Overview

ldap_gssapi_bind_timeout_sasl_deadlock.js (added in SERVER-137322) can pass without exercising the timed-out GSSAPI LDAP bind it is meant to test. Its fake KDC helper can also exit early, which leads to the same false pass.

Background

These issues were raised by automated review on the v9.0 backport PR [#65133|https://github.com/10gen/mongo/pull/65133].

The test only asserts that the client shell exits with code 0, which means db.auth() returned false. db.auth() catches exceptions and returns false, so a client-side GSSAPI failure that never reaches mongod's blocked LDAP bind also passes. The unit tests in ldap_runner_impl_test.cpp catch a reintroduced disconnect() on the failed-bind path. The jstest is the only end-to-end coverage for other regressions that bring back the deadlock.
jstests/external_auth/lib/unresponsive_kdc.py does not handle exceptions from recv() or accept(). A ConnectionResetError or ECONNABORTED ends the process and closes every listener. Later krb5 requests then fail immediately instead of blocking, and the test passes without testing the timeout path.

Scope of Work

* src/mongo/db/modules/enterprise/jstests/external_auth/ldap_gssapi_bind_timeout_sasl_deadlock.js — before accepting the client result, assert that the fake KDC accepted a connection ("Unresponsive KDC accepted connection" in program output) and that mongod logged an LDAP bind retry after a NetworkTimeout.
* src/mongo/db/modules/enterprise/jstests/external_auth/lib/unresponsive_kdc.py — handle OSError per socket in the serve loop (unregister and close the socket, keep serving).

Acceptance Criteria

* The test fails if the GSSAPI bind never blocks on the KDC or never times out.
* The fake KDC survives client connection resets and aborts.