardized Playwright import ordering and improved error message formatting in ssoAuth.ts and sso.ts.
  • Minor cleanup of redundant logic in popupLifecycle.ts and UI test spec files to ensure stable test execution.

_{This will update automatically on new commits.}

[github-actions]

✅ TypeScript Types Auto-Updated

The generated TypeScript types have been automatically updated based on JSON schema changes in this PR.

[Copilot]

Pull request overview

Copilot reviewed 80 out of 85 changed files in this pull request and generated 8 comments.

[gitar-bot]

Code Review 🚫 Blocked 0 resolved / 4 findings

Implements an SSO Test Login flow for OIDC, SAML, and LDAP with gating mechanisms, but critical security findings include unauthenticated SSRF via excluded endpoints, reflected XSS in error responses, and arbitrary credential probing in the LDAP handler.

🚨 Security: Test-login endpoints bypass authentication — unauthenticated SSRF

📄 openmetadata-service/src/main/java/org/openmetadata/service/security/JwtFilter.java:109-111 📄 openmetadata-service/src/main/java/org/openmetadata/service/security/auth/TestLoginHandler.java:158-162 📄 openmetadata-service/src/main/java/org/openmetadata/service/resources/system/ConfigResource.java:233-247

The three new test-login endpoints (/v1/system/config/auth/test-login/initiate, saml-initiate, ldap-initiate) are added to EXCLUDED_ENDPOINTS in JwtFilter, making them publicly accessible without any authentication. Combined with the fact that TestLoginHandler.handleInitiate() fetches a user-supplied discoveryUri server-side (line 160: new HTTPRequest(HTTPRequest.Method.GET, new URI(discoveryUri).toURL()).send()), this creates an unauthenticated Server-Side Request Forgery (SSRF) vector.

Any anonymous user can POST to /api/v1/system/config/auth/test-login/initiate with discoveryUri=http://169.254.169.254/latest/meta-data/ (or any internal service URL) and the server will fetch it, potentially leaking cloud instance metadata, internal service responses, or enabling port scanning of the internal network.

The LDAP endpoint is similarly dangerous: an unauthenticated attacker can probe arbitrary LDAP servers from the application's network position.

Suggested fix

Remove these endpoints from EXCLUDED_ENDPOINTS in JwtFilter so they require a valid JWT. Additionally, add admin-role authorization (e.g., @RolesAllowed("Admin")) and validate that discoveryUri is an HTTPS URL with a public IP (not RFC-1918, link-local, or loopback) before fetching.

🚨 Security: Reflected XSS in test-login HTML error responses

📄 openmetadata-service/src/main/java/org/openmetadata/service/security/auth/TestLoginResponses.java:50 📄 openmetadata-service/src/main/java/org/openmetadata/service/security/auth/TestLoginResponses.java:68-72

Both buildHtmlErrorResponse and buildPostMessageResponse in TestLoginResponses.java embed error messages directly into HTML without HTML entity encoding. Since these endpoints are unauthenticated and the error message can derive from user-supplied input (e.g., a malformed discoveryUri that returns an error containing <script>alert(1)</script>), this is a reflected XSS vulnerability.

At line 72, message is concatenated directly into <p>Test Login Error: " + message + "</p>". The sanitized variable at line 68 only escapes single quotes for the JavaScript string literal but the unsanitized message is used in the HTML body. Similarly, in buildPostMessageResponse line 50, the error string goes unescaped into the <p> tag.

