address comments

test/s3/iam/Makefile

@@ -221,8 +221,11 @@ docker-up: ## Start all services with Docker Compose (including Keycloak)
 	@echo "🐳 Starting services with Docker Compose including Keycloak..."
 	@docker compose up -d
 	@echo "⏳ Waiting for services to be healthy..."
-	@sleep 30
-	@echo "✅ Services should be ready"
+	@timeout 120 bash -c 'until curl -s http://localhost:8080/health/ready > /dev/null 2>&1; do sleep 2; done' || (echo "❌ Keycloak failed to become ready" && exit 1)
+	@timeout 60 bash -c 'until curl -s http://localhost:8333 > /dev/null 2>&1; do sleep 2; done' || (echo "❌ S3 API failed to become ready" && exit 1)
+	@timeout 60 bash -c 'until curl -s http://localhost:8888 > /dev/null 2>&1; do sleep 2; done' || (echo "❌ Filer failed to become ready" && exit 1)
+	@timeout 60 bash -c 'until curl -s http://localhost:9333 > /dev/null 2>&1; do sleep 2; done' || (echo "❌ Master failed to become ready" && exit 1)
+	@echo "✅ All services are healthy and ready"
 
 docker-down: ## Stop all Docker Compose services
 	@echo "🐳 Stopping Docker Compose services..."

test/s3/iam/docker-compose.yml

@@ -107,8 +107,6 @@ services:
       GLOG_v: "3"
     command: >
       sh -c "
-        echo 'Waiting for dependencies...' &&
-        sleep 10 &&
         echo 'Starting S3 API with IAM...' &&
         weed -v=3 s3 -ip=weed-s3 -port=8333 
           -filer=weed-filer:8888 

test/s3/iam/s3_iam_distributed_test.go

@@ -234,13 +234,13 @@ func TestS3IAMDistributedTests(t *testing.T) {
 		maxTotalErrorsRelaxed := 4 // Allow max 4 total errors (50% rate) - acceptable for resource-constrained CI
 
 		if len(errorList) > maxTotalErrorsRelaxed {
-			t.Errorf("❌ Too many total errors: %d (%.1f%%) - exceeds relaxed threshold of %d (%.1f%%). System is unstable under concurrent load.", 
+			t.Errorf("❌ Too many total errors: %d (%.1f%%) - exceeds relaxed threshold of %d (%.1f%%). System is unstable under concurrent load.",
 				len(errorList), errorRate*100, maxTotalErrorsRelaxed, float64(maxTotalErrorsRelaxed)/float64(totalOperations)*100)
 		} else if len(errorList) > maxTotalErrorsStrict {
-			t.Logf("⚠️  Concurrent operations completed with %d errors (%.1f%%) - within relaxed CI limits. Normal CI environment variability.", 
+			t.Logf("⚠️  Concurrent operations completed with %d errors (%.1f%%) - within relaxed CI limits. Normal CI environment variability.",
 				len(errorList), errorRate*100)
 		} else if len(errorList) > 0 {
-			t.Logf("✅ Concurrent operations completed with %d errors (%.1f%%) - good performance for CI environment!", 
+			t.Logf("✅ Concurrent operations completed with %d errors (%.1f%%) - good performance for CI environment!",
 				len(errorList), errorRate*100)
 		} else {
 			t.Logf("🎉 All %d concurrent operations completed successfully - excellent CI performance!", totalOperations)

test/s3/iam/s3_keycloak_integration_test.go

@@ -78,11 +78,8 @@ func TestKeycloakAuthentication(t *testing.T) {
 		parts := strings.Split(token, ".")
 		if len(parts) >= 2 {
 			payload := parts[1]
-			// Add padding if needed
-			for len(payload)%4 != 0 {
-				payload += "="
-			}
-			decoded, err := base64.StdEncoding.DecodeString(payload)
+			// JWTs use URL-safe base64 encoding without padding (RFC 4648 §5)
+			decoded, err := base64.RawURLEncoding.DecodeString(payload)
 			if err == nil {
 				var claims map[string]interface{}
 				if json.Unmarshal(decoded, &claims) == nil {
@@ -92,24 +89,24 @@ func TestKeycloakAuthentication(t *testing.T) {
 			}
 		}
 
-			// First test with direct HTTP request to verify OIDC authentication works
-	t.Logf("Testing with direct HTTP request...")
-	err = framework.TestKeycloakTokenDirectly(token)
-	require.NoError(t, err, "Direct HTTP test should succeed")
+		// First test with direct HTTP request to verify OIDC authentication works
+		t.Logf("Testing with direct HTTP request...")
+		err = framework.TestKeycloakTokenDirectly(token)
+		require.NoError(t, err, "Direct HTTP test should succeed")
 
-	// Create S3 client with Keycloak token
-	s3Client, err := framework.CreateS3ClientWithKeycloakToken(token)
-	require.NoError(t, err)
+		// Create S3 client with Keycloak token
+		s3Client, err := framework.CreateS3ClientWithKeycloakToken(token)
+		require.NoError(t, err)
 
-	// Test that read-only user can list buckets
-	t.Logf("Testing ListBuckets with AWS SDK...")
-	_, err = s3Client.ListBuckets(&s3.ListBucketsInput{})
-	assert.NoError(t, err, "Read-only user should be able to list buckets")
+		// Test that read-only user can list buckets
+		t.Logf("Testing ListBuckets with AWS SDK...")
+		_, err = s3Client.ListBuckets(&s3.ListBucketsInput{})
+		assert.NoError(t, err, "Read-only user should be able to list buckets")
 
-	// Test that read-only user cannot create buckets
-	t.Logf("Testing CreateBucket with AWS SDK...")
-	err = framework.CreateBucket(s3Client, testKeycloakBucket+"-readonly")
-	assert.Error(t, err, "Read-only user should not be able to create buckets")
+		// Test that read-only user cannot create buckets
+		t.Logf("Testing CreateBucket with AWS SDK...")
+		err = framework.CreateBucket(s3Client, testKeycloakBucket+"-readonly")
+		assert.Error(t, err, "Read-only user should not be able to create buckets")
 	})
 
 	t.Run("invalid_user_authentication", func(t *testing.T) {