feat(sso): Test Login admin flow across Custom OIDC, SAML, LDAP

docker/development/.env.sso-test

@@ -2,8 +2,8 @@
 # Configures OM server to use mock OIDC provider for E2E testing.
 #
 # Usage:
-#   1. Start mock OIDC provider first:
-#      docker compose --profile sso-test up -d mock-oidc-provider
+#   1. Start SSO test fixtures (mock OIDC + OpenLDAP):
+#      docker compose --profile sso-test up -d
 #
 #   2. Start (or restart) OM server with this env file:
 #      docker compose --env-file .env.sso-test up -d
@@ -12,8 +12,21 @@
 #      cd openmetadata-ui/src/main/resources/ui
 #      npx playwright test --config=playwright.sso.config.ts
 #
-# NOTE: Server-side URLs use Docker hostname (mock-oidc-provider:9090).
-#       Client-side URLs (authority, callback) use localhost:9090.
+# NOTE: Server-side URLs use Docker hostname (mock-oidc-provider:9090,
+#       openldap-test:1389). Client-side URLs (authority, callback)
+#       use localhost:9090.
+#
+# LDAP fixture (consumed by SSOTestLogin-LDAP.spec.ts via the SSO API,
+# not by the OM server's auth provider — these vars are documentation):
+#   LDAP host (server-side):   openldap-test
+#   LDAP host (host network):  localhost
+#   LDAP port:                 1389
+#   admin DN:                  cn=admin,dc=test,dc=local
+#   admin password:            admin-pass
+#   user base DN:              ou=people,dc=test,dc=local
+#   mail attribute:            mail
+#   seed user (with mail):     cn=alice,ou=people,dc=test,dc=local / alice-pass / mail=alice@company.com
+#   seed user (no mail):       cn=bob,ou=people,dc=test,dc=local / bob-pass
 
 # Authentication provider — custom-oidc uses OidcAuthenticator
 AUTHENTICATION_PROVIDER=custom-oidc

docker/development/docker-compose.yml

@@ -598,6 +598,34 @@ services:
     profiles:
       - sso-test
 
+  openldap-test:
+    build:
+      context: ./openldap-seed
+      dockerfile: Dockerfile
+    container_name: openldap_test
+    environment:
+      LDAP_ORGANISATION: OpenMetadata Test
+      LDAP_DOMAIN: test.local
+      LDAP_BASE_DN: dc=test,dc=local
+      LDAP_ADMIN_PASSWORD: admin-pass
+      LDAP_TLS: "false"
+    expose:
+      - 389
+    ports:
+      - "1389:389"
+    networks:
+      - local_app_net
+    healthcheck:
+      test:
+        - "CMD-SHELL"
+        - "ldapsearch -x -H ldap://localhost:389 -D 'cn=admin,dc=test,dc=local' -w admin-pass -b 'ou=people,dc=test,dc=local' '(cn=alice)' cn >/dev/null 2>&1"
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 30s
+    profiles:
+      - sso-test
+
 networks:
   local_app_net:
     name: ometa_network

docker/development/mock-oidc-provider/server.js

@@ -118,6 +118,9 @@ const providerConfig = {
     profile: ['name', 'preferred_username'],
   },
   scopes: ['openid', 'email', 'profile', 'offline_access'],
+  // Include all granted scope claims in the id_token so SSO Test Login (which
+  // reads claims from id_token only, not userinfo) can surface email/profile.
+  conformIdTokenClaims: false,
   features: {
     devInteractions: { enabled: false },
     rpInitiatedLogout: { enabled: true },

docker/development/openldap-seed/01-people.ldif

@@ -0,0 +1,29 @@
+# People organizational unit + seed users for SSO Test Login E2E specs.
+# Baked into the openldap-test image at build time (see Dockerfile).
+# Mirrors the fixture used by openmetadata-service TestLdapHandlerTest so the
+# E2E and unit-test bind shapes stay aligned.
+
+dn: ou=people,dc=test,dc=local
+objectClass: organizationalUnit
+ou: people
+
+dn: cn=alice,ou=people,dc=test,dc=local
+objectClass: inetOrgPerson
+objectClass: organizationalPerson
+objectClass: person
+objectClass: top
+cn: alice
+sn: Smith
+givenName: Alice
+mail: alice@company.com
+userPassword: alice-pass
+
+dn: cn=bob,ou=people,dc=test,dc=local
+objectClass: inetOrgPerson
+objectClass: organizationalPerson
+objectClass: person
+objectClass: top
+cn: bob
+sn: Jones
+givenName: Bob
+userPassword: bob-pass

docker/development/openldap-seed/Dockerfile

@@ -0,0 +1,4 @@
+FROM osixia/openldap:1.5.0
+
+COPY --chown=openldap:openldap 01-people.ldif \
+  /container/service/slapd/assets/config/bootstrap/ldif/custom/01-people.ldif

docker/local-sso/keycloak-saml/realms/om-azure-saml-realm.json

@@ -10,7 +10,7 @@
   "editUsernameAllowed": false,
   "clients": [
     {
-      "clientId": "http://localhost:8585/api/v1/saml/metadata",
+      "clientId": "http://localhost:8585",
       "name": "OpenMetadata",
       "enabled": true,
       "protocol": "saml",