Suggested fix

HTML-encode all dynamic content before embedding in the response. Use a utility like `org.owasp.encoder.Encode.forHtml(message)` or Apache Commons `StringEscapeUtils.escapeHtml4(message)` for both the HTML body text and the JavaScript string literal. Example:

String htmlSafe = org.owasp.encoder.Encode.forHtml(message);
String jsSafe = org.owasp.encoder.Encode.forJavaScriptBlock(message);

⚠️ Security: LDAP test-login endpoint exposes credential-probing capability

📄 openmetadata-service/src/main/java/org/openmetadata/service/security/auth/TestLdapHandler.java:73-87 📄 openmetadata-service/src/main/java/org/openmetadata/service/security/auth/TestLdapHandler.java:177-191

The /auth/test-login/ldap-initiate endpoint (ConfigResource line 334) accepts arbitrary LDAP host/port/credentials and attempts connections to them. Even if authentication is added, this allows an admin to:

1. Use the server as an LDAP connection proxy to scan internal networks
2. Exfiltrate the admin bind password via mode=existing overlay if the merge logic can be tricked

The mode=existing path in TestLdapHandler.maybeMergeWithSaved() reads the saved config (including dnAdminPassword) and merges it with user input. If the merged result is logged or returned in an error message, the saved password could leak.

Suggested fix

Ensure the endpoint requires admin authentication. Validate that the LDAP host is not a private/internal IP. Never include the admin password in error messages. Consider restricting `mode=existing` to only allow connecting to the already-saved host:port.

⚠️ Security: JavaScript injection via unsanitized JSON in localStorage script

📄 openmetadata-service/src/main/java/org/openmetadata/service/security/auth/TestLoginResponses.java:53-58 📄 openmetadata-service/src/main/java/org/openmetadata/service/security/auth/TestLoginResponses.java:78-83

In buildHtmlErrorResponse (line 79), the error message sanitization (replace("'", "\'")) is insufficient for a JavaScript context. Characters like </script>, backslashes, or Unicode escapes can break out of the JS string literal and inject arbitrary script. The buildPostMessageResponse method passes json (from JsonUtils.pojoToJson) directly into a JSON.stringify() call inside a <script> tag — if any claim value from the IdP contains </script>, it will terminate the script block early and enable XSS.

Suggested fix

Use proper JavaScript string encoding (escape </script> as <\/script>, encode all special chars). Better yet, pass the data via a <script type="application/json"> data island and parse it with JSON.parse in a separate script tag, avoiding inline interpolation entirely.

🤖 Prompt for agents

Code Review: Implements an SSO Test Login flow for OIDC, SAML, and LDAP with gating mechanisms, but critical security findings include unauthenticated SSRF via excluded endpoints, reflected XSS in error responses, and arbitrary credential probing in the LDAP handler.

1. 🚨 Security: Test-login endpoints bypass authentication — unauthenticated SSRF
   Files: openmetadata-service/src/main/java/org/openmetadata/service/security/JwtFilter.java:109-111, openmetadata-service/src/main/java/org/openmetadata/service/security/auth/TestLoginHandler.java:158-162, openmetadata-service/src/main/java/org/openmetadata/service/resources/system/ConfigResource.java:233-247

   The three new test-login endpoints (`/v1/system/config/auth/test-login/initiate`, `saml-initiate`, `ldap-initiate`) are added to `EXCLUDED_ENDPOINTS` in JwtFilter, making them publicly accessible without any authentication. Combined with the fact that `TestLoginHandler.handleInitiate()` fetches a user-supplied `discoveryUri` server-side (line 160: `new HTTPRequest(HTTPRequest.Method.GET, new URI(discoveryUri).toURL()).send()`), this creates an unauthenticated Server-Side Request Forgery (SSRF) vector.
   
   Any anonymous user can POST to `/api/v1/system/config/auth/test-login/initiate` with `discoveryUri=http://169.254.169.254/latest/meta-data/` (or any internal service URL) and the server will fetch it, potentially leaking cloud instance metadata, internal service responses, or enabling port scanning of the internal network.
   
   The LDAP endpoint is similarly dangerous: an unauthenticated attacker can probe arbitrary LDAP servers from the application's network position.

