/workspace/source/test/e2e/tests/test_subscription.py:1040: gateway-only mode: per-model AuthPolicy is not created/workspace/source/test/e2e/tests/test_tenant.py:127: Tenant not Active (e.g. Degraded); payload-processing not asserted/workspace/source/test/e2e/tests/test_external_oidc.py:426: OIDC_USERNAME_NO_ACCESS and OIDC_PASSWORD_NO_ACCESS not configuredself = <test_external_oidc.TestOIDCMultiTenant object at 0x7ffbd64955b0> maas_api_base_url = 'https://maas.apps.fb1fb2b1-e37d-43bb-a447-4e1b046d7a89.prod.konfluxeaas.com/maas-api' def test_tenant_b_token_rejected_by_maas(self, maas_api_base_url: str): """Token from tenant-b realm should be rejected since MaaS trusts tenant-a only. MaaS is deployed with OIDC_ISSUER_URL pointing at tenant-a. A token from tenant-b has a different issuer claim and should fail Authorino's OIDC verification. """ tenant_b_url = _tenant_b_token_url() # Get a valid token from tenant-b tenant_b_token = _request_oidc_token( username="charlie_sec_lead", password="letmein", token_url=tenant_b_url, client_id="test-client", ) # Try to use the tenant-b token against MaaS (configured for tenant-a) response = requests.post( f"{maas_api_base_url}/v1/api-keys", headers={"Authorization": f"Bearer {tenant_b_token}", "Content-Type": "application/json"}, json={"name": f"e2e-oidc-tenant-b-{uuid.uuid4().hex[:8]}"}, timeout=30, verify=TLS_VERIFY, ) > assert response.status_code == 401, ( f"Expected 401 for tenant-b token (untrusted issuer), " f"got {response.status_code}: {response.text}" ) E AssertionError: Expected 401 for tenant-b token (untrusted issuer), got 500: Internal Server Error. E E assert 500 == 401 E + where 500 = <Response [500]>.status_code test/e2e/tests/test_external_oidc.py:509: AssertionError