RUBY-3267 make specs pass when X.509 authentication is active

.evergreen/config.yml

@@ -1300,24 +1300,21 @@ buildvariants:
     tasks:
       - name: "test-mlaunch"
 
-  # The X.509 tests are failing with exceptions being expected, but never
-  # raised. (RUBY-3267)
-  #
-  # - matrix_name: "x509-tests"
-  #   matrix_spec:
-  #     auth-and-ssl: "x509"
-  #     ruby: "ruby-3.2"
-  #     # needs the latest_5x_mdb because run-tests.sh uses `mongo` to configure
-  #     # the server for certain auth mechanisms. Once run-tests.sh is made smart
-  #     # enough to install mongosh, and then use either mongo or mongosh
-  #     # (depending on server version and what's available), we can bump this to
-  #     # the latest stable db version.
-  #     mongodb-version: "5.3"
-  #     topology: standalone
-  #     os: rhel8
-  #   display_name: "${mongodb-version} ${topology} ${auth-and-ssl} ${ruby}"
-  #   tasks:
-  #     - name: "test-mlaunch"
+  - matrix_name: "x509-tests"
+    matrix_spec:
+      auth-and-ssl: "x509"
+      ruby: "ruby-3.2"
+      # needs the latest_5x_mdb because run-tests.sh uses `mongo` to configure
+      # the server for certain auth mechanisms. Once run-tests.sh is made smart
+      # enough to install mongosh, and then use either mongo or mongosh
+      # (depending on server version and what's available), we can bump this to
+      # the latest stable db version.
+      mongodb-version: "5.3"
+      topology: standalone
+      os: rhel8
+    display_name: "${mongodb-version} ${topology} ${auth-and-ssl} ${ruby}"
+    tasks:
+      - name: "test-mlaunch"
 
   - matrix_name: "jruby-auth"
     matrix_spec:

.evergreen/config/standard.yml.erb

@@ -232,24 +232,21 @@ buildvariants:
     tasks:
       - name: "test-mlaunch"
 
-  # The X.509 tests are failing with exceptions being expected, but never
-  # raised. (RUBY-3267)
-  #
-  # - matrix_name: "x509-tests"
-  #   matrix_spec:
-  #     auth-and-ssl: "x509"
-  #     ruby: <%= latest_ruby %>
-  #     # needs the latest_5x_mdb because run-tests.sh uses `mongo` to configure
-  #     # the server for certain auth mechanisms. Once run-tests.sh is made smart
-  #     # enough to install mongosh, and then use either mongo or mongosh
-  #     # (depending on server version and what's available), we can bump this to
-  #     # the latest stable db version.
-  #     mongodb-version: <%= latest_5x_mdb %>
-  #     topology: standalone
-  #     os: rhel8
-  #   display_name: "${mongodb-version} ${topology} ${auth-and-ssl} ${ruby}"
-  #   tasks:
-  #     - name: "test-mlaunch"
+  - matrix_name: "x509-tests"
+    matrix_spec:
+      auth-and-ssl: "x509"
+      ruby: <%= latest_ruby %>
+      # needs the latest_5x_mdb because run-tests.sh uses `mongo` to configure
+      # the server for certain auth mechanisms. Once run-tests.sh is made smart
+      # enough to install mongosh, and then use either mongo or mongosh
+      # (depending on server version and what's available), we can bump this to
+      # the latest stable db version.
+      mongodb-version: <%= latest_5x_mdb %>
+      topology: standalone
+      os: rhel8
+    display_name: "${mongodb-version} ${topology} ${auth-and-ssl} ${ruby}"
+    tasks:
+      - name: "test-mlaunch"
 
   - matrix_name: "jruby-auth"
     matrix_spec:

spec/mongo/server/connection_spec.rb

@@ -265,6 +265,10 @@ class ConnectionSpecTestException < Exception; end
       context 'when #authenticate! raises an exception' do
         require_auth
 
+        # because the mock/stub flow here doesn't cover the flow used by
+        # the X.509 authentication mechanism...
+        forbid_x509_auth
+
         let(:server_options) do
           Mongo::Client.canonicalize_ruby_options(
             SpecConfig.instance.all_test_options,

spec/spec_tests/sdam_unified_spec.rb

@@ -9,5 +9,7 @@
 SDAM_UNIFIED_TESTS = Dir.glob("#{base}/**/*.yml").sort
 
 describe 'SDAM unified spec tests' do
+  forbid_x509_auth
+
   define_unified_spec_tests(base, SDAM_UNIFIED_TESTS)
 end

spec/support/constraints.rb

@@ -17,6 +17,12 @@ def require_local_tls
     end
   end
 
+  def forbid_x509_auth
+    before(:all) do
+      skip 'X.509 auth not allowed' if SpecConfig.instance.x509_auth?
+    end
+  end
+
   def max_bson_version(version)
     required_version = version.split('.').map(&:to_i)
     actual_version = bson_version(required_version.length)