   Suggested fix:
   Remove these endpoints from EXCLUDED_ENDPOINTS in JwtFilter so they require a valid JWT. Additionally, add admin-role authorization (e.g., @RolesAllowed("Admin")) and validate that discoveryUri is an HTTPS URL with a public IP (not RFC-1918, link-local, or loopback) before fetching.

2. 🚨 Security: Reflected XSS in test-login HTML error responses
   Files: openmetadata-service/src/main/java/org/openmetadata/service/security/auth/TestLoginResponses.java:50, openmetadata-service/src/main/java/org/openmetadata/service/security/auth/TestLoginResponses.java:68-72

   Both `buildHtmlErrorResponse` and `buildPostMessageResponse` in `TestLoginResponses.java` embed error messages directly into HTML without HTML entity encoding. Since these endpoints are unauthenticated and the error message can derive from user-supplied input (e.g., a malformed `discoveryUri` that returns an error containing `<script>alert(1)</script>`), this is a reflected XSS vulnerability.
   
   At line 72, `message` is concatenated directly into `<p>Test Login Error: " + message + "</p>"`. The `sanitized` variable at line 68 only escapes single quotes for the JavaScript string literal but the *unsanitized* `message` is used in the HTML body. Similarly, in `buildPostMessageResponse` line 50, the `error` string goes unescaped into the `<p>` tag.

   Suggested fix:
   HTML-encode all dynamic content before embedding in the response. Use a utility like `org.owasp.encoder.Encode.forHtml(message)` or Apache Commons `StringEscapeUtils.escapeHtml4(message)` for both the HTML body text and the JavaScript string literal. Example:
   
   String htmlSafe = org.owasp.encoder.Encode.forHtml(message);
   String jsSafe = org.owasp.encoder.Encode.forJavaScriptBlock(message);

3. ⚠️ Security: LDAP test-login endpoint exposes credential-probing capability
   Files: openmetadata-service/src/main/java/org/openmetadata/service/security/auth/TestLdapHandler.java:73-87, openmetadata-service/src/main/java/org/openmetadata/service/security/auth/TestLdapHandler.java:177-191

   The `/auth/test-login/ldap-initiate` endpoint (ConfigResource line 334) accepts arbitrary LDAP host/port/credentials and attempts connections to them. Even if authentication is added, this allows an admin to:
   1. Use the server as an LDAP connection proxy to scan internal networks
   2. Exfiltrate the admin bind password via `mode=existing` overlay if the merge logic can be tricked
   
   The `mode=existing` path in `TestLdapHandler.maybeMergeWithSaved()` reads the saved config (including `dnAdminPassword`) and merges it with user input. If the merged result is logged or returned in an error message, the saved password could leak.

   Suggested fix:
   Ensure the endpoint requires admin authentication. Validate that the LDAP host is not a private/internal IP. Never include the admin password in error messages. Consider restricting `mode=existing` to only allow connecting to the already-saved host:port.

4. ⚠️ Security: JavaScript injection via unsanitized JSON in localStorage script
   Files: openmetadata-service/src/main/java/org/openmetadata/service/security/auth/TestLoginResponses.java:53-58, openmetadata-service/src/main/java/org/openmetadata/service/security/auth/TestLoginResponses.java:78-83

   In `buildHtmlErrorResponse` (line 79), the error message sanitization (`replace("'", "\'")`) is insufficient for a JavaScript context. Characters like `</script>`, backslashes, or Unicode escapes can break out of the JS string literal and inject arbitrary script. The `buildPostMessageResponse` method passes `json` (from `JsonUtils.pojoToJson`) directly into a `JSON.stringify()` call inside a `<script>` tag — if any claim value from the IdP contains `</script>`, it will terminate the script block early and enable XSS.

   Suggested fix:
   Use proper JavaScript string encoding (escape </script> as <\/script>, encode all special chars). Better yet, pass the data via a <script type="application/json"> data island and parse it with JSON.parse in a separate script tag, avoiding inline interpolation entirely.

Options

Display: compact → Showing less information.

