It seems that credentialDelegationTest() maybe does not work with any other server besides Apache DS and that is likely the reason of the original assumeTrue assumption? Updating this assumption might possibly make the test failing in pipeline with servers like MSAD or others (as previously, it was not tested with MSAD and others, but now it would be tested)... If the assertion is updated this way, it would be needed to have this PR approved also from some members of QA team, who confirms that it does work in the pipeline for real LDAP servers like MSAD.

Additional suggestion: Is it possible to keep this test even for embedded Apache DS, but just remove the invocation of invokeLdap ? That LDAP invocation is probably the most problematic for credential delegation, however I hope that rest of the functionality still works with embedded ApacheDS (especially serializing of the credential, adding it to the token and deserializing credential into GssCredential) and it would be nice if we still test it. So maybe in that case, the relevant lines can be updated to something like:

-    String ldapResponse = invokeLdap(gssCredential, token.getPreferredUsername());
-    Assertions.assertEquals("Horatio Nelson", ldapResponse);  
+ if (getKerberosRule().isStartEmbeddedLdapServer()) {
+     // Not calling LDAP as credential delegation does not work with embedded Apache DS, but just checking + gssCredential
+     Assert.assertEquals("hnelson@KEYCLOAK.ORG", gssCredential.getName().toString());
+ } else {
+     // Proper LDAP invocation with Kerberos credential for other servers (this assumes that credential delegation works for other servers besides Apache DS
+     String ldapResponse = invokeLdap(gssCredential, token.getPreferredUsername());
+     Assertions.assertEquals("Horatio Nelson", ldapResponse);    
+ }

I am not sure if "else" branch works as no idea if credential delegation works for other servers (like MSAD or others, which we test in pipeline). This would need to be confirmed.

True observation but this condition is pre-existing. The invokeLdap method was never designed for external providers. When the internal MSAD pipeline runs the credential delegation test, it would need the LDAP URL/DN adapted. But this isn't something we introduced, it was already the case before our change.