LDAP login tests restart the directory and can pass without a bind #319

What is wrong

AuthenticationControllerLdapEnabledTest starts and stops an in-memory UnboundID server in @BeforeEach and @AfterEach (setupLdapServer, lines 56 to 64). The class method time on the 2026-10-21 H2 run was 1.263s for four tests, plus a 2.19s context gap from Profiles.LDAP.

password12 matches the {SSHA} entry for internal in test-server.ldif. It does not match the $2y$10$ hash stored for internal in STM_USER.csv. successfulLdapLogin returns 200 only after that bind.

roleLookupDataAccessFailureReturnsUnauthorized throws only when the stack contains LdapUserAuthoritiesPopulator. If the bind never runs, bcrypt rejects password12 and the test still sees 401 and no cookie. The test stays green without proving the LDAP role lookup.

admin / admin matches the database hash and is absent from the LDIF, so the LDAP-failure case still returns 200 if nothing is listening. nositmunuser is absent from STM_USER, so 401 does not require a bind either.

Why this is not a one-line edit

The listener should start once for the class. The role-lookup test has to fail when LdapUserAuthoritiesPopulator never runs. That changes which status is accepted as proof. management.health.ldap.enabled in application-ldap.yml also searches LDAP when the context starts. That cost is separate from these method bodies.

Done when

One directory serves the class. The successful internal / password12 login still requires the bind. The role-lookup test fails if that populator does not run.