Comment with these commands to change:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqubecloud]

Quality Gate passed for 'open-metadata-ingestion'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

🔴 Playwright Results — 26 failure(s), 18 flaky

✅ 4041 passed · ❌ 26 failed · 🟡 18 flaky · ⏭️ 86 skipped

Shard	Passed	Failed	Flaky	Skipped
✅ Shard 1	299	0	0	4
🟡 Shard 2	761	0	7	8
🔴 Shard 3	752	26	3	7
🟡 Shard 4	787	0	3	18
🟡 Shard 5	708	0	1	41
🟡 Shard 6	734	0	4	8

Genuine Failures (failed on all attempts)

❌ Features/SSOConfiguration.spec.ts › should show correct fields for Google provider with confidential client (shard 3)

Error: �[2mexpect(�[22m�[31mlocator�[39m�[2m).�[22mtoBeChecked�[2m(�[22m�[2m)�[22m failed

Locator: getByRole('radio', { name: /confidential/i })
Expected: checked
Timeout: 15000ms
Error: element(s) not found

Call log:
�[2m  - Expect "toBeChecked" with timeout 15000ms�[22m
�[2m  - waiting for getByRole('radio', { name: /confidential/i })�[22m

❌ Features/SSOConfiguration.spec.ts › should show correct fields for Auth0 provider with confidential client (shard 3)

Error: �[2mexpect(�[22m�[31mlocator�[39m�[2m).�[22mtoBeChecked�[2m(�[22m�[2m)�[22m failed

Locator: getByRole('radio', { name: /confidential/i })
Expected: checked
Timeout: 15000ms
Error: element(s) not found

Call log:
�[2m  - Expect "toBeChecked" with timeout 15000ms�[22m
�[2m  - waiting for getByRole('radio', { name: /confidential/i })�[22m

❌ Features/SSOConfiguration.spec.ts › should show correct fields for Okta provider with confidential client (shard 3)

Error: �[2mexpect(�[22m�[31mlocator�[39m�[2m).�[22mtoBeChecked�[2m(�[22m�[2m)�[22m failed

Locator: getByRole('radio', { name: /confidential/i })
Expected: checked
Timeout: 15000ms
Error: element(s) not found

Call log:
�[2m  - Expect "toBeChecked" with timeout 15000ms�[22m
�[2m  - waiting for getByRole('radio', { name: /confidential/i })�[22m

❌ Features/SSOConfiguration.spec.ts › should show correct fields when selecting SAML provider (shard 3)

Error: Field not found: SP Entity ID

❌ Features/SSOConfiguration.spec.ts › should show correct fields when selecting LDAP provider (shard 3)

Error: �[2mexpect(�[22m�[31mlocator�[39m�[2m).�[22mtoBeVisible�[2m(�[22m�[2m)�[22m failed

Locator:  getByLabel('Enable SSL').first()
Expected: visible
Received: hidden
Timeout:  15000ms

Call log:
�[2m  - Expect "toBeVisible" with timeout 15000ms�[22m
�[2m  - waiting for getByLabel('Enable SSL').first()�[22m
�[2m    19 × locator resolved to <input type="checkbox" id="root/authenticationConfiguration/ldapConfiguration/sslEnabled" name="root/authenticationConfiguration/ldapConfiguration/sslEnabled" aria-describedby="root/authenticationConfiguration/ldapConfiguration/sslEnabled__error root/authenticationConfiguration/ldapConfiguration/sslEnabled__description root/authenticationConfiguration/ldapConfiguration/sslEnabled__help"/>�[22m
�[2m       - unexpected value "hidden"�[22m

❌ Features/SSOConfiguration.spec.ts › should show correct fields when selecting Google provider (shard 3)

�[31mTest timeout of 60000ms exceeded.�[39m

❌ Features/SSOConfiguration.spec.ts › should show correct fields when selecting Auth0 provider (shard 3)

