How to test single sign on(SSO) application using a token

Question

I have to two applications :
A : is the parent application
B : is the child application.

When the user has to access B , he needs to sign in to A , which creates a token, and then the user can access B with that token

Manually using post-man I was able to test the flow. How can I write automation for the same flow. How can my automation test in B access the same token from A and use it ? My automation will be using the RestAssure lib.

Both the applications are in JAVA.

Manually using post-man this is what I have so far :

curl -X POST \
  http://localhost:8080/applicationB/endpoint \
  -H 'authorization: Bearer <token_value>' 

I got the token_value by login into A that created the token that I used.

Answer 1

As far as I know you don't need JWT token for this, you need other type of token, ask the dev in charge with this functionality to help you with the code, JWT token will be generated by the app in the headers authorization.

SSO login using using visit:

1. write method that generates the token
2. write method that will form the url like this

http://localhost:8080/applicationB/endpoint?a=1&b=2&token=myS3cre7tokEn

where a, b are your parameters with their values, and token has value of your token.

3. use a method to visit/open this url

SSO login using using regular login:

1. you should have a page where you can login as a regular user
2. after that you will be redirected to your page

Answer 2

As lauda said you need to automate also the process of getting a token, i.e. authentication.

JWT token suggests you're probably testing a system with OAuth2 authentication. RFC 6749 specification defines a number of authentication flows for OAuth2:

• Implicit Grant
• Authorization Code Grant
• Resource Owner Password Credentials Grant
• Client Credentials Grant

If you're using authentication through UI, chances are this is Implicit Grant, but only you and your developers will know which flow your system is using. Moreover, Implicit Grant does not define how verification of your credentials (user, password) looks like --- this will be specific to your system.

Your options are:

• talk to your developers what authentication flow is used
• sniffer the traffic in the Network panel of your Chrome/Firefox to understand which flow is used, what HTTP Requests to craft and what to parse out from HTTP Responses.
• ask developers to write authentication library for you.

Answer 3

I have had to follow a similar workflow through Postman before for authentication and automated API testing. As others have mentioned you need to work with your developer to figure out how to generate the token through the API.

Most Postman specific, once you can generate the token by hitting an API you should be able to save the token to an Enviornment or Global variable and once you have it there you can pass that value to any subsequent API calls by just calling the stored variable in the header.

Once you have the API call to generate the token the rest shouldn't be too bad to do.