[BUG] main branch broken: ScimIntegrationTest fails 401 in full CI run

[pgermosen]

Service

IAM Identity Center (identitystore / SCIM)

AWS API Action

N/A — this is a CI/test-suite regression, not a wire-protocol bug against a real AWS API call.

Expected behavior

Build and Test (shard 3) passes on main.

Actual behavior

Every ScimIntegrationTest case that presents the configured bearer token (Bearer floci-scim-token, the default from floci.services.identitystore.scim-bearer-token) gets back 401 instead of the expected success status. 20-21 test methods fail identically, all with 1 expectation failed. Expected status code <2xx> but was <401>.

This is currently breaking main itself, not just a PR branch:

• Main's own CI run (no PR involved): https://github.com/floci-io/floci/actions/runs/34528774528/job/103044258009 — fails shard 3 the same way.
• Confirmed deterministic, not a transient flake: reran the identical job on an unrelated PR branch (feat(marketplace-reporting): emulate AWS Marketplace Reporting API #3343) twice; both reruns reproduced the same ~20-21 ScimIntegrationTest failures.

The regression window narrows to one commit: main's CI passed at commit 8624ccce8 (run https://github.com/floci-io/floci/actions/runs/34522178507) and failed at 19f410d6b (run https://github.com/floci-io/floci/actions/runs/34528774528). The only commit in between that touches identitystore/SCIM is cbfa03447 — feat(identity-center): complete IAM Identity Center emulation (#3331) — which is also the commit that added ScimIntegrationTest.java itself. So this looks like the new feature's own test suite failing under the full CI run, not a later unrelated PR breaking it.

Suspected root cause (not confirmed, worth checking first)

ScimController.requireBearer compares the presented token against scimBearerToken via MessageDigest.isEqual, which looks correct in isolation, and the config default (floci-scim-token) matches what the test sends. But resolveIdentityStore also requires ssoAdminService.hasIdentityStore(identityStoreId) to be true for the test's hardcoded tenant (9067f2a3c1-00000000-0000-0000-0000-000000000000 → d-9067f2a3c1), and returns the same 401 "Authorization header is invalid or tenant ID is incorrect" whether the token is wrong or the identity store isn't recognized. ScimIntegrationTest passes in isolation but not as part of the full suite, which points at shared/global identity-store-instance state (set up once, presumably at Quarkus startup or in a shared fixture) getting reset or never created when other IAM/SSO integration tests run earlier in the same JVM fork and reset shared state between tests.

Worth checking: whatever creates the default d-9067f2a3c1 identity store instance, and whether any @BeforeEach/Resettable.clear() path in an adjacent SSO/IAM test class wipes it before ScimIntegrationTest runs.

Reproduction

Run the full suite (not just ScimIntegrationTest in isolation) via the repo's own CI shard mechanism, or just push any branch and watch shard 3 fail. Isolated single-class runs of ScimIntegrationTest are expected to still pass, which is why this wasn't caught before merge.

Environment

• Branch: main (post feat(identity-center): complete IAM Identity Center emulation #3331 merge)
• Found while reviewing an unrelated PR (feat(marketplace-reporting): emulate AWS Marketplace Reporting API #3343) whose own CI failure on this same shard led to this investigation.