�[31mTest timeout of 60000ms exceeded.�[39m

❌ Features/SSOConfiguration.spec.ts › should show correct fields when selecting Okta provider (shard 3)

�[31mTest timeout of 60000ms exceeded.�[39m

❌ Features/SSOConfiguration.spec.ts › should show OIDC Callback URL as readonly for Google provider (shard 3)

Error: �[2mexpect(�[22m�[31mlocator�[39m�[2m).�[22mtoBeChecked�[2m(�[22m�[2m)�[22m failed

Locator: getByRole('radio', { name: /confidential/i })
Expected: checked
Timeout: 15000ms
Error: element(s) not found

Call log:
�[2m  - Expect "toBeChecked" with timeout 15000ms�[22m
�[2m  - waiting for getByRole('radio', { name: /confidential/i })�[22m

❌ Features/SSOConfiguration.spec.ts › should show OIDC Callback URL as readonly for Auth0 provider (shard 3)

Error: �[2mexpect(�[22m�[31mlocator�[39m�[2m).�[22mtoBeVisible�[2m(�[22m�[2m)�[22m failed

Locator: locator('[id="root/authenticationConfiguration/oidcConfiguration/callbackUrl"]')
Expected: visible
Timeout: 15000ms
Error: element(s) not found

Call log:
�[2m  - Expect "toBeVisible" with timeout 15000ms�[22m
�[2m  - waiting for locator('[id="root/authenticationConfiguration/oidcConfiguration/callbackUrl"]')�[22m

❌ Features/SSOConfiguration.spec.ts › should show OIDC Callback URL as readonly for Okta provider (shard 3)

Error: �[2mexpect(�[22m�[31mlocator�[39m�[2m).�[22mtoBeVisible�[2m(�[22m�[2m)�[22m failed

Locator: locator('[id="root/authenticationConfiguration/oidcConfiguration/callbackUrl"]')
Expected: visible
Timeout: 15000ms
Error: element(s) not found

Call log:
�[2m  - Expect "toBeVisible" with timeout 15000ms�[22m
�[2m  - waiting for locator('[id="root/authenticationConfiguration/oidcConfiguration/callbackUrl"]')�[22m

❌ Features/SSOConfiguration.spec.ts › should show OIDC Callback URL as readonly for Azure AD provider (shard 3)

Error: �[2mexpect(�[22m�[31mlocator�[39m�[2m).�[22mtoBeVisible�[2m(�[22m�[2m)�[22m failed

Locator: locator('[id="root/authenticationConfiguration/oidcConfiguration/callbackUrl"]')
Expected: visible
Timeout: 15000ms
Error: element(s) not found

Call log:
�[2m  - Expect "toBeVisible" with timeout 15000ms�[22m
�[2m  - waiting for locator('[id="root/authenticationConfiguration/oidcConfiguration/callbackUrl"]')�[22m

❌ Features/SSOConfiguration.spec.ts › should show SAML SP Entity ID and ACS URL as readonly (shard 3)

Error: �[2mexpect(�[22m�[31mlocator�[39m�[2m).�[22mtoBeVisible�[2m(�[22m�[2m)�[22m failed

Locator: locator('[id="root/authenticationConfiguration/samlConfiguration/sp/entityId"]')
Expected: visible
Timeout: 15000ms
Error: element(s) not found

Call log:
�[2m  - Expect "toBeVisible" with timeout 15000ms�[22m
�[2m  - waiting for locator('[id="root/authenticationConfiguration/samlConfiguration/sp/entityId"]')�[22m

❌ Features/SSOConfiguration.spec.ts › should display advanced config collapse for OIDC provider (shard 3)

Error: �[2mexpect(�[22m�[31mlocator�[39m�[2m).�[22mtoBeVisible�[2m(�[22m�[2m)�[22m failed

Locator: locator('.sso-advanced-properties-collapse')
Expected: visible
Timeout: 15000ms
Error: element(s) not found

