Skip to content

Ensure oidc-rs-junit-tenant Port Reservation handles parallel test-runs - #97

Open
LudBjork wants to merge 7 commits into
entur:mainfrom
LudBjork:main
Open

Ensure oidc-rs-junit-tenant Port Reservation handles parallel test-runs#97
LudBjork wants to merge 7 commits into
entur:mainfrom
LudBjork:main

Conversation

@LudBjork

Copy link
Copy Markdown

💡 What does this PR do?

This pull request aims to ensure mock server ports from WireMockAuthenticationServer do not collide when running parallelll JVM threads for Spring Boot tests.

Rids users of oidc-rs-junit-tenant having to use workarounds such as this in order to use the lib while having parallell tests running.

🔧 List of changes

  • Added PortReservationTest.java – verifies ports are distinct and don't collide. Test-case restartReservesNewPortWhenPreviousPortIsStolen is specifically to highlight bug is fixed.
  • Added TenantAnnotationTokenFactoryPortRaceTest.java — verifies that stolen port doesn't get overriden by new port reservation.
  • Added a SecureRandom number generator to PortReservation — ensures non-collision with other threads spinning up a mocked oidc resource server.
  • TenantAnnotationTokenFactory has 5 attempts at trying to reserve a port before giving up. Otherwise should reserve port via. the new RNG.

📋 Checklist

  • Am familiar with the release pipeline for this project
  • I have updated relevant developer documentation
  • I have updated relevant user documentation
  • I have added relevant tests for the new changes
  • I have verified that the project runs as expected after the new changes

LudBjork added 5 commits June 10, 2026 15:14
Seed the scan with a per-JVM SecureRandom,
advance through the range, and skip occupied ports immediately.

A port this instance picked itself is now tracked, so when another
process steals it the reservation rescans (new rescan() method) instead
of failing every subsequent start with "Preconfigured port is not
free". Externally pinned ports still fail fast. reserved() also closes
any socket a concurrent caller reserved while a thread waited, and
start() is a no-op while a reservation is already held.
…ails

Rescan for port using SafeRandom from PortReservation, ensuring that
parallell JVMs don't collide
… stolen

Ensure collision of ports don't happen
…stolen

Regression test for the upstream oidc-lib bug where re-running start()
after the previously scanned port was stolen throws IllegalArgumentException
("Preconfigured port ... is not free") and pins the dead port forever.
The ownPort distinction added when making port reservation robust for
parallel test JVMs makes start() abandon the stolen port and reserve a
fresh one instead; this test fails on upstream and passes on this fork.
@LudBjork
LudBjork requested a review from a team as a code owner June 12, 2026 09:51
@skjolber

Copy link
Copy Markdown

Checklist:

  • The spring test context is injected with the same port as the mock server which is bootstrapped by its junit extension
    • also for reused spring test contexts
  • There is no race condition on how the port is communicated from extension to spring test context

LudBjork added 2 commits June 16, 2026 12:00
…oads the context

The extension reserved the port in its constructor but only started WireMock
in beforeAll, which runs after SpringExtension has already loaded the context
and resolved the JWKS URLs. If the reserved port was stolen in the bind window,
startServer() rescanned to a fresh port, leaving the Spring context wired to the
old port while WireMock listened on the new one.

Start the WireMock server during extension construction instead, so the final
port is published to the MOCKAUTHSERVER_PORT system property before the context
loads. This keeps reused contexts wired to the port the server actually listens
on, even when the port has to be retried.
…contexts)

Add a Spring integration test asserting the published MOCKAUTHSERVER_PORT equals
the live WireMock server port and that an authenticated request succeeds, plus a
second class with identical configuration so a reused (cached) context is checked
for port consistency. Add a DefaultAuthProviders unit test that locks the
property->JWKS-URL resolution channel and confirms it tracks the port live.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants