Test Automation for different user roles within an application - Selenium and C#

Question

I was a developer a long time ago and have been tasked with our teams automated testing with Selenium and C# for our web application; Our application has many roles a user can be; such as an admin, carrier, Power user, and such. Depending on what role you are assigned, determines what you have access to in the application.

An admin has access to all pages, etc. A Carrier can only see buttons x and y; and can only see menu options A, B, and C for example

A user is required to Authenticate. I am having trouble visualizing the best way to create my tests/user. Almost all automation tests will need to be run for each user role. (we actually have 4 or 5 different role types, each has different access to parts of the application)

How would this be best handled? Anyone have some examples I can see (I am a visual learner)?

I am not trying to test having multiple users logged in at once; I am trying to test given a persons admin settings in the application - when they log in and authenticate, it will take their login information, and get their role, then the app takes care of what they can and can't have access to. (I am using a page object model as well)

Answer 1

You can make a call to the User creation endpoint, with the payload necessary for each role, and then access the system with the token for the newly created user.

Alternatively, you can create users with specific at deployment time, e.g. using databases fixtures, and use these pre-defined users on your automated checks.

Answer 2

I'm neck deep in this exact kind of testing right now. Web applications are particularly tricky to test authorization properly. The data setup can be difficult, because you need to create arbitrary users, and assign them roles. You also need to test your "standard" roles. Every HTTP request, button and icon needs testing for both "happy" path and "unhappy" path.

A couple of scenario outlines per link, per page will work. Also a couple of scenario outlines per web page simulating someone who has bookmarked a link to the page.

Scenario Outline: Authorized users can see the edit blog post link
    Given a blog post exists
    And a user exists with the "<Role>" role
    When the user views the blog post
    Then the "Edit Blog Post" link should be visible

Examples:
    | Role       |
    | Admin      |
    | Power User |

Scenario Outline: Unauthorized users cannot see the edit blog post link
    Given a blog post exists
    And a user exists with the "<Role>" role
    When the user views the blog post
    Then the "Edit Blog Post" link should not be visible

Examples:
    | Role       |
    | Carrier    |
    | Advertiser |

You basically need to repeat this test on every type of page that has an edit blog post link, for example. You also want to guard against people deep linking or bookmarking pages:

Scenario Outline: Authorized users can get to the edit blog post page
    Given a blog post exists
    And a user exists with the "<Role>" role
    When the user edits the blog post
    Then the user should be allowed access

Examples:
    | Role       |
    | Admin      |
    | Power User |

Scenario Outline: Unauthorized users cannot go to the edit blog post page
    Given a blog post exists
    And a user exists with the "<Role>" role
    When the user edits the blog post
    Then the user should be denied access

Examples:
    | Role       |
    | Carrier    |
    | Advertiser |

You also should guard against roles being revoked after loading a page, and then submitting a form:

Scenario Outline: Authorized users cannot save blog posts after access is revoked
    Given a blog post exists
    And a user exists with the "<Role>" role
    When the user edits the blog post
    And the user has the "<Role>" role revoked
    And the user saves the blog post
    Then the user should be denied access

Examples:
    | Role       |
    | Admin      |
    | Power User |

Deep diving into scenarios like this forces you to think of all the ways people can attempt to circumvent permissions checks. This exposes the true cost of enforcing security on a system. It was a little mind boggling for me when I first started testing this way. The cost of enforcing permissions was much higher than I anticipated, but spelling out the test case scenarios is also good justification for the cost. It forces the business owner to realize how important and big this kind of testing is.

Answer 3

Identify User Roles: Understand the different user roles in your application.

Setup Environment: Install Selenium WebDriver for C# and set up your development environment.

Define Test Scenarios: Create a list of test scenarios for each user role.

Write Test Scripts: Use Selenium and C# to write automated scripts that simulate user interactions for each scenario.

Execute and Verify: Run your scripts to ensure the application functions correctly for different user roles.

Report and Maintain: Generate test reports, maintain your test suite, and update scripts as needed to accommodate changes in the application.