Call log:
�[2m  - Expect "toBeVisible" with timeout 15000ms�[22m
�[2m  - waiting for locator('.sso-advanced-properties-collapse')�[22m

❌ Features/SSOConfiguration.spec.ts › should show advanced fields when advanced config is expanded (shard 3)

�[31mTest timeout of 60000ms exceeded.�[39m

❌ Features/SSOConfiguration.spec.ts › should hide publicKeyUrls field for confidential OIDC providers (shard 3)

Error: �[2mexpect(�[22m�[31mlocator�[39m�[2m).�[22mtoBeChecked�[2m(�[22m�[2m)�[22m failed

Locator: getByRole('radio', { name: /confidential/i })
Expected: checked
Timeout: 15000ms
Error: element(s) not found

Call log:
�[2m  - Expect "toBeChecked" with timeout 15000ms�[22m
�[2m  - waiting for getByRole('radio', { name: /confidential/i })�[22m

❌ Features/SSOConfiguration.spec.ts › should hide preferredJwsAlgorithm and responseType for OIDC providers (shard 3)

�[31mTest timeout of 60000ms exceeded.�[39m

❌ Features/SSOConfiguration.spec.ts › should hide clientAuthenticationMethod for Auth0 provider (shard 3)

�[31mTest timeout of 60000ms exceeded.�[39m

❌ Features/SSOConfiguration.spec.ts › should show clientAuthenticationMethod for Okta provider (shard 3)

�[31mTest timeout of 60000ms exceeded.�[39m

❌ Features/SSOConfiguration.spec.ts › should hide tenant field for Auth0 provider (shard 3)

�[31mTest timeout of 60000ms exceeded.�[39m

❌ Features/SSOConfiguration.spec.ts › should show tenant field for Azure provider (shard 3)

Error: �[2mexpect(�[22m�[31mlocator�[39m�[2m).�[22mtoBeVisible�[2m(�[22m�[2m)�[22m failed

Locator: locator('[id="root/authenticationConfiguration/oidcConfiguration/tenant"]')
Expected: visible
Timeout: 15000ms
Error: element(s) not found

Call log:
�[2m  - Expect "toBeVisible" with timeout 15000ms�[22m
�[2m  - waiting for locator('[id="root/authenticationConfiguration/oidcConfiguration/tenant"]')�[22m

❌ Features/SSOConfiguration.spec.ts › should collapse advanced config by default (shard 3)

Error: �[2mexpect(�[22m�[31mlocator�[39m�[2m).not.�[22mtoHaveClass�[2m(�[22m�[32mexpected�[39m�[2m)�[22m failed

Locator: locator('.sso-advanced-properties-collapse .ant-collapse-item')
Expected pattern: not �[32m/ant-collapse-item-active/�[39m
Timeout: 15000ms
Error: element(s) not found

Call log:
�[2m  - Expect "not toHaveClass" with timeout 15000ms�[22m
�[2m  - waiting for locator('.sso-advanced-properties-collapse .ant-collapse-item')�[22m

❌ Features/SSOConfiguration.spec.ts › should expand and collapse advanced config when clicked (shard 3)

Error: �[2mexpect(�[22m�[31mlocator�[39m�[2m).not.�[22mtoHaveClass�[2m(�[22m�[32mexpected�[39m�[2m)�[22m failed

Locator: locator('.sso-advanced-properties-collapse .ant-collapse-item')
Expected pattern: not �[32m/ant-collapse-item-active/�[39m
Timeout: 15000ms
Error: element(s) not found

Call log:
�[2m  - Expect "not toHaveClass" with timeout 15000ms�[22m
�[2m  - waiting for locator('.sso-advanced-properties-collapse .ant-collapse-item')�[22m

❌ Features/SSOConfiguration.spec.ts › should support full LDAP role mapping flow: add, fill, open roles dropdown, detect and resolve duplicates, and remove (shard 3)

