[fjlopez]

Why

AuthenticationControllerLdapEnabledTest started and stopped the in-memory LDAP directory before every test. roleLookupDataAccessFailureReturnsUnauthorized accepted HTTP 401 and no cookie even when LdapUserAuthoritiesPopulator never ran, because a bcrypt rejection of password12 produces the same result.

What changed

The directory now starts once for the class. The role-lookup case still returns HTTP 401 and no cookie, and the test fails unless that rejection happens inside LdapUserAuthoritiesPopulator. Successful internal / password12 login is unchanged and still depends on the LDAP bind. The other LDAP login cases stay in place.

Scope

Test-only change in AuthenticationControllerLdapEnabledTest, plus the [Unreleased] changelog note for #319.

Blast Radius

LDAP authentication behavior is unchanged. This class binds port 8389 once instead of once per test. AuthenticationControllerLdapMailTest is unchanged.

Verification

Focused AuthenticationControllerLdapEnabledTest and AuthenticationControllerLdapMailTest passed on Java 17. The pre-commit hook ran spotlessCheck, the full test suite, and jacocoTestReport.

Fixes #319