Fix TestExternalOIDCWithKeycloak timeout and add validation checks

- Increase OAuth validation timeout from 5min to 10min
- Add authentication type verification before validation
- Add post-update verification to detect config resets
- Add progress logging during validation
- Enhance debugging for authentication type changes

Must-gather analysis showed OAuth cleanup was in progress but
didn't complete within the original 5-minute timeout. The operator
was actively deleting OAuth resources when the test timed out.

Additional validation checks detect if spec.type is unexpectedly
reset during reconciliation, providing actionable error messages
instead of generic timeout failures.

Author: Rohit Patil

test/e2e-oidc/external_oidc.go

@@ -154,6 +154,13 @@ func testExternalOIDCWithKeycloak(ctx context.Context, t testing.TB) {
 	}
 
 	// Test 4: Validate OAuth state after OIDC configuration
+	// First, verify the authentication resource still has the OIDC configuration
+	currentAuth := testClient.getAuth(t, testCtx)
+	require.Equal(t, testSpec.Type, currentAuth.Spec.Type,
+		"authentication type changed after KAS rollout - expected %q, got %q (possible controller reset)",
+		testSpec.Type, currentAuth.Spec.Type)
+	t.Logf("Confirmed authentication type is still %q before OAuth state validation", currentAuth.Spec.Type)
+
 	testClient.validateOAuthState(t, testCtx, false, newExternalOIDCArchitectureEnabled)
 	t.Logf("OAuth state validation passed")
 
@@ -413,13 +420,31 @@ func (tc *testClient) updateAuthResource(t testing.TB, ctx context.Context, base
 	spec := baseSpec.DeepCopy()
 	updateAuthSpec(spec)
 
+	// Log the authentication type change for debugging
+	t.Logf("Updating authentication resource: type %q -> %q", auth.Spec.Type, spec.Type)
+	if len(spec.OIDCProviders) > 0 {
+		t.Logf("  OIDC providers: %d", len(spec.OIDCProviders))
+	}
+	if spec.WebhookTokenAuthenticator != nil {
+		t.Logf("  Webhook authenticator: %s", spec.WebhookTokenAuthenticator.KubeConfig.Name)
+	}
+
 	auth.Spec = *spec
 	auth, err := tc.configClient.ConfigV1().Authentications().Update(ctx, auth, metav1.UpdateOptions{})
 	if err != nil {
 		return nil, err
 	}
 
-	require.True(t, equality.Semantic.DeepEqual(auth.Spec, *spec))
+	require.True(t, equality.Semantic.DeepEqual(auth.Spec, *spec),
+		"authentication spec mismatch after update - expected type=%q, got type=%q",
+		spec.Type, auth.Spec.Type)
+
+	// Verify the update persisted by reading it back
+	updatedAuth := tc.getAuth(t, ctx)
+	require.Equal(t, spec.Type, updatedAuth.Spec.Type,
+		"authentication type changed after update - expected %q, got %q (possible webhook or controller reset)",
+		spec.Type, updatedAuth.Spec.Type)
+	t.Logf("Confirmed authentication resource updated successfully with type=%q", updatedAuth.Spec.Type)
 
 	return auth, nil
 }
@@ -546,14 +571,37 @@ func (tc *testClient) validateOAuthState(t testing.TB, ctx context.Context, requ
 	dynamicClient, err := dynamic.NewForConfig(tc.kubeConfig)
 	require.NoError(t, err, "unexpected error while creating dynamic client")
 
+	// Verify the authentication resource has the expected type before validating OAuth state
+	auth := tc.getAuth(t, ctx)
+	if requireMissing {
+		// When OAuth resources should be missing, we expect type=OIDC (or webhook for new arch)
+		expectedType := configv1.AuthenticationTypeOIDC
+		if newExternalOIDCArchitectureEnabled && len(auth.Spec.WebhookTokenAuthenticators) > 0 {
+			expectedType = ""
+		}
+		actualType := auth.Spec.Type
+		if actualType != expectedType {
+			t.Logf("WARNING: Authentication type mismatch before validation - expected %q, got %q", expectedType, actualType)
+			t.Logf("Full authentication spec: %+v", auth.Spec)
+		}
+	}
+
 	var validationErrs []error
-	waitErr := wait.PollUntilContextTimeout(ctx, 30*time.Second, 5*time.Minute, false, func(_ context.Context) (bool, error) {
+	// Increased timeout from 5 minutes to 10 minutes to allow for slower OAuth resource cleanup
+	// See: https://issues.redhat.com/browse/OCPBUGS-XXXXX
+	waitErr := wait.PollUntilContextTimeout(ctx, 30*time.Second, 10*time.Minute, false, func(_ context.Context) (bool, error) {
 		validationErrs = make([]error, 0)
 		validationErrs = append(validationErrs, validateOAuthResources(ctx, dynamicClient, requireMissing, newExternalOIDCArchitectureEnabled)...)
 		validationErrs = append(validationErrs, validateOAuthRoutes(ctx, tc.routeClient, tc.configClient, requireMissing)...)
 		validationErrs = append(validationErrs, validateOAuthControllerConditions(tc.operatorClient, requireMissing, newExternalOIDCArchitectureEnabled)...)
 		validationErrs = append(validationErrs, validateOperandVersions(ctx, tc.configClient, requireMissing, newExternalOIDCArchitectureEnabled)...)
 		validationErrs = append(validationErrs, validateOAuthRelatedObjects(ctx, tc.configClient, requireMissing)...)
+
+		// Log progress every iteration to help debug timeout issues
+		if len(validationErrs) > 0 {
+			t.Logf("OAuth state validation in progress, %d validation errors remaining", len(validationErrs))
+		}
+
 		return len(validationErrs) == 0, nil
 	})