�[31mTest timeout of 60000ms exceeded.�[39m

❌ Features/SSOConfiguration.spec.ts › should render authReassignRoles as a searchable dropdown and support role selection, removal, and search filtering (shard 3)

Error: �[2mexpect(�[22m�[31mlocator�[39m�[2m).�[22mtoBeVisible�[2m(�[22m�[2m)�[22m failed

Locator:  getByTestId('sso-configuration-form-array-field-template-authReassignRoles')
Expected: visible
Received: hidden
Timeout:  15000ms

Call log:
�[2m  - Expect "toBeVisible" with timeout 15000ms�[22m
�[2m  - waiting for getByTestId('sso-configuration-form-array-field-template-authReassignRoles')�[22m
�[2m    18 × locator resolved to <div data-testid="sso-configuration-form-array-field-template-authReassignRoles" class="ant-select m-t-xss w-full ant-select-multiple ant-select-allow-clear ant-select-show-search">…</div>�[22m
�[2m       - unexpected value "hidden"�[22m

❌ Features/SSOConfiguration.spec.ts › should parse valid SAML metadata XML and populate form fields, then clear fields on invalid XML (shard 3)

Error: locator.setInputFiles: Error: Node is not an HTMLInputElement
Call log:
�[2m  - waiting for getByTestId('file-uploader')�[22m
�[2m    - locator resolved to <div tabindex="0" role="button" data-testid="file-uploader" class="saml-metadata-upload-drop-zone">…</div>�[22m

🟡 18 flaky test(s) (passed on retry)

• Features/ActivityAPI.spec.ts › Activity event shows the actor who made the change (shard 2, 1 retry)
• Features/BulkEditEntity.spec.ts › Glossary (shard 2, 1 retry)
• Features/Glossary/GlossaryWorkflow.spec.ts › should start term as Draft when glossary has reviewers (shard 2, 1 retry)
• Features/KnowledgeCenter.spec.ts › Article mentions in description should working for Knowledge Center (shard 2, 1 retry)
• Features/KnowledgeCenterTextEditor.spec.ts › Rich Text Editor - Text Formatting (shard 2, 1 retry)
• Features/KnowledgeCenterTextEditor.spec.ts › Rich Text Editor - Text Formatting (shard 2, 1 retry)
• Features/KnowledgeCenterTextEditor.spec.ts › Rich Text Editor - Text Formatting (shard 2, 1 retry)
• Features/RTL.spec.ts › Verify Following widget functionality (shard 3, 1 retry)
• Features/Table.spec.ts › Tags term should be consistent for search (shard 3, 1 retry)
• Features/Workflows/WorkflowOssRestrictions.spec.ts › save, cancel, and validate buttons visible; delete absent in edit mode (shard 3, 1 retry)
• Pages/CustomProperties.spec.ts › Should display custom properties for apiCollection in right panel (shard 4, 1 retry)
• Pages/DataContracts.spec.ts › Create Data Contract and validate for Database Schema (shard 4, 1 retry)
• Pages/DomainUIInteractions.spec.ts › Clear domain selection returns to All Domains (shard 4, 1 retry)
• Pages/ExplorePageRightPanel_KnowledgeCenter.spec.ts › Should remove user owner for knowledgeCenter (shard 5, 1 retry)
• Pages/Glossary.spec.ts › Drag and Drop Glossary Term (shard 6, 1 retry)
• Pages/Lineage/LineageFilters.spec.ts › Verify lineage schema filter selection (shard 6, 1 retry)
• Pages/Login.spec.ts › Refresh should work (shard 6, 1 retry)
• Pages/ODCSImportExport.spec.ts › Multi-object ODCS contract - object selector shows all schema objects (shard 6, 1 retry)

📦 Download artifacts

How to debug locally

# Download playwright-test-results-<shard> artifact and unzip
npx playwright show-trace path/to/trace.zip    # view trace