Replace the LAM_OAUTH2_FRONTED skip predicate with a branched login
flow: when LAM is fronted by oauth2-proxy/Keycloak, click through the
Keycloak login form with the administrator credentials (already in
LAM's allowed_groups via meta/services.yml), then fall back to LAM's
own admin form only if it still appears post-SSO. Native path
(LAM_OAUTH2_FRONTED=false, lam-public profile with LDAP-bind auth) is
unchanged.
Move adminUsername/adminPassword from _shared.js module scope into
shared.env so the LAM verifier can read them (previously single-
consumer to beforeEach, now multi-consumer).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Mirror the nextcloud playwright layout: orchestrator + _shared.js for
multi-consumer logic, one test-*.js per scenario (baseline, ldap-variant,
profile-readonly, keycloak-scope, lam-writethrough, administrator-persona,
guest-persona). Extract the duplicated Account REST middleName-write
into setMiddleNameViaAccountRest in _shared.js, parametrized by
withRestore so keycloak-scope drives the round-trip+restore path and
lam-writethrough drives the write-only path.
Add LAM_OAUTH2_FRONTED to playwright.env.j2 and gate the LAM UI verifier
on it. With web-app-keycloak deployed, LAM is fronted by oauth2-proxy,
its native /templates/login.php is replaced by the Keycloak login page,
and the LDAP-bind admin password is unusable. The Keycloak-side write
is still verified end-to-end by keycloak-scope's main test.
Net diff -20 lines vs. the original monolith despite the new helper.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
kevinveenbirkenbach
