Is it possible to automate testing involving Two-factor Authentication?

Question

Are there methods for testing 2FA signup or login? I would assume judicious use of dummy phone numbers and/or emails would be involved.

Answer 1

I found this solution and I think it might be much more useful. You just do the authentication inside your automation: https://dev.to/j_sakamoto/selenium-testing---how-to-sign-in-to-two-factor-authentication-2joi No outside authenticator is necessary.

For example in Java:

import org.jboss.aerogear.security.otp.Totp;
...

String otpKeyStr = "6jm7n6xwitpjooh7ihewyyzeux7aqmw2"; // <- this 2FA secret key.

Totp totp = new Totp(otpKeyStr);
String twoFactorCode = totp.now(); // <- got 2FA coed at this time!

Answer 2

As long as you can provide these inputs from a external source like CSV file, Excel etc. it is possible. But if you want to automate authentication like receiving an OTP on mobile number and then using it for authentication then it will not be possible, as such things are introduced to avoid any Robotic or Automating behavior.

Again same will not be possible if you have to authenticate using some RSA key or any other token generator device. In most of the cases we have to skip such functionalities for automation or you can say they are exceptions e.g. one of the application we authenticated uses Static + RSA generated password on the login page, thus for testing purpose we always use commented the use of RSA token in configuration file. After that the Static password should be correct one and RSA key value can be anything (but the count of key should be valid), in this way we implemented our tests.

Such, features are exceptions to automation or you can say such tweakings needs to be done sometime in code for achieving testing. These things are usually part of the analysis which a QA do, to see What can be Automated and What can't be?

Yes, you can automate the same if you are saving this generated OTP or any kind of dynamic password which is being sent to mobile numbers, somewhere in your database. Then you need to connect that Database using the Automation tool (which is possible with almost every tool like JMeter, Test Studio, Selenium) and then extract that Unique Key value from database and use it in your automation code for successful authentication.

Answer 3

It mostly depends on whatever you have access to both authentication server and authenticated client.

I was able to automate OTP using email. But it required either own email server or email account on a real server, for example gmail or yahoo. It may be possible to automate OTP via SMS by using google voice and redirecting SMS into your email address.

For the KBA use case it is pretty easy to automate. My approach was to set up answer (let say last word of the question) and than just parse which question was asked.