From c94e386f186d845c781bdba5879ba39000a25a81 Mon Sep 17 00:00:00 2001
From: Michael Li <michael.li@hashicorp.com>
Date: Thu, 21 May 2026 15:43:33 -0400
Subject: [PATCH] chore(e2e): Ensure ldap is ready (#6736)

* fix(e2e): Modify ldap cleanup step

* chore(e2e): Parallelize dependency download

# Conflicts:
#	.github/workflows/enos-run.yml

* chore(e2e): Ensure ldap is ready
---
 .github/workflows/enos-run.yml                |  2 +-
 enos/enos-scenario-e2e-docker-base-plus.hcl   |  2 ++
 ...os-scenario-e2e-docker-base-with-vault.hcl |  1 +
 enos/modules/docker_ldap/main.tf              | 26 +++++++++++++++++++
 .../credential_library_vault_ldap_test.go     | 10 ++++---
 5 files changed, 36 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/enos-run.yml b/.github/workflows/enos-run.yml
index c85b6f3b3..df939eecd 100644
--- a/.github/workflows/enos-run.yml
+++ b/.github/workflows/enos-run.yml
@@ -263,7 +263,7 @@ jobs:
           # environment
           # A virtual environment was needed because python environments on
           # self-hosted runners are externally managed.
-          sudo apt install -y python3.12-venv
+          sudo apt install -y python3-venv
           python3 -m venv "$HOME/cqlsh-venv"
           "$HOME/cqlsh-venv/bin/pip" install --upgrade pip
           "$HOME/cqlsh-venv/bin/pip" install cqlsh
diff --git a/enos/enos-scenario-e2e-docker-base-plus.hcl b/enos/enos-scenario-e2e-docker-base-plus.hcl
index acd2a3e98..f4eb911b1 100644
--- a/enos/enos-scenario-e2e-docker-base-plus.hcl
+++ b/enos/enos-scenario-e2e-docker-base-plus.hcl
@@ -133,6 +133,8 @@ scenario "e2e_docker_base_plus" {
     module = module.test_e2e_docker
     depends_on = [
       step.create_boundary,
+      step.create_ldap_server,
+      step.create_host,
     ]
     variables {
       is_ci                     = var.is_ci
diff --git a/enos/enos-scenario-e2e-docker-base-with-vault.hcl b/enos/enos-scenario-e2e-docker-base-with-vault.hcl
index 0e8afcf68..3673f29ed 100644
--- a/enos/enos-scenario-e2e-docker-base-with-vault.hcl
+++ b/enos/enos-scenario-e2e-docker-base-with-vault.hcl
@@ -143,6 +143,7 @@ scenario "e2e_docker_base_with_vault" {
       step.create_boundary,
       step.create_vault,
       step.create_host,
+      step.create_ldap_server,
     ]
     variables {
       is_ci                    = var.is_ci
diff --git a/enos/modules/docker_ldap/main.tf b/enos/modules/docker_ldap/main.tf
index 557a2c269..5b6458a3c 100644
--- a/enos/modules/docker_ldap/main.tf
+++ b/enos/modules/docker_ldap/main.tf
@@ -98,6 +98,32 @@ resource "enos_local_exec" "create_ldap_group" {
   inline = ["docker exec ${var.container_name} ldapadd -x -H ldap://localhost -D \"${local.admin_dn}\" -w ${local.admin_password} -f /tmp/ldap/group.ldif"]
 }
 
+resource "enos_local_exec" "wait_for_user_entry" {
+  depends_on = [
+    enos_local_exec.create_ldap_user,
+  ]
+
+  inline = [
+    # First verify the user is discoverable the same way Boundary authenticates it.
+    "timeout 20s bash -c 'until docker exec ${var.container_name} ldapsearch -x -H ldap://localhost -D \"${local.admin_dn}\" -w ${local.admin_password} -b \"${local.domain_dn}\" \"(uid=${local.user_name})\" | grep \"numEntries: 1\"; do sleep 2; done'",
+    # Then verify the exact seeded DN exists for Vault static-role operations.
+    "timeout 20s bash -c 'until docker exec ${var.container_name} ldapsearch -x -H ldap://localhost -D \"${local.admin_dn}\" -w ${local.admin_password} -b \"cn=${local.user_name},${local.domain_dn}\" -s base \"(objectClass=*)\" | grep \"numEntries: 1\"; do sleep 2; done'",
+    # Finally verify we can bind as the user using the seeded DN shape.
+    "timeout 20s bash -c 'until docker exec ${var.container_name} ldapwhoami -x -H ldap://localhost -D \"cn=${local.user_name},${local.domain_dn}\" -w ${local.user_password}; do sleep 2; done'"
+  ]
+}
+
+resource "enos_local_exec" "wait_for_group_entry" {
+  depends_on = [
+    enos_local_exec.create_ldap_group,
+  ]
+
+  inline = [
+    # Verify that the group is discoverable
+    "timeout 20s bash -c 'until docker exec ${var.container_name} ldapsearch -x -H ldap://localhost -D \"${local.admin_dn}\" -w ${local.admin_password} -b \"${local.domain_dn}\" \"(cn=${local.group_name})\" | grep \"numEntries: 1\"; do sleep 2; done'"
+  ]
+}
+
 output "address" {
   value = "ldap://${var.container_name}"
 }
diff --git a/testing/internal/e2e/tests/base_with_vault/credential_library_vault_ldap_test.go b/testing/internal/e2e/tests/base_with_vault/credential_library_vault_ldap_test.go
index 93b838ad6..16e1d984c 100644
--- a/testing/internal/e2e/tests/base_with_vault/credential_library_vault_ldap_test.go
+++ b/testing/internal/e2e/tests/base_with_vault/credential_library_vault_ldap_test.go
@@ -86,10 +86,12 @@ func TestApiVaultLdapCredentialLibrary(t *testing.T) {
 		)
 		require.NoError(t, output.Err, string(output.Stderr))
 
-		output = e2e.RunCommand(ctx, "vault",
-			e2e.WithArgs("policy", "delete", ldapPolicyName),
-		)
-		require.NoError(t, output.Err, string(output.Stderr))
+		if ldapPolicyName != "" {
+			output = e2e.RunCommand(ctx, "vault",
+				e2e.WithArgs("policy", "delete", ldapPolicyName),
+			)
+			require.NoError(t, output.Err, string(output.Stderr))
+		}
 	})
 	require.NoError(t, err)