fix(tests): allow real DNS passthrough for external IdP integration tests - #6797
Open
jonpspri wants to merge 1 commit into
Open
fix(tests): allow real DNS passthrough for external IdP integration tests#6797jonpspri wants to merge 1 commit into
jonpspri wants to merge 1 commit into
Conversation
…ests The session-scoped _deterministic_dns stub in tests/conftest.py resolves every non-localhost hostname to a hardcoded example.com address, which blackholes all Microsoft Graph / Entra ID egress from the in-process integration suite (tests/integration/test_entra_id_integration.py): every network-dependent test fails with httpx.ConnectTimeout, so the suite cannot pass under tests/ as shipped. - Add opt-in TESTS_DNS_PASSTHROUGH_HOSTS: comma-separated hosts resolved via real DNS while the stub stays active. Hermetic default unchanged. - Normalize IDNA-encoded bytes hostnames before matching: httpx/anyio resolve through anyio.getaddrinfo, which encodes hostnames to bytes; the previous string-only comparison never matched passthrough (or localhost) entries on that path. - Document TESTS_DNS_PASSTHROUGH_HOSTS and the required --with-integration flag in docs/docs/testing/entra-id-e2e.md. Verified with a live tenant: the Entra ID E2E suite passes 15/15 with the variables set; without them, DNS remains stubbed and the suite self-skips as before. Signed-off-by: Jonathan Springer <jps@s390x.com>
jonpspri
requested review from
Lang-Akshay,
brian-hussey,
crivetimihai,
ja8zyjits and
msureshkumar88
as code owners
September 12, 2026 08:49
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
tests/conftest.pyinstalls a session-scoped autouse_deterministic_dnsfixture that resolves every non-localhost hostname to a hardcoded example.com address (93.184.215.14). Any test that makes a real HTTPS call to an external IdP from undertests/therefore connects to a black-holed IP and fails withhttpx.ConnectTimeout.This makes the Entra ID E2E suite (
tests/integration/test_entra_id_integration.py) unrunnable as shipped: with Azure credentials configured, 11 of 15 tests error in fixture setup (Graph API + ROPC egress) and only the purely local claim-forgery tests pass.Fix
TESTS_DNS_PASSTHROUGH_HOSTS— opt-in, comma-separated hostnames resolved via real DNS while the stub stays active for everything else. The hermetic default is unchanged (verified: without the variable, external names still resolve to the stub address).anyio.getaddrinfo, which IDNA-encodes hostnames tobytesbefore callingsocket.getaddrinfo. The previous string-only comparison never matched on that path, so even a correctly configured passthrough (orlocalhost) entry was ignored for httpx traffic. The stub now decodesbytes/bytearrayhosts before matching.docs/docs/testing/entra-id-e2e.mdgains the new variable in its environment reference and export example, plus the--with-integrationflag that the run command was missing (the suite silently skips without it).Verification
Against a live Entra tenant with
User.ReadWrite.All/Group.ReadWrite.Allapplication permissions:Without
TESTS_DNS_PASSTHROUGH_HOSTS, resolution stays stubbed and the suite behaves exactly as before this change..secrets.baselinecarries only line-number drift (390→395,391→396) from the conftest insertion, regenerated by the pre-commit hook.This PR is deliberately not part of the JWT-trust stack; the stack will be rebased onto this branch so the trust-mode work inherits a runnable Entra E2E baseline.