e2e-tests: Add tests for the entra_password flow

[nooreldeenmansour]

Important

This is a draft PR based on #1520, it will eventually be merged into it

These are new end-to-end tests that verify the new entra_password flow. Two new tests are intended to be added:

• A test that validates the enrollment path (register_device=true)

  • Local password caching by executing a sudo command)

• A test that validates the non-enrollment path (register_device=false and client_secret configuration)

UDENG-10836

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.29%. Comparing base (469f980) to head (0c060a5).

Additional details and impacted files

@@                       Coverage Diff                       @@
##           002-entra-password-mfa-auth    #1633      +/-   ##
===============================================================
- Coverage                        87.54%   86.29%   -1.26%     
===============================================================
  Files                              124       25      -99     
  Lines                             8463     1612    -6851     
  Branches                           111        0     -111     
===============================================================
- Hits                              7409     1391    -6018     
+ Misses                             998      221     -777     
+ Partials                            56        0      -56     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[nooreldeenmansour]

Good news, the two new tests are passing.
Bad news, four tests failed on the three releases runs with this error from journalctl

Jun 26 14:54:47 ubuntu authd-msentraid[1714]: Failed to refresh token: oauth2: "invalid_client" "AADSTS700025: Client is public so neither 'client_assertion' nor 'client_secret' should be presented. Trace ID: 49050e15-78f3-4f02-9eb0-69385e690f00 Correlation ID: d3bb37fd-71af-4007-af45-60d4bd0c416f Timestamp: 2026-06-26 14:54:47Z"

So while this could point out to a broker/e2e-vm provisioning misconfiguration, it likely points out to a latent issue in #1520, I'll investigate this further and see if it could be reliably fixed

The failing tests are:

• ssh login
• password change
• login gdm
• authctl group set gid

Edit: Looking at libhimmelblau codebase, I see this line https://gitlab.com/samba-team/libhimmelblau/-/blob/248738549d4a26830950116f5747c7bc79c11088/src/aadsts_err_gen.rs#L188, likely the origin of the error.. but still investigating how to "prevent" this from happening

Edit: Tests are passing now, but the client_secret for Entra is currently scoped only to the test that needs it. Rather than a snapshot or provisioning.. Also, added a small commit to prevent the error from sending the client_secret for the Microsoft Broker App, which caused the earlier error. but further investigation is required into this. Will look into the test runs for this PR (because the commit only wasn't sufficient to fix this... and this error only happened in this PR, when client_secret was introduced in the e2e provisioning...) and update my comment with findings

Edit: The root cause was that cfg.clientSecret was flowing into OIDC token requests unconditionally, including for flows that authenticate via the Microsoft Broker App (always a public client). Baking it into the provisioning snapshot made every test hit AADSTS700025 on token refresh, latent in #1520, first observable here. The fix has two parts: the secret is no longer provisioned into the snapshot and is injected at test-setup time only for the test that needs it, and the broker now suppresses it for Broker App flows at initialization (the Graph API path uses a separate client-credentials endpoint and is unaffected).

[adombeck]

Great work, just a few comments

[adombeck]

The "Login Entra Password" tests are failing in

https://authd-e2e-test-logs.adrian-dombeck.workers.dev/pr-1633/run-28371813849-1/noble-authd-google/log.html

and

https://authd-e2e-test-logs.adrian-dombeck.workers.dev/pr-1633/run-28371813849-1/resolute-authd-google/log.html#s1-s14

shouldn't they be skipped when using the google broker?