adjust test code to allow for using Okta LDAP in integration tests

- Okta LDAP requires using a different groups search filter.
- It also does not support posix groups, so make that expected
  value optional.

test/integration/audit_test.go

@@ -8,6 +8,7 @@ import (
 	"context"
 	"encoding/base64"
 	"encoding/json"
+	"fmt"
 	"io"
 	"net/http"
 	"os"
@@ -172,7 +173,7 @@ func TestAuditLogsDuringLogin_Disruptive(t *testing.T) {
 			"message": "Session Started",
 			"personalInfo": map[string]any{
 				"username":         "redacted",
-				"groups":           []any{"redacted 2 values"},
+				"groups":           []any{fmt.Sprintf("redacted %d values", len(expectedGroups))},
 				"subject":          "redacted",
 				"additionalClaims": map[string]any{"redacted": "redacted 0 keys"},
 			},
@@ -208,7 +209,7 @@ func TestAuditLogsDuringLogin_Disruptive(t *testing.T) {
 			},
 			"personalInfo": map[string]any{
 				"username": "redacted",
-				"groups":   []any{"redacted 2 values"},
+				"groups":   []any{fmt.Sprintf("redacted %d values", len(expectedGroups))},
 				"extras":   map[string]any{"redacted": "redacted 1 keys"},
 			},
 		},

test/integration/e2e_test.go

@@ -2010,7 +2010,7 @@ func setupClusterForEndToEndLDAPTest(t *testing.T, username string, env *testlib
 		},
 		GroupSearch: idpv1alpha1.LDAPIdentityProviderGroupSearch{
 			Base:   env.SupervisorUpstreamLDAP.GroupSearchBase,
-			Filter: "", // use the default value of "member={}"
+			Filter: env.SupervisorUpstreamLDAP.GroupSearchFilter, // if empty, uses the default value of "member={}"
 			Attributes: idpv1alpha1.LDAPIdentityProviderGroupSearchAttributes{
 				GroupName: "", // use the default value of "dn"
 			},

test/integration/supervisor_discovery_test.go

@@ -952,7 +952,7 @@ func requireIDPsListedByIDPDiscoveryEndpoint(
 		},
 		GroupSearch: idpv1alpha1.LDAPIdentityProviderGroupSearch{
 			Base:   env.SupervisorUpstreamLDAP.GroupSearchBase,
-			Filter: "", // use the default value of "member={}"
+			Filter: env.SupervisorUpstreamLDAP.GroupSearchFilter, // if empty, uses the default value of "member={}"
 			Attributes: idpv1alpha1.LDAPIdentityProviderGroupSearchAttributes{
 				GroupName: "", // use the default value of "dn"
 			},

test/integration/supervisor_ldap_idp_test.go

@@ -1,4 +1,4 @@
-// Copyright 2024 the Pinniped contributors. All Rights Reserved.
+// Copyright 2024-2025 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package integration
@@ -63,7 +63,7 @@ func TestLDAPIDPPhaseAndConditions_Parallel(t *testing.T) {
 		},
 		GroupSearch: idpv1alpha1.LDAPIdentityProviderGroupSearch{
 			Base:   env.SupervisorUpstreamLDAP.GroupSearchBase,
-			Filter: "", // use the default value of "member={}"
+			Filter: env.SupervisorUpstreamLDAP.GroupSearchFilter, // if empty, uses the default value of "member={}"
 			Attributes: idpv1alpha1.LDAPIdentityProviderGroupSearchAttributes{
 				GroupName: "", // use the default value of "dn"
 			},

test/integration/supervisor_login_test.go

@@ -277,7 +277,7 @@ func TestSupervisorLogin_Browser(t *testing.T) {
 			},
 			GroupSearch: idpv1alpha1.LDAPIdentityProviderGroupSearch{
 				Base:                   env.SupervisorUpstreamLDAP.GroupSearchBase,
-				Filter:                 "",
+				Filter:                 env.SupervisorUpstreamLDAP.GroupSearchFilter, // if empty, uses the default value of "member={}"
 				UserAttributeForFilter: "",
 				Attributes: idpv1alpha1.LDAPIdentityProviderGroupSearchAttributes{
 					GroupName: "dn",