How to test Single Sign On (SSO) implementation?

Question

Single Sign On (SSO) is being implemented on the application I work on and I have to QA this ensuring that nothing breaks due to the aforementioned implementation. The development side told us that this plays around with authentication of users and both session based and API based authentications must be tested.

What could be some of the test cases? How do I effectively test this implementation?

Answer 1

Single Sign-On is a very broad term and testing it will much depend on how it has been actually implemented in your project.

In short Single Sign-On provides you a way to authenticate at one place (Identity Provider) and access multiple systems (Service Providers) without the need to re-authenticate.

1. Your SSO implementation may allow to authenticate at different Identity Providers: external like Google, Facebook and your internal authentication services (e.g., based on LDAP, user certificates), specific to your company. You could verify integration with all identity providers you have.
2. Your SSO implementation may support different Service Providers. For instance, if you were Google, people that use Deezer music service might use GMail to single sign-on and access Deezer. You could verify integration with different service providers, i.e., are you able to access their resources after authenticating to a specific Identity Provider?
3. There are different protocols for SSO: SAML, OAuth2, etc. each having its pecularities. For instance:
   • some protocols like SAML 2.0 allows for Identity Provider discovery: e.g., when you try to access Google Docs you first enter your email; depending on your email domain (gmail.com vs your.company.com) it will redirect you to a corresponding Identity Provider where you actually provide password and authenticate.
   • some protocols allows also for Single Sign-Out. If your solution implements that you could check if actually are logged out from all service providers.
4. Since SSO is about multiple systems integration, there are many possible integration problems to encounter. For instance, what happens if you authenticate through GMail (Identity Provider) to access Deezer (Service Provider) but your user is not registered yet at Deezer or you don't have certain permissions there?

Answer 2

Single sign on(SSO) implementation needs to be validated in combination with manual testing as well as with automation testing.

Functional validation:

1. Need to test the application manually to ensure that the functionality of the application is working as expected.
2. To confirm the SSO, test with two separate logins to understand and confirm the behavior of the application. When testing apart from the GUI validation, you can check the cookies and session variables for each logins. The value of cookies and session variables must be different.

After this verification you can go ahead with the specific API validations.
To validate the API requests, you can use Postman, Curl tools to script and verify.