fix(mock-idp): provision the test user so Workbench SSO can resolve it

[ian-flores]

Closes #600

What

Provisions the mock-IdP realm's test user as a local Unix account in the Workbench container, from entrypoint-oidc.sh.

Why

Workbench SSO never completed in this stack. Keycloak authenticates the realm user fine, but rserver still has to map the returned username to an OS account, and no Workbench container here ever had one — so it refused the sign-in and the pre-test auth round-trip timed out on every leg of every run, including on main (32103933643).

docker/workbench/startup.sh is the only thing that creates the account, and it is mounted solely for compose.yml's password-auth stack. These images override ENTRYPOINT and run bare supervisord, so a cont-init.d mount would not fire on them regardless. Calling the same script from the entrypoint keeps one source of truth for the useradd logic and the VIP_TEST_USERNAME/VIP_TEST_PASSWORD contract.

Verified

Run 32172732884 on this branch, all three Workbench legs:

Signal	Before	After
>>> Workbench authenticated.	0	3
Warning: Workbench authentication did not complete	every leg	0
Workbench container	timed out	healthy

Local checks cannot reach this: bash -n, docker compose config -q and the selftests (1620 pass) do not see inside the image, which is where the risk lives. The first dispatch (32169996431) proved that — it created the user but installed the script over the image's own /usr/local/bin/startup.sh, which its supervisord rstudio-workbench program runs to create the rstudio user and exec rserver, so rserver went FATAL and the container exited. The script is therefore installed as vip-create-test-user.sh; do not rename it to startup.sh.

What this does not fix

test_workbench_login still skips, and this PR does not change that. It skips for an unrelated, by-design reason — src/vip_tests/workbench/test_auth.py:90 skips whenever the provider is not password — so the reason is identical before and after this change. Tracked in #602. The Workbench half of mock-idp-e2e therefore still verifies no login, even though SSO now works.

Notes

useradd -m can exit non-zero when the home directory already exists, which happens on a container recreate against a warm /home volume — /etc/passwd lives in the image layer, so the script's own id check misses. The entrypoint tolerates that exit code and then asserts the user exists, so a genuine provisioning failure stops the container rather than resurfacing later as an unexplained sign-in rejection.

Also corrects docker/connect/Dockerfile.oidc's claim that Workbench uses s6-overlay; container logs show bare supervisord.

Related

#596 — vip verify exits 0 when a configured product's tests all skip, which is what kept this invisible. #595 carries the same provisioning fix for the SAML lane and will need a small rebase in compose.mock-idp.yml once this merges.

[Copilot]

Pull request overview

This PR fixes the mock-IdP E2E Workbench OIDC lane by ensuring the realm’s test user (vip_test) exists as a local Unix account inside the Workbench container, so rserver can resolve the SSO-authenticated username to an OS user (instead of timing out and skipping all Workbench tests).

Changes:

• Call the existing Workbench user-provisioning logic during OIDC container startup (entrypoint-oidc.sh) and hard-fail if the user still doesn’t exist.
• Install the provisioning script under a non-conflicting name (vip-create-test-user.sh) in the Workbench OIDC image.
• Document and wire VIP_TEST_USERNAME / VIP_TEST_PASSWORD into the mock-idp compose stack; update Connect OIDC Dockerfile commentary for correctness.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
docker/workbench/entrypoint-oidc.sh	Provisions the realm test user as a local Unix account before starting supervisord/rserver.
docker/workbench/Dockerfile.oidc	Copies startup.sh into the image as vip-create-test-user.sh to avoid clobbering the base image’s startup.sh.
docker/connect/Dockerfile.oidc	Updates comments to reflect that Workbench does not use s6-overlay/cont-init.d in this stack.
compose.mock-idp.yml	Documents the OS-user requirement and passes VIP_TEST_USERNAME / VIP_TEST_PASSWORD into the Workbench service.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.