Add LDAP Test Suite

[runleveldev]

Integrate the OpenLDAP test suite for protocol compliance and interoperability testing.

Relevant integration details:

• Gather the OpenLDAP test scripts (core CRUD, schema, access control, search, modify, delete, password modify, basic overlays)
• Review and classify tests to identify required features and gaps
• Implement or adapt server features to pass core CRUD, schema, and functional tests
• Exclude out-of-scope test cases (such as slapadd and other features not targeted for this server)
• Update documentation to specify supported test coverage and exceptions

Initial deliverable: Run the OpenLDAP test suite harness against the server, report coverage, address failures except for excluded tests (e.g., slapadd).

This will enable protocol verification and improve interoperability, focusing on core LDAP operations relevant to this server.

[runleveldev]

Link to the openldap test scripts

https://git.openldap.org/openldap/openldap/-/tree/master/tests/scripts?ref_type=heads

[runleveldev]

This may be better implemented by a different, but still opensource, test suite such as https://ldap3.readthedocs.io/en/latest/testing.html

[runleveldev]

The ldap3 suite still requires in-band LDAP update/modification support for even search/bind tests. Since this server only intends to support search and bind operations, we may have to implement our own suite.

[runleveldev]

Minimum acceptance requirements:

1. For each directory backend:
   a. (objectClass=*) all object filter
   b. (objectClass=posixAccount) all users filter
   c. (objectClass=posixGroup) all group filter
   d. (uid=username) specific user
   e. (cn=groupname) specific group
   f. (cn=*) all groups filter
2. For each authentication backend:
   a. Bind w/ incorrect password fails
   b. Bind w/ correct password succeeds
   c. For notification provider, any password would succeed but only if push server responds positive
3. When REQUIRE_AUTH_FOR_SEARCH
   a. Is true
   a. Authenticated search succeeds
   b. Unauthenticated search fails
   b. Is false: all searches succeed
4. When TLS_MIN_VERSION=TLSv1.3, no TLSv1.2 connections are accepted
5. When TLS_CIPHERS is set, only those ciphers are accepted
6. npm run tests runs all the tests and shows the PASS or FAIL output
7. Integration testing w/ SSSD
   a. Make sure logins work w/ password
   b. Make sure user and group IDs are expected
   c. Make sure username and group names are all available
   d. example idea below

docker compose up -d
sshpass -ppassword ssh -l user localhost:2222 <<EOF
groups
id
whoami
getent passwd
EOF

8. Run the npm run tests in GH Action ci.yml, add PR rule to require tests to pass before merge