In an application user needs to enter email id and password on a Microsoft login page. After clicking on the Log in button, it sends a sms to a mobile number. Now User has to enter the OTP to login in the appication.
How do I automate this scenario in Selenium using C#?
Some options in my order of preference:
Probably you do not want to test the TwoFactorAuth, but you want to test the application behind it. Consider building a backdoor which is only enabled in the test environment, so that you can bypass the TFA.
Generate the OTP from code with OTP.Net: https://dev.to/j_sakamoto/selenium-testing---how-to-sign-in-to-two-factor-authentication-2joi
I have read that people try to create an Appium test to retrieve the OTP so that could be another path: https://discuss.appium.io/t/how-to-read-otp-from-messages-using-appium/16949/8
Use a SMS api service and let the code retrieve the SMS text from that service.
Overall this is pretty challenging and makes the test setup complex and contain dependecies.
Recently I have automated 2-factor authorization for our organization. Although it is not simple. Once you will do login on the second layer you have to get OTP from google auth service or other similar services OR through Mobile SMS.
OTP we received on the second layer is, TOTP stands for Time-based One-time Passwords and is a common form of Two-factor Authentication. Unique numeric passwords are generated with an algorithm that uses the current time as an input. The time-based passwords expire in 30-60 seconds.
I have listed few ways below:
We have to talk to the Development team if there is an API or the library how they are calculating OTP. If there is any way to fetch OTP from DB. Luckily I got API to calculate the 2F authentication code. But I have tried in many ways to reach the solution.
Almost all API's to receive SMS are paid, if your project has budget you can choose Nexmo or Twilio
You can utilize some external libraries to calculate 2F OTP like here but it always not successful as it Time based OTP so after a few seconds it can be expired.
Unsecure but free way to get SMS is to use some service provider as mentioned here. These service providers give a phone number which is public and all SMS received on this number will be displayed on their dashboard so it is not secure. This SMS can be read using the Selenium script.
We can get SMS through appium script but it is hectic as you need to write the separate script for this and needs a mobile number with the device.
We use Mailosaur for this. It's commercial but it has an API for dotnet here: https://mailosaur.com/docs/email-testing/dotnet/getting-started/ which you can use to access both SMS and Email your application.
You could possible use Otp.NET to generate the same time based token as you would get on your phone but we had trouble creating and storing new secrets on every end to end test.
