Overview

Add LDAP tests that cover failure modes in pooled LDAP bind handling that the existing tests can't reach. The bind-timeout fix in SERVER-137322 and the pooled bind-identity fix it corrected are currently verified mainly by reading the code.

Background

• The existing bind-timeout tests use the ldapBindTimeoutHangIndefinitely and ldapBindDelay failpoints. Both pause in OpenLDAPConnection::bindAsUser before libldap is called, so no network bind is in flight when the timeout fires. That is why the deadlock in SERVER-137322 was not caught.
• ldap_gssapi_bind_timeout_sasl_deadlock.js needs a Kerberos KDC and skips Windows. Nothing tests a simple bind that is timed out while blocked on the network.
• The unit tests in ldap_runner_impl_test.cpp replace the connection factory with a mock. They don't exercise executor::ConnectionPool, so nothing directly verifies that a connection whose bind failed is discarded and never reused.
• When there is no ldapQueryUser, a pooled connection still bound as a user gets an explicit anonymous simple bind before its next query. A server that allows anonymous searches but rejects anonymous binds (for example OpenLDAP with disallow bind_anon) fails that bind with OperationFailed, which isn't retried. This path is untested, and whether the failure only happens on connections that previously served a login depends on pool state.
• When ldapQueryPassword has several passwords, LDAPRunnerImpl::getConnectionWithOptions tries the next password on the same connection after any failure, including a timeout, while the timed-out bind may still be in flight on that connection.

Scope of Work

Integration tests

• Simple-bind version of ldap_gssapi_bind_timeout_sasl_deadlock.js: start ldapmockserver.py with --delay longer than ldapTimeoutMS, enable pooling, and check that the timed-out bind doesn't block other authentications or crash mongod. This runs on all platforms, including Windows.
• Pool discard test: with ldapConnectionPoolMaximumConnectionsPerHost=1, cause a bind to time out or fail, then check with connectionsCreated in serverStatus and the bind DNs logged by the mock server that the next operation uses a new connection. The timed-out bind keeps its socket open until the delayed response arrives, so don't assert on the mock server's TCP connection count.
• Add an option to ldapmockserver.py that rejects anonymous simple binds while still allowing anonymous searches. Use it to test PLAIN login followed by authorization with no ldapQueryUser, and record the intended behavior.
• Optional: run the anonymous-bind case against a containerized OpenLDAP server configured with disallow bind_anon, possibly using jstests/external_auth/lib/ldap_container.py.
• Optional, low priority: a SASL DIGEST-MD5 login followed by an anonymous simple rebind on the same pooled connection.

Unit tests (ldap_runner_impl_test.cpp)

• Several passwords configured: a timeout on the first password moves to a new connection for the next password, and a credentials failure keeps using the same connection. This needs a code change: today a timeout keeps using the same connection.
• First password times out and the second succeeds on a new connection.
• The anonymous rebind times out and is retried.
• The anonymous rebind is rejected with a non-retryable error: the operation fails and the connection is discarded.
• checkLiveness on a connection still bound as a user goes through the anonymous rebind.

Design decision

Decide whether to keep the anonymous rebind of user-bound pooled connections or to discard those connections instead, given servers that reject anonymous binds. Document the choice in this ticket.

Acceptance Criteria

• The simple-bind delay test and the pool discard test are committed and pass on Linux and Windows variants.
• The password retry loop uses a new connection after a timeout, and the unit tests above cover it.
• The anonymous-bind rejection behavior is tested and its intended behavior is documented.